--- /dev/null
+From a8aef36756b28fa0ca834c8c1d616b1cdf03f6a2 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Wed, 5 Dec 2018 09:05:30 -0200
+Subject: ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
+
+[ Upstream commit f15096f12a4e9340168df5fdd9201aa8ed60d59e ]
+
+According to bindings/regulator/fixed-regulator.txt the 'clocks' and
+'clock-names' properties are not valid ones.
+
+In order to turn on the Wifi clock the correct location for describing
+the CLKO2 clock is via a mmc-pwrseq handle, so do it accordingly.
+
+Fixes: 56354959cfec ("ARM: dts: imx: add Boundary Devices Nitrogen7 board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Troy Kisky <troy.kisky@boundarydevices.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index e7998308861f..f8caea16bc2d 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -117,13 +117,17 @@
+ compatible = "regulator-fixed";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+- clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
+- clock-names = "slow";
+ regulator-name = "reg_wlan";
+ startup-delay-us = <70000>;
+ gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ };
++
++ usdhc2_pwrseq: usdhc2_pwrseq {
++ compatible = "mmc-pwrseq-simple";
++ clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
++ clock-names = "ext_clock";
++ };
+ };
+
+ &adc1 {
+@@ -430,6 +434,7 @@
+ bus-width = <4>;
+ non-removable;
+ vmmc-supply = <®_wlan>;
++ mmc-pwrseq = <&usdhc2_pwrseq>;
+ cap-power-off-card;
+ keep-power-in-suspend;
+ status = "okay";
+--
+2.19.1
+
--- /dev/null
+From 2a806e70bebe7ee6e3b5cac96567579d92615a0a Mon Sep 17 00:00:00 2001
+From: Anson Huang <anson.huang@nxp.com>
+Date: Tue, 4 Dec 2018 03:17:45 +0000
+Subject: ARM: imx: update the cpu power up timing setting on i.mx6sx
+
+[ Upstream commit 1e434b703248580b7aaaf8a115d93e682f57d29f ]
+
+The sw2iso count should cover ARM LDO ramp-up time,
+the MAX ARM LDO ramp-up time may be up to more than
+100us on some boards, this patch sets sw2iso to 0xf
+(~384us) which is the reset value, and it is much
+more safe to cover different boards, since we have
+observed that some customer boards failed with current
+setting of 0x2.
+
+Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
+index c5a5c3a70ab1..edb888ac5ad3 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -108,7 +108,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(2, 1);
++ imx_gpc_set_arm_power_up_timing(0xf, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
+--
+2.19.1
+
--- /dev/null
+From 94be6588d4dabe44fc610b16d50438c428171c16 Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:00 -0800
+Subject: bnx2x: Clear fip MAC when fcoe offload support is disabled
+
+[ Upstream commit bbf666c1af916ed74795493c564df6fad462cc80 ]
+
+On some customer setups it was observed that shmem contains a non-zero fip
+MAC for 57711 which would lead to enabling of SW FCoE.
+Add a software workaround to clear the bad fip mac address if no FCoE
+connections are supported.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index bd3e3f080ebf..688d84cd6187 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -11733,8 +11733,10 @@ static void bnx2x_get_fcoe_info(struct bnx2x *bp)
+ * If maximum allowed number of connections is zero -
+ * disable the feature.
+ */
+- if (!bp->cnic_eth_dev.max_fcoe_conn)
++ if (!bp->cnic_eth_dev.max_fcoe_conn) {
+ bp->flags |= NO_FCOE_FLAG;
++ eth_zero_addr(bp->fip_mac);
++ }
+ }
+
+ static void bnx2x_get_cnic_info(struct bnx2x *bp)
+--
+2.19.1
+
--- /dev/null
+From be2a76f1d0a6130ef32f07f0c882b5201759bb3f Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:01 -0800
+Subject: bnx2x: Remove configured vlans as part of unload sequence.
+
+[ Upstream commit 04f05230c5c13b1384f66f5186a68d7499e34622 ]
+
+Vlans are not getting removed when drivers are unloaded. The recent storm
+firmware versions had added safeguards against re-configuring an already
+configured vlan. As a result, PF inner reload flows (e.g., mtu change)
+might trigger an assertion.
+This change is going to remove vlans (same as we do for MACs) when doing
+a chip cleanup during unload.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 34 +++++++++++++++----
+ .../net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 ++-
+ 2 files changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 688d84cd6187..433a7a37575d 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -8462,6 +8462,7 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ /* Fill a user request section if needed */
+ if (!test_bit(RAMROD_CONT, ramrod_flags)) {
+ ramrod_param.user_req.u.vlan.vlan = vlan;
++ __set_bit(BNX2X_VLAN, &ramrod_param.user_req.vlan_mac_flags);
+ /* Set the command: ADD or DEL */
+ if (set)
+ ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+@@ -8482,6 +8483,27 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ return rc;
+ }
+
++static int bnx2x_del_all_vlans(struct bnx2x *bp)
++{
++ struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
++ unsigned long ramrod_flags = 0, vlan_flags = 0;
++ struct bnx2x_vlan_entry *vlan;
++ int rc;
++
++ __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
++ __set_bit(BNX2X_VLAN, &vlan_flags);
++ rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_flags, &ramrod_flags);
++ if (rc)
++ return rc;
++
++ /* Mark that hw forgot all entries */
++ list_for_each_entry(vlan, &bp->vlan_reg, link)
++ vlan->hw = false;
++ bp->vlan_cnt = 0;
++
++ return 0;
++}
++
+ int bnx2x_del_all_macs(struct bnx2x *bp,
+ struct bnx2x_vlan_mac_obj *mac_obj,
+ int mac_type, bool wait_for_comp)
+@@ -9320,6 +9342,11 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode, bool keep_link)
+ BNX2X_ERR("Failed to schedule DEL commands for UC MACs list: %d\n",
+ rc);
+
++ /* Remove all currently configured VLANs */
++ rc = bnx2x_del_all_vlans(bp);
++ if (rc < 0)
++ BNX2X_ERR("Failed to delete all VLANs\n");
++
+ /* Disable LLH */
+ if (!CHIP_IS_E1(bp))
+ REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
+@@ -13006,13 +13033,6 @@ static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)
+
+ int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+ {
+- struct bnx2x_vlan_entry *vlan;
+-
+- /* The hw forgot all entries after reload */
+- list_for_each_entry(vlan, &bp->vlan_reg, link)
+- vlan->hw = false;
+- bp->vlan_cnt = 0;
+-
+ /* Don't set rx mode here. Our caller will do it. */
+ bnx2x_vlan_configure(bp, false);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+index 0bf2fd470819..7a6e82db4231 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+@@ -265,6 +265,7 @@ enum {
+ BNX2X_ETH_MAC,
+ BNX2X_ISCSI_ETH_MAC,
+ BNX2X_NETQ_ETH_MAC,
++ BNX2X_VLAN,
+ BNX2X_DONT_CONSUME_CAM_CREDIT,
+ BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
+ };
+@@ -272,7 +273,8 @@ enum {
+ #define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+ 1 << BNX2X_ETH_MAC | \
+ 1 << BNX2X_ISCSI_ETH_MAC | \
+- 1 << BNX2X_NETQ_ETH_MAC)
++ 1 << BNX2X_NETQ_ETH_MAC | \
++ 1 << BNX2X_VLAN)
+ #define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+ ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
+
+--
+2.19.1
+
--- /dev/null
+From 98bdc972521ad77da8db661fcc2f996f91e09949 Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:03 -0800
+Subject: bnx2x: Send update-svid ramrod with retry/poll flags enabled
+
+[ Upstream commit 9061193c4ee065d3240fde06767c2e06ec61decc ]
+
+Driver sends update-SVID ramrod in the MFW notification path.
+If there is a pending ramrod, driver doesn't retry the command
+and storm firmware will never be updated with the SVID value.
+The patch adds changes to send update-svid ramrod in process context with
+retry/poll flags set.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index 1b7f4342dab9..d17a5c911524 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1278,6 +1278,7 @@ enum sp_rtnl_flag {
+ BNX2X_SP_RTNL_TX_STOP,
+ BNX2X_SP_RTNL_GET_DRV_VERSION,
+ BNX2X_SP_RTNL_CHANGE_UDP_PORT,
++ BNX2X_SP_RTNL_UPDATE_SVID,
+ };
+
+ enum bnx2x_iov_flag {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 433a7a37575d..85a320e5c0a8 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -2925,6 +2925,10 @@ static void bnx2x_handle_update_svid_cmd(struct bnx2x *bp)
+ func_params.f_obj = &bp->func_obj;
+ func_params.cmd = BNX2X_F_CMD_SWITCH_UPDATE;
+
++ /* Prepare parameters for function state transitions */
++ __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
++ __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
++
+ if (IS_MF_UFP(bp) || IS_MF_BD(bp)) {
+ int func = BP_ABS_FUNC(bp);
+ u32 val;
+@@ -4301,7 +4305,8 @@ static void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
+ bnx2x_handle_eee_event(bp);
+
+ if (val & DRV_STATUS_OEM_UPDATE_SVID)
+- bnx2x_handle_update_svid_cmd(bp);
++ bnx2x_schedule_sp_rtnl(bp,
++ BNX2X_SP_RTNL_UPDATE_SVID, 0);
+
+ if (bp->link_vars.periodic_flags &
+ PERIODIC_FLAGS_LINK_EVENT) {
+@@ -10369,6 +10374,9 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
+ &bp->sp_rtnl_state))
+ bnx2x_update_mng_version(bp);
+
++ if (test_and_clear_bit(BNX2X_SP_RTNL_UPDATE_SVID, &bp->sp_rtnl_state))
++ bnx2x_handle_update_svid_cmd(bp);
++
+ if (test_and_clear_bit(BNX2X_SP_RTNL_CHANGE_UDP_PORT,
+ &bp->sp_rtnl_state)) {
+ if (bnx2x_udp_port_update(bp)) {
+--
+2.19.1
+
--- /dev/null
+From c3f704c3388c679e66cae857bc7b4a5b782333ca Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Fri, 14 Dec 2018 14:17:20 -0800
+Subject: checkstack.pl: fix for aarch64
+
+[ Upstream commit f1733a1d3cd32a9492f4cf866be37bb46e10163d ]
+
+There is actually a space after "sp," like this,
+
+ ffff2000080813c8: a9bb7bfd stp x29, x30, [sp, #-80]!
+
+Right now, checkstack.pl isn't able to print anything on aarch64,
+because it won't be able to match the stating objdump line of a function
+due to this missing space. Hence, it displays every stack as zero-size.
+
+After this patch, checkpatch.pl is able to match the start of a
+function's objdump, and is then able to calculate each function's stack
+correctly.
+
+Link: http://lkml.kernel.org/r/20181207195843.38528-1-cai@lca.pw
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkstack.pl | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index cb993801e4b2..16dc157f9662 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -46,8 +46,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+ if ($arch eq 'aarch64') {
+- #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]!
+- $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o;
++ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
++ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
+ #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64
+ $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
+--
+2.19.1
+
--- /dev/null
+From 973e350b7f94a769ef40b66604e8372d72bf346c Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Mon, 10 Dec 2018 21:20:30 -0700
+Subject: drivers: net: xgene: Remove unnecessary forward declarations
+
+[ Upstream commit 2ab4c3426c0cf711d7147e3f559638e4ab88960e ]
+
+Clang warns:
+
+drivers/net/ethernet/apm/xgene/xgene_enet_main.c:33:36: warning:
+tentative array definition assumed to have one element
+static const struct acpi_device_id xgene_enet_acpi_match[];
+ ^
+1 warning generated.
+
+Both xgene_enet_acpi_match and xgene_enet_of_match are defined before
+their uses at the bottom of the file so this is unnecessary. When
+CONFIG_ACPI is disabled, ACPI_PTR becomes NULL so xgene_enet_acpi_match
+doesn't need to be defined.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 3b889efddf78..50dd6bf176d0 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -29,9 +29,6 @@
+ #define RES_RING_CSR 1
+ #define RES_RING_CMD 2
+
+-static const struct of_device_id xgene_enet_of_match[];
+-static const struct acpi_device_id xgene_enet_acpi_match[];
+-
+ static void xgene_enet_init_bufpool(struct xgene_enet_desc_ring *buf_pool)
+ {
+ struct xgene_enet_raw_desc16 *raw_desc;
+--
+2.19.1
+
--- /dev/null
+From 74c96085a522bec093409067bdbb6af056d08335 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 17 Dec 2018 09:43:13 +0100
+Subject: gpio: mvebu: only fail on missing clk if pwm is actually to be used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c8da642d41a6811c21177c9994aa7dc35be67d46 ]
+
+The gpio IP on Armada 370 at offset 0x18180 has neither a clk nor pwm
+registers. So there is no need for a clk as the pwm isn't used anyhow.
+So only check for the clk in the presence of the pwm registers. This fixes
+a failure to probe the gpio driver for the above mentioned gpio device.
+
+Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mvebu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 45c65f805fd6..be85d4b39e99 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -777,9 +777,6 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ "marvell,armada-370-gpio"))
+ return 0;
+
+- if (IS_ERR(mvchip->clk))
+- return PTR_ERR(mvchip->clk);
+-
+ /*
+ * There are only two sets of PWM configuration registers for
+ * all the GPIO lines on those SoCs which this driver reserves
+@@ -790,6 +787,9 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ if (!res)
+ return 0;
+
++ if (IS_ERR(mvchip->clk))
++ return PTR_ERR(mvchip->clk);
++
+ /*
+ * Use set A for lines of GPIO chip with id 0, B for GPIO chip
+ * with id 1. Don't allow further GPIO chips to be used for PWM.
