Home Home > GIT Browse > SLE12-SP4-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-21 07:01:10 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-21 07:01:10 +0100
commit5d61b6616aeb0930cb222bbfab1c976a5751ffa5 (patch)
treecf04bea2a40bf5732d968b14362a5e2572b93c90
parent2056933076eabef7607b53073bc8e6b47fcf2155 (diff)
parent5cc7bcc73f8c5898e090cabd0c52898e67274fb8 (diff)
Merge branch 'SLE15' into SLE12-SP4
-rw-r--r--blacklist.conf1
-rw-r--r--patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch209
-rw-r--r--patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch54
-rw-r--r--patches.drivers/of-numa-Validate-some-distance-map-rules.patch84
-rw-r--r--patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch123
-rw-r--r--patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch74
-rw-r--r--patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch88
-rw-r--r--patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch76
-rw-r--r--patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch41
-rw-r--r--patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch78
-rw-r--r--patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch57
-rw-r--r--patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch84
-rw-r--r--patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch54
-rw-r--r--patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch72
-rw-r--r--patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch61
-rw-r--r--patches.fixes/netrom-switch-to-sock-timer-API.patch100
-rw-r--r--patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch39
-rw-r--r--patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch103
-rw-r--r--patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch86
-rwxr-xr-xrpm/klp-symbols2
-rw-r--r--series.conf18
21 files changed, 1503 insertions, 1 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 63bfdad41f..ab10375f18 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -964,3 +964,4 @@ a77660d231f8b3d84fd23ed482e0964f7aa546d6 # Fixes an unused debugging option
7be8c56f8f8a58af92f8791c5a09d48e342d7101 # Fixes comments only
7d63fb3af87aa67aa7d24466e792f9d7c57d8e79 # Cosmetic fix only
c5c08bed843c2b2c048c16d1296d7631d7c1620e # Fixes build of a userspace test tool
+da08d8cb8cfc58a340fc5e163385b5dfd714d762 # of: duplicated commit
diff --git a/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch b/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
new file mode 100644
index 0000000000..97742509ed
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
@@ -0,0 +1,209 @@
+From c0ca5eced22215c1e03e3ad479f8fab0bbb30772 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 20 Feb 2019 16:15:45 +0100
+Subject: [PATCH] ALSA: hda/realtek - Reduce click noise on Dell Precision 5820
+ headphone
+Git-commit: c0ca5eced22215c1e03e3ad479f8fab0bbb30772
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1126131
+
+Dell Precision 5820 with ALC3234 codec (which is equivalent with
+ALC255) shows click noises at (runtime) PM resume on the headphone.
+The biggest source of the noise comes from the cleared headphone pin
+control at resume, which is done via the standard shutup procedure.
+
+Although we have an override of the standard shutup callback to
+replace with NOP, this would skip other needed stuff (e.g. the pull
+down of headset power). So, instead, this "fixes" the behavior of
+alc_fixup_no_shutup() by introducing spec->no_shutup_pins flag.
+When this flag is set, Realtek codec won't call the standard
+snd_hda_shutup_pins() & co. Now alc_fixup_no_shutup() just sets this
+flag instead of overriding spec->shutup callback itself. This allows
+us to apply the similar fix for other entries easily if needed in
+future.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 57 +++++++++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 23 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -122,6 +122,7 @@ struct alc_spec {
+ unsigned int has_alc5505_dsp:1;
+ unsigned int no_depop_delay:1;
+ unsigned int done_hp_init:1;
++ unsigned int no_shutup_pins:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -484,6 +485,14 @@ static void alc_auto_setup_eapd(struct h
+ set_eapd(codec, *p, on);
+ }
+
++static void alc_shutup_pins(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->no_shutup_pins)
++ snd_hda_shutup_pins(codec);
++}
++
+ /* generic shutup callback;
+ * just turning off EAPD and a little pause for avoiding pop-noise
+ */
+@@ -494,7 +503,7 @@ static void alc_eapd_shutup(struct hda_c
+ alc_auto_setup_eapd(codec, false);
+ if (!spec->no_depop_delay)
+ msleep(200);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ /* generic EAPD initialization */
+@@ -855,7 +864,7 @@ static inline void alc_shutup(struct hda
+ if (spec && spec->shutup)
+ spec->shutup(codec);
+ else
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_reboot_notify(struct hda_codec *codec)
