--- /dev/null
+From 10cb6542154e3a8acbe5952dbd3bf9f4ab949e76 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Wed, 5 Dec 2018 09:05:30 -0200
+Subject: ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
+
+[ Upstream commit f15096f12a4e9340168df5fdd9201aa8ed60d59e ]
+
+According to bindings/regulator/fixed-regulator.txt the 'clocks' and
+'clock-names' properties are not valid ones.
+
+In order to turn on the Wifi clock the correct location for describing
+the CLKO2 clock is via a mmc-pwrseq handle, so do it accordingly.
+
+Fixes: 56354959cfec ("ARM: dts: imx: add Boundary Devices Nitrogen7 board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Troy Kisky <troy.kisky@boundarydevices.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index d8aac4a2d02a..177d21fdeb28 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -86,13 +86,17 @@
+ compatible = "regulator-fixed";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+- clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
+- clock-names = "slow";
+ regulator-name = "reg_wlan";
+ startup-delay-us = <70000>;
+ gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ };
++
++ usdhc2_pwrseq: usdhc2_pwrseq {
++ compatible = "mmc-pwrseq-simple";
++ clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
++ clock-names = "ext_clock";
++ };
+ };
+
+ &adc1 {
+@@ -375,6 +379,7 @@
+ bus-width = <4>;
+ non-removable;
+ vmmc-supply = <®_wlan>;
++ mmc-pwrseq = <&usdhc2_pwrseq>;
+ cap-power-off-card;
+ keep-power-in-suspend;
+ status = "okay";
+--
+2.19.1
+
--- /dev/null
+From 68a0f103238fd2e0591c3d6ddba10508986d2b6b Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Fri, 30 Nov 2018 08:31:29 -0200
+Subject: ARM: dts: imx7d-pico: Describe the Wifi clock
+
+[ Upstream commit c3b9ab5db11d8098ca7674175f12ab21cdce1bbb ]
+
+The Wifi chip should be clocked by a 32kHz clock coming from i.MX7D
+CLKO2 output pin, so describe the pinmux and clock hierarchy in the
+device tree to allow the Wifi chip to be properly clocked.
+
+Managed to successfully test Wifi with such change. Used the standard
+nvram.txt file provided by TechNexion, which selects an external 32kHz
+clock for the Wifi chip by default.
+
+Fixes: 99a52450c707 ("ARM: dts: imx7d-pico: Add Wifi support")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Tested-by: Otavio Salvador <otavio@ossystems.com.br>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-pico.dtsi | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
+index 21973eb55671..f27b3849d3ff 100644
+--- a/arch/arm/boot/dts/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/imx7d-pico.dtsi
+@@ -100,6 +100,19 @@
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
++
++ usdhc2_pwrseq: usdhc2_pwrseq {
++ compatible = "mmc-pwrseq-simple";
++ clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
++ clock-names = "ext_clock";
++ };
++};
++
++&clks {
++ assigned-clocks = <&clks IMX7D_CLKO2_ROOT_SRC>,
++ <&clks IMX7D_CLKO2_ROOT_DIV>;
++ assigned-clock-parents = <&clks IMX7D_CKIL>;
++ assigned-clock-rates = <0>, <32768>;
+ };
+
+ &i2c4 {
+@@ -199,12 +212,13 @@
+
+ &usdhc2 { /* Wifi SDIO */
+ pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usdhc2>;
++ pinctrl-0 = <&pinctrl_usdhc2 &pinctrl_wifi_clk>;
+ no-1-8-v;
+ non-removable;
+ keep-power-in-suspend;
+ wakeup-source;
+ vmmc-supply = <®_ap6212>;
++ mmc-pwrseq = <&usdhc2_pwrseq>;
+ status = "okay";
+ };
+
+@@ -301,6 +315,12 @@
+ };
+
+ &iomuxc_lpsr {
++ pinctrl_wifi_clk: wificlkgrp {
++ fsl,pins = <
++ MX7D_PAD_LPSR_GPIO1_IO03__CCM_CLKO2 0x7d
++ >;
++ };
++
+ pinctrl_wdog: wdoggrp {
+ fsl,pins = <
+ MX7D_PAD_LPSR_GPIO1_IO00__WDOG1_WDOG_B 0x74
+--
+2.19.1
+
--- /dev/null
+From 10edf12e93f00f24f16f3d092be36ff284d8b15d Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 9 Jul 2018 19:51:54 +0000
+Subject: ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V
+
+[ Upstream commit 5f8208f557065163f9a8089ea2ea7888f9d96922 ]
+
+Since commit d7c5f6863550 ("ARM: dts: sun8i: a83t: bananapi-m3: Add
+AXP813 regulator nodes") my BPIM3 no longer works at gigabit speed.
+
+With the default setting, dldo3 is regulated at 2.9v which seems
+sufficient for the PHY but the aforementioned commit drops it to 2.5V
+which is insufficient. Note that this behaviour is random for all BPIM3.
+Some work with 2.5V, but some don't.
+
+Finnaly, someone from Bananapi confirmed that this regulator must be set
+to 3.3V.
+
+Fixes: d7c5f6863550 ("ARM: dts: sun8i: a83t: bananapi-m3: Add AXP813
+ regulator nodes")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+[wens@csie.org: Reworked commit message]
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+index c7ce4158d6c8..f250b20af493 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+@@ -309,8 +309,8 @@
+
+ ®_dldo3 {
+ regulator-always-on;
+- regulator-min-microvolt = <2500000>;
+- regulator-max-microvolt = <2500000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-name = "vcc-pd";
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 4b16e970e0d18c2e877f504c2b008ab39024581d Mon Sep 17 00:00:00 2001
+From: Anson Huang <anson.huang@nxp.com>
+Date: Tue, 4 Dec 2018 03:17:45 +0000
+Subject: ARM: imx: update the cpu power up timing setting on i.mx6sx
+
+[ Upstream commit 1e434b703248580b7aaaf8a115d93e682f57d29f ]
+
+The sw2iso count should cover ARM LDO ramp-up time,
+the MAX ARM LDO ramp-up time may be up to more than
+100us on some boards, this patch sets sw2iso to 0xf
+(~384us) which is the reset value, and it is much
+more safe to cover different boards, since we have
+observed that some customer boards failed with current
+setting of 0x2.
+
+Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
+index 243a108a940b..fd0053e47a15 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -110,7 +110,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(2, 1);
++ imx_gpc_set_arm_power_up_timing(0xf, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
+--
+2.19.1
+
--- /dev/null
+From 772f091b34e11709795aae0d184bb0ba9d742f8e Mon Sep 17 00:00:00 2001
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Mon, 12 Nov 2018 09:28:06 +0800
+Subject: arm64: dts: mt7622: fix no more console output on rfb1
+
+[ Upstream commit 6c05946e349d92f527d98644fbc9c41f06312c00 ]
+
+No default serial console on boot.
+Fix this by using a 'stdout-path' property that points to the device.
+
+Fixes: c0d9f9ad4f76 ("arm64: dts: mt7622: add earlycon to mt7622-rfb1 board")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+[mb: Fix commit message]
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+index a747b7bf132d..387be39d40cd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -17,8 +17,13 @@
+ model = "MediaTek MT7622 RFB1 board";
+ compatible = "mediatek,mt7622-rfb1", "mediatek,mt7622";
+
++ aliases {
++ serial0 = &uart0;
++ };
++
+ chosen {
+- bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
++ stdout-path = "serial0:115200n8";
++ bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
+ };
+
+ cpus {
+--
+2.19.1
+
--- /dev/null
+From 950615dd14998f46e4a11d0641c8b3743ba4c4d7 Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Wed, 5 Dec 2018 13:52:47 +0000
+Subject: auxdisplay: charlcd: fix x/y command parsing
+
+[ Upstream commit 9bc30ab82108e6a34dc63bf956b49edf71b1681a ]
+
+The x/y command parsing has been broken since commit 129957069e6a
+("staging: panel: Fixed checkpatch warning about simple_strtoul()").
+
+Commit b34050fadb86 ("auxdisplay: charlcd: Fix and clean up handling of
+x/y commands") fixed some problems by rewriting the parsing code,
+but also broke things further by removing the check for a complete
+command before attempting to parse it. As a result, parsing is
+terminated at the first x or y character.
+
+This reinstates the check for a final semicolon. Whereas the original
+code use strchr(), this is wasteful seeing as the semicolon is always
+at the end of the buffer. Thus check this character directly instead.
+
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/charlcd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
+index 81c22d20d9d9..60e0b772673f 100644
+--- a/drivers/auxdisplay/charlcd.c
++++ b/drivers/auxdisplay/charlcd.c
+@@ -538,6 +538,9 @@ static inline int handle_lcd_special_code(struct charlcd *lcd)
+ }
+ case 'x': /* gotoxy : LxXXX[yYYY]; */
+ case 'y': /* gotoxy : LyYYY[xXXX]; */
++ if (priv->esc_seq.buf[priv->esc_seq.len - 1] != ';')
++ break;
++
+ /* If the command is valid, move to the new address */
+ if (parse_xy(esc, &priv->addr.x, &priv->addr.y))
+ charlcd_gotoxy(lcd);
+--
+2.19.1
+
--- /dev/null
+From 00e5b9f18a0ab77fe18e57c29a51a9eb3454acdd Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:00 -0800
+Subject: bnx2x: Clear fip MAC when fcoe offload support is disabled
+
+[ Upstream commit bbf666c1af916ed74795493c564df6fad462cc80 ]
+
+On some customer setups it was observed that shmem contains a non-zero fip
+MAC for 57711 which would lead to enabling of SW FCoE.
+Add a software workaround to clear the bad fip mac address if no FCoE
+connections are supported.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index fcc2328bb0d9..b05c1d0f829b 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -11740,8 +11740,10 @@ static void bnx2x_get_fcoe_info(struct bnx2x *bp)
+ * If maximum allowed number of connections is zero -
+ * disable the feature.
+ */
+- if (!bp->cnic_eth_dev.max_fcoe_conn)
++ if (!bp->cnic_eth_dev.max_fcoe_conn) {
+ bp->flags |= NO_FCOE_FLAG;
++ eth_zero_addr(bp->fip_mac);
++ }
+ }
+
+ static void bnx2x_get_cnic_info(struct bnx2x *bp)
+--
+2.19.1
+
--- /dev/null
+From 6d6f8604c99305ffd30f2df08105daf6542b8793 Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:01 -0800
+Subject: bnx2x: Remove configured vlans as part of unload sequence.
+
+[ Upstream commit 04f05230c5c13b1384f66f5186a68d7499e34622 ]
+
+Vlans are not getting removed when drivers are unloaded. The recent storm
+firmware versions had added safeguards against re-configuring an already
+configured vlan. As a result, PF inner reload flows (e.g., mtu change)
+might trigger an assertion.
+This change is going to remove vlans (same as we do for MACs) when doing
+a chip cleanup during unload.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 34 +++++++++++++++----
+ .../net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 ++-
+ 2 files changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index b05c1d0f829b..20e5cda6555e 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -8462,6 +8462,7 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ /* Fill a user request section if needed */
+ if (!test_bit(RAMROD_CONT, ramrod_flags)) {
+ ramrod_param.user_req.u.vlan.vlan = vlan;
++ __set_bit(BNX2X_VLAN, &ramrod_param.user_req.vlan_mac_flags);
+ /* Set the command: ADD or DEL */
+ if (set)
+ ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+@@ -8482,6 +8483,27 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ return rc;
+ }
+
++static int bnx2x_del_all_vlans(struct bnx2x *bp)
++{
++ struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
++ unsigned long ramrod_flags = 0, vlan_flags = 0;
++ struct bnx2x_vlan_entry *vlan;
++ int rc;
++
++ __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
++ __set_bit(BNX2X_VLAN, &vlan_flags);
++ rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_flags, &ramrod_flags);
++ if (rc)
++ return rc;
++
++ /* Mark that hw forgot all entries */
++ list_for_each_entry(vlan, &bp->vlan_reg, link)
++ vlan->hw = false;
++ bp->vlan_cnt = 0;
++
++ return 0;
++}
++
+ int bnx2x_del_all_macs(struct bnx2x *bp,
+ struct bnx2x_vlan_mac_obj *mac_obj,
+ int mac_type, bool wait_for_comp)
+@@ -9320,6 +9342,11 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode, bool keep_link)
+ BNX2X_ERR("Failed to schedule DEL commands for UC MACs list: %d\n",
+ rc);
+
++ /* Remove all currently configured VLANs */
++ rc = bnx2x_del_all_vlans(bp);
++ if (rc < 0)
++ BNX2X_ERR("Failed to delete all VLANs\n");
++
+ /* Disable LLH */
+ if (!CHIP_IS_E1(bp))
+ REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
+@@ -13016,13 +13043,6 @@ static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)
+
+ int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+ {
+- struct bnx2x_vlan_entry *vlan;
+-
+- /* The hw forgot all entries after reload */
+- list_for_each_entry(vlan, &bp->vlan_reg, link)
+- vlan->hw = false;
+- bp->vlan_cnt = 0;
+-
+ /* Don't set rx mode here. Our caller will do it. */
+ bnx2x_vlan_configure(bp, false);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+index 0bf2fd470819..7a6e82db4231 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+@@ -265,6 +265,7 @@ enum {
+ BNX2X_ETH_MAC,
+ BNX2X_ISCSI_ETH_MAC,
+ BNX2X_NETQ_ETH_MAC,
++ BNX2X_VLAN,
+ BNX2X_DONT_CONSUME_CAM_CREDIT,
+ BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
+ };
+@@ -272,7 +273,8 @@ enum {
+ #define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+ 1 << BNX2X_ETH_MAC | \
+ 1 << BNX2X_ISCSI_ETH_MAC | \
+- 1 << BNX2X_NETQ_ETH_MAC)
++ 1 << BNX2X_NETQ_ETH_MAC | \
++ 1 << BNX2X_VLAN)
+ #define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+ ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
+
+--
+2.19.1
+
--- /dev/null
+From 58e5d93f7f0a909edb2e2f8736e95d5630bd2f46 Mon Sep 17 00:00:00 2001
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Wed, 12 Dec 2018 08:57:03 -0800
+Subject: bnx2x: Send update-svid ramrod with retry/poll flags enabled
+
+[ Upstream commit 9061193c4ee065d3240fde06767c2e06ec61decc ]
+
+Driver sends update-SVID ramrod in the MFW notification path.
+If there is a pending ramrod, driver doesn't retry the command
+and storm firmware will never be updated with the SVID value.
+The patch adds changes to send update-svid ramrod in process context with
+retry/poll flags set.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index 0de487a8f0eb..3db54b664aed 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1282,6 +1282,7 @@ enum sp_rtnl_flag {
+ BNX2X_SP_RTNL_TX_STOP,
+ BNX2X_SP_RTNL_GET_DRV_VERSION,
+ BNX2X_SP_RTNL_CHANGE_UDP_PORT,
++ BNX2X_SP_RTNL_UPDATE_SVID,
+ };
+
+ enum bnx2x_iov_flag {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 20e5cda6555e..7742bf5f8a18 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -2925,6 +2925,10 @@ static void bnx2x_handle_update_svid_cmd(struct bnx2x *bp)
+ func_params.f_obj = &bp->func_obj;
+ func_params.cmd = BNX2X_F_CMD_SWITCH_UPDATE;
+
++ /* Prepare parameters for function state transitions */
++ __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
++ __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
++
+ if (IS_MF_UFP(bp) || IS_MF_BD(bp)) {
+ int func = BP_ABS_FUNC(bp);
+ u32 val;
+@@ -4301,7 +4305,8 @@ static void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
+ bnx2x_handle_eee_event(bp);
+
+ if (val & DRV_STATUS_OEM_UPDATE_SVID)
+- bnx2x_handle_update_svid_cmd(bp);
++ bnx2x_schedule_sp_rtnl(bp,
++ BNX2X_SP_RTNL_UPDATE_SVID, 0);
+
+ if (bp->link_vars.periodic_flags &
+ PERIODIC_FLAGS_LINK_EVENT) {
+@@ -10376,6 +10381,9 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
+ &bp->sp_rtnl_state))
+ bnx2x_update_mng_version(bp);
+
++ if (test_and_clear_bit(BNX2X_SP_RTNL_UPDATE_SVID, &bp->sp_rtnl_state))
++ bnx2x_handle_update_svid_cmd(bp);
++
+ if (test_and_clear_bit(BNX2X_SP_RTNL_CHANGE_UDP_PORT,
+ &bp->sp_rtnl_state)) {
+ if (bnx2x_udp_port_update(bp)) {
+--
+2.19.1
+
--- /dev/null
+From b42ece66438f5919b9f9c0974c3d3d1bfe8cbb02 Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Fri, 14 Dec 2018 14:17:20 -0800
+Subject: checkstack.pl: fix for aarch64
+
+[ Upstream commit f1733a1d3cd32a9492f4cf866be37bb46e10163d ]
+
+There is actually a space after "sp," like this,
+
+ ffff2000080813c8: a9bb7bfd stp x29, x30, [sp, #-80]!
+
+Right now, checkstack.pl isn't able to print anything on aarch64,
+because it won't be able to match the stating objdump line of a function
+due to this missing space. Hence, it displays every stack as zero-size.
+
+After this patch, checkpatch.pl is able to match the start of a
+function's objdump, and is then able to calculate each function's stack
+correctly.
+
+Link: http://lkml.kernel.org/r/20181207195843.38528-1-cai@lca.pw
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkstack.pl | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index 8081b6cf67d2..34414c6efad6 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -47,8 +47,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+ if ($arch eq 'aarch64') {
+- #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]!
+- $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o;
++ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
++ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
+ #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64
+ $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
+--
+2.19.1
+
--- /dev/null
+From 249cccae986972803abc2a2e0540f0897ef9fcd4 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Mon, 10 Dec 2018 21:20:30 -0700
+Subject: drivers: net: xgene: Remove unnecessary forward declarations
+
+[ Upstream commit 2ab4c3426c0cf711d7147e3f559638e4ab88960e ]
+
+Clang warns:
+
+drivers/net/ethernet/apm/xgene/xgene_enet_main.c:33:36: warning:
+tentative array definition assumed to have one element
+static const struct acpi_device_id xgene_enet_acpi_match[];
+ ^
+1 warning generated.
+
+Both xgene_enet_acpi_match and xgene_enet_of_match are defined before
+their uses at the bottom of the file so this is unnecessary. When
+CONFIG_ACPI is disabled, ACPI_PTR becomes NULL so xgene_enet_acpi_match
+doesn't need to be defined.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 3b889efddf78..50dd6bf176d0 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -29,9 +29,6 @@
+ #define RES_RING_CSR 1
+ #define RES_RING_CMD 2
+
+-static const struct of_device_id xgene_enet_of_match[];
+-static const struct acpi_device_id xgene_enet_acpi_match[];
+-
+ static void xgene_enet_init_bufpool(struct xgene_enet_desc_ring *buf_pool)
+ {
+ struct xgene_enet_raw_desc16 *raw_desc;
+--
+2.19.1
+
--- /dev/null
+From 8c3d85593187341c41b130a44094a4fa0087b9cd Mon Sep 17 00:00:00 2001
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Date: Thu, 6 Dec 2018 15:51:37 -0500
+Subject: drm/amdgpu: Fix DEBUG_LOCKS_WARN_ON(depth <= 0) in amdgpu_ctx.lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c554206077428af56cc2e0314b86b41cd030458c ]
+
+If CS is submitted using guilty ctx, we terminate amdgpu_cs_parser_init
+before locking ctx->lock, latter in amdgpu_cs_parser_fini we still are
+trying to release the lock just becase parser->ctx != NULL.