+--
+2.19.1
+
--- /dev/null
+From 9cc080de94b5d9d8602781e84818d9a5d7a8562f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 26 Nov 2018 11:52:18 +0100
+Subject: HID: ite: Add USB id match for another ITE based keyboard rfkill key
+ quirk
+
+[ Upstream commit 4050207485e47e00353e87f2fe2166083e282688 ]
+
+The 258a:6a88 keyboard-dock shipped with the Prowise PT301 tablet is
+likely another ITE based design. The controller die is directly bonded
+to the PCB with a blob of black glue on top so there are no markings and
+the 258a vendor-id used is unknown anywhere. But the keyboard has the
+exact same hotkeys mapped to Fn+F1 - F10 as the other ITE8595 keyboard
+I have *and* it has the same quirky behavior wrt the rfkill hotkey.
+
+Either way as said this keyboard has the same quirk for its rfkill /
+airplane mode hotkey as the ITE 8595 chip, it only sends a single release
+event when pressed and released, it never sends a press event.
+
+This commit adds the 258a:6a88 USB id to the hid-ite id-table, fixing
+the rfkill key not working on this keyboard.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-ite.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index fcc688df694c..28ae3dc57103 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -17,6 +17,9 @@
+ #ifndef HID_IDS_H_FILE
+ #define HID_IDS_H_FILE
+
++#define USB_VENDOR_ID_258A 0x258a
++#define USB_DEVICE_ID_258A_6A88 0x6a88
++
+ #define USB_VENDOR_ID_3M 0x0596
+ #define USB_DEVICE_ID_3M1968 0x0500
+ #define USB_DEVICE_ID_3M2256 0x0502
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 1882a4ab0f29..98b059d79bc8 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -42,6 +42,7 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+
+ static const struct hid_device_id ite_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ite_devices);
+--
+2.19.1
+
--- /dev/null
+From be2c5a72a31cd89209104b65467bdafa108d8363 Mon Sep 17 00:00:00 2001
+From: Stefan Assmann <sassmann@kpanic.de>
+Date: Tue, 4 Dec 2018 15:18:52 +0100
+Subject: i40e: fix mac filter delete when setting mac address
+
+[ Upstream commit 158daed16efb1170694e420ae06ba8ba954d82e5 ]
+
+A previous commit moved the ether_addr_copy() in i40e_set_mac() before
+the mac filter del/add to avoid a race. However it wasn't taken into
+account that this alters the mac address being handed to
+i40e_del_mac_filter().
+
+Also changed i40e_add_mac_filter() to operate on netdev->dev_addr,
+hopefully that makes the code easier to read.
+
+Fixes: 458867b2ca0c ("i40e: don't remove netdev->dev_addr when syncing uc list")
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Acked-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 176c99b8251d..904b42becd45 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1554,17 +1554,17 @@ static int i40e_set_mac(struct net_device *netdev, void *p)
+ netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
+
+ /* Copy the address first, so that we avoid a possible race with
+- * .set_rx_mode(). If we copy after changing the address in the filter
+- * list, we might open ourselves to a narrow race window where
+- * .set_rx_mode could delete our dev_addr filter and prevent traffic
+- * from passing.
++ * .set_rx_mode().
++ * - Remove old address from MAC filter
++ * - Copy new address
++ * - Add new address to MAC filter
+ */
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
+-
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+ i40e_del_mac_filter(vsi, netdev->dev_addr);
+- i40e_add_mac_filter(vsi, addr->sa_data);
++ ether_addr_copy(netdev->dev_addr, addr->sa_data);
++ i40e_add_mac_filter(vsi, netdev->dev_addr);
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
++
+ if (vsi->type == I40E_VSI_MAIN) {
+ i40e_status ret;
+
+--
+2.19.1
+
--- /dev/null
+From 181da2de980c8988905931be128c717a98614b4c Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Mon, 10 Dec 2018 15:22:23 -0600
+Subject: ibmvnic: Fix non-atomic memory allocation in IRQ context
+
+[ Upstream commit 1d1bbc37f89b0559c9e913682f2489d89cfde6b8 ]
+
+ibmvnic_reset allocated new reset work item objects in a non-atomic
+context. This can be called from a tasklet, generating the output below.
+Allocate work items with the GFP_ATOMIC flag instead.
+
+BUG: sleeping function called from invalid context at mm/slab.h:421
+in_atomic(): 1, irqs_disabled(): 1, pid: 93, name: kworker/0:2
+INFO: lockdep is turned off.
+irq event stamp: 66049
+hardirqs last enabled at (66048): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0
+hardirqs last disabled at (66049): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0
+softirqs last enabled at (66044): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160
+softirqs last disabled at (66045): [<c0000000000306e0>] call_do_softirq+0x14/0x24
+CPU: 0 PID: 93 Comm: kworker/0:2 Kdump: loaded Not tainted 4.20.0-rc6-00001-g1b50a8f03706 #7
+Workqueue: events linkwatch_event
+Call Trace:
+[c0000003fffe7ae0] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable)
+[c0000003fffe7b30] [c00000000015ba0c] ___might_sleep+0x2dc/0x320
+[c0000003fffe7bb0] [c000000000391514] kmem_cache_alloc_trace+0x3e4/0x440
+[c0000003fffe7c30] [d000000005b2309c] ibmvnic_reset+0x16c/0x360 [ibmvnic]
+[c0000003fffe7cc0] [d000000005b29834] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic]
+[c0000003fffe7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0
+[c0000003fffe7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c
+[c0000003fffe7f90] [c0000000000306e0] call_do_softirq+0x14/0x24
+[c0000003f3967980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0
+[c0000003f39679c0] [c0000000001218a8] do_softirq+0xa8/0x100
+[c0000003f39679f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180
+[c0000003f3967a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80
+[c0000003f3967a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160
+[c0000003f3967ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520
+[c0000003f3967b70] [c000000000a8cd40] dev_deactivate+0x40/0x60
+[c0000003f3967ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0
+[c0000003f3967bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0
+[c0000003f3967c30] [c000000000a5e728] linkwatch_event+0x48/0x60
+[c0000003f3967c50] [c0000000001444e8] process_one_work+0x238/0x710
+[c0000003f3967d20] [c000000000144a48] worker_thread+0x88/0x4e0
+[c0000003f3967db0] [c00000000014e3a8] kthread+0x178/0x1c0
+[c0000003f3967e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 14c53ed5cca6..c914b338691b 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1596,7 +1596,7 @@ static void ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ }
+
+- rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
++ rwi = kzalloc(sizeof(*rwi), GFP_ATOMIC);
+ if (!rwi) {
+ mutex_unlock(&adapter->rwi_lock);
+ ibmvnic_close(netdev);
+--
+2.19.1
+
--- /dev/null
+From 414b704d94ca61c0dba06fb74bf63f277558aa17 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 11 Dec 2018 11:13:39 +0800
+Subject: ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
+
+[ Upstream commit 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322 ]
+
+gcc warning this:
+
+drivers/net/ieee802154/ca8210.c:730:10: warning:
+ comparison is always false due to limited range of data type [-Wtype-limits]
+
+'len' is u8 type, we get it from buf[1] adding 2, which can overflow.
+This patch change the type of 'len' to unsigned int to avoid this,also fix
+the gcc warning.
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/ca8210.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 22e466ea919a..dcd10dba08c7 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -722,7 +722,7 @@ static void ca8210_mlme_reset_worker(struct work_struct *work)
+ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ {
+ u8 *buf;
+- u8 len;
++ unsigned int len;
+ struct work_priv_container *mlme_reset_wpc;
+ struct ca8210_priv *priv = cas_ctl->priv;
+
+@@ -731,7 +731,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ if (len > CA8210_SPI_BUF_SIZE) {
+ dev_crit(
+ &priv->spi->dev,
+- "Received packet len (%d) erroneously long\n",
++ "Received packet len (%u) erroneously long\n",
+ len
+ );
+ goto finish;
+--
+2.19.1
+
--- /dev/null
+From d6ece5f2aa13e1c0b1686ed156ed7d908c3c7ee6 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 4 Dec 2018 13:52:49 -0800
+Subject: Input: omap-keypad - fix idle configuration to not block SoC idle
+ states
+
+[ Upstream commit e2ca26ec4f01486661b55b03597c13e2b9c18b73 ]
+
+With PM enabled, I noticed that pressing a key on the droid4 keyboard will
+block deeper idle states for the SoC. Let's fix this by using IRQF_ONESHOT
+and stop constantly toggling the device OMAP4_KBD_IRQENABLE register as
+suggested by Dmitry Torokhov <dmitry.torokhov@gmail.com>.
+
+From the hardware point of view, looks like we need to manage the registers
+for OMAP4_KBD_IRQENABLE and OMAP4_KBD_WAKEUPENABLE together to avoid
+blocking deeper SoC idle states. And with toggling of OMAP4_KBD_IRQENABLE
+register now gone with IRQF_ONESHOT, also the SoC idle state problem is
+gone during runtime. We still also need to clear OMAP4_KBD_WAKEUPENABLE in
+omap4_keypad_close() though to pair it with omap4_keypad_open() to prevent
+blocking deeper SoC idle states after rmmod omap4-keypad.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/omap4-keypad.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index ce8e2baf31bb..616fdd94b069 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id)
+ {
+ struct omap4_keypad *keypad_data = dev_id;
+
+- if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) {
+- /* Disable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_VAL_IRQDISABLE);
++ if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS))
+ return IRQ_WAKE_THREAD;
+- }
+
+ return IRQ_NONE;
+ }
+@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id)
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+
+- /* enable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_DEF_IRQENABLE_EVENTEN |
+- OMAP4_DEF_IRQENABLE_LONGKEY);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input)
+
+ disable_irq(keypad_data->irq);
+
+- /* Disable interrupts */
++ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
++ kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0);
+
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+@@ -364,7 +356,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ }
+
+ error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler,
+- omap4_keypad_irq_thread_fn, 0,
++ omap4_keypad_irq_thread_fn, IRQF_ONESHOT,
+ "omap4-keypad", keypad_data);
+ if (error) {
+ dev_err(&pdev->dev, "failed to register interrupt\n");
+--
+2.19.1
+
--- /dev/null
+From abe8db0cc7816db4970f9b97d8fc1f07e45a0d3d Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 6 Dec 2018 09:03:36 +1000
+Subject: Input: restore EV_ABS ABS_RESERVED
+
+[ Upstream commit c201e3808e0e4be9b98d192802085a9f491bd80c ]
+
+ABS_RESERVED was added in d9ca1c990a7 and accidentally removed as part of
+ffe0e7cf290f5c9 when the high-resolution scrolling code was removed.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/input-event-codes.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index f4058bd4c373..61769d4b7dba 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -742,6 +742,15 @@
+
+ #define ABS_MISC 0x28
+
++/*
++ * 0x2e is reserved and should not be used in input drivers.
++ * It was used by HID as ABS_MISC+6 and userspace needs to detect if
++ * the next ABS_* event is correct or is just ABS_MISC + n.
++ * We define here ABS_RESERVED so userspace can rely on it and detect
++ * the situation described above.
++ */
++#define ABS_RESERVED 0x2e
++
+ #define ABS_MT_SLOT 0x2f /* MT slot being modified */
+ #define ABS_MT_TOUCH_MAJOR 0x30 /* Major axis of touching ellipse */
+ #define ABS_MT_TOUCH_MINOR 0x31 /* Minor axis (omit if circular) */
+--
+2.19.1
+
--- /dev/null
+From f6b44009dc95bdde40427c2fb9903a37f082d550 Mon Sep 17 00:00:00 2001
+From: Yussuf Khalil <dev@pp3345.net>
+Date: Sat, 8 Dec 2018 20:13:35 -0800
+Subject: Input: synaptics - enable RMI on ThinkPad T560
+
+[ Upstream commit ca5047286c9c93a01e1f471d00a6019536992954 ]
+
+Before commit 7fd6d98b89f3 ("i2c: i801: Allow ACPI AML access I/O
+ports not reserved for SMBus"), enabling RMI on the T560 would cause
+the touchpad to stop working after resuming from suspend. Now that
+this issue is fixed, RMI can be enabled safely and works fine.
+
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Yussuf Khalil <dev@pp3345.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 54f0d037b5b6..515a0b0d48bf 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -171,6 +171,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
++ "LEN005e", /* T560 */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+--
+2.19.1
+
--- /dev/null
+From f8fdad86c59513b86bfbee4b5b9cb150da851650 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
+Date: Fri, 21 Dec 2018 01:04:26 -0800
+Subject: Input: synaptics - enable SMBus for HP EliteBook 840 G4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 7a71712293ba303aad928f580b89addb0be2892e ]
+
+dmesg reports that "Your touchpad (PNP: SYN3052 SYN0100 SYN0002 PNP0f13)
+says it can support a different bus."
+
+I've tested the offered psmouse.synaptics_intertouch=1 with 4.18.x and
+4.19.x and it seems to work well. No problems seen with suspend/resume.
+
+Also, it appears that RMI/SMBus mode is actually required for 3-4 finger
+multitouch gestures to work -- otherwise they are not reported at all.
+
+Information from dmesg in both modes:
+
+ psmouse serio3: synaptics: Touchpad model: 1, fw: 8.2, id: 0x1e2b1,
+ caps: 0xf00123/0x840300/0x2e800/0x0, board id: 3139, fw id: 2000742
+
+ psmouse serio3: synaptics: Trying to set up SMBus access
+ rmi4_smbus 6-002c: registering SMbus-connected sensor
+ rmi4_f01 rmi4-00.fn01: found RMI device,
+ manufacturer: Synaptics, product: TM3139-001, fw id: 2000742
+
+Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 515a0b0d48bf..e9ec5d10e0a9 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+--
+2.19.1
+
--- /dev/null
+From e81f33ad03ef765d1d93c64891d33b347ec69371 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 18 Dec 2018 14:25:41 +0900
+Subject: kbuild: fix false positive warning/error about missing libelf
+
+[ Upstream commit ef7cfd00b2caf6edeb7f169682b64be2d0a798cf ]
+
+For the same reason as commit 25896d073d8a ("x86/build: Fix compiler
+support check for CONFIG_RETPOLINE"), you cannot put this $(error ...)