+@@ -2923,7 +2932,7 @@ static void alc269_shutup(struct hda_cod
+ (alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ msleep(150);
+ }
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static struct coef_fw alc282_coefs[] = {
+@@ -3026,14 +3035,15 @@ static void alc282_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x78, coef78);
+ }
+
+@@ -3139,15 +3149,16 @@ static void alc283_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (hp_pin_sense)
+ msleep(100);
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x43, 0x9614);
+ }
+
+@@ -3213,14 +3224,15 @@ static void alc256_shutup(struct hda_cod
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc225_init(struct hda_codec *codec)
+@@ -3307,7 +3319,7 @@ static void alc225_shutup(struct hda_cod
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -3361,14 +3373,15 @@ static void alc_default_shutup(struct hd
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc294_hp_init(struct hda_codec *codec)
+@@ -3385,8 +3398,9 @@ static void alc294_hp_init(struct hda_co
+
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+@@ -5047,16 +5061,12 @@ static void alc_fixup_auto_mute_via_amp(
+ }
+ }
+
+-static void alc_no_shutup(struct hda_codec *codec)
+-{
+-}
+-
+ static void alc_fixup_no_shutup(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+ if (action == HDA_FIXUP_ACT_PROBE) {
+ struct alc_spec *spec = codec->spec;
+- spec->shutup = alc_no_shutup;
++ spec->no_shutup_pins = 1;
+ }
+ }
+
+@@ -6652,6 +6662,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
diff --git a/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch b/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
new file mode 100644
index 0000000000..5253d11f75
--- /dev/null
+++ b/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
@@ -0,0 +1,54 @@
+From a74515604a7b171f2702bdcbd1e231225fb456d0 Mon Sep 17 00:00:00 2001
+From: Anderson Luiz Alves <alacn1@gmail.com>
+Date: Fri, 30 Nov 2018 21:58:36 -0200
+Subject: [PATCH] mv88e6060: disable hardware level MAC learning
+Git-commit: a74515604a7b171f2702bdcbd1e231225fb456d0
+Patch-mainline: v4.20-rc6
+References: bsc#1051510
+
+Disable hardware level MAC learning because it breaks station roaming.
+When enabled it drops all frames that arrive from a MAC address
+that is on a different port at learning table.
+
+Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/dsa/mv88e6060.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 65f10fec25b3..0b3e51f248c2 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/of-numa-Validate-some-distance-map-rules.patch b/patches.drivers/of-numa-Validate-some-distance-map-rules.patch
new file mode 100644
index 0000000000..1766f57b42
--- /dev/null
+++ b/patches.drivers/of-numa-Validate-some-distance-map-rules.patch
@@ -0,0 +1,84 @@
+From 89c38422e072bb453e3045b8f1b962a344c3edea Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Thu, 8 Nov 2018 18:17:03 +0800
+Subject: [PATCH] of, numa: Validate some distance map rules
+Git-commit: 89c38422e072bb453e3045b8f1b962a344c3edea
+Patch-mainline: v4.20-rc2
+References: bsc#1051510
+
+Currently the NUMA distance map parsing does not validate the distance
+table for the distance-matrix rules 1-2 in [1].
+
+However the arch NUMA code may enforce some of these rules, but not all.
+Such is the case for the arm64 port, which does not enforce the rule that
+the distance between separates nodes cannot equal LOCAL_DISTANCE.
+
+The patch adds the following rules validation:
+- distance of node to self equals LOCAL_DISTANCE
+- distance of separate nodes > LOCAL_DISTANCE
+
+This change avoids a yet-unresolved crash reported in [2].
+
+A note on dealing with symmetrical distances between nodes:
+
+Validating symmetrical distances between nodes is difficult. If it were
+mandated in the bindings that every distance must be recorded in the
+table, then it would be easy. However, it isn't.
+
+In addition to this, it is also possible to record [b, a] distance only
+(and not [a, b]). So, when processing the table for [b, a], we cannot
+assert that current distance of [a, b] != [b, a] as invalid, as [a, b]
+distance may not be present in the table and current distance would be
+default at REMOTE_DISTANCE.
+
+As such, we maintain the policy that we overwrite distance [a, b] = [b, a]
+for b > a. This policy is different to kernel ACPI SLIT validation, which
+allows non-symmetrical distances (ACPI spec SLIT rules allow it). However,
+the distance debug message is dropped as it may be misleading (for a distance
+which is later overwritten).
+
+Some final notes on semantics:
+
+- It is implied that it is the responsibility of the arch NUMA code to
+ reset the NUMA distance map for an error in distance map parsing.
+
+- It is the responsibility of the FW NUMA topology parsing (whether OF or
+ ACPI) to enforce NUMA distance rules, and not arch NUMA code.