+
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index b31d121a876b..81001d879322 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -122,14 +122,14 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs
+ goto free_chunk;
+ }
+
++ mutex_lock(&p->ctx->lock);
++
+ /* skip guilty context job */
+ if (atomic_read(&p->ctx->guilty) == 1) {
+ ret = -ECANCELED;
+ goto free_chunk;
+ }
+
+- mutex_lock(&p->ctx->lock);
+-
+ /* get chunks */
+ chunk_array_user = u64_to_user_ptr(cs->in.chunks);
+ if (copy_from_user(chunk_array, chunk_array_user,
+--
+2.19.1
+
--- /dev/null
+From b099897cf581058a3912ad51d64a00035e8d88bc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 17 Dec 2018 09:43:13 +0100
+Subject: gpio: mvebu: only fail on missing clk if pwm is actually to be used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c8da642d41a6811c21177c9994aa7dc35be67d46 ]
+
+The gpio IP on Armada 370 at offset 0x18180 has neither a clk nor pwm
+registers. So there is no need for a clk as the pwm isn't used anyhow.
+So only check for the clk in the presence of the pwm registers. This fixes
+a failure to probe the gpio driver for the above mentioned gpio device.
+
+Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mvebu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 6e02148c208b..adc768f908f1 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -773,9 +773,6 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ "marvell,armada-370-gpio"))
+ return 0;
+
+- if (IS_ERR(mvchip->clk))
+- return PTR_ERR(mvchip->clk);
+-
+ /*
+ * There are only two sets of PWM configuration registers for
+ * all the GPIO lines on those SoCs which this driver reserves
+@@ -786,6 +783,9 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ if (!res)
+ return 0;
+
++ if (IS_ERR(mvchip->clk))
++ return PTR_ERR(mvchip->clk);
++
+ /*
+ * Use set A for lines of GPIO chip with id 0, B for GPIO chip
+ * with id 1. Don't allow further GPIO chips to be used for PWM.
+--
+2.19.1
+
--- /dev/null
+From 4970e4d198c7f9e2da927fe993bc1502cc625be3 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 26 Nov 2018 11:52:18 +0100
+Subject: HID: ite: Add USB id match for another ITE based keyboard rfkill key
+ quirk
+
+[ Upstream commit 4050207485e47e00353e87f2fe2166083e282688 ]
+
+The 258a:6a88 keyboard-dock shipped with the Prowise PT301 tablet is
+likely another ITE based design. The controller die is directly bonded
+to the PCB with a blob of black glue on top so there are no markings and
+the 258a vendor-id used is unknown anywhere. But the keyboard has the
+exact same hotkeys mapped to Fn+F1 - F10 as the other ITE8595 keyboard
+I have *and* it has the same quirky behavior wrt the rfkill hotkey.
+
+Either way as said this keyboard has the same quirk for its rfkill /
+airplane mode hotkey as the ITE 8595 chip, it only sends a single release
+event when pressed and released, it never sends a press event.
+
+This commit adds the 258a:6a88 USB id to the hid-ite id-table, fixing
+the rfkill key not working on this keyboard.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-ite.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 46182d4dd1ce..b7870e7e41d4 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -17,6 +17,9 @@
+ #ifndef HID_IDS_H_FILE
+ #define HID_IDS_H_FILE
+
++#define USB_VENDOR_ID_258A 0x258a
++#define USB_DEVICE_ID_258A_6A88 0x6a88
++
+ #define USB_VENDOR_ID_3M 0x0596
+ #define USB_DEVICE_ID_3M1968 0x0500
+ #define USB_DEVICE_ID_3M2256 0x0502
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 1882a4ab0f29..98b059d79bc8 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -42,6 +42,7 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+
+ static const struct hid_device_id ite_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ite_devices);
+--
+2.19.1
+
--- /dev/null
+From acea112c4dd9e222565c2d4da94f1d98b187eaa6 Mon Sep 17 00:00:00 2001
+From: Stefan Assmann <sassmann@kpanic.de>
+Date: Tue, 4 Dec 2018 15:18:52 +0100
+Subject: i40e: fix mac filter delete when setting mac address
+
+[ Upstream commit 158daed16efb1170694e420ae06ba8ba954d82e5 ]
+
+A previous commit moved the ether_addr_copy() in i40e_set_mac() before
+the mac filter del/add to avoid a race. However it wasn't taken into
+account that this alters the mac address being handed to
+i40e_del_mac_filter().
+
+Also changed i40e_add_mac_filter() to operate on netdev->dev_addr,
+hopefully that makes the code easier to read.
+
+Fixes: 458867b2ca0c ("i40e: don't remove netdev->dev_addr when syncing uc list")
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Acked-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 3c342700bf5f..ed9d3fc4aaba 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1539,17 +1539,17 @@ static int i40e_set_mac(struct net_device *netdev, void *p)
+ netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
+
+ /* Copy the address first, so that we avoid a possible race with
+- * .set_rx_mode(). If we copy after changing the address in the filter
+- * list, we might open ourselves to a narrow race window where
+- * .set_rx_mode could delete our dev_addr filter and prevent traffic
+- * from passing.
++ * .set_rx_mode().
++ * - Remove old address from MAC filter
++ * - Copy new address
++ * - Add new address to MAC filter
+ */
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
+-
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+ i40e_del_mac_filter(vsi, netdev->dev_addr);
+- i40e_add_mac_filter(vsi, addr->sa_data);
++ ether_addr_copy(netdev->dev_addr, addr->sa_data);
++ i40e_add_mac_filter(vsi, netdev->dev_addr);
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
++
+ if (vsi->type == I40E_VSI_MAIN) {
+ i40e_status ret;
+
+--
+2.19.1
+
--- /dev/null
+From f71158aba39ad1cb4f79ae7ea3b75808785c6c12 Mon Sep 17 00:00:00 2001
+From: Mark Zhang <markz@mellanox.com>
+Date: Wed, 5 Dec 2018 15:50:49 +0200
+Subject: IB/core: Fix oops in netdev_next_upper_dev_rcu()
+
+[ Upstream commit 37fbd834b4e492dc41743830cbe435f35120abd8 ]
+
+When support for bonding of RoCE devices was added, there was
+necessarily a link between the RoCE device and the paired netdevice that
+was part of the bond. If you remove the mlx4_en module, that paired
+association is broken (the RoCE device is still present but the paired
+netdevice has been released). We need to account for this in
+is_upper_ndev_bond_master_filter() and filter out those links with a
+broken pairing or else we later oops in netdev_next_upper_dev_rcu().
+
+Fixes: 408f1242d940 ("IB/core: Delete lower netdevice default GID entries in bonding scenario")
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/roce_gid_mgmt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
+index 25d43c8f1c2a..558de0b9895c 100644
+--- a/drivers/infiniband/core/roce_gid_mgmt.c
++++ b/drivers/infiniband/core/roce_gid_mgmt.c
+@@ -267,6 +267,9 @@ is_upper_ndev_bond_master_filter(struct ib_device *ib_dev, u8 port,
+ struct net_device *cookie_ndev = cookie;
+ bool match = false;
+
++ if (!rdma_ndev)
++ return false;
++
+ rcu_read_lock();
+ if (netif_is_bond_master(cookie_ndev) &&
+ rdma_is_upper_dev_rcu(rdma_ndev, cookie_ndev))
+--
+2.19.1
+
--- /dev/null
+From f9f02ca1d2a752486f8d8ee34b2af4649c4a1842 Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Wed, 5 Dec 2018 15:50:21 +0200
+Subject: IB/mlx5: Block DEVX umem from the non applicable cases
+
+[ Upstream commit 47f07f03b5ee436fe074c4fb1fb28d013c36a0d8 ]
+
+Blocks creating a DEVX UMEM with the non applicable access flags
+as of ODP, MW_BIND, etc.
+
+Specifically when an ODP flag is used below WARN call trace is issued.
+
+[ 2510.404131] RIP: 0010:__mlx5_ib_populate_pas+0x207/0x220 [mlx5_ib]
+...
+[ 2510.404143] Call Trace:
+[ 2510.404150] ? __kmalloc_node+0x1b3/0x280
+[ 2510.404156] ? _uverbs_alloc+0x63/0x90 [ib_uverbs]
+[ 2510.404158] ? _uverbs_alloc+0x63/0x90 [ib_uverbs]
+[ 2510.404162] mlx5_ib_populate_pas+0x53/0x60 [mlx5_ib]
+[ 2510.404167] mlx5_ib_handler_MLX5_IB_METHOD_DEVX_UMEM_REG+0x273/0x3f0 [mlx5_ib]
+
+Fixes: aeae94579caf ("IB/mlx5: Add DEVX support for memory registration")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index f2f11e652dcd..02f36ab72ad4 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -857,7 +857,9 @@ static int devx_umem_get(struct mlx5_ib_dev *dev, struct ib_ucontext *ucontext,
+
+ err = uverbs_get_flags32(&access, attrs,
+ MLX5_IB_ATTR_DEVX_UMEM_REG_ACCESS,
+- IB_ACCESS_SUPPORTED);
++ IB_ACCESS_LOCAL_WRITE |
++ IB_ACCESS_REMOTE_WRITE |
++ IB_ACCESS_REMOTE_READ);
+ if (err)
+ return err;
+
+--
+2.19.1
+
--- /dev/null
+From 494e4f75f5b508364af9737d05bc37c5a7c1ae3c Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Mon, 10 Dec 2018 15:22:22 -0600
+Subject: ibmvnic: Convert reset work item mutex to spin lock
+
+[ Upstream commit 6c5c7489089608d89b7ce310bca44812e2b0a4a5 ]
+
+ibmvnic_reset can create and schedule a reset work item from
+an IRQ context, so do not use a mutex, which can sleep. Convert
+the reset work item mutex to a spin lock. Locking debugger generated
+the trace output below.
+
+BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
+in_atomic(): 1, irqs_disabled(): 1, pid: 120, name: kworker/8:1
+4 locks held by kworker/8:1/120:
+ #0: 0000000017c05720 ((wq_completion)"events"){+.+.}, at: process_one_work+0x188/0x710
+ #1: 00000000ace90706 ((linkwatch_work).work){+.+.}, at: process_one_work+0x188/0x710
+ #2: 000000007632871f (rtnl_mutex){+.+.}, at: rtnl_lock+0x30/0x50
+ #3: 00000000fc36813a (&(&crq->lock)->rlock){..-.}, at: ibmvnic_tasklet+0x88/0x2010 [ibmvnic]
+irq event stamp: 26293
+hardirqs last enabled at (26292): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0
+hardirqs last disabled at (26293): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0
+softirqs last enabled at (26288): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160
+softirqs last disabled at (26289): [<c0000000000306e0>] call_do_softirq+0x14/0x24
+CPU: 8 PID: 120 Comm: kworker/8:1 Kdump: loaded Not tainted 4.20.0-rc6 #6
+Workqueue: events linkwatch_event
+Call Trace:
+[c0000003fffa7a50] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable)
+[c0000003fffa7aa0] [c00000000015ba0c] ___might_sleep+0x2dc/0x320
+[c0000003fffa7b20] [c000000000be960c] __mutex_lock+0x8c/0xb40
+[c0000003fffa7c30] [d000000006202ac8] ibmvnic_reset+0x78/0x330 [ibmvnic]
+[c0000003fffa7cc0] [d0000000062097f4] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic]
+[c0000003fffa7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0
+[c0000003fffa7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c
+[c0000003fffa7f90] [c0000000000306e0] call_do_softirq+0x14/0x24
+[c0000003f3f87980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0
+[c0000003f3f879c0] [c0000000001218a8] do_softirq+0xa8/0x100
+[c0000003f3f879f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180
+[c0000003f3f87a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80
+[c0000003f3f87a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160
+[c0000003f3f87ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520
+[c0000003f3f87b70] [c000000000a8cd40] dev_deactivate+0x40/0x60
+[c0000003f3f87ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0
+[c0000003f3f87bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0
+[c0000003f3f87c30] [c000000000a5e728] linkwatch_event+0x48/0x60
+[c0000003f3f87c50] [c0000000001444e8] process_one_work+0x238/0x710
+[c0000003f3f87d20] [c000000000144a48] worker_thread+0x88/0x4e0
+[c0000003f3f87db0] [c00000000014e3a8] kthread+0x178/0x1c0
+[c0000003f3f87e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 16 +++++++++-------
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 +-
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5ab21a1b5444..5058bd83bdd6 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1939,8 +1939,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ {
+ struct ibmvnic_rwi *rwi;
++ unsigned long flags;
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ if (!list_empty(&adapter->rwi_list)) {
+ rwi = list_first_entry(&adapter->rwi_list, struct ibmvnic_rwi,
+@@ -1950,7 +1951,7 @@ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ rwi = NULL;
+ }
+
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ return rwi;
+ }
+
+@@ -2025,6 +2026,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ struct list_head *entry, *tmp_entry;
+ struct ibmvnic_rwi *rwi, *tmp;
+ struct net_device *netdev = adapter->netdev;
++ unsigned long flags;
+ int ret;
+
+ if (adapter->state == VNIC_REMOVING ||
+@@ -2041,13 +2043,13 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ goto err;
+ }
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ list_for_each(entry, &adapter->rwi_list) {
+ tmp = list_entry(entry, struct ibmvnic_rwi, list);
+ if (tmp->reset_reason == reason) {
+ netdev_dbg(netdev, "Skipping matching reset\n");
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ret = EBUSY;
+ goto err;
+ }
+@@ -2055,7 +2057,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+
+ rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
+ if (!rwi) {
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ibmvnic_close(netdev);
+ ret = ENOMEM;
+ goto err;
+@@ -2069,7 +2071,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ rwi->reset_reason = reason;
+ list_add_tail(&rwi->list, &adapter->rwi_list);
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ adapter->resetting = true;
+ netdev_dbg(adapter->netdev, "Scheduling reset (reason %d)\n", reason);
+ schedule_work(&adapter->ibmvnic_reset);
+@@ -4700,7 +4702,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+- mutex_init(&adapter->rwi_lock);
++ spin_lock_init(&adapter->rwi_lock);
+ adapter->resetting = false;
+
+ adapter->mac_change_pending = false;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 735f481b1870..09465397b7ff 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1068,7 +1068,7 @@ struct ibmvnic_adapter {
+ struct tasklet_struct tasklet;
+ enum vnic_state state;
+ enum ibmvnic_reset_reason reset_reason;
+- struct mutex rwi_lock;
++ spinlock_t rwi_lock;
+ struct list_head rwi_list;
+ struct work_struct ibmvnic_reset;
+ bool resetting;
+--
+2.19.1
+
--- /dev/null
+From fa92a9a1960a188b3aea8f8c63ea505ddd9ef1a8 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Mon, 10 Dec 2018 15:22:23 -0600
+Subject: ibmvnic: Fix non-atomic memory allocation in IRQ context
+
+[ Upstream commit 1d1bbc37f89b0559c9e913682f2489d89cfde6b8 ]
+
+ibmvnic_reset allocated new reset work item objects in a non-atomic
+context. This can be called from a tasklet, generating the output below.
+Allocate work items with the GFP_ATOMIC flag instead.
+
+BUG: sleeping function called from invalid context at mm/slab.h:421
+in_atomic(): 1, irqs_disabled(): 1, pid: 93, name: kworker/0:2
+INFO: lockdep is turned off.
+irq event stamp: 66049
+hardirqs last enabled at (66048): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0
+hardirqs last disabled at (66049): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0
+softirqs last enabled at (66044): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160
+softirqs last disabled at (66045): [<c0000000000306e0>] call_do_softirq+0x14/0x24
+CPU: 0 PID: 93 Comm: kworker/0:2 Kdump: loaded Not tainted 4.20.0-rc6-00001-g1b50a8f03706 #7
+Workqueue: events linkwatch_event
+Call Trace:
+[c0000003fffe7ae0] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable)
+[c0000003fffe7b30] [c00000000015ba0c] ___might_sleep+0x2dc/0x320
+[c0000003fffe7bb0] [c000000000391514] kmem_cache_alloc_trace+0x3e4/0x440
+[c0000003fffe7c30] [d000000005b2309c] ibmvnic_reset+0x16c/0x360 [ibmvnic]
+[c0000003fffe7cc0] [d000000005b29834] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic]
+[c0000003fffe7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0
+[c0000003fffe7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c
+[c0000003fffe7f90] [c0000000000306e0] call_do_softirq+0x14/0x24
+[c0000003f3967980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0
+[c0000003f39679c0] [c0000000001218a8] do_softirq+0xa8/0x100
+[c0000003f39679f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180
+[c0000003f3967a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80
+[c0000003f3967a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160
+[c0000003f3967ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520
+[c0000003f3967b70] [c000000000a8cd40] dev_deactivate+0x40/0x60
+[c0000003f3967ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0
+[c0000003f3967bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0
+[c0000003f3967c30] [c000000000a5e728] linkwatch_event+0x48/0x60
+[c0000003f3967c50] [c0000000001444e8] process_one_work+0x238/0x710
+[c0000003f3967d20] [c000000000144a48] worker_thread+0x88/0x4e0
+[c0000003f3967db0] [c00000000014e3a8] kthread+0x178/0x1c0
+[c0000003f3967e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5058bd83bdd6..c8704b1690eb 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2055,7 +2055,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ }
+
+- rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
++ rwi = kzalloc(sizeof(*rwi), GFP_ATOMIC);
+ if (!rwi) {
+ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ibmvnic_close(netdev);
+--
+2.19.1
+
--- /dev/null
+From 7e1a942d39b99db47bbc960675b32be4343aa112 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 11 Dec 2018 11:13:39 +0800
+Subject: ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
+
+[ Upstream commit 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322 ]
+
+gcc warning this:
+
+drivers/net/ieee802154/ca8210.c:730:10: warning:
+ comparison is always false due to limited range of data type [-Wtype-limits]
+
+'len' is u8 type, we get it from buf[1] adding 2, which can overflow.
+This patch change the type of 'len' to unsigned int to avoid this,also fix
+the gcc warning.
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/ca8210.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 0ff5a403a8dc..b2ff903a9cb6 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -721,7 +721,7 @@ static void ca8210_mlme_reset_worker(struct work_struct *work)
+ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ {
+ u8 *buf;
+- u8 len;
++ unsigned int len;
+ struct work_priv_container *mlme_reset_wpc;
+ struct ca8210_priv *priv = cas_ctl->priv;
+
+@@ -730,7 +730,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ if (len > CA8210_SPI_BUF_SIZE) {
+ dev_crit(
+ &priv->spi->dev,
+- "Received packet len (%d) erroneously long\n",
++ "Received packet len (%u) erroneously long\n",
+ len
+ );
+ goto finish;
+--
+2.19.1
+
--- /dev/null
+From 78e0f085c67f7b1e7ae01c35424daaa7b9dcb88e Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aring@mojatatu.com>
+Date: Thu, 29 Nov 2018 17:41:54 -0500
+Subject: ieee802154: hwsim: fix off-by-one in parse nested
+
+[ Upstream commit a73d4e1490913b76b292f91553b7ba08a65caa3f ]
+
+This patch fixes a off-by-one mistake in nla_parse_nested() functions of
+mac802154_hwsim driver. I had to enabled stack protector so I was able
+to reproduce it.
+
+Reference: https://github.com/linux-wpan/wpan-tools/issues/17
+
+Signed-off-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/mac802154_hwsim.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index bf70ab892e69..624bff4d3636 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -500,7 +500,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info)
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+- if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1,
++ if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX,
+ info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE],
+ hwsim_edge_policy, NULL))
+ return -EINVAL;
+@@ -550,7 +550,7 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+- if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1,
++ if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX,
+ info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE],
+ hwsim_edge_policy, NULL))
+ return -EINVAL;
+--
+2.19.1
+
--- /dev/null
+From e988759b6e71ce4b9aca6f14d3dfb7cc63977633 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 4 Dec 2018 13:52:49 -0800
+Subject: Input: omap-keypad - fix idle configuration to not block SoC idle
+ states
+
+[ Upstream commit e2ca26ec4f01486661b55b03597c13e2b9c18b73 ]
+
+With PM enabled, I noticed that pressing a key on the droid4 keyboard will
+block deeper idle states for the SoC. Let's fix this by using IRQF_ONESHOT
+and stop constantly toggling the device OMAP4_KBD_IRQENABLE register as
+suggested by Dmitry Torokhov <dmitry.torokhov@gmail.com>.