+into the parse stage of the top Makefile.
+
+Perhaps I'd propose a more sophisticated solution later, but this is
+the best I can do for now.
+
+Link: https://lkml.org/lkml/2017/12/25/211
+Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Reported-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Reported-by: Qian Cai <cai@lca.pw>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Tested-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index be4d1f25cb29..2de4072bcc90 100644
+--- a/Makefile
++++ b/Makefile
+@@ -954,11 +954,6 @@ ifdef CONFIG_STACK_VALIDATION
+ ifeq ($(has_libelf),1)
+ objtool_target := tools/objtool FORCE
+ else
+- ifdef CONFIG_UNWINDER_ORC
+- $(error "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- else
+- $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- endif
+ SKIP_STACK_VALIDATION := 1
+ export SKIP_STACK_VALIDATION
+ endif
+@@ -1102,6 +1097,14 @@ uapi-asm-generic:
+
+ PHONY += prepare-objtool
+ prepare-objtool: $(objtool_target)
++ifeq ($(SKIP_STACK_VALIDATION),1)
++ifdef CONFIG_UNWINDER_ORC
++ @echo "error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++ @false
++else
++ @echo "warning: Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++endif
++endif
+
+ # Check for CONFIG flags that require compiler support. Abort the build
+ # after .config has been processed, but before the kernel build starts.
+--
+2.19.1
+
--- /dev/null
+From 80dc4a24b7ec1feb39eeb9c857d6f27f14b9f688 Mon Sep 17 00:00:00 2001
+From: Jason Martinsen <jasonmartinsen@msn.com>
+Date: Tue, 18 Dec 2018 05:38:22 +0000
+Subject: lan78xx: Resolve issue with changing MAC address
+
+[ Upstream commit 15515aaaa69659c502003926a2067ee76176148a ]
+
+Current state for the lan78xx driver does not allow for changing the
+MAC address of the interface, without either removing the module (if
+you compiled it that way) or rebooting the machine. If you attempt to
+change the MAC address, ifconfig will show the new address, however,
+the system/interface will not respond to any traffic using that
+configuration. A few short-term options to work around this are to
+unload the module and reload it with the new MAC address, change the
+interface to "promisc", or reboot with the correct configuration to
+change the MAC.
+
+This patch enables the ability to change the MAC address via fairly normal means...
+ifdown <interface>
+modify entry in /etc/network/interfaces OR a similar method
+ifup <interface>
+Then test via any network communication, such as ICMP requests to gateway.
+
+My only test platform for this patch has been a raspberry pi model 3b+.
+
+Signed-off-by: Jason Martinsen <jasonmartinsen@msn.com>
+
+-----
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index e069b310d6a6..b62c41114e34 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2212,6 +2212,10 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
+
++ /* Added to support MAC address changes */
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 646b9b607ae495c920de63a98f405fca9a15183f Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Sat, 15 Dec 2018 11:03:06 +0200
+Subject: mac80211: free skb fraglist before freeing the skb
+
+[ Upstream commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a ]
+
+mac80211 uses the frag list to build AMSDU. When freeing
+the skb, it may not be really freed, since someone is still
+holding a reference to it.
+In that case, when TCP skb is being retransmitted, the
+pointer to the frag list is being reused, while the data
+in there is no longer valid.
+Since we will never get frag list from the network stack,
+as mac80211 doesn't advertise the capability, we can safely
+free and nullify it before releasing the SKB.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/status.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 35912270087c..b18466cf466c 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -545,6 +545,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
+ }
+
+ ieee80211_led_tx(local);
++
++ if (skb_has_frag_list(skb)) {
++ kfree_skb_list(skb_shinfo(skb)->frag_list);
++ skb_shinfo(skb)->frag_list = NULL;
++ }
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From 30cdb8832cf1e3eeca63fa60ac0e433e93c53b2b Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:28 +0800
+Subject: net: hns: Add mac pcs config when enable|disable mac
+
+[ Upstream commit 726ae5c9e5f0c18eca8ea5296b526242c3e89822 ]
+
+In some case, when mac enable|disable and adjust link, may cause hard to
+link(or abnormal) between mac and phy. This patch adds the code for rx PCS
+to avoid this bug.
+
+Disable the rx PCS when driver disable the gmac, and enable the rx PCS
+when driver enable the mac.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 ++++++++++----
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 1 +
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+index 8c7bc5cf193c..5e8930d02f50 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+@@ -67,11 +67,14 @@ static void hns_gmac_enable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*enable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 1);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* enable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 0);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 1);
++ }
+ }
+
+ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+@@ -79,11 +82,14 @@ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*disable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 0);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* disable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 1);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 0);
++ }
+ }
+
+ /* hns_gmac_get_en - get port enable
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 5ae3d017ddbc..ae97b203f73b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -534,6 +534,7 @@
+ #define GMAC_LD_LINK_COUNTER_REG 0x01D0UL
+ #define GMAC_LOOP_REG 0x01DCUL
+ #define GMAC_RECV_CONTROL_REG 0x01E0UL
++#define GMAC_PCS_RX_EN_REG 0x01E4UL
+ #define GMAC_VLAN_CODE_REG 0x01E8UL
+ #define GMAC_RX_OVERRUN_CNT_REG 0x01ECUL
+ #define GMAC_RX_LENGTHFIELD_ERR_CNT_REG 0x01F4UL
+--
+2.19.1
+
--- /dev/null
+From 278324072c756e9ba42e9c8a470eeaadfdd2408a Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:21 +0800
+Subject: net: hns: All ports can not work when insmod hns ko after rmmod.
+
+[ Upstream commit 308c6cafde0147616da45e3a928adae55c428deb ]
+
+There are two test cases:
+1. Remove the 4 modules:hns_enet_drv/hns_dsaf/hnae/hns_mdio,
+ and install them again, must use "ifconfig down/ifconfig up"
+ command pair to bring port to work.
+
+ This patch calls phy_stop function when init phy to fix this bug.
+
+2. Remove the 2 modules:hns_enet_drv/hns_dsaf, and install them again,
+ all ports can not use anymore, because of the phy devices register
+ failed(phy devices already exists).
+
+ Phy devices are registered when hns_dsaf installed, this patch
+ removes them when hns_dsaf removed.
+
+The two cases are sometimes related, fixing the second case also requires
+fixing the first case, so fix them together.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +++++++++++++++
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+index 5a8dbd72fe45..07e117deeb0f 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+@@ -783,6 +783,17 @@ static int hns_mac_register_phy(struct hns_mac_cb *mac_cb)
+ return rc;
+ }
+
++static void hns_mac_remove_phydev(struct hns_mac_cb *mac_cb)
++{
++ if (!to_acpi_device_node(mac_cb->fw_port) || !mac_cb->phy_dev)
++ return;
++
++ phy_device_remove(mac_cb->phy_dev);
++ phy_device_free(mac_cb->phy_dev);
++
++ mac_cb->phy_dev = NULL;
++}
++
+ #define MAC_MEDIA_TYPE_MAX_LEN 16
+
+ static const struct {
+@@ -1120,7 +1131,11 @@ void hns_mac_uninit(struct dsaf_device *dsaf_dev)
+ int max_port_num = hns_mac_get_max_port_num(dsaf_dev);
+
+ for (i = 0; i < max_port_num; i++) {
++ if (!dsaf_dev->mac_cb[i])
++ continue;
++
+ dsaf_dev->misc_op->cpld_reset_led(dsaf_dev->mac_cb[i]);
++ hns_mac_remove_phydev(dsaf_dev->mac_cb[i]);
+ dsaf_dev->mac_cb[i] = NULL;
+ }
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 4faadc3ffe8c..2758c4bb9208 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1286,6 +1286,9 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
+ if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
+ phy_dev->autoneg = false;
+
++ if (h->phy_if == PHY_INTERFACE_MODE_SGMII)
++ phy_stop(phy_dev);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From c35d518b4e266d1b7305459759e52390636021bd Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:26 +0800
+Subject: net: hns: Avoid net reset caused by pause frames storm
+
+[ Upstream commit a57275d35576fdd89d8c771eedf1e7cf97e0dfa6 ]
+
+There will be a large number of MAC pause frames on the net,
+which caused tx timeout of net device. And then the net device
+was reset to try to recover it. So that is not useful, and will
+cause some other problems.
+
+So need doubled ndev->watchdog_timeo if device watchdog occurred
+until watchdog_timeo up to 40s and then try resetting to recover
+it.
+
+When collecting dfx information such as hardware registers when tx timeout.
+Some registers for count were cleared when read. So need move this task
+before update net state which also read the count registers.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index bcd9aaba09b3..f28a639e8393 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1609,11 +1609,19 @@ static int hns_nic_net_stop(struct net_device *ndev)
+ }
+
+ static void hns_tx_timeout_reset(struct hns_nic_priv *priv);
++#define HNS_TX_TIMEO_LIMIT (40 * HZ)
+ static void hns_nic_net_timeout(struct net_device *ndev)
+ {
+ struct hns_nic_priv *priv = netdev_priv(ndev);
+
+- hns_tx_timeout_reset(priv);
++ if (ndev->watchdog_timeo < HNS_TX_TIMEO_LIMIT) {
++ ndev->watchdog_timeo *= 2;
++ netdev_info(ndev, "watchdog_timo changed to %d.\n",
++ ndev->watchdog_timeo);
++ } else {
++ ndev->watchdog_timeo = HNS_NIC_TX_TIMEOUT;
++ hns_tx_timeout_reset(priv);
++ }
+ }
+
+ static int hns_nic_do_ioctl(struct net_device *netdev, struct ifreq *ifr,
+@@ -2193,11 +2201,11 @@ static void hns_nic_service_task(struct work_struct *work)
+ = container_of(work, struct hns_nic_priv, service_task);
+ struct hnae_handle *h = priv->ae_handle;
+
++ hns_nic_reset_subtask(priv);
+ hns_nic_update_link_status(priv->netdev);
+ h->dev->ops->update_led_status(h);
+ hns_nic_update_stats(priv->netdev);
+
+- hns_nic_reset_subtask(priv);
+ hns_nic_service_event_complete(priv);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 8bef0a9cfd99f08c7b19521f6a870ebdeb988e80 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:24 +0800
+Subject: net: hns: Clean rx fbd when ae stopped.
+
+[ Upstream commit 31f6b61d810654fb3ef43f4d8afda0f44b142fad ]
+
+If there are packets in hardware when changing the speed or duplex,
+it may cause hardware hang up.
+
+This patch adds the code to wait rx fbd clean up when ae stopped.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index bf930ab3c2bd..a185a8be7999 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -379,6 +379,9 @@ void hns_ae_stop(struct hnae_handle *handle)
+
+ hns_ae_ring_enable_all(handle, 0);
+
++ /* clean rx fbd. */
++ hns_rcb_wait_fbd_clean(handle->qs, handle->q_num, RCB_INT_FLAG_RX);
++
+ (void)hns_mac_vm_config_bc_en(mac_cb, 0, false);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 3b53deb1c0e4ef80b535013f94a42ac1dc3a0e47 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:27 +0800
+Subject: net: hns: Fix ntuple-filters status error.
+
+[ Upstream commit 7e74a19ca522aec7c2be201a7ae1d1d57ded409b ]
+
+The ntuple-filters features is forced on by chip.
+But it shows "ntuple-filters: off [fixed]" when use ethtool.
+This patch make it correct with "ntuple-filters: on [fixed]".
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index f28a639e8393..86662a14208e 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -2486,7 +2486,7 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ ndev->min_mtu = MAC_MIN_MTU;
+ switch (priv->enet_ver) {
+ case AE_VERSION_2:
+- ndev->features |= NETIF_F_TSO | NETIF_F_TSO6;
++ ndev->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_NTUPLE;
+ ndev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+ NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_GSO |
+ NETIF_F_GRO | NETIF_F_TSO | NETIF_F_TSO6;
+--
+2.19.1
+
--- /dev/null
+From 52c2aa7f7c79e2cd6e1d52e0cb858d669dd848ec Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:29 +0800
+Subject: net: hns: Fix ping failed when use net bridge and send multicast
+
+[ Upstream commit 6adafc356e20189193b38ee6b9af7743078bf6b4 ]
+
+Create a net bridge, add eth and vnet to the bridge. The vnet is used
+by a virtual machine. When ping the virtual machine from the outside
+host and the virtual machine send multicast at the same time, the ping
+package will lost.
+
+The multicast package send to the eth, eth will send it to the bridge too,
+and the bridge learn the mac of eth. When outside host ping the virtual
+mechine, it will match the promisc entry of the eth which is not expected,
+and the bridge send it to eth not to vnet, cause ping lost.