+
+[1] Documents/devicetree/bindings/numa.txt
+[2] https://www.spinics.net/lists/arm-kernel/msg683304.html
+
+Cc: stable@vger.kernel.org # 4.7
+Signed-off-by: John Garry <john.garry@huawei.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/of/of_numa.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
+index 35c64a4295e0..fe6b13608e51 100644
+--- a/drivers/of/of_numa.c
++++ b/drivers/of/of_numa.c
+@@ -104,9 +104,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map)
+ distance = of_read_number(matrix, 1);
+ matrix++;
+
++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) ||
++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) {
++ pr_err("Invalid distance[node%d -> node%d] = %d\n",
++ nodea, nodeb, distance);
++ return -EINVAL;
++ }
++
+ numa_set_distance(nodea, nodeb, distance);
+- pr_debug("distance[node%d -> node%d] = %d\n",
+- nodea, nodeb, distance);
+
+ /* Set default distance of node B->A same as A->B */
+ if (nodeb > nodea)
+--
+2.16.4
+
diff --git a/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch b/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
new file mode 100644
index 0000000000..f2f0895c9f
--- /dev/null
+++ b/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
@@ -0,0 +1,123 @@
+From 8894891446c9380709451b99ab45c5c53adfd2fc Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 25 Sep 2018 21:06:24 -0700
+Subject: [PATCH] of: unittest: Disable interrupt node tests for old world MAC systems
+Git-commit: 8894891446c9380709451b99ab45c5c53adfd2fc
+Patch-mainline: v4.19-rc8
+References: bsc#1051510
+
+On systems with OF_IMAP_OLDWORLD_MAC set in of_irq_workarounds, the
+devicetree interrupt parsing code is different, causing unit tests of
+devicetree interrupt nodes to fail. Due to a bug in unittest code, which
+tries to dereference an uninitialized pointer, this results in a crash.
+
+Of: /testcase-data/phandle-tests/consumer-a: arguments longer than property
+Unable to handle kernel paging request for data at address 0x00bc616e
+Faulting instruction address: 0xc08e9468
+Oops: Kernel access of bad area, sig: 11 [#1]
+BE PREEMPT PowerMac
+Modules linked in:
+Cpu: 0 PID: 1 Comm: swapper Not tainted 4.14.72-rc1-yocto-standard+ #1
+Task: cf8e0000 task.stack: cf8da000
+Nip: c08e9468 LR: c08ea5bc CTR: c08ea5ac
+Regs: cf8dbb50 TRAP: 0300 Not tainted (4.14.72-rc1-yocto-standard+)
+Msr: 00001032 <ME,IR,DR,RI> CR: 82004044 XER: 00000000
+Dar: 00bc616e DSISR: 40000000
+Gpr00: c08ea5bc cf8dbc00 cf8e0000 c13ca517 c13ca517 c13ca8a0 00000066 00000002
+Gpr08: 00000063 00bc614e c0b05865 000affff 82004048 00000000 c00047f0 00000000
+Gpr16: c0a80000 c0a9cc34 c13ca517 c0ad1134 05ffffff 000affff c0b05860 c0abeef8
+Gpr24: cecec278 cecec278 c0a8c4d0 c0a885e0 c13ca8a0 05ffffff c13ca8a0 c13ca517
+
+NIP [c08e9468] device_node_gen_full_name+0x30/0x15c
+LR [c08ea5bc] device_node_string+0x190/0x3c8
+Call Trace:
+[cf8dbc00] [c007f670] trace_hardirqs_on_caller+0x118/0x1fc (unreliable)
+[cf8dbc40] [c08ea5bc] device_node_string+0x190/0x3c8
+[cf8dbcb0] [c08eb794] pointer+0x25c/0x4d0
+[cf8dbd00] [c08ebcbc] vsnprintf+0x2b4/0x5ec
+[cf8dbd60] [c08ec00c] vscnprintf+0x18/0x48
+[cf8dbd70] [c008e268] vprintk_store+0x4c/0x22c
+[cf8dbda0] [c008ecac] vprintk_emit+0x94/0x130
+[cf8dbdd0] [c008ff54] printk+0x5c/0x6c
+[cf8dbe10] [c0b8ddd4] of_unittest+0x2220/0x26f8
+[cf8dbea0] [c0004434] do_one_initcall+0x4c/0x184
+[cf8dbf00] [c0b4534c] kernel_init_freeable+0x13c/0x1d8
+[cf8dbf30] [c0004814] kernel_init+0x24/0x118
+[cf8dbf40] [c0013398] ret_from_kernel_thread+0x5c/0x64
+
+The problem was observed when running a qemu test for the g3beige machine
+with devicetree unittests enabled.
+
+Disable interrupt node tests on affected systems to avoid both false
+unittest failures and the crash.
+
+With this patch in place, unittest on the affected system passes with
+the following message.