+
+From the hardware point of view, looks like we need to manage the registers
+for OMAP4_KBD_IRQENABLE and OMAP4_KBD_WAKEUPENABLE together to avoid
+blocking deeper SoC idle states. And with toggling of OMAP4_KBD_IRQENABLE
+register now gone with IRQF_ONESHOT, also the SoC idle state problem is
+gone during runtime. We still also need to clear OMAP4_KBD_WAKEUPENABLE in
+omap4_keypad_close() though to pair it with omap4_keypad_open() to prevent
+blocking deeper SoC idle states after rmmod omap4-keypad.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/omap4-keypad.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index a7dc286f406c..840e53732753 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id)
+ {
+ struct omap4_keypad *keypad_data = dev_id;
+
+- if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) {
+- /* Disable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_VAL_IRQDISABLE);
++ if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS))
+ return IRQ_WAKE_THREAD;
+- }
+
+ return IRQ_NONE;
+ }
+@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id)
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+
+- /* enable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_DEF_IRQENABLE_EVENTEN |
+- OMAP4_DEF_IRQENABLE_LONGKEY);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input)
+
+ disable_irq(keypad_data->irq);
+
+- /* Disable interrupts */
++ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
++ kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0);
+
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+@@ -365,7 +357,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ }
+
+ error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler,
+- omap4_keypad_irq_thread_fn, 0,
++ omap4_keypad_irq_thread_fn, IRQF_ONESHOT,
+ "omap4-keypad", keypad_data);
+ if (error) {
+ dev_err(&pdev->dev, "failed to register interrupt\n");
+--
+2.19.1
+
--- /dev/null
+From 72334afd63688a8193bc071d28b2f233bea98910 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 6 Dec 2018 09:03:36 +1000
+Subject: Input: restore EV_ABS ABS_RESERVED
+
+[ Upstream commit c201e3808e0e4be9b98d192802085a9f491bd80c ]
+
+ABS_RESERVED was added in d9ca1c990a7 and accidentally removed as part of
+ffe0e7cf290f5c9 when the high-resolution scrolling code was removed.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/input-event-codes.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 53fbae27b280..61a5799b440b 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -744,6 +744,15 @@
+
+ #define ABS_MISC 0x28
+
++/*
++ * 0x2e is reserved and should not be used in input drivers.
++ * It was used by HID as ABS_MISC+6 and userspace needs to detect if
++ * the next ABS_* event is correct or is just ABS_MISC + n.
++ * We define here ABS_RESERVED so userspace can rely on it and detect
++ * the situation described above.
++ */
++#define ABS_RESERVED 0x2e
++
+ #define ABS_MT_SLOT 0x2f /* MT slot being modified */
+ #define ABS_MT_TOUCH_MAJOR 0x30 /* Major axis of touching ellipse */
+ #define ABS_MT_TOUCH_MINOR 0x31 /* Minor axis (omit if circular) */
+--
+2.19.1
+
--- /dev/null
+From 0937ecfe893f9732697da0a5db17337487a1447e Mon Sep 17 00:00:00 2001
+From: Yussuf Khalil <dev@pp3345.net>
+Date: Sat, 8 Dec 2018 20:13:35 -0800
+Subject: Input: synaptics - enable RMI on ThinkPad T560
+
+[ Upstream commit ca5047286c9c93a01e1f471d00a6019536992954 ]
+
+Before commit 7fd6d98b89f3 ("i2c: i801: Allow ACPI AML access I/O
+ports not reserved for SMBus"), enabling RMI on the T560 would cause
+the touchpad to stop working after resuming from suspend. Now that
+this issue is fixed, RMI can be enabled safely and works fine.
+
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Yussuf Khalil <dev@pp3345.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 2bd5bb11c8ba..7bdf8fc2c3b5 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -171,6 +171,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
++ "LEN005e", /* T560 */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+--
+2.19.1
+
--- /dev/null
+From e91e1f4e448e21e2c2a4dfa9c2d68d0733436d97 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
+Date: Fri, 21 Dec 2018 01:04:26 -0800
+Subject: Input: synaptics - enable SMBus for HP EliteBook 840 G4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 7a71712293ba303aad928f580b89addb0be2892e ]
+
+dmesg reports that "Your touchpad (PNP: SYN3052 SYN0100 SYN0002 PNP0f13)
+says it can support a different bus."
+
+I've tested the offered psmouse.synaptics_intertouch=1 with 4.18.x and
+4.19.x and it seems to work well. No problems seen with suspend/resume.
+
+Also, it appears that RMI/SMBus mode is actually required for 3-4 finger
+multitouch gestures to work -- otherwise they are not reported at all.
+
+Information from dmesg in both modes:
+
+ psmouse serio3: synaptics: Touchpad model: 1, fw: 8.2, id: 0x1e2b1,
+ caps: 0xf00123/0x840300/0x2e800/0x0, board id: 3139, fw id: 2000742
+
+ psmouse serio3: synaptics: Trying to set up SMBus access
+ rmi4_smbus 6-002c: registering SMbus-connected sensor
+ rmi4_f01 rmi4-00.fn01: found RMI device,
+ manufacturer: Synaptics, product: TM3139-001, fw id: 2000742
+
+Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 7bdf8fc2c3b5..b6da0c1267e3 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+--
+2.19.1
+
--- /dev/null
+From 688c7f8b486f2776539c9d9afa3773f5543ec8de Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Wed, 5 Dec 2018 13:54:26 +0000
+Subject: ixgbe: Fix race when the VF driver does a reset
+
+[ Upstream commit 96d1a731611f711f0cb82cea93363ae2ea8cb028 ]
+
+When the VF driver does a reset, it (at least the Linux one) writes to
+the VFCTRL register to issue a reset and then immediately sends a reset
+message using the mailbox API. This is racy because when the PF driver
+detects that the VFCTRL register reset pin has been asserted, it clears
+the mailbox memory. Depending on ordering, the reset message sent by
+the VF could be cleared by the PF driver. It then responds to the
+cleared message with a NACK which causes the VF driver to malfunction.
+Fix this by deferring clearing the mailbox memory until the reset
+message is received.
+
+Fixes: 939b701ad633 ("ixgbe: fix driver behaviour after issuing VFLR")
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index eea63a99f29c..f6ffd9fb2079 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -699,7 +699,6 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ u8 num_tcs = adapter->hw_tcs;
+ u32 reg_val;
+ u32 queue;
+- u32 word;
+
+ /* remove VLAN filters beloning to this VF */
+ ixgbe_clear_vf_vlans(adapter, vf);
+@@ -754,6 +753,14 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ }
+ }
+
++ IXGBE_WRITE_FLUSH(hw);
++}
++
++static void ixgbe_vf_clear_mbx(struct ixgbe_adapter *adapter, u32 vf)
++{
++ struct ixgbe_hw *hw = &adapter->hw;
++ u32 word;
++
+ /* Clear VF's mailbox memory */
+ for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
+ IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
+@@ -827,6 +834,8 @@ static int ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf)
+ /* reset the filters for the device */
+ ixgbe_vf_reset_event(adapter, vf);
+
++ ixgbe_vf_clear_mbx(adapter, vf);
++
+ /* set vf mac address */
+ if (!is_zero_ether_addr(vf_mac))
+ ixgbe_set_vf_mac(adapter, vf, vf_mac);
+--
+2.19.1
+
--- /dev/null
+From dffcdb51f6620016457ac974b1e55a6c216d5c59 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 18 Dec 2018 14:25:41 +0900
+Subject: kbuild: fix false positive warning/error about missing libelf
+
+[ Upstream commit ef7cfd00b2caf6edeb7f169682b64be2d0a798cf ]
+
+For the same reason as commit 25896d073d8a ("x86/build: Fix compiler
+support check for CONFIG_RETPOLINE"), you cannot put this $(error ...)
+into the parse stage of the top Makefile.
+
+Perhaps I'd propose a more sophisticated solution later, but this is
+the best I can do for now.
+
+Link: https://lkml.org/lkml/2017/12/25/211
+Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Reported-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Reported-by: Qian Cai <cai@lca.pw>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Tested-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 3324dd0e11a3..8e6408acf50b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -954,11 +954,6 @@ ifdef CONFIG_STACK_VALIDATION
+ ifeq ($(has_libelf),1)
+ objtool_target := tools/objtool FORCE
+ else
+- ifdef CONFIG_UNWINDER_ORC
+- $(error "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- else
+- $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- endif
+ SKIP_STACK_VALIDATION := 1
+ export SKIP_STACK_VALIDATION
+ endif
+@@ -1115,6 +1110,14 @@ uapi-asm-generic:
+
+ PHONY += prepare-objtool
+ prepare-objtool: $(objtool_target)
++ifeq ($(SKIP_STACK_VALIDATION),1)
++ifdef CONFIG_UNWINDER_ORC
++ @echo "error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++ @false
++else
++ @echo "warning: Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++endif
++endif
+
+ # Generate some files
+ # ---------------------------------------------------------------------------
+--
+2.19.1
+
--- /dev/null
+From b848f41f7c89df448dd7701316e2af9c4f2bb114 Mon Sep 17 00:00:00 2001
+From: Bryan Whitehead <Bryan.Whitehead@microchip.com>
+Date: Mon, 17 Dec 2018 16:44:50 -0500
+Subject: lan743x: Expand phy search for LAN7431
+
+[ Upstream commit 0db7d253e9f0ff1a41c602429bea93df221be6ed ]
+
+The LAN7431 uses an external phy, and it can be found anywhere in
+the phy address space. This patch uses phy address 1 for LAN7430
+only. And searches all addresses otherwise.
+
+Signed-off-by: Bryan Whitehead <Bryan.Whitehead@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index aaedf1072460..ff196a66eaaa 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -2722,8 +2722,9 @@ static int lan743x_mdiobus_init(struct lan743x_adapter *adapter)
+ snprintf(adapter->mdiobus->id, MII_BUS_ID_SIZE,
+ "pci-%s", pci_name(adapter->pdev));
+
+- /* set to internal PHY id */
+- adapter->mdiobus->phy_mask = ~(u32)BIT(1);
++ if ((adapter->csr.id_rev & ID_REV_ID_MASK_) == ID_REV_ID_LAN7430_)
++ /* LAN7430 uses internal phy at address 1 */
++ adapter->mdiobus->phy_mask = ~(u32)BIT(1);
+
+ /* register mdiobus */
+ ret = mdiobus_register(adapter->mdiobus);
+--
+2.19.1
+
--- /dev/null
+From 9bf4959799d18e94fff4391ed8ab0b95189b5c3e Mon Sep 17 00:00:00 2001
+From: Bryan Whitehead <Bryan.Whitehead@microchip.com>
+Date: Wed, 19 Dec 2018 16:55:15 -0500
+Subject: lan743x: Remove MAC Reset from initialization
+
+[ Upstream commit e0e587878f538c9e3400219b6c516b8199dc2042 ]
+
+The MAC Reset was noticed to erase important EEPROM settings.
+It is also unnecessary since a chip wide reset was done earlier
+in initialization, and that reset preserves EEPROM settings.
+
+There for this patch removes the unnecessary MAC specific reset.
+
+Signed-off-by: Bryan Whitehead <Bryan.Whitehead@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index ff196a66eaaa..1393252c6e3c 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -802,14 +802,8 @@ static int lan743x_mac_init(struct lan743x_adapter *adapter)
+ u32 mac_addr_hi = 0;
+ u32 mac_addr_lo = 0;
+ u32 data;
+- int ret;
+
+ netdev = adapter->netdev;
+- lan743x_csr_write(adapter, MAC_CR, MAC_CR_RST_);
+- ret = lan743x_csr_wait_for_bit(adapter, MAC_CR, MAC_CR_RST_,
+- 0, 1000, 20000, 100);
+- if (ret)
+- return ret;
+
+ /* setup auto duplex, and speed detection */
+ data = lan743x_csr_read(adapter, MAC_CR);
+--
+2.19.1
+
--- /dev/null
+From 0801ed4cb9bcb9c569425920cf85fdc5f3442368 Mon Sep 17 00:00:00 2001
+From: Jason Martinsen <jasonmartinsen@msn.com>
+Date: Tue, 18 Dec 2018 05:38:22 +0000
+Subject: lan78xx: Resolve issue with changing MAC address
+
+[ Upstream commit 15515aaaa69659c502003926a2067ee76176148a ]
+
+Current state for the lan78xx driver does not allow for changing the
+MAC address of the interface, without either removing the module (if
+you compiled it that way) or rebooting the machine. If you attempt to
+change the MAC address, ifconfig will show the new address, however,
+the system/interface will not respond to any traffic using that
+configuration. A few short-term options to work around this are to
+unload the module and reload it with the new MAC address, change the
+interface to "promisc", or reboot with the correct configuration to
+change the MAC.
+
+This patch enables the ability to change the MAC address via fairly normal means...
+ifdown <interface>
+modify entry in /etc/network/interfaces OR a similar method
+ifup <interface>
+Then test via any network communication, such as ICMP requests to gateway.
+
+My only test platform for this patch has been a raspberry pi model 3b+.
+
+Signed-off-by: Jason Martinsen <jasonmartinsen@msn.com>
+
+-----
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index c3c9ba44e2a1..8d140495da79 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2335,6 +2335,10 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
+
++ /* Added to support MAC address changes */
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 99deacdda4bd38998eac152adfa6f10b07fa48bf Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Mon, 3 Dec 2018 12:53:51 +0100
+Subject: m68k: Fix memblock-related crashes
+
+[ Upstream commit bed1369f51901b17108a4bb4f7210aab183bea42 ]
+
+When running the kernel in Fast RAM on Atari:
+
+ Ignoring memory chunk at 0x0:0xe00000 before the first chunk
+ ...
+ Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
+ Oops: 00000000
+ Modules linked in:
+ PC: [<0069dbac>] free_all_bootmem+0x12c/0x186
+ SR: 2714 SP: (ptrval) a2: 005e3314
+ d0: 00000000 d1: 0000000a d2: 00000e00 d3: 00000000
+ d4: 005e1fc0 d5: 0000001a a0: 01000000 a1: 00000000
+ Process swapper (pid: 0, task=(ptrval))
+ Frame format=7 eff addr=00000736 ssw=0505 faddr=00000736
+ wb 1 stat/addr/data: 0000 00000000 00000000
+ wb 2 stat/addr/data: 0000 00000000 00000000
+ wb 3 stat/addr/data: 0000 00000736 00000000
+ push data: 00000000 00000000 00000000 00000000
+ Stack from 005e1f84:
+ 00000000 0000000a 027d3260 006b5006 00000000 00000000 00000000 00000000
+ 0004f062 0003a220 0069e272 005e1ff8 0000054c 00000000 00e00000 00000000
+ 00000001 00693cd8 027d3260 0004f062 0003a220 00691be6 00000000 00000000
+ 00000000 00000000 00000000 00000000 006b5006 00000000 00690872
+ Call Trace: [<0004f062>] printk+0x0/0x18
+ [<0003a220>] parse_args+0x0/0x2d4
+ [<0069e272>] memblock_virt_alloc_try_nid+0x0/0xa4
+ [<00693cd8>] mem_init+0xa/0x5c
+ [<0004f062>] printk+0x0/0x18
+ [<0003a220>] parse_args+0x0/0x2d4
+ [<00691be6>] start_kernel+0x1ca/0x462
+ [<00690872>] _sinittext+0x872/0x11f8
+ Code: 7a1a eaae 2270 6db0 0061 ef14 2f01 2f03 <96a9> 0736 2203 e589 d681 e78b d6a9 0732 2f03 2f40 0034 4eb9 0069 b8d0 260e 4fef
+ Disabling lock debugging due to kernel taint
+ Kernel panic - not syncing: Attempted to kill the idle task!
+
+As the kernel must run in the memory chunk with the lowest address,
+ST-RAM is ignored, and removed from the m68k_memory[] array.
+However, it is not removed from memblock, causing a crash later.
+
+More investigation shows that there are 3 places where memory chunks are
+ignored, all after the calls to memblock_add() in m68k_parse_bootinfo(),
+and thus causing crashes:
+ 1. On classic m68k CPUs with a MMU, paging_init() ignores all memory
+ chunks below the first chunk, cfr. above,
+ 2. On Amigas equipped with a Zorro III bus, config_amiga() ignores all
+ Zorro II memory,
+ 3. If CONFIG_SINGLE_MEMORY_CHUNK=y, m68k_parse_bootinfo() ignores all
+ but the first memory chunk.
+
+Fix this by moving the calls to memblock_add() from
+m68k_parse_bootinfo() to paging_init(), after all ignored memory chunks
+have been removed from m68k_memory[].
+
+Reported-by: Andreas Schwab <schwab@linux-m68k.org>
+Fixes: 1008a11590b966b4 ("m68k: switch to MEMBLOCK + NO_BOOTMEM")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/setup_mm.c | 2 --
+ arch/m68k/mm/motorola.c | 2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
+index 5d3596c180f9..de44899c0e61 100644
+--- a/arch/m68k/kernel/setup_mm.c
++++ b/arch/m68k/kernel/setup_mm.c
+@@ -165,8 +165,6 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
+ be32_to_cpu(m->addr);
+ m68k_memory[m68k_num_memory].size =
+ be32_to_cpu(m->size);
+- memblock_add(m68k_memory[m68k_num_memory].addr,
+- m68k_memory[m68k_num_memory].size);
+ m68k_num_memory++;
+ } else
+ pr_warn("%s: too many memory chunks\n",
+diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
+index 4e17ecb5928a..2eb2b31fb16a 100644
+--- a/arch/m68k/mm/motorola.c
++++ b/arch/m68k/mm/motorola.c
+@@ -228,6 +228,7 @@ void __init paging_init(void)
+
+ min_addr = m68k_memory[0].addr;
+ max_addr = min_addr + m68k_memory[0].size;
++ memblock_add(m68k_memory[0].addr, m68k_memory[0].size);
+ for (i = 1; i < m68k_num_memory;) {
+ if (m68k_memory[i].addr < min_addr) {
+ printk("Ignoring memory chunk at 0x%lx:0x%lx before the first chunk\n",
+@@ -238,6 +239,7 @@ void __init paging_init(void)
+ (m68k_num_memory - i) * sizeof(struct m68k_mem_info));
+ continue;
+ }
++ memblock_add(m68k_memory[i].addr, m68k_memory[i].size);
+ addr = m68k_memory[i].addr + m68k_memory[i].size;
+ if (addr > max_addr)
+ max_addr = addr;
+--
+2.19.1
+
--- /dev/null
+From a249d5ad30174002b532b1580d596d6eeb5d117f Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Sat, 15 Dec 2018 11:03:10 +0200
+Subject: mac80211: fix a kernel panic when TXing after TXQ teardown
+
+[ Upstream commit a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 ]
+
+Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(),
+to avoid a use-after-free of the netdev data. However, interfaces
+aren't fully removed at the point, and cfg80211_shutdown_all_interfaces
+can for example, TX a deauth frame. Move the TXQ teardown to the
+point between cfg80211_shutdown_all_interfaces and the free of
+netdev queues, so we can be sure they are torn down before netdev
+is freed, but after there is no ongoing TX.
+
+Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/iface.c | 3 +++
+ net/mac80211/main.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 5f3c81e705c7..3a0171a65db3 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -7,6 +7,7 @@
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -1951,6 +1952,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
+ WARN(local->open_count, "%s: open count remains %d\n",
+ wiphy_name(local->hw.wiphy), local->open_count);
+
++ ieee80211_txq_teardown_flows(local);
++
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+ list_del(&sdata->list);
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 513627896204..68db2a356443 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1198,7 +1198,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ rtnl_unlock();
+ ieee80211_led_exit(local);
+ ieee80211_wep_free(local);
+- ieee80211_txq_teardown_flows(local);
+ fail_flows:
+ destroy_workqueue(local->workqueue);
+ fail_workqueue:
+@@ -1224,7 +1223,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ #if IS_ENABLED(CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+- ieee80211_txq_teardown_flows(local);
+
+ rtnl_lock();
+
+--
+2.19.1
+
--- /dev/null
+From dc9bcdc50bfea3c03ffde75b7b147f7fc5dc8b39 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Sat, 15 Dec 2018 11:03:06 +0200
+Subject: mac80211: free skb fraglist before freeing the skb
+
+[ Upstream commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a ]
+
+mac80211 uses the frag list to build AMSDU. When freeing
+the skb, it may not be really freed, since someone is still
+holding a reference to it.