+
+So this patch change promisc tcam entry position to the END of 512 tcam
+entries, which indicate lower priority. And separate one promisc entry to
+two: mc & uc, to avoid package match the wrong tcam entry.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns/hns_dsaf_main.c | 257 +++++++++++++++---
+ 1 file changed, 216 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index 9086d566a624..51d42d7f6074 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -934,6 +934,62 @@ static void hns_dsaf_tcam_mc_cfg(
+ spin_unlock_bh(&dsaf_dev->tcam_lock);
+ }
+
++/**
++ * hns_dsaf_tcam_uc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ */
++static void hns_dsaf_tcam_uc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_ucast_cfg *tcam_uc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_ucast_cfg(dsaf_dev, tcam_uc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_ucast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
++/**
++ * hns_dsaf_tcam_mc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ * @ptbl_tcam_mask
++ * @ptbl_tcam_mcast
++ */
++static void hns_dsaf_tcam_mc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_mcast_cfg *tcam_mc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_mcast_cfg(dsaf_dev, tcam_mc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_mcast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
+ /**
+ * hns_dsaf_tcam_mc_invld - INT
+ * @dsaf_id: dsa fabric id
+@@ -1491,6 +1547,27 @@ static u16 hns_dsaf_find_empty_mac_entry(struct dsaf_device *dsaf_dev)
+ return DSAF_INVALID_ENTRY_IDX;
+ }
+
++/**
++ * hns_dsaf_find_empty_mac_entry_reverse
++ * search dsa fabric soft empty-entry from the end
++ * @dsaf_dev: dsa fabric device struct pointer
++ */
++static u16 hns_dsaf_find_empty_mac_entry_reverse(struct dsaf_device *dsaf_dev)
++{
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ int i;
++
++ soft_mac_entry = priv->soft_mac_tbl + (DSAF_TCAM_SUM - 1);
++ for (i = (DSAF_TCAM_SUM - 1); i > 0; i--) {
++ /* search all entry from end to start.*/
++ if (soft_mac_entry->index == DSAF_INVALID_ENTRY_IDX)
++ return i;
++ soft_mac_entry--;
++ }
++ return DSAF_INVALID_ENTRY_IDX;
++}
++
+ /**
+ * hns_dsaf_set_mac_key - set mac key
+ * @dsaf_dev: dsa fabric device struct pointer
+@@ -2666,58 +2743,156 @@ int hns_dsaf_get_regs_count(void)
+ return DSAF_DUMP_REGS_NUM;
+ }
+
+-/* Reserve the last TCAM entry for promisc support */
+-#define dsaf_promisc_tcam_entry(port) \
+- (DSAF_TCAM_SUM - DSAFV2_MAC_FUZZY_TCAM_NUM + (port))
+-void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
+- u32 port, bool enable)
++static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ {
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask_uc = {0x01000000, 0xf};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
+ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
+- struct dsaf_drv_soft_mac_tbl *soft_mac_entry = priv->soft_mac_tbl;
+- u16 entry_index;
+- struct dsaf_drv_tbl_tcam_key tbl_tcam_data, tbl_tcam_mask;
+- struct dsaf_tbl_tcam_mcast_cfg mac_data = {0};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, port};
++ struct dsaf_drv_mac_single_dest_entry mask_entry;
++ struct dsaf_drv_tbl_tcam_key temp_key, mask_key;
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ struct hns_mac_cb *mac_cb;
++ u8 addr[ETH_ALEN] = {0};
++ u8 port_num;
++ u16 mskid;
+
+- if ((AE_IS_VER1(dsaf_dev->dsaf_ver)) || HNS_DSAF_IS_DEBUG(dsaf_dev))
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++ if (entry_index != DSAF_INVALID_ENTRY_IDX)
+ return;
+
+- /* find the tcam entry index for promisc */
+- entry_index = dsaf_promisc_tcam_entry(port);
+-
+- memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
+- memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
+-
+- /* config key mask */
+- if (enable) {
+- dsaf_set_field(tbl_tcam_data.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, port);
+- dsaf_set_field(tbl_tcam_mask.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, 0xf);
+-
+- /* SUB_QID */
+- dsaf_set_bit(mac_data.tbl_mcast_port_msk[0],
+- DSAF_SERVICE_NW_NUM, true);
+- mac_data.tbl_mcast_item_vld = true; /* item_vld bit */
++ /* put promisc tcam entry in the end. */
++ /* 1. set promisc unicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable uc promisc failed (port:%#x)\n",
++ port);
++ return;
++ }
++
++ mac_cb = dsaf_dev->mac_cb[port];
++ (void)hns_mac_get_inner_port_num(mac_cb, 0, &port_num);
++ tbl_tcam_ucast.tbl_ucast_out_port = port_num;
++
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask_uc, &tbl_tcam_ucast);
++
++ /* update software entry */
++ soft_mac_entry = priv->soft_mac_tbl;
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = mac_key.high.val;
++ soft_mac_entry->tcam_key.low.val = mac_key.low.val;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. set promisc multicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable mc promisc failed (port:%#x)\n",
++ port);
++ return;
++ }
++
++ memset(&mask_entry, 0x0, sizeof(mask_entry));
++ memset(&mask_key, 0x0, sizeof(mask_key));
++ memset(&temp_key, 0x0, sizeof(temp_key));
++ mask_entry.addr[0] = 0x01;
++ hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
++ port, mask_entry.addr);
++ tbl_tcam_mcast.tbl_mcast_item_vld = 1;
++ tbl_tcam_mcast.tbl_mcast_old_en = 0;
++
++ if (port < DSAF_SERVICE_NW_NUM) {
++ mskid = port;
++ } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
++ mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+ } else {
+- mac_data.tbl_mcast_item_vld = false; /* item_vld bit */
++ dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
++ dsaf_dev->ae_dev.name, port,
++ mask_key.high.val, mask_key.low.val);
++ return;
+ }
+
+- dev_dbg(dsaf_dev->dev,
+- "set_promisc_entry, %s Mac key(%#x:%#x) entry_index%d\n",
+- dsaf_dev->ae_dev.name, tbl_tcam_data.high.val,
+- tbl_tcam_data.low.val, entry_index);
++ dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
++ mskid % 32, 1);
++ memcpy(&temp_key, &mask_key, sizeof(mask_key));
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ (struct dsaf_tbl_tcam_data *)(&mask_key),
++ &tbl_tcam_mcast);
+
+- /* config promisc entry with mask */
+- hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_data,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_mask,
+- &mac_data);
++ /* update software entry */
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = temp_key.high.val;
++ soft_mac_entry->tcam_key.low.val = temp_key.low.val;
++}
+
+- /* config software entry */
++static void set_promisc_tcam_disable(struct dsaf_device *dsaf_dev, u32 port)
++{
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 0, 0, 0, 0};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, 0};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask = {0, 0};
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ u8 addr[ETH_ALEN] = {0};
++
++ /* 1. delete uc vague tcam entry. */
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask, &tbl_tcam_ucast);
++ /* update soft management table. */
++ soft_mac_entry = priv->soft_mac_tbl;
+ soft_mac_entry += entry_index;
+- soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. delete mc vague tcam entry. */
++ addr[0] = 0x01;
++ memset(&mac_key, 0x0, sizeof(mac_key));
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config mc vague table */
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ &tbl_tcam_mask, &tbl_tcam_mcast);
++ /* update soft management table. */
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++}
++
++/* Reserve the last TCAM entry for promisc support */
++void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
++ u32 port, bool enable)
++{
++ if (enable)
++ set_promisc_tcam_enable(dsaf_dev, port);
++ else
++ set_promisc_tcam_disable(dsaf_dev, port);
+ }
+
+ int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
+--
+2.19.1
+
--- /dev/null
+From 532965a35ff7bdb2b93dabb7194a92e9608a9dd3 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:23 +0800
+Subject: net: hns: Fixed bug that netdev was opened twice
+
+[ Upstream commit 5778b13b64eca5549d242686f2f91a2c80c8fa40 ]
+
+After resetting dsaf to try to repair chip error such as ecc error,
+the net device will be open if net interface is up. But at this time
+if there is the users set the net device up with the command ifconfig,
+the net device will be opened twice consecutively.
+
+Function napi_enable was called when open device. And Kernel panic will
+be occurred if it was called twice consecutively. Such as follow:
+static inline void napi_enable(struct napi_struct *n)
+{
+ BUG_ON(!test_bit(NAPI_STATE_SCHED, &n->state));
+ smp_mb__before_clear_bit();
+ clear_bit(NAPI_STATE_SCHED, &n->state);
+}
+
+[37255.571996] Kernel panic - not syncing: BUG!
+[37255.595234] Call trace:
+[37255.597694] [<ffff80000008ab48>] dump_backtrace+0x0/0x1a0
+[37255.603114] [<ffff80000008ad08>] show_stack+0x20/0x28
+[37255.608187] [<ffff8000009c4944>] dump_stack+0x98/0xb8
+[37255.613258] [<ffff8000009c149c>] panic+0x10c/0x26c
+[37255.618070] [<ffff80000070f134>] hns_nic_net_up+0x30c/0x4e0
+[37255.623664] [<ffff80000070f39c>] hns_nic_net_open+0x94/0x12c
+[37255.629346] [<ffff80000084be78>] __dev_open+0xf4/0x168
+[37255.634504] [<ffff80000084c1ac>] __dev_change_flags+0x98/0x15c
+[37255.640359] [<ffff80000084c29c>] dev_change_flags+0x2c/0x68
+[37255.769580] [<ffff8000008dc400>] devinet_ioctl+0x650/0x704
+[37255.775086] [<ffff8000008ddc38>] inet_ioctl+0x98/0xb4
+[37255.780159] [<ffff800000827b7c>] sock_do_ioctl+0x44/0x84
+[37255.785490] [<ffff800000828e04>] sock_ioctl+0x248/0x30c
+[37255.790737] [<ffff80000026dc6c>] do_vfs_ioctl+0x480/0x618
+[37255.796156] [<ffff80000026de94>] SyS_ioctl+0x90/0xa4
+[37255.801139] SMP: stopping secondary CPUs
+[37255.805079] kbox: catch panic event.
+[37255.809586] collected_len = 128928, LOG_BUF_LEN_LOCAL = 131072
+[37255.816103] flush cache 0xffff80003f000000 size 0x800000
+[37255.822192] flush cache 0xffff80003f000000 size 0x800000
+[37255.828289] flush cache 0xffff80003f000000 size 0x800000
+[37255.834378] kbox: no notify die func register. no need to notify
+[37255.840413] ---[ end Kernel panic - not syncing: BUG!
+
+This patchset fix this bug according to the flag NIC_STATE_DOWN.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 2758c4bb9208..801fbcebfbaa 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1433,6 +1433,9 @@ static int hns_nic_net_up(struct net_device *ndev)
+ int i, j;
+ int ret;
+
++ if (!test_bit(NIC_STATE_DOWN, &priv->state))
++ return 0;
++
+ ret = hns_nic_init_irq(priv);
+ if (ret != 0) {
+ netdev_err(ndev, "hns init irq failed! ret=%d\n", ret);
+--
+2.19.1
+
--- /dev/null
+From c8557906435ef4375c30e441c35dba06a00fdc84 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:25 +0800
+Subject: net: hns: Free irq when exit from abnormal branch
+
+[ Upstream commit c82bd077e1ba3dd586569c733dc6d3dd4b0e43cd ]
+
+1.In "hns_nic_init_irq", if request irq fail at index i,
+ the function return directly without releasing irq resources
+ that already requested.
+
+2.In "hns_nic_net_up" after "hns_nic_init_irq",
+ if exceptional branch occurs, irqs that already requested
+ are not release.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 23 ++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 801fbcebfbaa..bcd9aaba09b3 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1384,6 +1384,22 @@ static int hns_nic_init_affinity_mask(int q_num, int ring_idx,
+ return cpu;
+ }
+
++static void hns_nic_free_irq(int q_num, struct hns_nic_priv *priv)
++{
++ int i;
++
++ for (i = 0; i < q_num * 2; i++) {
++ if (priv->ring_data[i].ring->irq_init_flag == RCB_IRQ_INITED) {
++ irq_set_affinity_hint(priv->ring_data[i].ring->irq,
++ NULL);
++ free_irq(priv->ring_data[i].ring->irq,
++ &priv->ring_data[i]);
++ priv->ring_data[i].ring->irq_init_flag =
++ RCB_IRQ_NOT_INITED;
++ }
++ }
++}
++
+ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ {
+ struct hnae_handle *h = priv->ae_handle;
+@@ -1409,7 +1425,7 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ if (ret) {
+ netdev_err(priv->netdev, "request irq(%d) fail\n",
+ rd->ring->irq);
+- return ret;
++ goto out_free_irq;
+ }
+ disable_irq(rd->ring->irq);
+
+@@ -1424,6 +1440,10 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ }
+
+ return 0;
++
++out_free_irq:
++ hns_nic_free_irq(h->q_num, priv);
++ return ret;
+ }
+
+ static int hns_nic_net_up(struct net_device *ndev)
+@@ -1471,6 +1491,7 @@ static int hns_nic_net_up(struct net_device *ndev)
+ for (j = i - 1; j >= 0; j--)
+ hns_nic_ring_close(ndev, j);
+
++ hns_nic_free_irq(h->q_num, priv);
+ set_bit(NIC_STATE_DOWN, &priv->state);
+
+ return ret;
+--
+2.19.1
+
--- /dev/null
+From 3994072870a243342869bd71e90f3ea5ebd98cda Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:20 +0800
+Subject: net: hns: Incorrect offset address used for some registers.
+
+[ Upstream commit 4e1d4be681b2c26fd874adbf584bf034573ac45d ]
+
+According to the hip06 Datasheet:
+1. The offset of INGRESS_SW_VLAN_TAG_DISC should be 0x1A00+4*all_chn_num
+2. The offset of INGRESS_IN_DATA_STP_DISC should be 0x1A50+4*all_chn_num
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index 1f056a6b167e..bc020dddd253 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2159,9 +2159,9 @@ void hns_dsaf_update_stats(struct dsaf_device *dsaf_dev, u32 node_num)
+ DSAF_INODE_LOCAL_ADDR_FALSE_NUM_0_REG + 0x80 * (u64)node_num);
+
+ hw_stats->vlan_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 4 * (u64)node_num);
+ hw_stats->stp_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_IN_DATA_STP_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_IN_DATA_STP_DISC_0_REG + 4 * (u64)node_num);
+
+ /* pfc pause frame statistics stored in dsaf inode*/
+ if ((node_num < DSAF_SERVICE_NW_NUM) && !is_ver1) {
+--
+2.19.1
+
--- /dev/null
+From 414feb3d151714b07bd88c52769ad555befff7b7 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:22 +0800
+Subject: net: hns: Some registers use wrong address according to the
+ datasheet.