+
+ dt-test ### end of unittest - 144 passed, 0 failed
+
+Fixes: 53a42093d96ef ("of: Add device tree selftests")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/of/unittest.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 722537e14848..41b49716ac75 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -771,6 +771,9 @@ static void __init of_unittest_parse_interrupts(void)
+ struct of_phandle_args args;
+ int i, rc;
+
++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)
++ return;
++
+ np = of_find_node_by_path("/testcase-data/interrupts/interrupts0");
+ if (!np) {
+ pr_err("missing testcase data\n");
+@@ -845,6 +848,9 @@ static void __init of_unittest_parse_interrupts_extended(void)
+ struct of_phandle_args args;
+ int i, rc;
+
++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)
++ return;
++
+ np = of_find_node_by_path("/testcase-data/interrupts/interrupts-extended0");
+ if (!np) {
+ pr_err("missing testcase data\n");
+@@ -1001,15 +1007,19 @@ static void __init of_unittest_platform_populate(void)
+ pdev = of_find_device_by_node(np);
+ unittest(pdev, "device 1 creation failed\n");
+
+- irq = platform_get_irq(pdev, 0);
+- unittest(irq == -EPROBE_DEFER, "device deferred probe failed - %d\n", irq);
++ if (!(of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)) {
++ irq = platform_get_irq(pdev, 0);
++ unittest(irq == -EPROBE_DEFER,
++ "device deferred probe failed - %d\n", irq);
+
+- /* Test that a parsing failure does not return -EPROBE_DEFER */
+- np = of_find_node_by_path("/testcase-data/testcase-device2");
+- pdev = of_find_device_by_node(np);
+- unittest(pdev, "device 2 creation failed\n");
+- irq = platform_get_irq(pdev, 0);
+- unittest(irq < 0 && irq != -EPROBE_DEFER, "device parsing error failed - %d\n", irq);
++ /* Test that a parsing failure does not return -EPROBE_DEFER */
++ np = of_find_node_by_path("/testcase-data/testcase-device2");
++ pdev = of_find_device_by_node(np);
++ unittest(pdev, "device 2 creation failed\n");
++ irq = platform_get_irq(pdev, 0);
++ unittest(irq < 0 && irq != -EPROBE_DEFER,
++ "device parsing error failed - %d\n", irq);
++ }
+
+ np = of_find_node_by_path("/testcase-data/platform-tests");
+ unittest(np, "No testcase data in device tree\n");
+--
+2.16.4
+
diff --git a/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch b/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
new file mode 100644
index 0000000000..9f778f09d9
--- /dev/null
+++ b/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
@@ -0,0 +1,74 @@
+From d7119224bfe6e8efbf821a52db7da9530d790f07 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 19 Jan 2018 17:25:41 +0800
+Subject: [PATCH] phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS
+Git-commit: d7119224bfe6e8efbf821a52db7da9530d790f07
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The AXP223 PMIC, like the AXP221, does not generate VBUS change
+interrupts when N_VBUSEN is used to drive VBUS for the OTG port
+on the board.
+
+This was not noticed until recently, as most A23/A33 boards use
+a GPIO pin that does not support interrupts for OTG ID detection.
+This forces the driver to use polling. However the A33-OlinuXino
+uses a pin that does support interrupts, so the driver uses them.
+However the VBUS interrupt never fires, and the driver never gets
+to update the VBUS status. This results in musb timing out waiting
+for VBUS to rise.
+
+This was worked around for the AXP221 by resorting to polling
+changes in commit 91d96f06a760 ("phy-sun4i-usb: Add workaround for
+missing Vbus det interrupts on A31"). This patch adds the A23 and
+A33 to the list of SoCs that need the workaround.
+
+Fixes: fc1f45ed3043 ("phy-sun4i-usb: Add support for the usb-phys on the sun8i-a33 SoC")
+Fixes: 123dfdbcfaf5 ("phy-sun4i-usb: Add support for the usb-phys on the sun8i-a23 SoC")
+Cc: <stable@vger.kernel.org> # 4.3.x: 68dbc2ce77bb phy-sun4i-usb: Use of_match_node to get model specific config data
+Cc: <stable@vger.kernel.org> # 4.3.x: 5cf700ac9d50 phy: phy-sun4i-usb: Fix optional gpios failing probe
+Cc: <stable@vger.kernel.org> # 4.3.x: 04e59a0211ff phy-sun4i-usb: Fix irq free conditions to match request conditions
+Cc: <stable@vger.kernel.org> # 4.3.x: 91d96f06a760 phy-sun4i-usb: Add workaround for missing Vbus det interrupts on A31
+Cc: <stable@vger.kernel.org> # 4.3.x
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index bee798892b21..d4dcd39b8d76 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -411,11 +411,13 @@ static bool sun4i_usb_phy0_poll(struct sun4i_usb_phy_data *data)
+ return true;
+
+ /*
+- * The A31 companion pmic (axp221) does not generate vbus change
+- * interrupts when the board is driving vbus, so we must poll
++ * The A31/A23/A33 companion pmics (AXP221/AXP223) do not
++ * generate vbus change interrupts when the board is driving
++ * vbus using the N_VBUSEN pin on the pmic, so we must poll
+ * when using the pmic for vbus-det _and_ we're driving vbus.