+In that case, when TCP skb is being retransmitted, the
+pointer to the frag list is being reused, while the data
+in there is no longer valid.
+Since we will never get frag list from the network stack,
+as mac80211 doesn't advertise the capability, we can safely
+free and nullify it before releasing the SKB.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/status.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 7fa10d06cc51..534a604b75c2 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -556,6 +556,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
+ }
+
+ ieee80211_led_tx(local);
++
++ if (skb_has_frag_list(skb)) {
++ kfree_skb_list(skb_shinfo(skb)->frag_list);
++ skb_shinfo(skb)->frag_list = NULL;
++ }
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From 7335a0c9b1a093a516e0c2a1deae89a4963f85b0 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 16 Nov 2018 17:19:21 +0100
+Subject: mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues
+
+[ Upstream commit 7c250f4612ae97aa04500c0d0cff69bb87046e3a ]
+
+Starting from mac80211 commit adf8ed01e4fd ("mac80211: add an optional
+TXQ for other PS-buffered frames") and commit 0eeb2b674f05 ("mac80211:
+add an option for station management TXQ") a new per-sta queue has been
+introduced for bufferable management frames.
+sta->txq[IEEE80211_NUM_TIDS] is initialized just if the driver reports
+the following hw flags:
+- IEEE80211_HW_STA_MMPDU_TXQ
+- IEEE80211_HW_BUFF_MMPDU_TXQ
+This can produce a NULL pointer dereference in mt76_stop_tx_queues
+since mt76 iterates on all available sta tx queues assuming they are
+initialized by mac80211. This issue has been spotted analyzing the code
+(it has not triggered any crash yet)
+
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/tx.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index af48d43bb7dc..20447fdce4c3 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -385,7 +385,12 @@ void mt76_stop_tx_queues(struct mt76_dev *dev, struct ieee80211_sta *sta,
+
+ for (i = 0; i < ARRAY_SIZE(sta->txq); i++) {
+ struct ieee80211_txq *txq = sta->txq[i];
+- struct mt76_txq *mtxq = (struct mt76_txq *) txq->drv_priv;
++ struct mt76_txq *mtxq;
++
++ if (!txq)
++ continue;
++
++ mtxq = (struct mt76_txq *)txq->drv_priv;
+
+ spin_lock_bh(&mtxq->hwq->lock);
+ mtxq->send_bar = mtxq->aggr && send_bar;
+--
+2.19.1
+
--- /dev/null
+From 39080cd59969d50b1540ee48c261469ceeeeffa5 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:28 +0800
+Subject: net: hns: Add mac pcs config when enable|disable mac
+
+[ Upstream commit 726ae5c9e5f0c18eca8ea5296b526242c3e89822 ]
+
+In some case, when mac enable|disable and adjust link, may cause hard to
+link(or abnormal) between mac and phy. This patch adds the code for rx PCS
+to avoid this bug.
+
+Disable the rx PCS when driver disable the gmac, and enable the rx PCS
+when driver enable the mac.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 ++++++++++----
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 1 +
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+index 09e4061d1fa6..aa2c25d7a61d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+@@ -67,11 +67,14 @@ static void hns_gmac_enable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*enable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 1);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* enable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 0);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 1);
++ }
+ }
+
+ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+@@ -79,11 +82,14 @@ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*disable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 0);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* disable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 1);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 0);
++ }
+ }
+
+ /* hns_gmac_get_en - get port enable
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index f171d11b9b44..b9733b0b8482 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -534,6 +534,7 @@
+ #define GMAC_LD_LINK_COUNTER_REG 0x01D0UL
+ #define GMAC_LOOP_REG 0x01DCUL
+ #define GMAC_RECV_CONTROL_REG 0x01E0UL
++#define GMAC_PCS_RX_EN_REG 0x01E4UL
+ #define GMAC_VLAN_CODE_REG 0x01E8UL
+ #define GMAC_RX_OVERRUN_CNT_REG 0x01ECUL
+ #define GMAC_RX_LENGTHFIELD_ERR_CNT_REG 0x01F4UL
+--
+2.19.1
+
--- /dev/null
+From 1ba00bbcb06aa66ef2c43175dc9db37343f81cde Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:21 +0800
+Subject: net: hns: All ports can not work when insmod hns ko after rmmod.
+
+[ Upstream commit 308c6cafde0147616da45e3a928adae55c428deb ]
+
+There are two test cases:
+1. Remove the 4 modules:hns_enet_drv/hns_dsaf/hnae/hns_mdio,
+ and install them again, must use "ifconfig down/ifconfig up"
+ command pair to bring port to work.
+
+ This patch calls phy_stop function when init phy to fix this bug.
+
+2. Remove the 2 modules:hns_enet_drv/hns_dsaf, and install them again,
+ all ports can not use anymore, because of the phy devices register
+ failed(phy devices already exists).
+
+ Phy devices are registered when hns_dsaf installed, this patch
+ removes them when hns_dsaf removed.
+
+The two cases are sometimes related, fixing the second case also requires
+fixing the first case, so fix them together.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +++++++++++++++
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+index 6ed6f142427e..cfdc92de9dc0 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+@@ -778,6 +778,17 @@ static int hns_mac_register_phy(struct hns_mac_cb *mac_cb)
+ return rc;
+ }
+
++static void hns_mac_remove_phydev(struct hns_mac_cb *mac_cb)
++{
++ if (!to_acpi_device_node(mac_cb->fw_port) || !mac_cb->phy_dev)
++ return;
++
++ phy_device_remove(mac_cb->phy_dev);
++ phy_device_free(mac_cb->phy_dev);
++
++ mac_cb->phy_dev = NULL;
++}
++
+ #define MAC_MEDIA_TYPE_MAX_LEN 16
+
+ static const struct {
+@@ -1117,7 +1128,11 @@ void hns_mac_uninit(struct dsaf_device *dsaf_dev)
+ int max_port_num = hns_mac_get_max_port_num(dsaf_dev);
+
+ for (i = 0; i < max_port_num; i++) {
++ if (!dsaf_dev->mac_cb[i])
++ continue;
++
+ dsaf_dev->misc_op->cpld_reset_led(dsaf_dev->mac_cb[i]);
++ hns_mac_remove_phydev(dsaf_dev->mac_cb[i]);
+ dsaf_dev->mac_cb[i] = NULL;
+ }
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 28e907831b0e..c205a0e4b64b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1186,6 +1186,9 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
+ if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
+ phy_dev->autoneg = false;
+
++ if (h->phy_if == PHY_INTERFACE_MODE_SGMII)
++ phy_stop(phy_dev);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From b7378d7867c98b1c8ff9798f3412901c4054b019 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:26 +0800
+Subject: net: hns: Avoid net reset caused by pause frames storm
+
+[ Upstream commit a57275d35576fdd89d8c771eedf1e7cf97e0dfa6 ]
+
+There will be a large number of MAC pause frames on the net,
+which caused tx timeout of net device. And then the net device
+was reset to try to recover it. So that is not useful, and will
+cause some other problems.
+
+So need doubled ndev->watchdog_timeo if device watchdog occurred
+until watchdog_timeo up to 40s and then try resetting to recover
+it.
+
+When collecting dfx information such as hardware registers when tx timeout.
+Some registers for count were cleared when read. So need move this task
+before update net state which also read the count registers.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 03d959c7a39f..8a53c82c72b4 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1509,11 +1509,19 @@ static int hns_nic_net_stop(struct net_device *ndev)
+ }
+
+ static void hns_tx_timeout_reset(struct hns_nic_priv *priv);
++#define HNS_TX_TIMEO_LIMIT (40 * HZ)
+ static void hns_nic_net_timeout(struct net_device *ndev)
+ {
+ struct hns_nic_priv *priv = netdev_priv(ndev);
+
+- hns_tx_timeout_reset(priv);
++ if (ndev->watchdog_timeo < HNS_TX_TIMEO_LIMIT) {
++ ndev->watchdog_timeo *= 2;
++ netdev_info(ndev, "watchdog_timo changed to %d.\n",
++ ndev->watchdog_timeo);
++ } else {
++ ndev->watchdog_timeo = HNS_NIC_TX_TIMEOUT;
++ hns_tx_timeout_reset(priv);
++ }
+ }
+
+ static int hns_nic_do_ioctl(struct net_device *netdev, struct ifreq *ifr,
+@@ -2076,11 +2084,11 @@ static void hns_nic_service_task(struct work_struct *work)
+ = container_of(work, struct hns_nic_priv, service_task);
+ struct hnae_handle *h = priv->ae_handle;
+
++ hns_nic_reset_subtask(priv);
+ hns_nic_update_link_status(priv->netdev);
+ h->dev->ops->update_led_status(h);
+ hns_nic_update_stats(priv->netdev);
+
+- hns_nic_reset_subtask(priv);
+ hns_nic_service_event_complete(priv);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 24e49878d1e8cf445a744f69adb43c3082fc7adf Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:24 +0800
+Subject: net: hns: Clean rx fbd when ae stopped.
+
+[ Upstream commit 31f6b61d810654fb3ef43f4d8afda0f44b142fad ]
+
+If there are packets in hardware when changing the speed or duplex,
+it may cause hardware hang up.
+
+This patch adds the code to wait rx fbd clean up when ae stopped.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index b52029e26d15..ad1779fc410e 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -379,6 +379,9 @@ static void hns_ae_stop(struct hnae_handle *handle)
+
+ hns_ae_ring_enable_all(handle, 0);
+
++ /* clean rx fbd. */
++ hns_rcb_wait_fbd_clean(handle->qs, handle->q_num, RCB_INT_FLAG_RX);
++
+ (void)hns_mac_vm_config_bc_en(mac_cb, 0, false);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 1af98c45c506d65bd8759ed48b884030c43ff725 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:27 +0800
+Subject: net: hns: Fix ntuple-filters status error.
+
+[ Upstream commit 7e74a19ca522aec7c2be201a7ae1d1d57ded409b ]
+
+The ntuple-filters features is forced on by chip.
+But it shows "ntuple-filters: off [fixed]" when use ethtool.
+This patch make it correct with "ntuple-filters: on [fixed]".
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 8a53c82c72b4..6242249c9f4c 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -2374,7 +2374,7 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ ndev->min_mtu = MAC_MIN_MTU;
+ switch (priv->enet_ver) {
+ case AE_VERSION_2:
+- ndev->features |= NETIF_F_TSO | NETIF_F_TSO6;
++ ndev->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_NTUPLE;
+ ndev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+ NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_GSO |
+ NETIF_F_GRO | NETIF_F_TSO | NETIF_F_TSO6;
+--
+2.19.1
+
--- /dev/null
+From 992ed6a529c79cc77d6f5b8cb7bfdfed32279ecb Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:29 +0800
+Subject: net: hns: Fix ping failed when use net bridge and send multicast
+
+[ Upstream commit 6adafc356e20189193b38ee6b9af7743078bf6b4 ]
+
+Create a net bridge, add eth and vnet to the bridge. The vnet is used
+by a virtual machine. When ping the virtual machine from the outside
+host and the virtual machine send multicast at the same time, the ping
+package will lost.
+
+The multicast package send to the eth, eth will send it to the bridge too,
+and the bridge learn the mac of eth. When outside host ping the virtual
+mechine, it will match the promisc entry of the eth which is not expected,
+and the bridge send it to eth not to vnet, cause ping lost.
+
+So this patch change promisc tcam entry position to the END of 512 tcam
+entries, which indicate lower priority. And separate one promisc entry to
+two: mc & uc, to avoid package match the wrong tcam entry.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns/hns_dsaf_main.c | 257 +++++++++++++++---
+ 1 file changed, 216 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index 97d62decba19..3b9e74be5fbd 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -934,6 +934,62 @@ static void hns_dsaf_tcam_mc_cfg(
+ spin_unlock_bh(&dsaf_dev->tcam_lock);
+ }
+
++/**
++ * hns_dsaf_tcam_uc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ */
++static void hns_dsaf_tcam_uc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_ucast_cfg *tcam_uc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_ucast_cfg(dsaf_dev, tcam_uc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_ucast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
++/**
++ * hns_dsaf_tcam_mc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ * @ptbl_tcam_mask
++ * @ptbl_tcam_mcast
++ */
++static void hns_dsaf_tcam_mc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_mcast_cfg *tcam_mc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_mcast_cfg(dsaf_dev, tcam_mc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_mcast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
+ /**
+ * hns_dsaf_tcam_mc_invld - INT
+ * @dsaf_id: dsa fabric id
+@@ -1492,6 +1548,27 @@ static u16 hns_dsaf_find_empty_mac_entry(struct dsaf_device *dsaf_dev)
+ return DSAF_INVALID_ENTRY_IDX;
+ }
+
++/**
++ * hns_dsaf_find_empty_mac_entry_reverse
++ * search dsa fabric soft empty-entry from the end
++ * @dsaf_dev: dsa fabric device struct pointer
++ */
++static u16 hns_dsaf_find_empty_mac_entry_reverse(struct dsaf_device *dsaf_dev)
++{
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ int i;
++
++ soft_mac_entry = priv->soft_mac_tbl + (DSAF_TCAM_SUM - 1);
++ for (i = (DSAF_TCAM_SUM - 1); i > 0; i--) {
++ /* search all entry from end to start.*/
++ if (soft_mac_entry->index == DSAF_INVALID_ENTRY_IDX)
++ return i;
++ soft_mac_entry--;
++ }
++ return DSAF_INVALID_ENTRY_IDX;
++}
++
+ /**
+ * hns_dsaf_set_mac_key - set mac key
+ * @dsaf_dev: dsa fabric device struct pointer
+@@ -2673,58 +2750,156 @@ int hns_dsaf_get_regs_count(void)
+ return DSAF_DUMP_REGS_NUM;
+ }
+
+-/* Reserve the last TCAM entry for promisc support */
+-#define dsaf_promisc_tcam_entry(port) \
+- (DSAF_TCAM_SUM - DSAFV2_MAC_FUZZY_TCAM_NUM + (port))
+-void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
+- u32 port, bool enable)
++static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ {
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask_uc = {0x01000000, 0xf};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
+ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
+- struct dsaf_drv_soft_mac_tbl *soft_mac_entry = priv->soft_mac_tbl;
+- u16 entry_index;
+- struct dsaf_drv_tbl_tcam_key tbl_tcam_data, tbl_tcam_mask;
+- struct dsaf_tbl_tcam_mcast_cfg mac_data = {0};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, port};
++ struct dsaf_drv_mac_single_dest_entry mask_entry;
++ struct dsaf_drv_tbl_tcam_key temp_key, mask_key;
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ struct hns_mac_cb *mac_cb;
++ u8 addr[ETH_ALEN] = {0};
++ u8 port_num;
++ u16 mskid;
+
+- if ((AE_IS_VER1(dsaf_dev->dsaf_ver)) || HNS_DSAF_IS_DEBUG(dsaf_dev))
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++ if (entry_index != DSAF_INVALID_ENTRY_IDX)
+ return;
+
+- /* find the tcam entry index for promisc */
+- entry_index = dsaf_promisc_tcam_entry(port);
+-
+- memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
+- memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
+-
+- /* config key mask */
+- if (enable) {
+- dsaf_set_field(tbl_tcam_data.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, port);
+- dsaf_set_field(tbl_tcam_mask.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, 0xf);
+-
+- /* SUB_QID */
+- dsaf_set_bit(mac_data.tbl_mcast_port_msk[0],
+- DSAF_SERVICE_NW_NUM, true);
+- mac_data.tbl_mcast_item_vld = true; /* item_vld bit */
++ /* put promisc tcam entry in the end. */
++ /* 1. set promisc unicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable uc promisc failed (port:%#x)\n",
++ port);
++ return;
++ }
++
++ mac_cb = dsaf_dev->mac_cb[port];
++ (void)hns_mac_get_inner_port_num(mac_cb, 0, &port_num);
++ tbl_tcam_ucast.tbl_ucast_out_port = port_num;
++
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask_uc, &tbl_tcam_ucast);
++
++ /* update software entry */
++ soft_mac_entry = priv->soft_mac_tbl;
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = mac_key.high.val;
++ soft_mac_entry->tcam_key.low.val = mac_key.low.val;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. set promisc multicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable mc promisc failed (port:%#x)\n",
++ port);
++ return;
++ }
++
++ memset(&mask_entry, 0x0, sizeof(mask_entry));
++ memset(&mask_key, 0x0, sizeof(mask_key));
++ memset(&temp_key, 0x0, sizeof(temp_key));
++ mask_entry.addr[0] = 0x01;
++ hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
++ port, mask_entry.addr);
++ tbl_tcam_mcast.tbl_mcast_item_vld = 1;
++ tbl_tcam_mcast.tbl_mcast_old_en = 0;
++
++ if (port < DSAF_SERVICE_NW_NUM) {
++ mskid = port;
++ } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
++ mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+ } else {
+- mac_data.tbl_mcast_item_vld = false; /* item_vld bit */
++ dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
++ dsaf_dev->ae_dev.name, port,
++ mask_key.high.val, mask_key.low.val);
++ return;
+ }
+
+- dev_dbg(dsaf_dev->dev,
+- "set_promisc_entry, %s Mac key(%#x:%#x) entry_index%d\n",
+- dsaf_dev->ae_dev.name, tbl_tcam_data.high.val,
+- tbl_tcam_data.low.val, entry_index);
++ dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
++ mskid % 32, 1);
++ memcpy(&temp_key, &mask_key, sizeof(mask_key));
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ (struct dsaf_tbl_tcam_data *)(&mask_key),
++ &tbl_tcam_mcast);
+
+- /* config promisc entry with mask */
+- hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_data,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_mask,
+- &mac_data);
++ /* update software entry */
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = temp_key.high.val;
++ soft_mac_entry->tcam_key.low.val = temp_key.low.val;
++}
+
+- /* config software entry */
++static void set_promisc_tcam_disable(struct dsaf_device *dsaf_dev, u32 port)
++{
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 0, 0, 0, 0};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, 0};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask = {0, 0};
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ u8 addr[ETH_ALEN] = {0};
++
++ /* 1. delete uc vague tcam entry. */
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask, &tbl_tcam_ucast);
++ /* update soft management table. */
++ soft_mac_entry = priv->soft_mac_tbl;
+ soft_mac_entry += entry_index;
+- soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. delete mc vague tcam entry. */
++ addr[0] = 0x01;
++ memset(&mac_key, 0x0, sizeof(mac_key));
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config mc vague table */
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ &tbl_tcam_mask, &tbl_tcam_mcast);
++ /* update soft management table. */
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++}
++
++/* Reserve the last TCAM entry for promisc support */
++void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
++ u32 port, bool enable)
++{
++ if (enable)
++ set_promisc_tcam_enable(dsaf_dev, port);
++ else
++ set_promisc_tcam_disable(dsaf_dev, port);
+ }
+
+ int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
+--
+2.19.1
+
--- /dev/null
+From 55571d9de0afadfcd5d9aad7a030ea0906ddec09 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:23 +0800
+Subject: net: hns: Fixed bug that netdev was opened twice
+
+[ Upstream commit 5778b13b64eca5549d242686f2f91a2c80c8fa40 ]
+
+After resetting dsaf to try to repair chip error such as ecc error,
+the net device will be open if net interface is up. But at this time
+if there is the users set the net device up with the command ifconfig,
+the net device will be opened twice consecutively.