+
+[ Upstream commit 4ad26f117b6ea0f5d5f1592127bafb5ec65904d3 ]
+
+According to the hip06 datasheet:
+1.Six registers use wrong address:
+ RCB_COM_SF_CFG_INTMASK_RING
+ RCB_COM_SF_CFG_RING_STS
+ RCB_COM_SF_CFG_RING
+ RCB_COM_SF_CFG_INTMASK_BD
+ RCB_COM_SF_CFG_BD_RINT_STS
+ DSAF_INODE_VC1_IN_PKT_NUM_0_REG
+2.The offset of DSAF_INODE_VC1_IN_PKT_NUM_0_REG should be
+ 0x103C + 0x80 * all_chn_num
+3.The offset to show the value of DSAF_INODE_IN_DATA_STP_DISC_0_REG
+ is wrong, so the value of DSAF_INODE_SW_VLAN_TAG_DISC_0_REG will be
+ overwrite
+
+These registers are only used in "ethtool -d", so that did not cause ndev
+to misfunction.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns/hns_dsaf_main.c | 242 +++++++++---------
+ .../net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 12 +-
+ 2 files changed, 127 insertions(+), 127 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index bc020dddd253..9086d566a624 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2278,237 +2278,237 @@ void hns_dsaf_get_regs(struct dsaf_device *ddev, u32 port, void *data)
+ DSAF_INODE_BD_ORDER_STATUS_0_REG + j * 4);
+ p[223 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + j * 4);
+- p[224 + i] = dsaf_read_dev(ddev,
++ p[226 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_IN_DATA_STP_DISC_0_REG + j * 4);
+ }
+
+- p[227] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
++ p[229] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
+
+ for (i = 0; i < DSAF_INODE_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[228 + i] = dsaf_read_dev(ddev,
++ p[230 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_VC0_IN_PKT_NUM_0_REG + j * 4);
+ }
+
+- p[231] = dsaf_read_dev(ddev,
+- DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 4);
++ p[233] = dsaf_read_dev(ddev,
++ DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 0x80);
+
+ /* dsaf inode registers */
+ for (i = 0; i < HNS_DSAF_SBM_NUM(ddev) / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[232 + i] = dsaf_read_dev(ddev,
++ p[234 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_CFG_REG_0_REG + j * 0x80);
+- p[235 + i] = dsaf_read_dev(ddev,
++ p[237 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_0_XGE_REG_0_REG + j * 0x80);
+- p[238 + i] = dsaf_read_dev(ddev,
++ p[240 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_1_REG_0_REG + j * 0x80);
+- p[241 + i] = dsaf_read_dev(ddev,
++ p[243 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_2_XGE_REG_0_REG + j * 0x80);
+- p[244 + i] = dsaf_read_dev(ddev,
++ p[246 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_0_0_REG + j * 0x80);
+- p[245 + i] = dsaf_read_dev(ddev,
++ p[249 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_1_0_REG + j * 0x80);
+- p[248 + i] = dsaf_read_dev(ddev,
++ p[252 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_0_0_REG + j * 0x80);
+- p[251 + i] = dsaf_read_dev(ddev,
++ p[255 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_1_0_REG + j * 0x80);
+- p[254 + i] = dsaf_read_dev(ddev,
++ p[258 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_2_0_REG + j * 0x80);
+- p[257 + i] = dsaf_read_dev(ddev,
++ p[261 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_3_0_REG + j * 0x80);
+- p[260 + i] = dsaf_read_dev(ddev,
++ p[264 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INER_ST_0_REG + j * 0x80);
+- p[263 + i] = dsaf_read_dev(ddev,
++ p[267 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_MIB_REQ_FAILED_TC_0_REG + j * 0x80);
+- p[266 + i] = dsaf_read_dev(ddev,
++ p[270 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_CNT_0_REG + j * 0x80);
+- p[269 + i] = dsaf_read_dev(ddev,
++ p[273 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_DROP_CNT_0_REG + j * 0x80);
+- p[272 + i] = dsaf_read_dev(ddev,
++ p[276 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INF_OUTPORT_CNT_0_REG + j * 0x80);
+- p[275 + i] = dsaf_read_dev(ddev,
++ p[279 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC0_CNT_0_REG + j * 0x80);
+- p[278 + i] = dsaf_read_dev(ddev,
++ p[282 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC1_CNT_0_REG + j * 0x80);
+- p[281 + i] = dsaf_read_dev(ddev,
++ p[285 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC2_CNT_0_REG + j * 0x80);
+- p[284 + i] = dsaf_read_dev(ddev,
++ p[288 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC3_CNT_0_REG + j * 0x80);
+- p[287 + i] = dsaf_read_dev(ddev,
++ p[291 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC4_CNT_0_REG + j * 0x80);
+- p[290 + i] = dsaf_read_dev(ddev,
++ p[294 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC5_CNT_0_REG + j * 0x80);
+- p[293 + i] = dsaf_read_dev(ddev,
++ p[297 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC6_CNT_0_REG + j * 0x80);
+- p[296 + i] = dsaf_read_dev(ddev,
++ p[300 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC7_CNT_0_REG + j * 0x80);
+- p[299 + i] = dsaf_read_dev(ddev,
++ p[303 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_REQ_CNT_0_REG + j * 0x80);
+- p[302 + i] = dsaf_read_dev(ddev,
++ p[306 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_RELS_CNT_0_REG + j * 0x80);
+- p[305 + i] = dsaf_read_dev(ddev,
++ p[309 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_3_REG_0_REG + j * 0x80);
+- p[308 + i] = dsaf_read_dev(ddev,
++ p[312 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_4_REG_0_REG + j * 0x80);
+ }
+
+ /* dsaf onode registers */
+ for (i = 0; i < DSAF_XOD_NUM; i++) {
+- p[311 + i] = dsaf_read_dev(ddev,
++ p[315 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[319 + i] = dsaf_read_dev(ddev,
++ p[323 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[327 + i] = dsaf_read_dev(ddev,
++ p[331 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[335 + i] = dsaf_read_dev(ddev,
++ p[339 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[343 + i] = dsaf_read_dev(ddev,
++ p[347 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_OFFSET_CFG_0_REG + i * 0x90);
+- p[351 + i] = dsaf_read_dev(ddev,
++ p[355 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TOKEN_CFG_0_REG + i * 0x90);
+ }
+
+- p[359] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
+- p[360] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
+- p[361] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
++ p[363] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
++ p[364] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
++ p[365] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
+
+ for (i = 0; i < DSAF_XOD_BIG_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[362 + i] = dsaf_read_dev(ddev,
++ p[366 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_L_0_REG + j * 0x90);
+- p[365 + i] = dsaf_read_dev(ddev,
++ p[369 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_H_0_REG + j * 0x90);
+- p[368 + i] = dsaf_read_dev(ddev,
++ p[372 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_CONNECT_STATE_0_REG + j * 0x90);
+- p[371 + i] = dsaf_read_dev(ddev,
++ p[375 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVPKT_CNT_0_REG + j * 0x90);
+- p[374 + i] = dsaf_read_dev(ddev,
++ p[378 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC0_CNT_0_REG + j * 0x90);
+- p[377 + i] = dsaf_read_dev(ddev,
++ p[381 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC1_CNT_0_REG + j * 0x90);
+- p[380 + i] = dsaf_read_dev(ddev,
++ p[384 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC2_CNT_0_REG + j * 0x90);
+- p[383 + i] = dsaf_read_dev(ddev,
++ p[387 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC3_CNT_0_REG + j * 0x90);
+- p[386 + i] = dsaf_read_dev(ddev,
++ p[390 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC0_CNT_0_REG + j * 0x90);
+- p[389 + i] = dsaf_read_dev(ddev,
++ p[393 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC1_CNT_0_REG + j * 0x90);
+ }
+
+- p[392] = dsaf_read_dev(ddev,
++ p[396] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[393] = dsaf_read_dev(ddev,
++ p[397] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[394] = dsaf_read_dev(ddev,
++ p[398] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN2_CNT_0_REG + port * 0x90);
+- p[395] = dsaf_read_dev(ddev,
++ p[399] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN3_CNT_0_REG + port * 0x90);
+- p[396] = dsaf_read_dev(ddev,
++ p[400] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN4_CNT_0_REG + port * 0x90);
+- p[397] = dsaf_read_dev(ddev,
++ p[401] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN5_CNT_0_REG + port * 0x90);
+- p[398] = dsaf_read_dev(ddev,
++ p[402] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN6_CNT_0_REG + port * 0x90);
+- p[399] = dsaf_read_dev(ddev,
++ p[403] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN7_CNT_0_REG + port * 0x90);
+- p[400] = dsaf_read_dev(ddev,
++ p[404] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[401] = dsaf_read_dev(ddev,
++ p[405] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[402] = dsaf_read_dev(ddev,
++ p[406] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[403] = dsaf_read_dev(ddev,
++ p[407] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[404] = dsaf_read_dev(ddev,
++ p[408] = dsaf_read_dev(ddev,
+ DSAF_XOD_FIFO_STATUS_0_REG + port * 0x90);
+
+ /* dsaf voq registers */
+ for (i = 0; i < DSAF_VOQ_NUM / DSAF_COMM_CHN; i++) {
+ j = (i * DSAF_COMM_CHN + port) * 0x90;
+- p[405 + i] = dsaf_read_dev(ddev,
++ p[409 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_INVERT_EN_0_REG + j);
+- p[408 + i] = dsaf_read_dev(ddev,
++ p[412 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_SRAM_PKT_NUM_0_REG + j);
+- p[411 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
+- p[414 + i] = dsaf_read_dev(ddev,
++ p[415 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
++ p[418 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_OUT_PKT_NUM_0_REG + j);
+- p[417 + i] = dsaf_read_dev(ddev,
++ p[421 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_ERR_ADDR_0_REG + j);
+- p[420 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
+- p[423 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
+- p[426 + i] = dsaf_read_dev(ddev,
++ p[424 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
++ p[427 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
++ p[430 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_0_0_REG + j);
+- p[429 + i] = dsaf_read_dev(ddev,
++ p[433 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_1_0_REG + j);
+- p[432 + i] = dsaf_read_dev(ddev,
++ p[436 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_PPE_XOD_REQ_0_REG + j);
+- p[435 + i] = dsaf_read_dev(ddev,
++ p[439 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ROCEE_XOD_REQ_0_REG + j);
+- p[438 + i] = dsaf_read_dev(ddev,
++ p[442 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_BP_ALL_THRD_0_REG + j);
+ }
+
+ /* dsaf tbl registers */
+- p[441] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
+- p[442] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
+- p[443] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
+- p[444] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
+- p[445] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
+- p[446] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
+- p[447] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
+- p[448] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
+- p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
+- p[450] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
+- p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
+- p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
+- p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
+- p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
+- p[455] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
+- p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
+- p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
+- p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
+- p[459] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
+- p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
+- p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
+- p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
+- p[463] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
++ p[445] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
++ p[446] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
++ p[447] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
++ p[448] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
++ p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
++ p[450] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
++ p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
++ p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
++ p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
++ p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
++ p[455] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
++ p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
++ p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
++ p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
++ p[459] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
++ p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
++ p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
++ p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
++ p[463] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
++ p[464] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
++ p[465] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
++ p[466] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
++ p[467] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
+
+ for (i = 0; i < DSAF_SW_PORT_NUM; i++) {
+ j = i * 0x8;
+- p[464 + 2 * i] = dsaf_read_dev(ddev,
++ p[468 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO1_0_REG + j);
+- p[465 + 2 * i] = dsaf_read_dev(ddev,
++ p[469 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO0_0_REG + j);
+ }
+
+- p[480] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
+- p[481] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
+- p[482] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
+- p[483] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
+- p[484] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
+- p[485] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
+- p[486] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
+- p[487] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
+- p[488] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
+- p[489] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
+- p[490] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
+- p[491] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
++ p[484] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
++ p[485] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
++ p[486] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
++ p[487] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
++ p[488] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
++ p[489] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
++ p[490] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
++ p[491] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
++ p[492] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
++ p[493] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
++ p[494] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
++ p[495] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
+
+ /* dsaf other registers */
+- p[492] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
+- p[493] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
+- p[494] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
+- p[495] = dsaf_read_dev(ddev,
++ p[496] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
++ p[497] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
++ p[498] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
++ p[499] = dsaf_read_dev(ddev,
+ DSAF_XGE_APP_RX_LINK_UP_0_REG + port * 0x4);
+- p[496] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
+- p[497] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
++ p[500] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
++ p[501] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
+
+ if (!is_ver1)
+- p[498] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
++ p[502] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
+
+ /* mark end of dsaf regs */
+- for (i = 499; i < 504; i++)
++ for (i = 503; i < 504; i++)
+ p[i] = 0xdddddddd;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 6d20e4eb7402..5ae3d017ddbc 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -176,7 +176,7 @@
+ #define DSAF_INODE_IN_DATA_STP_DISC_0_REG 0x1A50
+ #define DSAF_INODE_GE_FC_EN_0_REG 0x1B00
+ #define DSAF_INODE_VC0_IN_PKT_NUM_0_REG 0x1B50
+-#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x1C00
++#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x103C
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_REG 0x1C00
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_OFFSET 0x100
+ #define DSAF_INODE_IN_PRIO_PAUSE_OFFSET 0x50
+@@ -404,11 +404,11 @@
+ #define RCB_ECC_ERR_ADDR4_REG 0x460
+ #define RCB_ECC_ERR_ADDR5_REG 0x464
+
+-#define RCB_COM_SF_CFG_INTMASK_RING 0x480
+-#define RCB_COM_SF_CFG_RING_STS 0x484
+-#define RCB_COM_SF_CFG_RING 0x488
+-#define RCB_COM_SF_CFG_INTMASK_BD 0x48C
+-#define RCB_COM_SF_CFG_BD_RINT_STS 0x470
++#define RCB_COM_SF_CFG_INTMASK_RING 0x470
++#define RCB_COM_SF_CFG_RING_STS 0x474
++#define RCB_COM_SF_CFG_RING 0x478
++#define RCB_COM_SF_CFG_INTMASK_BD 0x47C
++#define RCB_COM_SF_CFG_BD_RINT_STS 0x480
+ #define RCB_COM_RCB_RD_BD_BUSY 0x490
+ #define RCB_COM_RCB_FBD_CRT_EN 0x494
+ #define RCB_COM_AXI_WR_ERR_INTMASK 0x498
+--
+2.19.1
+
--- /dev/null
+From 72f682dea584c59fe91396a624891f91fe601208 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 17 Dec 2018 15:05:40 +0200
+Subject: net: macb: fix dropped RX frames due to a race
+
+[ Upstream commit 8159ecab0db9095902d4c73605fb8787f5c7d653 ]
+
+Bit RX_USED set to 0 in the address field allows the controller to write
+data to the receive buffer descriptor.