+ */
+- if (data->cfg->type == sun6i_a31_phy &&
++ if ((data->cfg->type == sun6i_a31_phy ||
++ data->cfg->type == sun8i_a33_phy) &&
+ data->vbus_power_supply && data->phys[0].regulator_on)
+ return true;
+
+@@ -886,7 +888,7 @@ static const struct sun4i_usb_phy_cfg sun7i_a20_cfg = {
+
+ static const struct sun4i_usb_phy_cfg sun8i_a23_cfg = {
+ .num_phys = 2,
+- .type = sun4i_a10_phy,
++ .type = sun6i_a31_phy,
+ .disc_thresh = 3,
+ .phyctl_offset = REG_PHYCTL_A10,
+ .dedicated_clocks = true,
+--
+2.16.4
+
diff --git a/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch b/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
new file mode 100644
index 0000000000..7760bcc7ee
--- /dev/null
+++ b/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
@@ -0,0 +1,88 @@
+From 8387c576b713bf677d59b7f16be64adb6b2de660 Mon Sep 17 00:00:00 2001
+From: Vivek Gautam <vivek.gautam@codeaurora.org>
+Date: Tue, 20 Jun 2017 11:27:18 +0530
+Subject: [PATCH] phy: qcom-qmp: Fix failure path in phy_init functions
+Git-commit: 8387c576b713bf677d59b7f16be64adb6b2de660
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+Fixing the clk enable failure path in qcom_qmp_phy_init()
+and cleanup the reset control deassertion failure path in
+qcom_qmp_phy_com_init().
+
+Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
+
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index 0c6cb8819200..e17f0351ccc2 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -775,8 +775,6 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+ if (ret) {
+ dev_err(qmp->dev, "%s reset deassert failed\n",
+ qmp->cfg->reset_list[i]);
+- while (--i >= 0)
+- reset_control_assert(qmp->resets[i]);
+ goto err_rst;
+ }
+ }
+@@ -805,7 +803,7 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+ if (ret) {
+ dev_err(qmp->dev,
+ "phy common block init timed-out\n");
+- goto err_com_init;
++ goto err_rst;
+ }
+ }
+
+@@ -813,11 +811,11 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+
+ return 0;
+
+-err_com_init:
++err_rst:
+ while (--i >= 0)
+ reset_control_assert(qmp->resets[i]);
+-err_rst:
+ mutex_unlock(&qmp->phy_mutex);
++
+ return ret;
+ }
+
+@@ -870,14 +868,13 @@ static int qcom_qmp_phy_init(struct phy *phy)
+ if (ret) {
+ dev_err(qmp->dev, "failed to enable %s clk, err=%d\n",
+ qmp->cfg->clk_list[i], ret);
+- while (--i >= 0)
+- clk_disable_unprepare(qmp->clks[i]);
++ goto err_clk;
+ }
+ }
+
+ ret = qcom_qmp_phy_com_init(qmp);
+ if (ret)
+- goto err_com_init;
++ goto err_clk;
+
+ if (cfg->has_lane_rst) {
+ ret = reset_control_deassert(qphy->lane_rst);
+@@ -925,7 +922,7 @@ static int qcom_qmp_phy_init(struct phy *phy)
+ reset_control_assert(qphy->lane_rst);
+ err_lane_rst:
+ qcom_qmp_phy_com_exit(qmp);
+-err_com_init:
++err_clk:
+ while (--i >= 0)
+ clk_disable_unprepare(qmp->clks[i]);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch b/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
new file mode 100644
index 0000000000..8805d1f273
--- /dev/null
+++ b/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
@@ -0,0 +1,76 @@
+From f8ba22a39e985c93e278709b1d5f20857a26b49b Mon Sep 17 00:00:00 2001
+From: Vivek Gautam <vivek.gautam@codeaurora.org>
+Date: Tue, 16 Jan 2018 16:26:56 +0530
+Subject: [PATCH] phy: qcom-qmp: Fix phy pipe clock gating
+Git-commit: f8ba22a39e985c93e278709b1d5f20857a26b49b
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Pipe clock comes out of the phy and is available as long as
+the phy is turned on. Clock controller fails to gate this
+clock after the phy is turned off and generates a warning.
+
+/ # [ 33.048561] gcc_usb3_phy_pipe_clk status stuck at 'on'
+[ 33.048585] ------------[ cut here ]------------
+[ 33.052621] WARNING: CPU: 1 PID: 18 at ../drivers/clk/qcom/clk-branch.c:97 clk_branch_wait+0xf0/0x108
+[ 33.057384] Modules linked in:
+[ 33.066497] CPU: 1 PID: 18 Comm: kworker/1:0 Tainted: G W 4.12.0-rc7-00024-gfe926e34c36d-dirty #96
+[ 33.069451] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
+...