+
+Function napi_enable was called when open device. And Kernel panic will
+be occurred if it was called twice consecutively. Such as follow:
+static inline void napi_enable(struct napi_struct *n)
+{
+ BUG_ON(!test_bit(NAPI_STATE_SCHED, &n->state));
+ smp_mb__before_clear_bit();
+ clear_bit(NAPI_STATE_SCHED, &n->state);
+}
+
+[37255.571996] Kernel panic - not syncing: BUG!
+[37255.595234] Call trace:
+[37255.597694] [<ffff80000008ab48>] dump_backtrace+0x0/0x1a0
+[37255.603114] [<ffff80000008ad08>] show_stack+0x20/0x28
+[37255.608187] [<ffff8000009c4944>] dump_stack+0x98/0xb8
+[37255.613258] [<ffff8000009c149c>] panic+0x10c/0x26c
+[37255.618070] [<ffff80000070f134>] hns_nic_net_up+0x30c/0x4e0
+[37255.623664] [<ffff80000070f39c>] hns_nic_net_open+0x94/0x12c
+[37255.629346] [<ffff80000084be78>] __dev_open+0xf4/0x168
+[37255.634504] [<ffff80000084c1ac>] __dev_change_flags+0x98/0x15c
+[37255.640359] [<ffff80000084c29c>] dev_change_flags+0x2c/0x68
+[37255.769580] [<ffff8000008dc400>] devinet_ioctl+0x650/0x704
+[37255.775086] [<ffff8000008ddc38>] inet_ioctl+0x98/0xb4
+[37255.780159] [<ffff800000827b7c>] sock_do_ioctl+0x44/0x84
+[37255.785490] [<ffff800000828e04>] sock_ioctl+0x248/0x30c
+[37255.790737] [<ffff80000026dc6c>] do_vfs_ioctl+0x480/0x618
+[37255.796156] [<ffff80000026de94>] SyS_ioctl+0x90/0xa4
+[37255.801139] SMP: stopping secondary CPUs
+[37255.805079] kbox: catch panic event.
+[37255.809586] collected_len = 128928, LOG_BUF_LEN_LOCAL = 131072
+[37255.816103] flush cache 0xffff80003f000000 size 0x800000
+[37255.822192] flush cache 0xffff80003f000000 size 0x800000
+[37255.828289] flush cache 0xffff80003f000000 size 0x800000
+[37255.834378] kbox: no notify die func register. no need to notify
+[37255.840413] ---[ end Kernel panic - not syncing: BUG!
+
+This patchset fix this bug according to the flag NIC_STATE_DOWN.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index c205a0e4b64b..c9454c4784cb 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1333,6 +1333,9 @@ static int hns_nic_net_up(struct net_device *ndev)
+ int i, j;
+ int ret;
+
++ if (!test_bit(NIC_STATE_DOWN, &priv->state))
++ return 0;
++
+ ret = hns_nic_init_irq(priv);
+ if (ret != 0) {
+ netdev_err(ndev, "hns init irq failed! ret=%d\n", ret);
+--
+2.19.1
+
--- /dev/null
+From d53e3a1ccada83e48efa75a39b7e6ecb7b521914 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:25 +0800
+Subject: net: hns: Free irq when exit from abnormal branch
+
+[ Upstream commit c82bd077e1ba3dd586569c733dc6d3dd4b0e43cd ]
+
+1.In "hns_nic_init_irq", if request irq fail at index i,
+ the function return directly without releasing irq resources
+ that already requested.
+
+2.In "hns_nic_net_up" after "hns_nic_init_irq",
+ if exceptional branch occurs, irqs that already requested
+ are not release.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 23 ++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index c9454c4784cb..03d959c7a39f 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1284,6 +1284,22 @@ static int hns_nic_init_affinity_mask(int q_num, int ring_idx,
+ return cpu;
+ }
+
++static void hns_nic_free_irq(int q_num, struct hns_nic_priv *priv)
++{
++ int i;
++
++ for (i = 0; i < q_num * 2; i++) {
++ if (priv->ring_data[i].ring->irq_init_flag == RCB_IRQ_INITED) {
++ irq_set_affinity_hint(priv->ring_data[i].ring->irq,
++ NULL);
++ free_irq(priv->ring_data[i].ring->irq,
++ &priv->ring_data[i]);
++ priv->ring_data[i].ring->irq_init_flag =
++ RCB_IRQ_NOT_INITED;
++ }
++ }
++}
++
+ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ {
+ struct hnae_handle *h = priv->ae_handle;
+@@ -1309,7 +1325,7 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ if (ret) {
+ netdev_err(priv->netdev, "request irq(%d) fail\n",
+ rd->ring->irq);
+- return ret;
++ goto out_free_irq;
+ }
+ disable_irq(rd->ring->irq);
+
+@@ -1324,6 +1340,10 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ }
+
+ return 0;
++
++out_free_irq:
++ hns_nic_free_irq(h->q_num, priv);
++ return ret;
+ }
+
+ static int hns_nic_net_up(struct net_device *ndev)
+@@ -1371,6 +1391,7 @@ static int hns_nic_net_up(struct net_device *ndev)
+ for (j = i - 1; j >= 0; j--)
+ hns_nic_ring_close(ndev, j);
+
++ hns_nic_free_irq(h->q_num, priv);
+ set_bit(NIC_STATE_DOWN, &priv->state);
+
+ return ret;
+--
+2.19.1
+
--- /dev/null
+From ad0f27ee02e121e6cb10fe4d2d85270e2dd905a6 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:20 +0800
+Subject: net: hns: Incorrect offset address used for some registers.
+
+[ Upstream commit 4e1d4be681b2c26fd874adbf584bf034573ac45d ]
+
+According to the hip06 Datasheet:
+1. The offset of INGRESS_SW_VLAN_TAG_DISC should be 0x1A00+4*all_chn_num
+2. The offset of INGRESS_IN_DATA_STP_DISC should be 0x1A50+4*all_chn_num
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index e557a4ef5996..dc9215a565c9 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2166,9 +2166,9 @@ void hns_dsaf_update_stats(struct dsaf_device *dsaf_dev, u32 node_num)
+ DSAF_INODE_LOCAL_ADDR_FALSE_NUM_0_REG + 0x80 * (u64)node_num);
+
+ hw_stats->vlan_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 4 * (u64)node_num);
+ hw_stats->stp_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_IN_DATA_STP_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_IN_DATA_STP_DISC_0_REG + 4 * (u64)node_num);
+
+ /* pfc pause frame statistics stored in dsaf inode*/
+ if ((node_num < DSAF_SERVICE_NW_NUM) && !is_ver1) {
+--
+2.19.1
+
--- /dev/null
+From 5c51847b7642284ae97e7028f1fae745bde25ebc Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Sat, 15 Dec 2018 11:53:22 +0800
+Subject: net: hns: Some registers use wrong address according to the
+ datasheet.
+
+[ Upstream commit 4ad26f117b6ea0f5d5f1592127bafb5ec65904d3 ]
+
+According to the hip06 datasheet:
+1.Six registers use wrong address:
+ RCB_COM_SF_CFG_INTMASK_RING
+ RCB_COM_SF_CFG_RING_STS
+ RCB_COM_SF_CFG_RING
+ RCB_COM_SF_CFG_INTMASK_BD
+ RCB_COM_SF_CFG_BD_RINT_STS
+ DSAF_INODE_VC1_IN_PKT_NUM_0_REG
+2.The offset of DSAF_INODE_VC1_IN_PKT_NUM_0_REG should be
+ 0x103C + 0x80 * all_chn_num
+3.The offset to show the value of DSAF_INODE_IN_DATA_STP_DISC_0_REG
+ is wrong, so the value of DSAF_INODE_SW_VLAN_TAG_DISC_0_REG will be
+ overwrite
+
+These registers are only used in "ethtool -d", so that did not cause ndev
+to misfunction.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns/hns_dsaf_main.c | 242 +++++++++---------
+ .../net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 12 +-
+ 2 files changed, 127 insertions(+), 127 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index dc9215a565c9..97d62decba19 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2285,237 +2285,237 @@ void hns_dsaf_get_regs(struct dsaf_device *ddev, u32 port, void *data)
+ DSAF_INODE_BD_ORDER_STATUS_0_REG + j * 4);
+ p[223 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + j * 4);
+- p[224 + i] = dsaf_read_dev(ddev,
++ p[226 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_IN_DATA_STP_DISC_0_REG + j * 4);
+ }
+
+- p[227] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
++ p[229] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
+
+ for (i = 0; i < DSAF_INODE_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[228 + i] = dsaf_read_dev(ddev,
++ p[230 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_VC0_IN_PKT_NUM_0_REG + j * 4);
+ }
+
+- p[231] = dsaf_read_dev(ddev,
+- DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 4);
++ p[233] = dsaf_read_dev(ddev,
++ DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 0x80);
+
+ /* dsaf inode registers */
+ for (i = 0; i < HNS_DSAF_SBM_NUM(ddev) / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[232 + i] = dsaf_read_dev(ddev,
++ p[234 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_CFG_REG_0_REG + j * 0x80);
+- p[235 + i] = dsaf_read_dev(ddev,
++ p[237 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_0_XGE_REG_0_REG + j * 0x80);
+- p[238 + i] = dsaf_read_dev(ddev,
++ p[240 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_1_REG_0_REG + j * 0x80);
+- p[241 + i] = dsaf_read_dev(ddev,
++ p[243 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_2_XGE_REG_0_REG + j * 0x80);
+- p[244 + i] = dsaf_read_dev(ddev,
++ p[246 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_0_0_REG + j * 0x80);
+- p[245 + i] = dsaf_read_dev(ddev,
++ p[249 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_1_0_REG + j * 0x80);
+- p[248 + i] = dsaf_read_dev(ddev,
++ p[252 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_0_0_REG + j * 0x80);
+- p[251 + i] = dsaf_read_dev(ddev,
++ p[255 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_1_0_REG + j * 0x80);
+- p[254 + i] = dsaf_read_dev(ddev,
++ p[258 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_2_0_REG + j * 0x80);
+- p[257 + i] = dsaf_read_dev(ddev,
++ p[261 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_3_0_REG + j * 0x80);
+- p[260 + i] = dsaf_read_dev(ddev,
++ p[264 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INER_ST_0_REG + j * 0x80);
+- p[263 + i] = dsaf_read_dev(ddev,
++ p[267 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_MIB_REQ_FAILED_TC_0_REG + j * 0x80);
+- p[266 + i] = dsaf_read_dev(ddev,
++ p[270 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_CNT_0_REG + j * 0x80);
+- p[269 + i] = dsaf_read_dev(ddev,
++ p[273 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_DROP_CNT_0_REG + j * 0x80);
+- p[272 + i] = dsaf_read_dev(ddev,
++ p[276 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INF_OUTPORT_CNT_0_REG + j * 0x80);
+- p[275 + i] = dsaf_read_dev(ddev,
++ p[279 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC0_CNT_0_REG + j * 0x80);
+- p[278 + i] = dsaf_read_dev(ddev,
++ p[282 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC1_CNT_0_REG + j * 0x80);
+- p[281 + i] = dsaf_read_dev(ddev,
++ p[285 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC2_CNT_0_REG + j * 0x80);
+- p[284 + i] = dsaf_read_dev(ddev,
++ p[288 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC3_CNT_0_REG + j * 0x80);
+- p[287 + i] = dsaf_read_dev(ddev,
++ p[291 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC4_CNT_0_REG + j * 0x80);
+- p[290 + i] = dsaf_read_dev(ddev,
++ p[294 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC5_CNT_0_REG + j * 0x80);
+- p[293 + i] = dsaf_read_dev(ddev,
++ p[297 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC6_CNT_0_REG + j * 0x80);
+- p[296 + i] = dsaf_read_dev(ddev,
++ p[300 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC7_CNT_0_REG + j * 0x80);
+- p[299 + i] = dsaf_read_dev(ddev,
++ p[303 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_REQ_CNT_0_REG + j * 0x80);
+- p[302 + i] = dsaf_read_dev(ddev,
++ p[306 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_RELS_CNT_0_REG + j * 0x80);
+- p[305 + i] = dsaf_read_dev(ddev,
++ p[309 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_3_REG_0_REG + j * 0x80);
+- p[308 + i] = dsaf_read_dev(ddev,
++ p[312 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_4_REG_0_REG + j * 0x80);
+ }
+
+ /* dsaf onode registers */
+ for (i = 0; i < DSAF_XOD_NUM; i++) {
+- p[311 + i] = dsaf_read_dev(ddev,
++ p[315 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[319 + i] = dsaf_read_dev(ddev,
++ p[323 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[327 + i] = dsaf_read_dev(ddev,
++ p[331 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[335 + i] = dsaf_read_dev(ddev,
++ p[339 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[343 + i] = dsaf_read_dev(ddev,
++ p[347 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_OFFSET_CFG_0_REG + i * 0x90);
+- p[351 + i] = dsaf_read_dev(ddev,
++ p[355 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TOKEN_CFG_0_REG + i * 0x90);
+ }
+
+- p[359] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
+- p[360] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
+- p[361] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
++ p[363] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
++ p[364] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
++ p[365] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
+
+ for (i = 0; i < DSAF_XOD_BIG_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[362 + i] = dsaf_read_dev(ddev,
++ p[366 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_L_0_REG + j * 0x90);
+- p[365 + i] = dsaf_read_dev(ddev,
++ p[369 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_H_0_REG + j * 0x90);
+- p[368 + i] = dsaf_read_dev(ddev,
++ p[372 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_CONNECT_STATE_0_REG + j * 0x90);
+- p[371 + i] = dsaf_read_dev(ddev,
++ p[375 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVPKT_CNT_0_REG + j * 0x90);
+- p[374 + i] = dsaf_read_dev(ddev,
++ p[378 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC0_CNT_0_REG + j * 0x90);
+- p[377 + i] = dsaf_read_dev(ddev,
++ p[381 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC1_CNT_0_REG + j * 0x90);
+- p[380 + i] = dsaf_read_dev(ddev,
++ p[384 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC2_CNT_0_REG + j * 0x90);
+- p[383 + i] = dsaf_read_dev(ddev,
++ p[387 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC3_CNT_0_REG + j * 0x90);
+- p[386 + i] = dsaf_read_dev(ddev,
++ p[390 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC0_CNT_0_REG + j * 0x90);
+- p[389 + i] = dsaf_read_dev(ddev,
++ p[393 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC1_CNT_0_REG + j * 0x90);
+ }
+
+- p[392] = dsaf_read_dev(ddev,
++ p[396] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[393] = dsaf_read_dev(ddev,
++ p[397] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[394] = dsaf_read_dev(ddev,
++ p[398] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN2_CNT_0_REG + port * 0x90);
+- p[395] = dsaf_read_dev(ddev,
++ p[399] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN3_CNT_0_REG + port * 0x90);
+- p[396] = dsaf_read_dev(ddev,
++ p[400] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN4_CNT_0_REG + port * 0x90);
+- p[397] = dsaf_read_dev(ddev,
++ p[401] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN5_CNT_0_REG + port * 0x90);
+- p[398] = dsaf_read_dev(ddev,
++ p[402] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN6_CNT_0_REG + port * 0x90);
+- p[399] = dsaf_read_dev(ddev,
++ p[403] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN7_CNT_0_REG + port * 0x90);
+- p[400] = dsaf_read_dev(ddev,
++ p[404] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[401] = dsaf_read_dev(ddev,
++ p[405] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[402] = dsaf_read_dev(ddev,
++ p[406] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[403] = dsaf_read_dev(ddev,
++ p[407] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[404] = dsaf_read_dev(ddev,
++ p[408] = dsaf_read_dev(ddev,
+ DSAF_XOD_FIFO_STATUS_0_REG + port * 0x90);
+
+ /* dsaf voq registers */
+ for (i = 0; i < DSAF_VOQ_NUM / DSAF_COMM_CHN; i++) {
+ j = (i * DSAF_COMM_CHN + port) * 0x90;
+- p[405 + i] = dsaf_read_dev(ddev,
++ p[409 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_INVERT_EN_0_REG + j);
+- p[408 + i] = dsaf_read_dev(ddev,
++ p[412 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_SRAM_PKT_NUM_0_REG + j);
+- p[411 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
+- p[414 + i] = dsaf_read_dev(ddev,
++ p[415 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
++ p[418 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_OUT_PKT_NUM_0_REG + j);
+- p[417 + i] = dsaf_read_dev(ddev,
++ p[421 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_ERR_ADDR_0_REG + j);
+- p[420 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
+- p[423 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
+- p[426 + i] = dsaf_read_dev(ddev,
++ p[424 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
++ p[427 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
++ p[430 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_0_0_REG + j);
+- p[429 + i] = dsaf_read_dev(ddev,
++ p[433 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_1_0_REG + j);
+- p[432 + i] = dsaf_read_dev(ddev,
++ p[436 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_PPE_XOD_REQ_0_REG + j);
+- p[435 + i] = dsaf_read_dev(ddev,
++ p[439 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ROCEE_XOD_REQ_0_REG + j);
+- p[438 + i] = dsaf_read_dev(ddev,
++ p[442 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_BP_ALL_THRD_0_REG + j);
+ }
+
+ /* dsaf tbl registers */
+- p[441] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
+- p[442] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
+- p[443] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
+- p[444] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
+- p[445] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
+- p[446] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
+- p[447] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
+- p[448] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
+- p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
+- p[450] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
+- p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
+- p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
+- p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
+- p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
+- p[455] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
+- p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
+- p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
+- p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
+- p[459] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
+- p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
+- p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
+- p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
+- p[463] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
++ p[445] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
++ p[446] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
++ p[447] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
++ p[448] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
++ p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
++ p[450] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
++ p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
++ p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
++ p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
++ p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
++ p[455] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
++ p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
++ p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
++ p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
++ p[459] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
++ p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
++ p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
++ p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
++ p[463] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
++ p[464] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
++ p[465] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
++ p[466] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
++ p[467] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
+
+ for (i = 0; i < DSAF_SW_PORT_NUM; i++) {
+ j = i * 0x8;
+- p[464 + 2 * i] = dsaf_read_dev(ddev,
++ p[468 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO1_0_REG + j);
+- p[465 + 2 * i] = dsaf_read_dev(ddev,
++ p[469 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO0_0_REG + j);
+ }
+
+- p[480] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
+- p[481] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
+- p[482] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
+- p[483] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
+- p[484] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
+- p[485] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
+- p[486] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
+- p[487] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
+- p[488] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
+- p[489] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
+- p[490] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
+- p[491] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
++ p[484] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
++ p[485] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
++ p[486] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
++ p[487] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
++ p[488] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
++ p[489] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
++ p[490] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
++ p[491] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
++ p[492] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
++ p[493] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
++ p[494] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
++ p[495] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
+
+ /* dsaf other registers */
+- p[492] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
+- p[493] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
+- p[494] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
+- p[495] = dsaf_read_dev(ddev,
++ p[496] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
++ p[497] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
++ p[498] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
++ p[499] = dsaf_read_dev(ddev,
+ DSAF_XGE_APP_RX_LINK_UP_0_REG + port * 0x4);
+- p[496] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
+- p[497] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
++ p[500] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
++ p[501] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
+
+ if (!is_ver1)
+- p[498] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
++ p[502] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
+
+ /* mark end of dsaf regs */
+- for (i = 499; i < 504; i++)
++ for (i = 503; i < 504; i++)
+ p[i] = 0xdddddddd;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 74d935d82cbc..f171d11b9b44 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -176,7 +176,7 @@
+ #define DSAF_INODE_IN_DATA_STP_DISC_0_REG 0x1A50
+ #define DSAF_INODE_GE_FC_EN_0_REG 0x1B00
+ #define DSAF_INODE_VC0_IN_PKT_NUM_0_REG 0x1B50
+-#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x1C00
++#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x103C
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_REG 0x1C00
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_OFFSET 0x100
+ #define DSAF_INODE_IN_PRIO_PAUSE_OFFSET 0x50
+@@ -404,11 +404,11 @@
+ #define RCB_ECC_ERR_ADDR4_REG 0x460
+ #define RCB_ECC_ERR_ADDR5_REG 0x464
+
+-#define RCB_COM_SF_CFG_INTMASK_RING 0x480
+-#define RCB_COM_SF_CFG_RING_STS 0x484
+-#define RCB_COM_SF_CFG_RING 0x488
+-#define RCB_COM_SF_CFG_INTMASK_BD 0x48C
+-#define RCB_COM_SF_CFG_BD_RINT_STS 0x470
++#define RCB_COM_SF_CFG_INTMASK_RING 0x470
++#define RCB_COM_SF_CFG_RING_STS 0x474
++#define RCB_COM_SF_CFG_RING 0x478
++#define RCB_COM_SF_CFG_INTMASK_BD 0x47C
++#define RCB_COM_SF_CFG_BD_RINT_STS 0x480
+ #define RCB_COM_RCB_RD_BD_BUSY 0x490
+ #define RCB_COM_RCB_FBD_CRT_EN 0x494
+ #define RCB_COM_AXI_WR_ERR_INTMASK 0x498
+--
+2.19.1
+
--- /dev/null
+From de5acf78eb68bf2b255436f767ebf1fee59263aa Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 17 Dec 2018 15:05:41 +0200
+Subject: net: macb: add missing barriers when reading descriptors
+
+[ Upstream commit 6e0af298066f3b6d99f58989bb0dca6f764b4c6d ]
+
+When reading buffer descriptors on RX or on TX completion, an
+RX_USED/TX_USED bit is checked first to ensure that the descriptors have
+been populated, i.e. the ownership has been transferred. However, there
+are no memory barriers to ensure that the data protected by the
+RX_USED/TX_USED bit is up-to-date with respect to that bit.