+
+The driver does not ensure the ctrl field is ready (cleared) when the
+controller sees the RX_USED=0 written by the driver. The ctrl field might
+only be cleared after the controller has already updated it according to
+a newly received frame, causing the frame to be discarded in gem_rx() due
+to unexpected ctrl field contents.
+
+A message is logged when the above scenario occurs:
+
+ macb ff0b0000.ethernet eth0: not whole frame pointed by descriptor
+
+Fix the issue by ensuring that when the controller sees RX_USED=0 the
+ctrl field is already cleared.
+
+This issue was observed on a ZynqMP based system.
+
+Fixes: 4df95131ea80 ("net/macb: change RX path for GEM")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 3aabc36eec0b..9046993947cc 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -923,14 +923,19 @@ static void gem_rx_refill(struct macb *bp)
+
+ if (entry == bp->rx_ring_size - 1)
+ paddr |= MACB_BIT(RX_WRAP);
+- macb_set_addr(bp, desc, paddr);
+ desc->ctrl = 0;
++ /* Setting addr clears RX_USED and allows reception,
++ * make sure ctrl is cleared first to avoid a race.
++ */
++ dma_wmb();
++ macb_set_addr(bp, desc, paddr);
+
+ /* properly align Ethernet header */
+ skb_reserve(skb, NET_IP_ALIGN);
+ } else {
+- desc->addr &= ~MACB_BIT(RX_USED);
+ desc->ctrl = 0;
++ dma_wmb();
++ desc->addr &= ~MACB_BIT(RX_USED);
+ }
+ }
+
+--
+2.19.1
+
--- /dev/null
+From acdec781094995b52578d75eaaf9408c999f5221 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 17 Dec 2018 15:05:39 +0200
+Subject: net: macb: fix random memory corruption on RX with 64-bit DMA
+
+[ Upstream commit e100a897bf9b19089e57f236f2398c9e0538900e ]
+
+64-bit DMA addresses are split in upper and lower halves that are
+written in separate fields on GEM. For RX, bit 0 of the address is used
+as the ownership bit (RX_USED). When the RX_USED bit is unset the
+controller is allowed to write data to the buffer.
+
+The driver does not guarantee that the controller already sees the upper
+half when the RX_USED bit is cleared, possibly resulting in the
+controller writing an incoming frame to an address with an incorrect
+upper half and therefore possibly corrupting unrelated system memory.
+
+Fix that by adding the necessary DMA memory barrier between the writes.
+
+This corruption was observed on a ZynqMP based system.
+
+Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Acked-by: Harini Katakam <harini.katakam@xilinx.com>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 0b2f9ddfb1c4..3aabc36eec0b 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -675,6 +675,11 @@ static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_
+ if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+ desc_64 = macb_64b_desc(bp, desc);
+ desc_64->addrh = upper_32_bits(addr);
++ /* The low bits of RX address contain the RX_USED bit, clearing
++ * of which allows packet RX. Make sure the high bits are also
++ * visible to HW at that point.
++ */
++ dma_wmb();
+ }
+ #endif
+ desc->addr = lower_32_bits(addr);
+--
+2.19.1
+
--- /dev/null
+From 25052815f85aed90269462394a0f0fb81d7b9929 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 21 Dec 2018 00:22:32 -0600
+Subject: net: netxen: fix a missing check and an uninitialized use
+
+[ Upstream commit d134e486e831defd26130770181f01dfc6195f7d ]
+
+When netxen_rom_fast_read() fails, "bios" is left uninitialized and may
+contain random value, thus should not be used.
+
+The fix ensures that if netxen_rom_fast_read() fails, we return "-EIO".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+index 3dd973475125..4b444351ab7d 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+@@ -1125,7 +1125,8 @@ netxen_validate_firmware(struct netxen_adapter *adapter)
+ return -EINVAL;
+ }
+ val = nx_get_bios_version(adapter);
+- netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios);
++ if (netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios))
++ return -EIO;
+ if ((__force u32)val != bios) {
+ dev_err(&pdev->dev, "%s: firmware bios is incompatible\n",
+ fw_name[fw_type]);
+--
+2.19.1
+
--- /dev/null
+From 5924dc8240978b9362319cc9e9cc995d829f7896 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Mon, 10 Dec 2018 14:39:37 +0100
+Subject: netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
+
+[ Upstream commit 708abf74dd87f8640871b814faa195fb5970b0e3 ]
+
+In the error handling block, nla_nest_cancel(skb, atd) is called to
+cancel the nest operation. But then, ipset_nest_end(skb, atd) is
+unexpected called to end the nest operation. This patch calls the
+ipset_nest_end only on the branch that nla_nest_cancel is not called.
+
+Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_list_set.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 75d52aed6fdb..e563921e6af5 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -542,8 +542,8 @@ list_set_list(const struct ip_set *set,
+ ret = -EMSGSIZE;
+ } else {
+ cb->args[IPSET_CB_ARG0] = i;
++ ipset_nest_end(skb, atd);
+ }
+- ipset_nest_end(skb, atd);
+ out:
+ rcu_read_unlock();
+ return ret;
+--
+2.19.1
+
--- /dev/null
+From fe31e7b578e65d8e55c55aeb66be6c34c10513fd Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 11 Dec 2018 07:45:29 +0100
+Subject: netfilter: nat: can't use dst_hold on noref dst
+
+[ Upstream commit 542fbda0f08f1cbbc250f9e59f7537649651d0c8 ]
+
+The dst entry might already have a zero refcount, waiting on rcu list
+to be free'd. Using dst_hold() transitions its reference count to 1, and
+next dst release will try to free it again -- resulting in a double free:
+
+ WARNING: CPU: 1 PID: 0 at include/net/dst.h:239 nf_xfrm_me_harder+0xe7/0x130 [nf_nat]
+ RIP: 0010:nf_xfrm_me_harder+0xe7/0x130 [nf_nat]
+ Code: 48 8b 5c 24 60 65 48 33 1c 25 28 00 00 00 75 53 48 83 c4 68 5b 5d 41 5c c3 85 c0 74 0d 8d 48 01 f0 0f b1 0a 74 86 85 c0 75 f3 <0f> 0b e9 7b ff ff ff 29 c6 31 d2 b9 20 00 48 00 4c 89 e7 e8 31 27
+ Call Trace:
+ nf_nat_ipv4_out+0x78/0x90 [nf_nat_ipv4]
+ nf_hook_slow+0x36/0xd0
+ ip_output+0x9f/0xd0
+ ip_forward+0x328/0x440
+ ip_rcv+0x8a/0xb0
+
+Use dst_hold_safe instead and bail out if we cannot take a reference.
+
+Fixes: a4c2fd7f7891 ("net: remove DST_NOCACHE flag")
+Reported-by: Martin Zaharinov <micron10@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index af8345fc4fbd..ed0ea64b8d04 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -97,7 +97,8 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
+ dst = skb_dst(skb);
+ if (dst->xfrm)
+ dst = ((struct xfrm_dst *)dst)->route;
+- dst_hold(dst);
++ if (!dst_hold_safe(dst))
++ return -EHOSTUNREACH;
+
+ dst = xfrm_lookup(net, dst, &fl, skb->sk, 0);
+ if (IS_ERR(dst))
+--
+2.19.1
+
--- /dev/null
+From ce79fa71af941b6cf51e369ce5f1a6b8b36e8abe Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 5 Dec 2018 14:12:19 +0100
+Subject: netfilter: seqadj: re-load tcp header pointer after possible head
+ reallocation
+
+[ Upstream commit 530aad77010b81526586dfc09130ec875cd084e4 ]
+
+When adjusting sack block sequence numbers, skb_make_writable() gets
+called to make sure tcp options are all in the linear area, and buffer
+is not shared.
+
+This can cause tcp header pointer to get reallocated, so we must
+reaload it to avoid memory corruption.
+
+This bug pre-dates git history.
+
+Reported-by: Neel Mehta <nmehta@google.com>
+Reported-by: Shane Huntley <shuntley@google.com>
+Reported-by: Heather Adkins <argv@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_seqadj.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
+index a975efd6b8c3..9da303461069 100644
+--- a/net/netfilter/nf_conntrack_seqadj.c
++++ b/net/netfilter/nf_conntrack_seqadj.c
+@@ -115,12 +115,12 @@ static void nf_ct_sack_block_adjust(struct sk_buff *skb,
+ /* TCP SACK sequence number adjustment */
+ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ unsigned int protoff,
+- struct tcphdr *tcph,
+ struct nf_conn *ct,
+ enum ip_conntrack_info ctinfo)
+ {
+- unsigned int dir, optoff, optend;
++ struct tcphdr *tcph = (void *)skb->data + protoff;
+ struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
++ unsigned int dir, optoff, optend;
+
+ optoff = protoff + sizeof(struct tcphdr);
+ optend = protoff + tcph->doff * 4;
+@@ -128,6 +128,7 @@ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ if (!skb_make_writable(skb, optend))
+ return 0;
+
++ tcph = (void *)skb->data + protoff;
+ dir = CTINFO2DIR(ctinfo);
+
+ while (optoff < optend) {
+@@ -207,7 +208,7 @@ int nf_ct_seq_adjust(struct sk_buff *skb,
+ ntohl(newack));
+ tcph->ack_seq = newack;
+
+- res = nf_ct_sack_adjust(skb, protoff, tcph, ct, ctinfo);
++ res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo);
+ out:
+ spin_unlock_bh(&ct->lock);
+
+--
+2.19.1
+
--- /dev/null
+From 04367265c10d1351adc20d5f40291aba1c38d5cf Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Tue, 13 Nov 2018 11:55:36 +0100
+Subject: pinctrl: meson: fix pull enable register calculation
+
+[ Upstream commit 614b1868a125a0ba24be08f3a7fa832ddcde6bca ]
+
+We just changed the code so we apply bias disable on the correct
+register but forgot to align the register calculation. The result
+is that we apply the change on the correct register, but possibly
+at the incorrect offset/bit
+
+This went undetected because offsets tends to be the same between
+REG_PULL and REG_PULLEN for a given pin the EE controller. This
+is not true for the AO controller.
+
+Fixes: e39f9dd8206a ("pinctrl: meson: fix pinconf bias disable")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 6c43322dbb97..2998941fdeca 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -272,7 +272,8 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ case PIN_CONFIG_BIAS_DISABLE:
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+- meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
++ meson_calc_reg_and_bit(bank, pin, REG_PULLEN, ®,
++ &bit);
+ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+--
+2.19.1
+
--- /dev/null
+From ebf933d9c64a992bed7049b7941768fdaaf7e473 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Tue, 27 Nov 2018 09:01:54 +1100
+Subject: powerpc: Fix COFF zImage booting on old powermacs
+
+[ Upstream commit 5564597d51c8ff5b88d95c76255e18b13b760879 ]
+
+Commit 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper
+as a relocatable ET_DYN", 2011-04-12) changed the procedure descriptor
+at the start of crt0.S to have a hard-coded start address of 0x500000
+rather than a reference to _zimage_start, presumably because having
+a reference to a symbol introduced a relocation which is awkward to
+handle in a position-independent executable. Unfortunately, what is
+at 0x500000 in the COFF image is not the first instruction, but the
+procedure descriptor itself, that is, a word containing 0x500000,
+which is not a valid instruction. Hence, booting a COFF zImage
+results in a "DEFAULT CATCH!, code=FFF00700" message from Open
+Firmware.
+
+This fixes the problem by (a) putting the procedure descriptor in the
+data section and (b) adding a branch to _zimage_start as the first
+instruction in the program.
+
+Fixes: 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN")
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/crt0.S | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index 32dfe6d083f3..9b9d17437373 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -15,7 +15,7 @@
+ RELA = 7
+ RELACOUNT = 0x6ffffff9
+
+- .text
++ .data
+ /* A procedure descriptor used when booting this as a COFF file.
+ * When making COFF, this comes first in the link and we're
+ * linked at 0x500000.