+[ 33.278565] [<ffff00000849b27c>] clk_branch_wait+0xf0/0x108
+[ 33.286375] [<ffff00000849b2f4>] clk_branch2_disable+0x28/0x34
+[ 33.291761] [<ffff0000084868dc>] clk_core_disable+0x5c/0x88
+[ 33.297660] [<ffff000008487d68>] clk_core_disable_lock+0x20/0x34
+[ 33.303129] [<ffff000008487d98>] clk_disable+0x1c/0x24
+[ 33.309384] [<ffff0000083ccd78>] qcom_qmp_phy_poweroff+0x20/0x48
+[ 33.314328] [<ffff0000083c53f4>] phy_power_off+0x80/0xdc
+[ 33.320492] [<ffff00000875c950>] dwc3_core_exit+0x94/0xa0
+[ 33.325784] [<ffff00000875c9ac>] dwc3_suspend_common+0x50/0x60
+[ 33.331080] [<ffff00000875ca04>] dwc3_runtime_suspend+0x48/0x6c
+[ 33.336810] [<ffff0000085b82f4>] pm_generic_runtime_suspend+0x28/0x38
+[ 33.342627] [<ffff0000085bace0>] __rpm_callback+0x150/0x254
+[ 33.349222] [<ffff0000085bae08>] rpm_callback+0x24/0x78
+[ 33.354604] [<ffff0000085b9fd8>] rpm_suspend+0xe0/0x4e4
+[ 33.359813] [<ffff0000085bb784>] pm_runtime_work+0xdc/0xf0
+[ 33.365028] [<ffff0000080d7b30>] process_one_work+0x12c/0x28c
+[ 33.370576] [<ffff0000080d7ce8>] worker_thread+0x58/0x3b8
+[ 33.376393] [<ffff0000080dd4a8>] kthread+0x100/0x12c
+[ 33.381776] [<ffff0000080836c0>] ret_from_fork+0x10/0x50
+
+Fix this by disabling it as the first thing in phy_exit().
+
+Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
+Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index e17f0351ccc2..2526971f9929 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -751,8 +751,6 @@ static int qcom_qmp_phy_poweroff(struct phy *phy)
+ struct qmp_phy *qphy = phy_get_drvdata(phy);
+ struct qcom_qmp *qmp = qphy->qmp;
+
+- clk_disable_unprepare(qphy->pipe_clk);
+-
+ regulator_bulk_disable(qmp->cfg->num_vregs, qmp->vregs);
+
+ return 0;
+@@ -936,6 +934,8 @@ static int qcom_qmp_phy_exit(struct phy *phy)
+ const struct qmp_phy_cfg *cfg = qmp->cfg;
+ int i = cfg->num_clks;
+
++ clk_disable_unprepare(qphy->pipe_clk);
++
+ /* PHY reset */
+ qphy_setbits(qphy->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch b/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
new file mode 100644
index 0000000000..5937e87154
--- /dev/null
+++ b/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
@@ -0,0 +1,41 @@
+From 09938ea9d136243e8d1fed6d4d7a257764f28f6d Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 21 Sep 2018 20:53:18 +0900
+Subject: [PATCH] phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs
+Git-commit: 09938ea9d136243e8d1fed6d4d7a257764f28f6d
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+This patch fixes and issue that the vbus_ctrl is disabled by
+rcar_gen3_init_from_a_peri_to_a_host(), so a usb host cannot
+supply the vbus.
+
+Note that this condition will exit when the otg irq happens
+even if we don't apply this patch.