+
+Specifically:
+
+- TX timestamp descriptors may be loaded before ctrl is loaded for the
+ TX_USED check, which is racy as the descriptors may be updated between
+ the loads, causing old timestamp descriptor data to be used.
+
+- RX ctrl may be loaded before addr is loaded for the RX_USED check,
+ which is racy as a new frame may be written between the loads, causing
+ old ctrl descriptor data to be used.
+ This issue exists for both macb_rx() and gem_rx() variants.
+
+Fix the races by adding DMA read memory barriers on those paths and
+reordering the reads in macb_rx().
+
+I have not observed any actual problems in practice caused by these
+being missing, though.
+
+Tested on a ZynqMP based system.
+
+Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 13 ++++++++++---
+ drivers/net/ethernet/cadence/macb_ptp.c | 2 ++
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index b8b37afc5dc3..8f4b2f9a8e07 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1001,11 +1001,15 @@ static int gem_rx(struct macb_queue *queue, int budget)
+
+ rxused = (desc->addr & MACB_BIT(RX_USED)) ? true : false;
+ addr = macb_get_addr(bp, desc);
+- ctrl = desc->ctrl;
+
+ if (!rxused)
+ break;
+
++ /* Ensure ctrl is at least as up-to-date as rxused */
++ dma_rmb();
++
++ ctrl = desc->ctrl;
++
+ queue->rx_tail++;
+ count++;
+
+@@ -1180,11 +1184,14 @@ static int macb_rx(struct macb_queue *queue, int budget)
+ /* Make hw descriptor updates visible to CPU */
+ rmb();
+
+- ctrl = desc->ctrl;
+-
+ if (!(desc->addr & MACB_BIT(RX_USED)))
+ break;
+
++ /* Ensure ctrl is at least as up-to-date as addr */
++ dma_rmb();
++
++ ctrl = desc->ctrl;
++
+ if (ctrl & MACB_BIT(RX_SOF)) {
+ if (first_frag != -1)
+ discard_partial_frame(queue, first_frag, tail);
+diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
+index cd5296b84229..a6dc47edc4cf 100644
+--- a/drivers/net/ethernet/cadence/macb_ptp.c
++++ b/drivers/net/ethernet/cadence/macb_ptp.c
+@@ -319,6 +319,8 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb,
+ desc_ptp = macb_ptp_desc(queue->bp, desc);
+ tx_timestamp = &queue->tx_timestamps[head];
+ tx_timestamp->skb = skb;
++ /* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */
++ dma_rmb();
+ tx_timestamp->desc_ptp.ts_1 = desc_ptp->ts_1;
+ tx_timestamp->desc_ptp.ts_2 = desc_ptp->ts_2;
+ /* move head */
+--
+2.19.1
+
--- /dev/null
+From 975d32af884a6625781504ebe9c2c46c7ac2e864 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 17 Dec 2018 15:05:40 +0200
+Subject: net: macb: fix dropped RX frames due to a race
+
+[ Upstream commit 8159ecab0db9095902d4c73605fb8787f5c7d653 ]
+
+Bit RX_USED set to 0 in the address field allows the controller to write
+data to the receive buffer descriptor.
+
+The driver does not ensure the ctrl field is ready (cleared) when the
+controller sees the RX_USED=0 written by the driver. The ctrl field might
+only be cleared after the controller has already updated it according to
+a newly received frame, causing the frame to be discarded in gem_rx() due
+to unexpected ctrl field contents.
+
+A message is logged when the above scenario occurs:
+
+ macb ff0b0000.ethernet eth0: not whole frame pointed by descriptor
+
+Fix the issue by ensuring that when the controller sees RX_USED=0 the
+ctrl field is already cleared.
+
+This issue was observed on a ZynqMP based system.
+
+Fixes: 4df95131ea80 ("net/macb: change RX path for GEM")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 2de9197df074..b8b37afc5dc3 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -935,14 +935,19 @@ static void gem_rx_refill(struct macb_queue *queue)
+
+ if (entry == bp->rx_ring_size - 1)
+ paddr |= MACB_BIT(RX_WRAP);
+- macb_set_addr(bp, desc, paddr);
+ desc->ctrl = 0;
++ /* Setting addr clears RX_USED and allows reception,
++ * make sure ctrl is cleared first to avoid a race.
++ */
++ dma_wmb();
++ macb_set_addr(bp, desc, paddr);
+
+ /* properly align Ethernet header */
+ skb_reserve(skb, NET_IP_ALIGN);
+ } else {
+- desc->addr &= ~MACB_BIT(RX_USED);
+ desc->ctrl = 0;
++ dma_wmb();
++ desc->addr &= ~MACB_BIT(RX_USED);
+ }
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 9ae546b47185086feea0b7ecd8e1996a38c36a6d Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 17 Dec 2018 15:05:39 +0200
+Subject: net: macb: fix random memory corruption on RX with 64-bit DMA
+
+[ Upstream commit e100a897bf9b19089e57f236f2398c9e0538900e ]
+
+64-bit DMA addresses are split in upper and lower halves that are
+written in separate fields on GEM. For RX, bit 0 of the address is used
+as the ownership bit (RX_USED). When the RX_USED bit is unset the
+controller is allowed to write data to the buffer.
+
+The driver does not guarantee that the controller already sees the upper
+half when the RX_USED bit is cleared, possibly resulting in the
+controller writing an incoming frame to an address with an incorrect
+upper half and therefore possibly corrupting unrelated system memory.
+
+Fix that by adding the necessary DMA memory barrier between the writes.
+
+This corruption was observed on a ZynqMP based system.
+
+Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Acked-by: Harini Katakam <harini.katakam@xilinx.com>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 240fd36b5074..2de9197df074 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -682,6 +682,11 @@ static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_
+ if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+ desc_64 = macb_64b_desc(bp, desc);
+ desc_64->addrh = upper_32_bits(addr);
++ /* The low bits of RX address contain the RX_USED bit, clearing
++ * of which allows packet RX. Make sure the high bits are also
++ * visible to HW at that point.
++ */
++ dma_wmb();
+ }
+ #endif
+ desc->addr = lower_32_bits(addr);
+--
+2.19.1
+
--- /dev/null
+From 401fcbd6d3659bf71bd85d0a8dc701b7c38324c4 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 21 Dec 2018 00:22:32 -0600
+Subject: net: netxen: fix a missing check and an uninitialized use
+
+[ Upstream commit d134e486e831defd26130770181f01dfc6195f7d ]
+
+When netxen_rom_fast_read() fails, "bios" is left uninitialized and may
+contain random value, thus should not be used.
+
+The fix ensures that if netxen_rom_fast_read() fails, we return "-EIO".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+index 0ea141ece19e..6547a9dd5935 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+@@ -1125,7 +1125,8 @@ netxen_validate_firmware(struct netxen_adapter *adapter)
+ return -EINVAL;
+ }
+ val = nx_get_bios_version(adapter);
+- netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios);
++ if (netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios))
++ return -EIO;
+ if ((__force u32)val != bios) {
+ dev_err(&pdev->dev, "%s: firmware bios is incompatible\n",
+ fw_name[fw_type]);
+--
+2.19.1
+
--- /dev/null
+From 1e593eb5d60ff240ac4d9a33a9ca687ad8058f73 Mon Sep 17 00:00:00 2001
+From: Atul Gupta <atul.gupta@chelsio.com>
+Date: Tue, 11 Dec 2018 02:19:40 -0800
+Subject: net/tls: Init routines in create_ctx
+
+[ Upstream commit 6c0563e442528733219afe15c749eb2cc365da3f ]
+
+create_ctx is called from tls_init and tls_hw_prot
+hence initialize function pointers in common routine.
+
+Signed-off-by: Atul Gupta <atul.gupta@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 7fab2891ce7f..a091c03abcb2 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -555,6 +555,9 @@ static struct tls_context *create_ctx(struct sock *sk)
+ return NULL;
+
+ icsk->icsk_ulp_data = ctx;
++ ctx->setsockopt = sk->sk_prot->setsockopt;
++ ctx->getsockopt = sk->sk_prot->getsockopt;
++ ctx->sk_proto_close = sk->sk_prot->close;
+ return ctx;
+ }
+
+@@ -685,9 +688,6 @@ static int tls_init(struct sock *sk)
+ rc = -ENOMEM;
+ goto out;
+ }
+- ctx->setsockopt = sk->sk_prot->setsockopt;
+- ctx->getsockopt = sk->sk_prot->getsockopt;
+- ctx->sk_proto_close = sk->sk_prot->close;
+
+ /* Build IPv6 TLS whenever the address of tcpv6 _prot changes */
+ if (ip_ver == TLSV6 &&
+--
+2.19.1
+
--- /dev/null
+From 508809b982583a98f0f912bbcc618addf6c2bb17 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Mon, 10 Dec 2018 14:39:37 +0100
+Subject: netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
+
+[ Upstream commit 708abf74dd87f8640871b814faa195fb5970b0e3 ]
+
+In the error handling block, nla_nest_cancel(skb, atd) is called to
+cancel the nest operation. But then, ipset_nest_end(skb, atd) is
+unexpected called to end the nest operation. This patch calls the
+ipset_nest_end only on the branch that nla_nest_cancel is not called.
+
+Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_list_set.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 4eef55da0878..8da228da53ae 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -531,8 +531,8 @@ list_set_list(const struct ip_set *set,
+ ret = -EMSGSIZE;
+ } else {
+ cb->args[IPSET_CB_ARG0] = i;
++ ipset_nest_end(skb, atd);
+ }
+- ipset_nest_end(skb, atd);
+ out:
+ rcu_read_unlock();
+ return ret;
+--
+2.19.1
+
--- /dev/null
+From cf26cb3f175693ad03f8be1dee27de75f19d3b66 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 11 Dec 2018 07:45:29 +0100
+Subject: netfilter: nat: can't use dst_hold on noref dst
+
+[ Upstream commit 542fbda0f08f1cbbc250f9e59f7537649651d0c8 ]
+
+The dst entry might already have a zero refcount, waiting on rcu list
+to be free'd. Using dst_hold() transitions its reference count to 1, and
+next dst release will try to free it again -- resulting in a double free:
+
+ WARNING: CPU: 1 PID: 0 at include/net/dst.h:239 nf_xfrm_me_harder+0xe7/0x130 [nf_nat]
+ RIP: 0010:nf_xfrm_me_harder+0xe7/0x130 [nf_nat]
+ Code: 48 8b 5c 24 60 65 48 33 1c 25 28 00 00 00 75 53 48 83 c4 68 5b 5d 41 5c c3 85 c0 74 0d 8d 48 01 f0 0f b1 0a 74 86 85 c0 75 f3 <0f> 0b e9 7b ff ff ff 29 c6 31 d2 b9 20 00 48 00 4c 89 e7 e8 31 27
+ Call Trace:
+ nf_nat_ipv4_out+0x78/0x90 [nf_nat_ipv4]
+ nf_hook_slow+0x36/0xd0
+ ip_output+0x9f/0xd0
+ ip_forward+0x328/0x440
+ ip_rcv+0x8a/0xb0
+
+Use dst_hold_safe instead and bail out if we cannot take a reference.
+
+Fixes: a4c2fd7f7891 ("net: remove DST_NOCACHE flag")
+Reported-by: Martin Zaharinov <micron10@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index e2b196054dfc..2268b10a9dcf 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -117,7 +117,8 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
+ dst = skb_dst(skb);
+ if (dst->xfrm)
+ dst = ((struct xfrm_dst *)dst)->route;
+- dst_hold(dst);
++ if (!dst_hold_safe(dst))
++ return -EHOSTUNREACH;
+
+ if (sk && !net_eq(net, sock_net(sk)))
+ sk = NULL;
+--
+2.19.1
+
--- /dev/null
+From 0e720bbf221c6b5d676b5dc6e9eb24c9c54b5fca Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sat, 8 Dec 2018 11:03:01 +0900
+Subject: netfilter: nf_conncount: use rb_link_node_rcu() instead of
+ rb_link_node()
+
+[ Upstream commit d4e7df16567b80836a78d31b42f1a9355a636d67 ]
+
+rbnode in insert_tree() is rcu protected pointer.
+So, in order to handle this pointer, _rcu function should be used.
+rb_link_node_rcu() is a rcu version of rb_link_node().
+
+Fixes: 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index b6d0f6deea86..9cd180bda092 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -427,7 +427,7 @@ insert_tree(struct net *net,
+ count = 1;
+ rbconn->list.count = count;
+
+- rb_link_node(&rbconn->node, parent, rbnode);
++ rb_link_node_rcu(&rbconn->node, parent, rbnode);
+ rb_insert_color(&rbconn->node, root);
+ out_unlock:
+ spin_unlock_bh(&nf_conncount_locks[hash % CONNCOUNT_LOCK_SLOTS]);
+--
+2.19.1
+
--- /dev/null
+From d2fb352c98f9103bd15c2971c75432bb59c358fc Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Mon, 26 Nov 2018 20:03:30 +0900
+Subject: netfilter: nf_tables: fix suspicious RCU usage in
+ nft_chain_stats_replace()
+
+[ Upstream commit 4c05ec47384ab3627b62814e8f886e90cc38ce15 ]
+
+basechain->stats is rcu protected data which is updated from
+nft_chain_stats_replace(). This function is executed from the commit
+phase which holds the pernet nf_tables commit mutex - not the global
+nfnetlink subsystem mutex.
+
+Test commands to reproduce the problem are:
+ %iptables-nft -I INPUT
+ %iptables-nft -Z
+ %iptables-nft -Z
+
+This patch uses RCU calls to handle basechain->stats updates to fix a
+splat that looks like:
+
+[89279.358755] =============================
+[89279.363656] WARNING: suspicious RCU usage
+[89279.368458] 4.20.0-rc2+ #44 Tainted: G W L
+[89279.374661] -----------------------------
+[89279.379542] net/netfilter/nf_tables_api.c:1404 suspicious rcu_dereference_protected() usage!
+[...]
+[89279.406556] 1 lock held by iptables-nft/5225:
+[89279.411728] #0: 00000000bf45a000 (&net->nft.commit_mutex){+.+.}, at: nf_tables_valid_genid+0x1f/0x70 [nf_tables]
+[89279.424022] stack backtrace:
+[89279.429236] CPU: 0 PID: 5225 Comm: iptables-nft Tainted: G W L 4.20.0-rc2+ #44
+[89279.430135] Call Trace:
+[89279.430135] dump_stack+0xc9/0x16b
+[89279.430135] ? show_regs_print_info+0x5/0x5
+[89279.430135] ? lockdep_rcu_suspicious+0x117/0x160
+[89279.430135] nft_chain_commit_update+0x4ea/0x640 [nf_tables]
+[89279.430135] ? sched_clock_local+0xd4/0x140
+[89279.430135] ? check_flags.part.35+0x440/0x440
+[89279.430135] ? __rhashtable_remove_fast.constprop.67+0xec0/0xec0 [nf_tables]
+[89279.430135] ? sched_clock_cpu+0x126/0x170
+[89279.430135] ? find_held_lock+0x39/0x1c0
+[89279.430135] ? hlock_class+0x140/0x140
+[89279.430135] ? is_bpf_text_address+0x5/0xf0
+[89279.430135] ? check_flags.part.35+0x440/0x440
+[89279.430135] ? __lock_is_held+0xb4/0x140
+[89279.430135] nf_tables_commit+0x2555/0x39c0 [nf_tables]
+
+Fixes: f102d66b335a4 ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 12 ------------
+ net/netfilter/nf_tables_api.c | 21 +++++++++++++--------
+ net/netfilter/nf_tables_core.c | 2 +-
+ 3 files changed, 14 insertions(+), 21 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 4a520d3304a2..cf09ab37b45b 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -62,18 +62,6 @@ static inline bool lockdep_nfnl_is_held(__u8 subsys_id)
+ }
+ #endif /* CONFIG_PROVE_LOCKING */
+
+-/*
+- * nfnl_dereference - fetch RCU pointer when updates are prevented by subsys mutex
+- *
+- * @p: The pointer to read, prior to dereferencing
+- * @ss: The nfnetlink subsystem ID
+- *
+- * Return the value of the specified RCU-protected pointer, but omit
+- * the READ_ONCE(), because caller holds the NFNL subsystem mutex.
+- */
+-#define nfnl_dereference(p, ss) \
+- rcu_dereference_protected(p, lockdep_nfnl_is_held(ss))
+-
+ #define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
+ MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index fe0558b15fd3..ed9af46720e1 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1199,7 +1199,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
+ goto nla_put_failure;
+
+- if (basechain->stats && nft_dump_stats(skb, basechain->stats))
++ if (rcu_access_pointer(basechain->stats) &&
++ nft_dump_stats(skb, rcu_dereference(basechain->stats)))
+ goto nla_put_failure;
+ }
+
+@@ -1375,7 +1376,8 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
+ return newstats;
+ }
+
+-static void nft_chain_stats_replace(struct nft_base_chain *chain,
++static void nft_chain_stats_replace(struct net *net,
++ struct nft_base_chain *chain,
+ struct nft_stats __percpu *newstats)
+ {
+ struct nft_stats __percpu *oldstats;
+@@ -1383,8 +1385,9 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
+ if (newstats == NULL)
+ return;
+
+- if (chain->stats) {
+- oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
++ if (rcu_access_pointer(chain->stats)) {
++ oldstats = rcu_dereference_protected(chain->stats,
++ lockdep_commit_lock_is_held(net));
+ rcu_assign_pointer(chain->stats, newstats);
+ synchronize_rcu();
+ free_percpu(oldstats);
+@@ -1421,9 +1424,10 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
+ struct nft_base_chain *basechain = nft_base_chain(chain);
+
+ module_put(basechain->type->owner);
+- free_percpu(basechain->stats);
+- if (basechain->stats)
++ if (rcu_access_pointer(basechain->stats)) {
+ static_branch_dec(&nft_counters_enabled);
++ free_percpu(rcu_dereference_raw(basechain->stats));
++ }
+ kfree(chain->name);
+ kfree(basechain);
+ } else {
+@@ -1572,7 +1576,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ kfree(basechain);
+ return PTR_ERR(stats);
+ }
+- basechain->stats = stats;
++ rcu_assign_pointer(basechain->stats, stats);
+ static_branch_inc(&nft_counters_enabled);
+ }
+
+@@ -6145,7 +6149,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
+ return;
+
+ basechain = nft_base_chain(trans->ctx.chain);
+- nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
++ nft_chain_stats_replace(trans->ctx.net, basechain,
++ nft_trans_chain_stats(trans));
+
+ switch (nft_trans_chain_policy(trans)) {
+ case NF_DROP:
+diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
+index ffd5c0f9412b..60f258f2c707 100644
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -101,7 +101,7 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
+ struct nft_stats *stats;
+
+ base_chain = nft_base_chain(chain);
+- if (!base_chain->stats)
++ if (!rcu_access_pointer(base_chain->stats))
+ return;
+
+ local_bh_disable();
+--
+2.19.1
+
--- /dev/null
+From e0656546d72fe5119e4bea59aac4b97f2089ea81 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 5 Dec 2018 14:12:19 +0100
+Subject: netfilter: seqadj: re-load tcp header pointer after possible head
+ reallocation
+
+[ Upstream commit 530aad77010b81526586dfc09130ec875cd084e4 ]
+
+When adjusting sack block sequence numbers, skb_make_writable() gets
+called to make sure tcp options are all in the linear area, and buffer
+is not shared.