+@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9
+ .globl _zimage_start_opd
+ _zimage_start_opd:
+ .long 0x500000, 0, 0, 0
++ .text
++ b _zimage_start
+
+ #ifdef __powerpc64__
+ .balign 8
+--
+2.19.1
+
--- /dev/null
+From 11cdaf1b0421ec25c78890222f404b59488f74ee Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 26 Nov 2018 12:59:16 +1100
+Subject: powerpc/mm: Fix linux page tables build with some configs
+
+[ Upstream commit 462951cd32e1496dc64b00051dfb777efc8ae5d8 ]
+
+For some configs the build fails with:
+
+ arch/powerpc/mm/dump_linuxpagetables.c: In function 'populate_markers':
+ arch/powerpc/mm/dump_linuxpagetables.c:306:39: error: 'PKMAP_BASE' undeclared (first use in this function)
+ arch/powerpc/mm/dump_linuxpagetables.c:314:50: error: 'LAST_PKMAP' undeclared (first use in this function)
+
+These come from highmem.h, including that fixes the build.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/dump_linuxpagetables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index 31c1c61afaa4..0bbaf7344872 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -19,6 +19,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/io.h>
+ #include <linux/mm.h>
++#include <linux/highmem.h>
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <asm/fixmap.h>
+--
+2.19.1
+
--- /dev/null
+From a460da8f01f0709b5018578ee72ec7ab8789a2b5 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 17 Dec 2018 10:05:13 +0300
+Subject: qed: Fix an error code qed_ll2_start_xmit()
+
+[ Upstream commit f07d4276892d97671e880190ff195a288b2d8d92 ]
+
+We accidentally deleted the code to set "rc = -ENOMEM;" and this patch
+adds it back.
+
+Fixes: d2201a21598a ("qed: No need for LL2 frags indication")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 5f52f14761a3..b73bcbeb5f27 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -2351,6 +2351,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
+ if (unlikely(dma_mapping_error(&cdev->pdev->dev, mapping))) {
+ DP_NOTICE(cdev,
+ "Unable to map frag - dropping packet\n");
++ rc = -ENOMEM;
+ goto err;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From d38e2ab3725c3a73fac2efe9d8b998a226e94ea6 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Fri, 21 Dec 2018 13:07:23 +0100
+Subject: qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
+
+[ Upstream commit d667044f49513d55fcfefe4fa8f8d96091782901 ]
+
+This patch fixes qmap header retrieval when modem is configured for
+dl data aggregation.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 969474c9d297..891f8f975b43 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -151,17 +151,18 @@ static bool qmimux_has_slaves(struct usbnet *dev)
+
+ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
+- unsigned int len, offset = sizeof(struct qmimux_hdr);
++ unsigned int len, offset = 0;
+ struct qmimux_hdr *hdr;
+ struct net_device *net;
+ struct sk_buff *skbn;
++ u8 qmimux_hdr_sz = sizeof(*hdr);
+
+- while (offset < skb->len) {
+- hdr = (struct qmimux_hdr *)skb->data;
++ while (offset + qmimux_hdr_sz < skb->len) {
++ hdr = (struct qmimux_hdr *)(skb->data + offset);
+ len = be16_to_cpu(hdr->pkt_len);
+
+ /* drop the packet, bogus length */
+- if (offset + len > skb->len)
++ if (offset + len + qmimux_hdr_sz > skb->len)
+ return 0;
+
+ /* control packet, we do not know what to do */
+@@ -176,7 +177,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ return 0;
+ skbn->dev = net;
+
+- switch (skb->data[offset] & 0xf0) {
++ switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) {
+ case 0x40:
+ skbn->protocol = htons(ETH_P_IP);
+ break;
+@@ -188,12 +189,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ goto skip;
+ }
+
+- skb_put_data(skbn, skb->data + offset, len);
++ skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len);
+ if (netif_rx(skbn) != NET_RX_SUCCESS)
+ return 0;
+
+ skip:
+- offset += len + sizeof(struct qmimux_hdr);
++ offset += len + qmimux_hdr_sz;
+ }
+ return 1;
+ }
+--
+2.19.1
+
--- /dev/null
+From bbc8ee6d2e8968ae88f030de01590a83c0bd82d2 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 1 Nov 2018 08:25:30 +0300
+Subject: scsi: bnx2fc: Fix NULL dereference in error handling
+
+[ Upstream commit 9ae4f8420ed7be4b13c96600e3568c144d101a23 ]
+
+If "interface" is NULL then we can't release it and trying to will only
+lead to an Oops.
+
+Fixes: aea71a024914 ("[SCSI] bnx2fc: Introduce interface structure for each vlan interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index 6844ba361616..89f09b122135 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -2372,7 +2372,7 @@ static int _bnx2fc_create(struct net_device *netdev,
+ if (!interface) {
+ printk(KERN_ERR PFX "bnx2fc_interface_create failed\n");
+ rc = -ENOMEM;
+- goto ifput_err;
++ goto netdev_err;
+ }
+
+ if (is_vlan_dev(netdev)) {
+--
+2.19.1
+
--- /dev/null
+From 092a0eeb5dbc7cc89e198095017e44e5e5e36deb Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 9 Nov 2018 20:59:46 +0530
+Subject: scsi: target: iscsi: cxgbit: add missing spin_lock_init()
+
+[ Upstream commit 9e6371d3c6913ff1707fb2c0274c9925f7aaef80 ]
+
+Add missing spin_lock_init() for cdev->np_lock.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_main.c b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+index 4fd775ace541..6340e2e7ffbe 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_main.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+@@ -58,6 +58,7 @@ static void *cxgbit_uld_add(const struct cxgb4_lld_info *lldi)
+ return ERR_PTR(-ENOMEM);
+
+ kref_init(&cdev->kref);
++ spin_lock_init(&cdev->np_lock);
+
+ cdev->lldi = *lldi;
+
+--
+2.19.1
+
--- /dev/null
+From f3a86b4319944621acd9f51cf69571a90ddf79fa Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 9 Nov 2018 20:59:01 +0530
+Subject: scsi: target: iscsi: cxgbit: fix csk leak
+
+[ Upstream commit 801df68d617e3cb831f531c99fa6003620e6b343 ]
+
+csk leak can happen if a new TCP connection gets established after
+cxgbit_accept_np() returns, to fix this leak free remaining csk in
+cxgbit_free_np().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index d4fa41be80f9..0c00bb27c9c5 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -631,8 +631,11 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)
+
+ static void cxgbit_arp_failure_discard(void *handle, struct sk_buff *skb)
+ {
++ struct cxgbit_sock *csk = handle;
++
+ pr_debug("%s cxgbit_device %p\n", __func__, handle);
+ kfree_skb(skb);
++ cxgbit_put_csk(csk);
+ }
+
+ static void cxgbit_abort_arp_failure(void *handle, struct sk_buff *skb)
+@@ -1147,7 +1150,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req)
+ rpl5->opt0 = cpu_to_be64(opt0);
+ rpl5->opt2 = cpu_to_be32(opt2);
+ set_wr_txq(skb, CPL_PRIORITY_SETUP, csk->ctrlq_idx);
+- t4_set_arp_err_handler(skb, NULL, cxgbit_arp_failure_discard);
++ t4_set_arp_err_handler(skb, csk, cxgbit_arp_failure_discard);
+ cxgbit_l2t_send(csk->com.cdev, skb, csk->l2t);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From f25f1aed05ebfe468f52e5b5ba4bd1b55ad6945a Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 12 Dec 2018 11:01:45 -0500
+Subject: serial/sunsu: fix refcount leak
+
+[ Upstream commit d430aff8cd0c57502d873909c184e3b5753f8b88 ]
+
+The function of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+
+su_get_type() doesn't do that. The match node are used as an identifier
+to compare against the current node, so we can directly drop the refcount
+after getting the node from the path as it is not used as pointer.
+
+Fix this by use a single variable and drop the refcount right after
+of_find_node_by_path().
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sunsu.c | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index 95d34d7565c9..1cf78cec7461 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -1393,22 +1393,43 @@ static inline struct console *SUNSU_CONSOLE(void)
+ static enum su_type su_get_type(struct device_node *dp)
+ {
+ struct device_node *ap = of_find_node_by_path("/aliases");
++ enum su_type rc = SU_PORT_PORT;
+
+ if (ap) {
+ const char *keyb = of_get_property(ap, "keyboard", NULL);
+ const char *ms = of_get_property(ap, "mouse", NULL);
++ struct device_node *match;
+
+ if (keyb) {
+- if (dp == of_find_node_by_path(keyb))
+- return SU_PORT_KBD;
++ match = of_find_node_by_path(keyb);
++
++ /*
++ * The pointer is used as an identifier not
++ * as a pointer, we can drop the refcount on
++ * the of__node immediately after getting it.
++ */
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_KBD;
++ goto out;
++ }
+ }
+ if (ms) {
+- if (dp == of_find_node_by_path(ms))
+- return SU_PORT_MS;
++ match = of_find_node_by_path(ms);
++
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_MS;
++ goto out;
++ }
+ }
+ }
+
+- return SU_PORT_PORT;
++out:
++ of_node_put(ap);
++ return rc;
+ }
+
+ static int su_probe(struct platform_device *op)
+--
+2.19.1
+
--- /dev/null
+pinctrl-meson-fix-pull-enable-register-calculation.patch
+powerpc-fix-coff-zimage-booting-on-old-powermacs.patch
+powerpc-mm-fix-linux-page-tables-build-with-some-con.patch
+hid-ite-add-usb-id-match-for-another-ite-based-keybo.patch
+arm-imx-update-the-cpu-power-up-timing-setting-on-i..patch
+arm-dts-imx7d-nitrogen7-fix-the-description-of-the-w.patch
+input-restore-ev_abs-abs_reserved.patch
+checkstack.pl-fix-for-aarch64.patch
+xfrm-fix-error-return-code-in-xfrm_output_one.patch
+xfrm-fix-bucket-count-reported-to-userspace.patch
+xfrm-fix-null-pointer-dereference-in-xfrm_input-when.patch
+netfilter-seqadj-re-load-tcp-header-pointer-after-po.patch
+scsi-bnx2fc-fix-null-dereference-in-error-handling.patch
+input-omap-keypad-fix-idle-configuration-to-not-bloc.patch
+input-synaptics-enable-rmi-on-thinkpad-t560.patch
+ibmvnic-fix-non-atomic-memory-allocation-in-irq-cont.patch
+ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch
+x86-mm-fix-guard-hole-handling.patch
+x86-dump_pagetables-fix-ldt-remap-address-marker.patch
+i40e-fix-mac-filter-delete-when-setting-mac-address.patch
+netfilter-ipset-do-not-call-ipset_nest_end-after-nla.patch
+netfilter-nat-can-t-use-dst_hold-on-noref-dst.patch
+bnx2x-clear-fip-mac-when-fcoe-offload-support-is-dis.patch
+bnx2x-remove-configured-vlans-as-part-of-unload-sequ.patch
+bnx2x-send-update-svid-ramrod-with-retry-poll-flags-.patch
+scsi-target-iscsi-cxgbit-fix-csk-leak.patch
+scsi-target-iscsi-cxgbit-add-missing-spin_lock_init.patch
+x86-hyperv-remove-pci-dependency.patch
+drivers-net-xgene-remove-unnecessary-forward-declara.patch
+w90p910_ether-remove-incorrect-__init-annotation.patch
+net-hns-incorrect-offset-address-used-for-some-regis.patch
+net-hns-all-ports-can-not-work-when-insmod-hns-ko-af.patch
+net-hns-some-registers-use-wrong-address-according-t.patch
+net-hns-fixed-bug-that-netdev-was-opened-twice.patch
+net-hns-clean-rx-fbd-when-ae-stopped.patch
+net-hns-free-irq-when-exit-from-abnormal-branch.patch
+net-hns-avoid-net-reset-caused-by-pause-frames-storm.patch
+net-hns-fix-ntuple-filters-status-error.patch
+net-hns-add-mac-pcs-config-when-enable-disable-mac.patch
+net-hns-fix-ping-failed-when-use-net-bridge-and-send.patch
+sunrpc-fix-a-race-with-xprt_connecting.patch
+qed-fix-an-error-code-qed_ll2_start_xmit.patch
+net-macb-fix-random-memory-corruption-on-rx-with-64-.patch
+net-macb-fix-dropped-rx-frames-due-to-a-race.patch
+lan78xx-resolve-issue-with-changing-mac-address.patch
+vxge-ensure-data0-is-initialized-in-when-fetching-fi.patch
+mac80211-free-skb-fraglist-before-freeing-the-skb.patch
+kbuild-fix-false-positive-warning-error-about-missin.patch
+virtio-fix-test-build-after-uio.h-change.patch
+gpio-mvebu-only-fail-on-missing-clk-if-pwm-is-actual.patch
+input-synaptics-enable-smbus-for-hp-elitebook-840-g4.patch
+net-netxen-fix-a-missing-check-and-an-uninitialized-.patch
+qmi_wwan-fix-qmap-header-retrieval-in-qmimux_rx_fixu.patch
+serial-sunsu-fix-refcount-leak.patch
--- /dev/null
+From f072d336d1949dc1d8aece72b05b4370a8c43d4e Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 17 Dec 2018 17:38:51 -0500
+Subject: SUNRPC: Fix a race with XPRT_CONNECTING
+
+[ Upstream commit cf76785d30712d90185455e752337acdb53d2a5d ]
+
+Ensure that we clear XPRT_CONNECTING before releasing the XPRT_LOCK so that
+we don't have races between the (asynchronous) socket setup code and
+tasks in xprt_connect().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 30192abfdc3b..05a58cc1b0cd 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2223,8 +2223,8 @@ static void xs_udp_setup_socket(struct work_struct *work)
+ trace_rpc_socket_connect(xprt, sock, 0);
+ status = 0;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+@@ -2451,8 +2451,8 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ }
+ status = -EAGAIN;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From bbb0a7e5d7b16190dfdf5e6004891a2aa1a68039 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 19 Dec 2018 18:21:51 -0500
+Subject: virtio: fix test build after uio.h change
+
+[ Upstream commit c5c08bed843c2b2c048c16d1296d7631d7c1620e ]
+
+Fixes: d38499530e5 ("fs: decouple READ and WRITE from the block layer ops")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/virtio/linux/kernel.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
+index 395521a7a8d8..268ce239de65 100644
+--- a/tools/virtio/linux/kernel.h
++++ b/tools/virtio/linux/kernel.h
+@@ -23,6 +23,10 @@
+ #define PAGE_MASK (~(PAGE_SIZE-1))
+ #define PAGE_ALIGN(x) ((x + PAGE_SIZE - 1) & PAGE_MASK)
+
++/* generic data direction definitions */
++#define READ 0
++#define WRITE 1
++
+ typedef unsigned long long phys_addr_t;
+ typedef unsigned long long dma_addr_t;
+ typedef size_t __kernel_size_t;
+--
+2.19.1
+
--- /dev/null
+From 30eb3eb05d4c3736279d8a93fe0aa480ea4d7770 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 18 Dec 2018 15:19:47 +0000
+Subject: vxge: ensure data0 is initialized in when fetching firmware version
+ information
+
+[ Upstream commit f7db2beb4c2c6cc8111f5ab90fc7363ca91107b6 ]
+
+Currently variable data0 is not being initialized so a garbage value is
+being passed to vxge_hw_vpath_fw_api and this value is being written to
+the rts_access_steer_data0 register. There are other occurrances where
+data0 is being initialized to zero (e.g. in function
+vxge_hw_upgrade_read_version) so I think it makes sense to ensure data0
+is initialized likewise to 0.