+
+Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index 3d57ea1e1437..a6db25c20e2c 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -195,7 +195,7 @@ static void rcar_gen3_init_from_a_peri_to_a_host(struct rcar_gen3_chan *ch)
+ val = readl(usb2_base + USB2_OBINTEN);
+ writel(val & ~USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+
+- rcar_gen3_enable_vbus_ctrl(ch, 0);
++ rcar_gen3_enable_vbus_ctrl(ch, 1);
+ rcar_gen3_init_for_host(ch);
+
+ writel(val | USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+--
+2.16.4
+
diff --git a/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch b/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
new file mode 100644
index 0000000000..cdb42ddaac
--- /dev/null
+++ b/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
@@ -0,0 +1,78 @@
+From a4781c2a74b249cad814ceea7272997bbd20051e Mon Sep 17 00:00:00 2001
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Thu, 11 Jan 2018 10:40:26 +0800
+Subject: [PATCH] phy: rockchip-emmc: retry calpad busy trimming
+Git-commit: a4781c2a74b249cad814ceea7272997bbd20051e
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+It turns out that 5us isn't enough for all cases, so let's
+retry some more times to wait for caldone.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Tested-by: Ziyuan Xu <xzy.xu@rock-chips.com>
+Signed-off-by: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/rockchip/phy-rockchip-emmc.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-emmc.c b/drivers/phy/rockchip/phy-rockchip-emmc.c
+index f1b24f18e9b2..b0d10934413f 100644
+--- a/drivers/phy/rockchip/phy-rockchip-emmc.c
++++ b/drivers/phy/rockchip/phy-rockchip-emmc.c
+@@ -76,6 +76,10 @@
+ #define PHYCTRL_OTAPDLYSEL_MASK 0xf
+ #define PHYCTRL_OTAPDLYSEL_SHIFT 0x7
+
++#define PHYCTRL_IS_CALDONE(x) \
++ ((((x) >> PHYCTRL_CALDONE_SHIFT) & \
++ PHYCTRL_CALDONE_MASK) == PHYCTRL_CALDONE_DONE)
++
+ struct rockchip_emmc_phy {
+ unsigned int reg_offset;
+ struct regmap *reg_base;
+@@ -90,6 +94,7 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off)
+ unsigned int freqsel = PHYCTRL_FREQSEL_200M;
+ unsigned long rate;
+ unsigned long timeout;
++ int ret;
+
+ /*
+ * Keep phyctrl_pdb and phyctrl_endll low to allow
+@@ -160,17 +165,19 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off)
+ PHYCTRL_PDB_SHIFT));
+
+ /*
+- * According to the user manual, it asks driver to
+- * wait 5us for calpad busy trimming
++ * According to the user manual, it asks driver to wait 5us for
++ * calpad busy trimming. However it is documented that this value is
++ * PVT(A.K.A process,voltage and temperature) relevant, so some
++ * failure cases are found which indicates we should be more tolerant
++ * to calpad busy trimming.
+ */
+- udelay(5);
+- regmap_read(rk_phy->reg_base,
+- rk_phy->reg_offset + GRF_EMMCPHY_STATUS,
+- &caldone);
+- caldone = (caldone >> PHYCTRL_CALDONE_SHIFT) & PHYCTRL_CALDONE_MASK;
+- if (caldone != PHYCTRL_CALDONE_DONE) {
+- pr_err("rockchip_emmc_phy_power: caldone timeout.\n");
+- return -ETIMEDOUT;
++ ret = regmap_read_poll_timeout(rk_phy->reg_base,
++ rk_phy->reg_offset + GRF_EMMCPHY_STATUS,
++ caldone, PHYCTRL_IS_CALDONE(caldone),
++ 0, 50);
++ if (ret) {
++ pr_err("%s: caldone failed, ret=%d\n", __func__, ret);
++ return ret;
+ }
+
+ /* Set the frequency of the DLL operation */
+--
+2.16.4
+
diff --git a/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch b/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
new file mode 100644
index 0000000000..6d06de5f45
--- /dev/null
+++ b/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
@@ -0,0 +1,57 @@
+From 2659392e5c08dff626e6db1d739adff58a94604d Mon Sep 17 00:00:00 2001
+From: Icenowy Zheng <icenowy@aosc.io>
+Date: Thu, 4 Oct 2018 20:28:47 +0800
+Subject: [PATCH] phy: sun4i-usb: add support for missing USB PHY index
+Git-commit: 2659392e5c08dff626e6db1d739adff58a94604d
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The new Allwinner H6 SoC's USB2 PHY has two holes -- USB1 (which is a
+3.0 port with dedicated PHY) and USB2 (which doesn't exist at all).
+
+Add support for this kind of missing USB PHY index.
+
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index d4dcd39b8d76..881078ff73f6 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -126,6 +126,7 @@ struct sun4i_usb_phy_cfg {
+ bool dedicated_clocks;
+ bool enable_pmu_unk1;
+ bool phy0_dual_route;
++ int missing_phys;
+ };
+
+ struct sun4i_usb_phy_data {
+@@ -646,6 +647,9 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
+ if (args->args[0] >= data->cfg->num_phys)
+ return ERR_PTR(-ENODEV);
+
++ if (data->cfg->missing_phys & BIT(args->args[0]))
++ return ERR_PTR(-ENODEV);
++
+ return data->phys[args->args[0]].phy;
+ }
+
+@@ -741,6 +745,9 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
+ struct sun4i_usb_phy *phy = data->phys + i;
+ char name[16];
+
++ if (data->cfg->missing_phys & BIT(i))
++ continue;
++
+ snprintf(name, sizeof(name), "usb%d_vbus", i);
+ phy->vbus = devm_regulator_get_optional(dev, name);
+ if (IS_ERR(phy->vbus)) {
+--
+2.16.4
+
diff --git a/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch b/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
new file mode 100644
index 0000000000..efef6b8c48
--- /dev/null
+++ b/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
@@ -0,0 +1,84 @@
+From b7563e2796f8b23c98afcfea7363194227fa089d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 12 Jan 2018 11:12:05 +0100
+Subject: [PATCH] phy: work around 'phys' references to usb-nop-xceiv devices
+Git-commit: b7563e2796f8b23c98afcfea7363194227fa089d
+Patch-mainline: v4.15-rc9
+References: bsc#1051510
+
+Stefan Wahren reports a problem with a warning fix that was merged
+for v4.15: we had lots of device nodes with a 'phys' property pointing
+to a device node that is not compliant with the binding documented in
+Documentation/devicetree/bindings/phy/phy-bindings.txt
+
+This generally works because USB HCD drivers that support both the generic
+phy subsystem and the older usb-phy subsystem ignore most errors from
+phy_get() and related calls and then use the usb-phy driver instead.