+
+This can cause tcp header pointer to get reallocated, so we must
+reaload it to avoid memory corruption.
+
+This bug pre-dates git history.
+
+Reported-by: Neel Mehta <nmehta@google.com>
+Reported-by: Shane Huntley <shuntley@google.com>
+Reported-by: Heather Adkins <argv@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_seqadj.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
+index a975efd6b8c3..9da303461069 100644
+--- a/net/netfilter/nf_conntrack_seqadj.c
++++ b/net/netfilter/nf_conntrack_seqadj.c
+@@ -115,12 +115,12 @@ static void nf_ct_sack_block_adjust(struct sk_buff *skb,
+ /* TCP SACK sequence number adjustment */
+ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ unsigned int protoff,
+- struct tcphdr *tcph,
+ struct nf_conn *ct,
+ enum ip_conntrack_info ctinfo)
+ {
+- unsigned int dir, optoff, optend;
++ struct tcphdr *tcph = (void *)skb->data + protoff;
+ struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
++ unsigned int dir, optoff, optend;
+
+ optoff = protoff + sizeof(struct tcphdr);
+ optend = protoff + tcph->doff * 4;
+@@ -128,6 +128,7 @@ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ if (!skb_make_writable(skb, optend))
+ return 0;
+
++ tcph = (void *)skb->data + protoff;
+ dir = CTINFO2DIR(ctinfo);
+
+ while (optoff < optend) {
+@@ -207,7 +208,7 @@ int nf_ct_seq_adjust(struct sk_buff *skb,
+ ntohl(newack));
+ tcph->ack_seq = newack;
+
+- res = nf_ct_sack_adjust(skb, protoff, tcph, ct, ctinfo);
++ res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo);
+ out:
+ spin_unlock_bh(&ct->lock);
+
+--
+2.19.1
+
--- /dev/null
+From 14a66809e142401a917ab0b1bb318c396786f640 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sat, 15 Dec 2018 11:03:22 +0200
+Subject: nl80211: fix memory leak if validate_pae_over_nl80211() fails
+
+[ Upstream commit d350a0f431189517b1af0dbbb605c273231a8966 ]
+
+If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(),
+we might leak the 'connkeys' allocation. Fix this.
+
+Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 176edfefcbaa..295cd8d5554f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -8993,8 +8993,10 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
+ if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
+ int r = validate_pae_over_nl80211(rdev, info);
+
+- if (r < 0)
++ if (r < 0) {
++ kzfree(connkeys);
+ return r;
++ }
+
+ ibss.control_port_over_nl80211 = true;
+ }
+--
+2.19.1
+
--- /dev/null
+From 879c65e3a722df5b9471d98ad5768f72524561bb Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Tue, 13 Nov 2018 11:55:36 +0100
+Subject: pinctrl: meson: fix pull enable register calculation
+
+[ Upstream commit 614b1868a125a0ba24be08f3a7fa832ddcde6bca ]
+
+We just changed the code so we apply bias disable on the correct
+register but forgot to align the register calculation. The result
+is that we apply the change on the correct register, but possibly
+at the incorrect offset/bit
+
+This went undetected because offsets tends to be the same between
+REG_PULL and REG_PULLEN for a given pin the EE controller. This
+is not true for the AO controller.
+
+Fixes: e39f9dd8206a ("pinctrl: meson: fix pinconf bias disable")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 4f3ab18636a3..c8eff70fdb1c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -191,7 +191,8 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ case PIN_CONFIG_BIAS_DISABLE:
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+- meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
++ meson_calc_reg_and_bit(bank, pin, REG_PULLEN, ®,
++ &bit);
+ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+--
+2.19.1
+
--- /dev/null
+From ab398701cb38f7e7c5ab526ba2dcd449fd27ea44 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Tue, 27 Nov 2018 09:01:54 +1100
+Subject: powerpc: Fix COFF zImage booting on old powermacs
+
+[ Upstream commit 5564597d51c8ff5b88d95c76255e18b13b760879 ]
+
+Commit 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper
+as a relocatable ET_DYN", 2011-04-12) changed the procedure descriptor
+at the start of crt0.S to have a hard-coded start address of 0x500000
+rather than a reference to _zimage_start, presumably because having
+a reference to a symbol introduced a relocation which is awkward to
+handle in a position-independent executable. Unfortunately, what is
+at 0x500000 in the COFF image is not the first instruction, but the
+procedure descriptor itself, that is, a word containing 0x500000,
+which is not a valid instruction. Hence, booting a COFF zImage
+results in a "DEFAULT CATCH!, code=FFF00700" message from Open
+Firmware.
+
+This fixes the problem by (a) putting the procedure descriptor in the
+data section and (b) adding a branch to _zimage_start as the first
+instruction in the program.
+
+Fixes: 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN")
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/crt0.S | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index 32dfe6d083f3..9b9d17437373 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -15,7 +15,7 @@
+ RELA = 7
+ RELACOUNT = 0x6ffffff9
+
+- .text
++ .data
+ /* A procedure descriptor used when booting this as a COFF file.
+ * When making COFF, this comes first in the link and we're
+ * linked at 0x500000.
+@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9
+ .globl _zimage_start_opd
+ _zimage_start_opd:
+ .long 0x500000, 0, 0, 0
++ .text
++ b _zimage_start
+
+ #ifdef __powerpc64__
+ .balign 8
+--
+2.19.1
+
--- /dev/null
+From 1c5bc9fd21f1acfcf53ec1d95c0801a36567316f Mon Sep 17 00:00:00 2001
+From: Oliver O'Halloran <oohall@gmail.com>
+Date: Fri, 7 Dec 2018 02:17:14 +1100
+Subject: powerpc/mm: Fallback to RAM if the altmap is unusable
+
+[ Upstream commit 9ef34630a4614ee1cd478f9859ebea55d55f10ec ]
+
+The "altmap" is used to provide a pool of memory that is reserved for
+the vmemmap backing of hot-plugged memory. This is useful when adding
+large amount of ZONE_DEVICE memory to a system with a limited amount of
+normal memory.
+
+On ppc64 we use huge pages to map the vmemmap which requires the backing
+storage to be contigious and aligned to the hugepage size. The altmap
+implementation allows for the altmap provider to reserve a few PFNs at
+the start of the range for it's own uses and when this occurs the
+first chunk of the altmap is not usable for hugepage mappings. On hash
+there is no sane way to fall back to a normal sized page mapping so we
+fail the allocation. This results in memory hotplug failing with
+ENOMEM when the new range doesn't fall into an existing vmemmap block.
+
+This patch handles this case by falling back to using system memory
+rather than failing if we cannot allocate from the altmap. This
+fallback should only ever be used for the first vmemmap block so it
+should not cause excess memory consumption.
+
+Fixes: 7b73d978a5d0 ("mm: pass the vmem_altmap to vmemmap_populate")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/init_64.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
+index 7a9886f98b0c..a5091c034747 100644
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -188,15 +188,20 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
+ pr_debug("vmemmap_populate %lx..%lx, node %d\n", start, end, node);
+
+ for (; start < end; start += page_size) {
+- void *p;
++ void *p = NULL;
+ int rc;
+
+ if (vmemmap_populated(start, page_size))
+ continue;
+
++ /*
++ * Allocate from the altmap first if we have one. This may
++ * fail due to alignment issues when using 16MB hugepages, so
++ * fall back to system memory if the altmap allocation fail.
++ */
+ if (altmap)
+ p = altmap_alloc_block_buf(page_size, altmap);
+- else
++ if (!p)
+ p = vmemmap_alloc_block_buf(page_size, node);
+ if (!p)
+ return -ENOMEM;
+@@ -255,8 +260,15 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ {
+ unsigned long page_size = 1 << mmu_psize_defs[mmu_vmemmap_psize].shift;
+ unsigned long page_order = get_order(page_size);
++ unsigned long alt_start = ~0, alt_end = ~0;
++ unsigned long base_pfn;
+
+ start = _ALIGN_DOWN(start, page_size);
++ if (altmap) {
++ alt_start = altmap->base_pfn;
++ alt_end = altmap->base_pfn + altmap->reserve +
++ altmap->free + altmap->alloc + altmap->align;
++ }
+
+ pr_debug("vmemmap_free %lx...%lx\n", start, end);
+
+@@ -280,8 +292,9 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ page = pfn_to_page(addr >> PAGE_SHIFT);
+ section_base = pfn_to_page(vmemmap_section_start(start));
+ nr_pages = 1 << page_order;
++ base_pfn = PHYS_PFN(addr);
+
+- if (altmap) {
++ if (base_pfn >= alt_start && base_pfn < alt_end) {
+ vmem_altmap_free(altmap, nr_pages);
+ } else if (PageReserved(page)) {
+ /* allocated from bootmem */
+--
+2.19.1
+
--- /dev/null
+From a3576d29f140b71a7a8ef2c438cd644199b65b1b Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 26 Nov 2018 12:59:16 +1100
+Subject: powerpc/mm: Fix linux page tables build with some configs
+
+[ Upstream commit 462951cd32e1496dc64b00051dfb777efc8ae5d8 ]
+
+For some configs the build fails with:
+
+ arch/powerpc/mm/dump_linuxpagetables.c: In function 'populate_markers':
+ arch/powerpc/mm/dump_linuxpagetables.c:306:39: error: 'PKMAP_BASE' undeclared (first use in this function)
+ arch/powerpc/mm/dump_linuxpagetables.c:314:50: error: 'LAST_PKMAP' undeclared (first use in this function)
+
+These come from highmem.h, including that fixes the build.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/dump_linuxpagetables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index bdf33b989f98..8464c2c01c0c 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -19,6 +19,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/io.h>
+ #include <linux/mm.h>
++#include <linux/highmem.h>
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <asm/fixmap.h>
+--
+2.19.1
+
--- /dev/null
+From 32e8f8fca26fc33bb1955cd0f7bc6bfcc794cf5a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 17 Dec 2018 10:05:13 +0300
+Subject: qed: Fix an error code qed_ll2_start_xmit()
+
+[ Upstream commit f07d4276892d97671e880190ff195a288b2d8d92 ]
+
+We accidentally deleted the code to set "rc = -ENOMEM;" and this patch
+adds it back.
+
+Fixes: d2201a21598a ("qed: No need for LL2 frags indication")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 14ac9cab2653..2fa1c050a14b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -2485,6 +2485,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
+ if (unlikely(dma_mapping_error(&cdev->pdev->dev, mapping))) {
+ DP_NOTICE(cdev,
+ "Unable to map frag - dropping packet\n");
++ rc = -ENOMEM;
+ goto err;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From b5a65c5a3d6179c5e90b2504bd3d177faeba4512 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Fri, 21 Dec 2018 13:07:23 +0100
+Subject: qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
+
+[ Upstream commit d667044f49513d55fcfefe4fa8f8d96091782901 ]
+
+This patch fixes qmap header retrieval when modem is configured for
+dl data aggregation.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index f5bac5075386..774e1ff01c9a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -151,17 +151,18 @@ static bool qmimux_has_slaves(struct usbnet *dev)
+
+ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
+- unsigned int len, offset = sizeof(struct qmimux_hdr);
++ unsigned int len, offset = 0;
+ struct qmimux_hdr *hdr;
+ struct net_device *net;
+ struct sk_buff *skbn;
++ u8 qmimux_hdr_sz = sizeof(*hdr);
+
+- while (offset < skb->len) {
+- hdr = (struct qmimux_hdr *)skb->data;
++ while (offset + qmimux_hdr_sz < skb->len) {
++ hdr = (struct qmimux_hdr *)(skb->data + offset);
+ len = be16_to_cpu(hdr->pkt_len);
+
+ /* drop the packet, bogus length */
+- if (offset + len > skb->len)
++ if (offset + len + qmimux_hdr_sz > skb->len)
+ return 0;
+
+ /* control packet, we do not know what to do */
+@@ -176,7 +177,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ return 0;
+ skbn->dev = net;
+
+- switch (skb->data[offset] & 0xf0) {
++ switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) {
+ case 0x40:
+ skbn->protocol = htons(ETH_P_IP);
+ break;
+@@ -188,12 +189,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ goto skip;
+ }
+
+- skb_put_data(skbn, skb->data + offset, len);
++ skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len);
+ if (netif_rx(skbn) != NET_RX_SUCCESS)
+ return 0;
+
+ skip:
+- offset += len + sizeof(struct qmimux_hdr);
++ offset += len + qmimux_hdr_sz;
+ }
+ return 1;
+ }
+--
+2.19.1
+
--- /dev/null
+From f902f42e80860dfd6684bc55da15345f56c0a1aa Mon Sep 17 00:00:00 2001
+From: Himanshu Madhani <hmadhani@marvell.com>
+Date: Thu, 6 Dec 2018 21:49:42 -0800
+Subject: Revert "scsi: qla2xxx: Fix NVMe Target discovery"
+
+[ Upstream commit c64a87f9518409d0a439895f09f6149ffdd427b8 ]
+
+This reverts commit db186382af21e926e90df19499475f2552192b77.
+
+This commit introduced regression with FCP discovery so revert it to fix
+discovery for FCP luns.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index ae9fd2d01004..42b8f0d3e580 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4808,10 +4808,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ fcport->d_id = e->u.new_sess.id;
+ fcport->flags |= FCF_FABRIC_DEVICE;
+ fcport->fw_login_state = DSC_LS_PLOGI_PEND;
+- if (e->u.new_sess.fc4_type & FS_FC4TYPE_FCP)
++ if (e->u.new_sess.fc4_type == FS_FC4TYPE_FCP)
+ fcport->fc4_type = FC4_TYPE_FCP_SCSI;
+
+- if (e->u.new_sess.fc4_type & FS_FC4TYPE_NVME) {
++ if (e->u.new_sess.fc4_type == FS_FC4TYPE_NVME) {
+ fcport->fc4_type = FC4_TYPE_OTHER;
+ fcport->fc4f_nvme = FC4_TYPE_NVME;
+ }
+--
+2.19.1
+
--- /dev/null
+From d152795b69f2e9068bfd99800b9537428ebc6bc0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 1 Nov 2018 08:25:30 +0300
+Subject: scsi: bnx2fc: Fix NULL dereference in error handling
+
+[ Upstream commit 9ae4f8420ed7be4b13c96600e3568c144d101a23 ]
+
+If "interface" is NULL then we can't release it and trying to will only
+lead to an Oops.
+
+Fixes: aea71a024914 ("[SCSI] bnx2fc: Introduce interface structure for each vlan interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index f00045813378..3f97ec4aac4b 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -2371,7 +2371,7 @@ static int _bnx2fc_create(struct net_device *netdev,
+ if (!interface) {
+ printk(KERN_ERR PFX "bnx2fc_interface_create failed\n");
+ rc = -ENOMEM;
+- goto ifput_err;
++ goto netdev_err;
+ }
+
+ if (is_vlan_dev(netdev)) {
+--
+2.19.1
+
--- /dev/null
+From f6a2ccb09fbc40a405049f9cab15e73bb89c5cd6 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 9 Nov 2018 20:59:46 +0530
+Subject: scsi: target: iscsi: cxgbit: add missing spin_lock_init()
+
+[ Upstream commit 9e6371d3c6913ff1707fb2c0274c9925f7aaef80 ]
+
+Add missing spin_lock_init() for cdev->np_lock.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_main.c b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+index f3f8856bfb68..c011c826fc26 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_main.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+@@ -58,6 +58,7 @@ static void *cxgbit_uld_add(const struct cxgb4_lld_info *lldi)
+ return ERR_PTR(-ENOMEM);
+
+ kref_init(&cdev->kref);
++ spin_lock_init(&cdev->np_lock);
+
+ cdev->lldi = *lldi;
+
+--
+2.19.1
+
--- /dev/null
+From 0897a3c63b91f86951f3a97b64d6e634b7fadb37 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 9 Nov 2018 20:59:01 +0530
+Subject: scsi: target: iscsi: cxgbit: fix csk leak
+
+[ Upstream commit 801df68d617e3cb831f531c99fa6003620e6b343 ]
+
+csk leak can happen if a new TCP connection gets established after
+cxgbit_accept_np() returns, to fix this leak free remaining csk in
+cxgbit_free_np().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index 8de16016b6de..b289b90ae6dc 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -631,8 +631,11 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)
+
+ static void cxgbit_arp_failure_discard(void *handle, struct sk_buff *skb)
+ {
++ struct cxgbit_sock *csk = handle;
++
+ pr_debug("%s cxgbit_device %p\n", __func__, handle);
+ kfree_skb(skb);
++ cxgbit_put_csk(csk);
+ }
+
+ static void cxgbit_abort_arp_failure(void *handle, struct sk_buff *skb)
+@@ -1190,7 +1193,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req)
+ rpl5->opt0 = cpu_to_be64(opt0);
+ rpl5->opt2 = cpu_to_be32(opt2);
+ set_wr_txq(skb, CPL_PRIORITY_SETUP, csk->ctrlq_idx);
+- t4_set_arp_err_handler(skb, NULL, cxgbit_arp_failure_discard);
++ t4_set_arp_err_handler(skb, csk, cxgbit_arp_failure_discard);
+ cxgbit_l2t_send(csk->com.cdev, skb, csk->l2t);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 4dfe82aefacaa41218cfbc968e88efebba888642 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 12 Dec 2018 11:01:45 -0500
+Subject: serial/sunsu: fix refcount leak
+
+[ Upstream commit d430aff8cd0c57502d873909c184e3b5753f8b88 ]
+
+The function of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+
+su_get_type() doesn't do that. The match node are used as an identifier
+to compare against the current node, so we can directly drop the refcount
+after getting the node from the path as it is not used as pointer.
+
+Fix this by use a single variable and drop the refcount right after
+of_find_node_by_path().
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sunsu.c | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index 6cf3e9b0728f..3e77475668c0 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -1394,22 +1394,43 @@ static inline struct console *SUNSU_CONSOLE(void)
+ static enum su_type su_get_type(struct device_node *dp)
+ {
+ struct device_node *ap = of_find_node_by_path("/aliases");
++ enum su_type rc = SU_PORT_PORT;
+
+ if (ap) {
+ const char *keyb = of_get_property(ap, "keyboard", NULL);
+ const char *ms = of_get_property(ap, "mouse", NULL);
++ struct device_node *match;
+
+ if (keyb) {
+- if (dp == of_find_node_by_path(keyb))
+- return SU_PORT_KBD;
++ match = of_find_node_by_path(keyb);
++
++ /*
++ * The pointer is used as an identifier not
++ * as a pointer, we can drop the refcount on
++ * the of__node immediately after getting it.