+
+Detected by CoverityScan, CID#140696 ("Uninitialized scalar variable")
+
+Fixes: 8424e00dfd52 ("vxge: serialize access to steering control register")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index 6223930a8155..6f57b0b7d57a 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -808,7 +808,7 @@ __vxge_hw_vpath_fw_ver_get(struct __vxge_hw_virtualpath *vpath,
+ struct vxge_hw_device_date *fw_date = &hw_info->fw_date;
+ struct vxge_hw_device_version *flash_version = &hw_info->flash_version;
+ struct vxge_hw_device_date *flash_date = &hw_info->flash_date;
+- u64 data0, data1 = 0, steer_ctrl = 0;
++ u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+ enum vxge_hw_status status;
+
+ status = vxge_hw_vpath_fw_api(vpath,
+--
+2.19.1
+
--- /dev/null
+From 3862e49355b6f45e8a4c517d16aa74400ead0e02 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:45:07 +0100
+Subject: w90p910_ether: remove incorrect __init annotation
+
+[ Upstream commit 51367e423c6501a26e67d91a655d2bc892303462 ]
+
+The get_mac_address() function is normally inline, but when it is
+not, we get a warning that this configuration is broken:
+
+WARNING: vmlinux.o(.text+0x4aff00): Section mismatch in reference from the function w90p910_ether_setup() to the function .init.text:get_mac_address()
+The function w90p910_ether_setup() references
+the function __init get_mac_address().
+This is often because w90p910_ether_setup lacks a __init
+
+Remove the __init to make it always do the right thing.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/nuvoton/w90p910_ether.c b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+index 4a67c55aa9f1..11a9add81849 100644
+--- a/drivers/net/ethernet/nuvoton/w90p910_ether.c
++++ b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+@@ -912,7 +912,7 @@ static const struct net_device_ops w90p910_ether_netdev_ops = {
+ .ndo_validate_addr = eth_validate_addr,
+ };
+
+-static void __init get_mac_address(struct net_device *dev)
++static void get_mac_address(struct net_device *dev)
+ {
+ struct w90p910_ether *ether = netdev_priv(dev);
+ struct platform_device *pdev;
+--
+2.19.1
+
--- /dev/null
+From 17ca9f0457e59098c6c4b5cb7bbc4311e9b38910 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 30 Nov 2018 23:23:28 +0300
+Subject: x86/dump_pagetables: Fix LDT remap address marker
+
+[ Upstream commit 254eb5505ca0ca749d3a491fc6668b6c16647a99 ]
+
+The LDT remap placement has been changed. It's now placed before the direct
+mapping in the kernel virtual address space for both paging modes.
+
+Change address markers order accordingly.
+
+Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging")
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: peterz@infradead.org
+Cc: boris.ostrovsky@oracle.com
+Cc: jgross@suse.com
+Cc: bhe@redhat.com
+Cc: hans.van.kranenburg@mendix.com
+Cc: linux-mm@kvack.org
+Cc: xen-devel@lists.xenproject.org
+Link: https://lkml.kernel.org/r/20181130202328.65359-3-kirill.shutemov@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/dump_pagetables.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index cf403e057f3f..6bca45d06676 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -51,10 +51,10 @@ struct addr_marker {
+ enum address_markers_idx {
+ USER_SPACE_NR = 0,
+ KERNEL_SPACE_NR,
+- LOW_KERNEL_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
++#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ LDT_NR,
+ #endif
++ LOW_KERNEL_NR,
+ VMALLOC_START_NR,
+ VMEMMAP_START_NR,
+ #ifdef CONFIG_KASAN
+@@ -62,9 +62,6 @@ enum address_markers_idx {
+ KASAN_SHADOW_END_NR,
+ #endif
+ CPU_ENTRY_AREA_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
+- LDT_NR,
+-#endif
+ #ifdef CONFIG_X86_ESPFIX64
+ ESPFIX_START_NR,
+ #endif
+--
+2.19.1
+
--- /dev/null
+From 9e5096b417fc448baa93d8c86f181bdea1e31d77 Mon Sep 17 00:00:00 2001
+From: Sinan Kaya <okaya@kernel.org>
+Date: Sat, 1 Dec 2018 21:40:38 +0000
+Subject: x86, hyperv: remove PCI dependency
+
+[ Upstream commit c629421a990033ba539eb8585e73a2e6fa9ea631 ]
+
+Need to be able to boot without PCI devices present.
+
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig
+index 50b89ea0e60f..247a62604d1f 100644
+--- a/drivers/hv/Kconfig
++++ b/drivers/hv/Kconfig
+@@ -2,7 +2,7 @@ menu "Microsoft Hyper-V guest support"
+
+ config HYPERV
+ tristate "Microsoft Hyper-V client drivers"
+- depends on X86 && ACPI && PCI && X86_LOCAL_APIC && HYPERVISOR_GUEST
++ depends on X86 && ACPI && X86_LOCAL_APIC && HYPERVISOR_GUEST
+ select PARAVIRT
+ help
+ Select this option to run Linux as a Hyper-V client operating
+--
+2.19.1
+
--- /dev/null
+From c626e405d9daf44ca3c9967380815b356728602b Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 30 Nov 2018 23:23:27 +0300
+Subject: x86/mm: Fix guard hole handling
+
+[ Upstream commit 16877a5570e0c5f4270d5b17f9bab427bcae9514 ]
+
+There is a guard hole at the beginning of the kernel address space, also
+used by hypervisors. It occupies 16 PGD entries.
+
+This reserved range is not defined explicitely, it is calculated relative
+to other entities: direct mapping and user space ranges.
+
+The calculation got broken by recent changes of the kernel memory layout:
+LDT remap range is now mapped before direct mapping and makes the
+calculation invalid.
+
+The breakage leads to crash on Xen dom0 boot[1].
+
+Define the reserved range explicitely. It's part of kernel ABI (hypervisors
+expect it to be stable) and must not depend on changes in the rest of
+kernel memory layout.
+
+[1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html
+
+Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging")
+Reported-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: peterz@infradead.org
+Cc: boris.ostrovsky@oracle.com
+Cc: bhe@redhat.com
+Cc: linux-mm@kvack.org
+Cc: xen-devel@lists.xenproject.org
+Link: https://lkml.kernel.org/r/20181130202328.65359-2-kirill.shutemov@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/pgtable_64_types.h | 5 +++++
+ arch/x86/mm/dump_pagetables.c | 8 ++++----
+ arch/x86/xen/mmu_pv.c | 11 ++++++-----
+ 3 files changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 7764617b8f9c..bf6d2692fc60 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -94,6 +94,11 @@ typedef struct { pteval_t pte; } pte_t;
+ # define __VMEMMAP_BASE _AC(0xffffea0000000000, UL)
+ #endif
+
++#define GUARD_HOLE_PGD_ENTRY -256UL
++#define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT)
++#define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT)
++#define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE)
++
+ #define LDT_PGD_ENTRY -240UL
+ #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
+
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index 2a4849e92831..cf403e057f3f 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -465,11 +465,11 @@ static inline bool is_hypervisor_range(int idx)
+ {
+ #ifdef CONFIG_X86_64
+ /*
+- * ffff800000000000 - ffff87ffffffffff is reserved for
+- * the hypervisor.
++ * A hole in the beginning of kernel address space reserved
++ * for a hypervisor.
+ */
+- return (idx >= pgd_index(__PAGE_OFFSET) - 16) &&
+- (idx < pgd_index(__PAGE_OFFSET));
++ return (idx >= pgd_index(GUARD_HOLE_BASE_ADDR)) &&
++ (idx < pgd_index(GUARD_HOLE_END_ADDR));
+ #else
+ return false;
+ #endif
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index b33fa127a613..7631e6130d44 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -614,19 +614,20 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd,
+ unsigned long limit)
+ {
+ int i, nr, flush = 0;
+- unsigned hole_low, hole_high;
++ unsigned hole_low = 0, hole_high = 0;
+
+ /* The limit is the last byte to be touched */
+ limit--;
+ BUG_ON(limit >= FIXADDR_TOP);
+
++#ifdef CONFIG_X86_64
+ /*
+ * 64-bit has a great big hole in the middle of the address
+- * space, which contains the Xen mappings. On 32-bit these
+- * will end up making a zero-sized hole and so is a no-op.
++ * space, which contains the Xen mappings.
+ */
+- hole_low = pgd_index(USER_LIMIT);
+- hole_high = pgd_index(PAGE_OFFSET);
++ hole_low = pgd_index(GUARD_HOLE_BASE_ADDR);
++ hole_high = pgd_index(GUARD_HOLE_END_ADDR);
++#endif
+
+ nr = pgd_index(limit) + 1;
+ for (i = 0; i < nr; i++) {
+--
+2.19.1
+
--- /dev/null
+From 7bbad986ae242dd1560b67bd0ffebdad5448a8fe Mon Sep 17 00:00:00 2001
+From: Benjamin Poirier <bpoirier@suse.com>
+Date: Mon, 5 Nov 2018 17:00:53 +0900
+Subject: xfrm: Fix bucket count reported to userspace
+
+[ Upstream commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 ]
+
+sadhcnt is reported by `ip -s xfrm state count` as "buckets count", not the
+hash mask.
+
+Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.")
+Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 6c4ec69e11a0..0cd2bdf3b217 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -789,7 +789,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
+ {
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ si->sadcnt = net->xfrm.state_num;
+- si->sadhcnt = net->xfrm.state_hmask;
++ si->sadhcnt = net->xfrm.state_hmask + 1;
+ si->sadhmcnt = xfrm_state_hashmax;
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+ }
+--
+2.19.1
+
--- /dev/null
+From 243d5b400b0d5a81641272a0c5a6f50af330029b Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 27 Oct 2018 06:12:06 +0000
+Subject: xfrm: Fix error return code in xfrm_output_one()
+
+[ Upstream commit 533555e5cbb6aa2d77598917871ae5b579fe724b ]
+
+xfrm_output_one() does not return a error code when there is
+no dst_entry attached to the skb, it is still possible crash
+with a NULL pointer dereference in xfrm_output_resume(). Fix
+it by return error code -EHOSTUNREACH.
+
+Fixes: 9e1437937807 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_output.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index c47660fba498..b226b230e8bf 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -103,6 +103,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
+ skb_dst_force(skb);
+ if (!skb_dst(skb)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
++ err = -EHOSTUNREACH;
+ goto error_nolock;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 0e0ad41a64aecf360c44eb2bb7ce29653b37f992 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Thu, 22 Nov 2018 07:26:24 +0100
+Subject: xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force
+ clears the dst_entry.
+
+[ Upstream commit 0152eee6fc3b84298bb6a79961961734e8afa5b8 ]
+
+Since commit 222d7dbd258d ("net: prevent dst uses after free")
+skb_dst_force() might clear the dst_entry attached to the skb.
+The xfrm code doesn't expect this to happen, so we crash with
+a NULL pointer dereference in this case.
+
+Fix it by checking skb_dst(skb) for NULL after skb_dst_force()
+and drop the packet in case the dst_entry was cleared. We also
+move the skb_dst_force() to a codepath that is not used when
+the transformation was offloaded, because in this case we
+don't have a dst_entry attached to the skb.
+
+The output and forwarding path was already fixed by
+commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when
+skb_dst_force clears the dst_entry.")
+
+Fixes: 222d7dbd258d ("net: prevent dst uses after free")
+Reported-by: Jean-Philippe Menil <jpmenil@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 8e75319dd9c0..06dec32503bd 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -341,6 +341,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+
+ skb->sp->xvec[skb->sp->len++] = x;
+
++ skb_dst_force(skb);
++ if (!skb_dst(skb)) {
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
++ goto drop;
++ }
++
+ lock:
+ spin_lock(&x->lock);
+
+@@ -380,7 +386,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ XFRM_SKB_CB(skb)->seq.input.low = seq;
+ XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
+
+- skb_dst_force(skb);
+ dev_hold(skb->dev);
+
+ if (crypto_done)
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