++ */
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_KBD;
++ goto out;
++ }
+ }
+ if (ms) {
+- if (dp == of_find_node_by_path(ms))
+- return SU_PORT_MS;
++ match = of_find_node_by_path(ms);
++
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_MS;
++ goto out;
++ }
+ }
+ }
+
+- return SU_PORT_PORT;
++out:
++ of_node_put(ap);
++ return rc;
+ }
+
+ static int su_probe(struct platform_device *op)
+--
+2.19.1
+
--- /dev/null
+arm-dts-sun8i-a83t-bananapi-m3-increase-vcc-pd-volta.patch
+pinctrl-meson-fix-pull-enable-register-calculation.patch
+arm64-dts-mt7622-fix-no-more-console-output-on-rfb1.patch
+powerpc-fix-coff-zimage-booting-on-old-powermacs.patch
+powerpc-mm-fix-linux-page-tables-build-with-some-con.patch
+hid-ite-add-usb-id-match-for-another-ite-based-keybo.patch
+arm-dts-imx7d-pico-describe-the-wifi-clock.patch
+arm-imx-update-the-cpu-power-up-timing-setting-on-i..patch
+arm-dts-imx7d-nitrogen7-fix-the-description-of-the-w.patch
+ib-mlx5-block-devx-umem-from-the-non-applicable-case.patch
+input-restore-ev_abs-abs_reserved.patch
+powerpc-mm-fallback-to-ram-if-the-altmap-is-unusable.patch
+drm-amdgpu-fix-debug_locks_warn_on-depth-0-in-amdgpu.patch
+ib-core-fix-oops-in-netdev_next_upper_dev_rcu.patch
+checkstack.pl-fix-for-aarch64.patch
+xfrm-fix-error-return-code-in-xfrm_output_one.patch
+xfrm-fix-bucket-count-reported-to-userspace.patch
+xfrm-fix-null-pointer-dereference-in-xfrm_input-when.patch
+ieee802154-hwsim-fix-off-by-one-in-parse-nested.patch
+netfilter-nf_tables-fix-suspicious-rcu-usage-in-nft_.patch
+netfilter-seqadj-re-load-tcp-header-pointer-after-po.patch
+revert-scsi-qla2xxx-fix-nvme-target-discovery.patch
+scsi-bnx2fc-fix-null-dereference-in-error-handling.patch
+input-omap-keypad-fix-idle-configuration-to-not-bloc.patch
+input-synaptics-enable-rmi-on-thinkpad-t560.patch
+ibmvnic-convert-reset-work-item-mutex-to-spin-lock.patch
+ibmvnic-fix-non-atomic-memory-allocation-in-irq-cont.patch
+ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch
+x86-mm-fix-guard-hole-handling.patch
+x86-dump_pagetables-fix-ldt-remap-address-marker.patch
+i40e-fix-mac-filter-delete-when-setting-mac-address.patch
+ixgbe-fix-race-when-the-vf-driver-does-a-reset.patch
+netfilter-ipset-do-not-call-ipset_nest_end-after-nla.patch
+netfilter-nat-can-t-use-dst_hold-on-noref-dst.patch
+netfilter-nf_conncount-use-rb_link_node_rcu-instead-.patch
+bnx2x-clear-fip-mac-when-fcoe-offload-support-is-dis.patch
+bnx2x-remove-configured-vlans-as-part-of-unload-sequ.patch
+bnx2x-send-update-svid-ramrod-with-retry-poll-flags-.patch
+scsi-target-iscsi-cxgbit-fix-csk-leak.patch
+scsi-target-iscsi-cxgbit-add-missing-spin_lock_init.patch
+mt76-fix-potential-null-pointer-dereference-in-mt76_.patch
+x86-hyperv-remove-pci-dependency.patch
+drivers-net-xgene-remove-unnecessary-forward-declara.patch
+net-tls-init-routines-in-create_ctx.patch
+w90p910_ether-remove-incorrect-__init-annotation.patch
+net-hns-incorrect-offset-address-used-for-some-regis.patch
+net-hns-all-ports-can-not-work-when-insmod-hns-ko-af.patch
+net-hns-some-registers-use-wrong-address-according-t.patch
+net-hns-fixed-bug-that-netdev-was-opened-twice.patch
+net-hns-clean-rx-fbd-when-ae-stopped.patch
+net-hns-free-irq-when-exit-from-abnormal-branch.patch
+net-hns-avoid-net-reset-caused-by-pause-frames-storm.patch
+net-hns-fix-ntuple-filters-status-error.patch
+net-hns-add-mac-pcs-config-when-enable-disable-mac.patch
+net-hns-fix-ping-failed-when-use-net-bridge-and-send.patch
+mac80211-fix-a-kernel-panic-when-txing-after-txq-tea.patch
+sunrpc-fix-a-race-with-xprt_connecting.patch
+qed-fix-an-error-code-qed_ll2_start_xmit.patch
+net-macb-fix-random-memory-corruption-on-rx-with-64-.patch
+net-macb-fix-dropped-rx-frames-due-to-a-race.patch
+net-macb-add-missing-barriers-when-reading-descripto.patch
+lan743x-expand-phy-search-for-lan7431.patch
+lan78xx-resolve-issue-with-changing-mac-address.patch
+vxge-ensure-data0-is-initialized-in-when-fetching-fi.patch
+nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch
+mac80211-free-skb-fraglist-before-freeing-the-skb.patch
+kbuild-fix-false-positive-warning-error-about-missin.patch
+m68k-fix-memblock-related-crashes.patch
+virtio-fix-test-build-after-uio.h-change.patch
+lan743x-remove-mac-reset-from-initialization.patch
+gpio-mvebu-only-fail-on-missing-clk-if-pwm-is-actual.patch
+input-synaptics-enable-smbus-for-hp-elitebook-840-g4.patch
+net-netxen-fix-a-missing-check-and-an-uninitialized-.patch
+qmi_wwan-fix-qmap-header-retrieval-in-qmimux_rx_fixu.patch
+serial-sunsu-fix-refcount-leak.patch
+auxdisplay-charlcd-fix-x-y-command-parsing.patch
--- /dev/null
+From b968f7139caac597f43a0cb2b0ae31b828e67e46 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 17 Dec 2018 17:38:51 -0500
+Subject: SUNRPC: Fix a race with XPRT_CONNECTING
+
+[ Upstream commit cf76785d30712d90185455e752337acdb53d2a5d ]
+
+Ensure that we clear XPRT_CONNECTING before releasing the XPRT_LOCK so that
+we don't have races between the (asynchronous) socket setup code and
+tasks in xprt_connect().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 6b7539c0466e..7d8cce1dfcad 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2244,8 +2244,8 @@ static void xs_udp_setup_socket(struct work_struct *work)
+ trace_rpc_socket_connect(xprt, sock, 0);
+ status = 0;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+@@ -2480,8 +2480,8 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ }
+ status = -EAGAIN;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 6a39fdd65613176eecddbdf3f5a5dd267ab2ec98 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 19 Dec 2018 18:21:51 -0500
+Subject: virtio: fix test build after uio.h change
+
+[ Upstream commit c5c08bed843c2b2c048c16d1296d7631d7c1620e ]
+
+Fixes: d38499530e5 ("fs: decouple READ and WRITE from the block layer ops")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/virtio/linux/kernel.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
+index fb22bccfbc8a..7ef45a4a3cba 100644
+--- a/tools/virtio/linux/kernel.h
++++ b/tools/virtio/linux/kernel.h
+@@ -23,6 +23,10 @@
+ #define PAGE_MASK (~(PAGE_SIZE-1))
+ #define PAGE_ALIGN(x) ((x + PAGE_SIZE - 1) & PAGE_MASK)
+
++/* generic data direction definitions */
++#define READ 0
++#define WRITE 1
++
+ typedef unsigned long long phys_addr_t;
+ typedef unsigned long long dma_addr_t;
+ typedef size_t __kernel_size_t;
+--
+2.19.1
+
--- /dev/null
+From 193a4e0a0761dc735ef7cd5152fa70df8d10c405 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 18 Dec 2018 15:19:47 +0000
+Subject: vxge: ensure data0 is initialized in when fetching firmware version
+ information
+
+[ Upstream commit f7db2beb4c2c6cc8111f5ab90fc7363ca91107b6 ]
+
+Currently variable data0 is not being initialized so a garbage value is
+being passed to vxge_hw_vpath_fw_api and this value is being written to
+the rts_access_steer_data0 register. There are other occurrances where
+data0 is being initialized to zero (e.g. in function
+vxge_hw_upgrade_read_version) so I think it makes sense to ensure data0
+is initialized likewise to 0.
+
+Detected by CoverityScan, CID#140696 ("Uninitialized scalar variable")
+
+Fixes: 8424e00dfd52 ("vxge: serialize access to steering control register")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index 398011c87643..bf4302e45dcd 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -807,7 +807,7 @@ __vxge_hw_vpath_fw_ver_get(struct __vxge_hw_virtualpath *vpath,
+ struct vxge_hw_device_date *fw_date = &hw_info->fw_date;
+ struct vxge_hw_device_version *flash_version = &hw_info->flash_version;
+ struct vxge_hw_device_date *flash_date = &hw_info->flash_date;
+- u64 data0, data1 = 0, steer_ctrl = 0;
++ u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+ enum vxge_hw_status status;
+
+ status = vxge_hw_vpath_fw_api(vpath,
+--
+2.19.1
+
--- /dev/null
+From a396daf98c9061bc290bbe10c1078dd330fc6d98 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:45:07 +0100
+Subject: w90p910_ether: remove incorrect __init annotation
+
+[ Upstream commit 51367e423c6501a26e67d91a655d2bc892303462 ]
+
+The get_mac_address() function is normally inline, but when it is
+not, we get a warning that this configuration is broken:
+
+WARNING: vmlinux.o(.text+0x4aff00): Section mismatch in reference from the function w90p910_ether_setup() to the function .init.text:get_mac_address()
+The function w90p910_ether_setup() references
+the function __init get_mac_address().
+This is often because w90p910_ether_setup lacks a __init
+
+Remove the __init to make it always do the right thing.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/nuvoton/w90p910_ether.c b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+index 052b3d2c07a1..c662c6f5bee3 100644
+--- a/drivers/net/ethernet/nuvoton/w90p910_ether.c
++++ b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+@@ -912,7 +912,7 @@ static const struct net_device_ops w90p910_ether_netdev_ops = {
+ .ndo_validate_addr = eth_validate_addr,
+ };
+
+-static void __init get_mac_address(struct net_device *dev)
++static void get_mac_address(struct net_device *dev)
+ {
+ struct w90p910_ether *ether = netdev_priv(dev);
+ struct platform_device *pdev;
+--
+2.19.1
+
--- /dev/null
+From b1691b6074844bbd2bc60102023ab170f2473a3c Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 30 Nov 2018 23:23:28 +0300
+Subject: x86/dump_pagetables: Fix LDT remap address marker
+
+[ Upstream commit 254eb5505ca0ca749d3a491fc6668b6c16647a99 ]
+
+The LDT remap placement has been changed. It's now placed before the direct
+mapping in the kernel virtual address space for both paging modes.
+
+Change address markers order accordingly.
+
+Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging")
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: peterz@infradead.org
+Cc: boris.ostrovsky@oracle.com
+Cc: jgross@suse.com
+Cc: bhe@redhat.com
+Cc: hans.van.kranenburg@mendix.com
+Cc: linux-mm@kvack.org
+Cc: xen-devel@lists.xenproject.org
+Link: https://lkml.kernel.org/r/20181130202328.65359-3-kirill.shutemov@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/dump_pagetables.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index 073755c89126..c05a818224bb 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -53,10 +53,10 @@ struct addr_marker {
+ enum address_markers_idx {
+ USER_SPACE_NR = 0,
+ KERNEL_SPACE_NR,
+- LOW_KERNEL_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
++#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ LDT_NR,
+ #endif
++ LOW_KERNEL_NR,
+ VMALLOC_START_NR,
+ VMEMMAP_START_NR,
+ #ifdef CONFIG_KASAN
+@@ -64,9 +64,6 @@ enum address_markers_idx {
+ KASAN_SHADOW_END_NR,
+ #endif
+ CPU_ENTRY_AREA_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
+- LDT_NR,
+-#endif
+ #ifdef CONFIG_X86_ESPFIX64
+ ESPFIX_START_NR,
+ #endif
+--
+2.19.1
+
--- /dev/null
+From 1bc9b8201778f95aa2764e972ff308613625b9be Mon Sep 17 00:00:00 2001
+From: Sinan Kaya <okaya@kernel.org>
+Date: Sat, 1 Dec 2018 21:40:38 +0000
+Subject: x86, hyperv: remove PCI dependency
+
+[ Upstream commit c629421a990033ba539eb8585e73a2e6fa9ea631 ]
+
+Need to be able to boot without PCI devices present.
+
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig
+index 97954f575c3f..1c1a2514d6f3 100644
+--- a/drivers/hv/Kconfig
++++ b/drivers/hv/Kconfig
+@@ -4,7 +4,7 @@ menu "Microsoft Hyper-V guest support"
+
+ config HYPERV
+ tristate "Microsoft Hyper-V client drivers"
+- depends on X86 && ACPI && PCI && X86_LOCAL_APIC && HYPERVISOR_GUEST
++ depends on X86 && ACPI && X86_LOCAL_APIC && HYPERVISOR_GUEST
+ select PARAVIRT
+ help
+ Select this option to run Linux as a Hyper-V client operating
+--
+2.19.1
+
--- /dev/null
+From ba6c8cf1705a59392fb654c977cadc91d382e9e5 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 30 Nov 2018 23:23:27 +0300
+Subject: x86/mm: Fix guard hole handling
+
+[ Upstream commit 16877a5570e0c5f4270d5b17f9bab427bcae9514 ]
+
+There is a guard hole at the beginning of the kernel address space, also
+used by hypervisors. It occupies 16 PGD entries.
+
+This reserved range is not defined explicitely, it is calculated relative
+to other entities: direct mapping and user space ranges.
+
+The calculation got broken by recent changes of the kernel memory layout:
+LDT remap range is now mapped before direct mapping and makes the
+calculation invalid.
+
+The breakage leads to crash on Xen dom0 boot[1].
+
+Define the reserved range explicitely. It's part of kernel ABI (hypervisors
+expect it to be stable) and must not depend on changes in the rest of
+kernel memory layout.
+
+[1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html
+
+Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging")
+Reported-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: peterz@infradead.org
+Cc: boris.ostrovsky@oracle.com
+Cc: bhe@redhat.com
+Cc: linux-mm@kvack.org
+Cc: xen-devel@lists.xenproject.org
+Link: https://lkml.kernel.org/r/20181130202328.65359-2-kirill.shutemov@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/pgtable_64_types.h | 5 +++++
+ arch/x86/mm/dump_pagetables.c | 8 ++++----
+ arch/x86/xen/mmu_pv.c | 11 ++++++-----
+ 3 files changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 84bd9bdc1987..88bca456da99 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -111,6 +111,11 @@ extern unsigned int ptrs_per_p4d;
+ */
+ #define MAXMEM (1UL << MAX_PHYSMEM_BITS)
+
++#define GUARD_HOLE_PGD_ENTRY -256UL
++#define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT)
++#define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT)
++#define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE)
++
+ #define LDT_PGD_ENTRY -240UL
+ #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
+ #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE)
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index a12afff146d1..073755c89126 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -493,11 +493,11 @@ static inline bool is_hypervisor_range(int idx)
+ {
+ #ifdef CONFIG_X86_64
+ /*
+- * ffff800000000000 - ffff87ffffffffff is reserved for
+- * the hypervisor.
++ * A hole in the beginning of kernel address space reserved
++ * for a hypervisor.
+ */
+- return (idx >= pgd_index(__PAGE_OFFSET) - 16) &&
+- (idx < pgd_index(__PAGE_OFFSET));
++ return (idx >= pgd_index(GUARD_HOLE_BASE_ADDR)) &&
++ (idx < pgd_index(GUARD_HOLE_END_ADDR));
+ #else
+ return false;
+ #endif
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index 2c84c6ad8b50..c8f011e07a15 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -640,19 +640,20 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd,
+ unsigned long limit)
+ {
+ int i, nr, flush = 0;
+- unsigned hole_low, hole_high;
++ unsigned hole_low = 0, hole_high = 0;
+
+ /* The limit is the last byte to be touched */
+ limit--;
+ BUG_ON(limit >= FIXADDR_TOP);
+
++#ifdef CONFIG_X86_64
+ /*
+ * 64-bit has a great big hole in the middle of the address
+- * space, which contains the Xen mappings. On 32-bit these
+- * will end up making a zero-sized hole and so is a no-op.
++ * space, which contains the Xen mappings.
+ */
+- hole_low = pgd_index(USER_LIMIT);
+- hole_high = pgd_index(PAGE_OFFSET);
++ hole_low = pgd_index(GUARD_HOLE_BASE_ADDR);
++ hole_high = pgd_index(GUARD_HOLE_END_ADDR);
++#endif
+
+ nr = pgd_index(limit) + 1;
+ for (i = 0; i < nr; i++) {
+--
+2.19.1
+
--- /dev/null
+From 6d2d50fb885860374f6d664227e0d90f6fd39105 Mon Sep 17 00:00:00 2001
+From: Benjamin Poirier <bpoirier@suse.com>
+Date: Mon, 5 Nov 2018 17:00:53 +0900
+Subject: xfrm: Fix bucket count reported to userspace
+
+[ Upstream commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 ]
+
+sadhcnt is reported by `ip -s xfrm state count` as "buckets count", not the
+hash mask.
+
+Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.")
+Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 7a34990a68b1..cc0203efb584 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -794,7 +794,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
+ {
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ si->sadcnt = net->xfrm.state_num;
+- si->sadhcnt = net->xfrm.state_hmask;
++ si->sadhcnt = net->xfrm.state_hmask + 1;
+ si->sadhmcnt = xfrm_state_hashmax;
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+ }
+--
+2.19.1
+
--- /dev/null
+From e9c9b4648ccf2cc188aeaf490d472de5d239a7c9 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 27 Oct 2018 06:12:06 +0000
+Subject: xfrm: Fix error return code in xfrm_output_one()
+
+[ Upstream commit 533555e5cbb6aa2d77598917871ae5b579fe724b ]
+
+xfrm_output_one() does not return a error code when there is
+no dst_entry attached to the skb, it is still possible crash
+with a NULL pointer dereference in xfrm_output_resume(). Fix
+it by return error code -EHOSTUNREACH.
+
+Fixes: 9e1437937807 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_output.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index 261995d37ced..6d20fbcde000 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -102,6 +102,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
+ skb_dst_force(skb);
+ if (!skb_dst(skb)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
++ err = -EHOSTUNREACH;
+ goto error_nolock;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 6b6186bec8e0efb8dc639536b97cfeaac44c2323 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Thu, 22 Nov 2018 07:26:24 +0100
+Subject: xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force
+ clears the dst_entry.
+
+[ Upstream commit 0152eee6fc3b84298bb6a79961961734e8afa5b8 ]
+
+Since commit 222d7dbd258d ("net: prevent dst uses after free")
+skb_dst_force() might clear the dst_entry attached to the skb.
+The xfrm code doesn't expect this to happen, so we crash with
+a NULL pointer dereference in this case.
+
+Fix it by checking skb_dst(skb) for NULL after skb_dst_force()
+and drop the packet in case the dst_entry was cleared. We also
+move the skb_dst_force() to a codepath that is not used when
+the transformation was offloaded, because in this case we
+don't have a dst_entry attached to the skb.
+
+The output and forwarding path was already fixed by
+commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when
+skb_dst_force clears the dst_entry.")
+
+Fixes: 222d7dbd258d ("net: prevent dst uses after free")
+Reported-by: Jean-Philippe Menil <jpmenil@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index be3520e429c9..790b514f86b6 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -346,6 +346,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+
+ skb->sp->xvec[skb->sp->len++] = x;
+
++ skb_dst_force(skb);
++ if (!skb_dst(skb)) {
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
++ goto drop;
++ }
++
+ lock:
+ spin_lock(&x->lock);
+
+@@ -385,7 +391,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ XFRM_SKB_CB(skb)->seq.input.low = seq;
+ XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
+
+- skb_dst_force(skb);
+ dev_hold(skb->dev);
+
+ if (crypto_done)
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