+
+However, it turns out that making the usb-nop-xceiv device compatible with
+the generic-phy binding changes the phy_get() return code from -EINVAL to
+-EPROBE_DEFER, and the dwc2 usb controller driver for bcm2835 now returns
+-EPROBE_DEFER from its probe function rather than ignoring the failure,
+breaking all USB support on raspberry-pi when CONFIG_GENERIC_PHY is
+enabled. The same code is used in the dwc3 driver and the usb_add_hcd()
+function, so a reasonable assumption would be that many other platforms
+are affected as well.
+
+I have reviewed all the related patches and concluded that "usb-nop-xceiv"
+is the only USB phy that is affected by the change, and since it is by far
+the most commonly referenced phy, all the other USB phy drivers appear
+to be used in ways that are are either safe in DT (they don't use the
+'phys' property), or in the driver (they already ignore -EPROBE_DEFER
+from generic-phy when usb-phy is available).
+
+To work around the problem, this adds a special case to _of_phy_get()
+so we ignore any PHY node that is compatible with "usb-nop-xceiv",
+as we know that this can never load no matter how much we defer. In the
+future, we might implement a generic-phy driver for "usb-nop-xceiv"
+and then remove this workaround.
+
+Since we generally want older kernels to also want to work with the
+fixed devicetree files, it would be good to backport the patch into
+stable kernels as well (3.13+ are possibly affected), even though they
+don't contain any of the patches that may have caused regressions.
+
+Fixes: 014d6da6cb25 ARM: dts: bcm283x: Fix DTC warnings about missing phy-cells
+Fixes: c5bbf358b790 arm: dts: nspire: Add missing #phy-cells to usb-nop-xceiv
+Fixes: 44e5dced2ef6 arm: dts: marvell: Add missing #phy-cells to usb-nop-xceiv
+Fixes: f568f6f554b8 ARM: dts: omap: Add missing #phy-cells to usb-nop-xceiv
+Fixes: d745d5f277bf ARM: dts: imx51-zii-rdu1: Add missing #phy-cells to usb-nop-xceiv
+Fixes: 915fbe59cbf2 ARM: dts: imx: Add missing #phy-cells to usb-nop-xceiv
+Link: https://marc.info/?l=linux-usb&m=151518314314753&w=2
+Link: https://patchwork.kernel.org/patch/10158145/
+Cc: stable@vger.kernel.org
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Eric Anholt <eric@anholt.net>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Tested-by: Hans Verkuil <hans.verkuil@cisco.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/phy-core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index b4964b067aec..8f6e8e28996d 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -410,6 +410,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
+ if (ret)
+ return ERR_PTR(-ENODEV);
+
++ /* This phy type handled by the usb-phy subsystem for now */
++ if (of_device_is_compatible(args.np, "usb-nop-xceiv"))
++ return ERR_PTR(-ENODEV);
++
+ mutex_lock(&phy_provider_mutex);
+ phy_provider = of_phy_provider_lookup(args.np);
+ if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
+--
+2.16.4
+
diff --git a/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch b/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
new file mode 100644
index 0000000000..4623625ccb
--- /dev/null
+++ b/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
@@ -0,0 +1,54 @@
+From 7f6d6558ae44bc193eb28df3617c364d3bb6df39 Mon Sep 17 00:00:00 2001
+From: Flavio Leitner <fbl@redhat.com>
+Date: Fri, 28 Sep 2018 14:55:34 -0300
+Subject: [PATCH] Revert "openvswitch: Fix template leak in error cases."
+Git-commit: 7f6d6558ae44bc193eb28df3617c364d3bb6df39
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+This reverts commit 90c7afc96cbbd77f44094b5b651261968e97de67.
+
+When the commit was merged, the code used nf_ct_put() to free
+the entry, but later on commit 76644232e612 ("openvswitch: Free
+tmpl with tmpl_free.") replaced that with nf_ct_tmpl_free which
+is a more appropriate. Now the original problem is removed.
+
+Then 44d6e2f27328 ("net: Replace NF_CT_ASSERT() with WARN_ON().")
+replaced a debug assert with a WARN_ON() which is trigged now.
+
+Signed-off-by: Flavio Leitner <fbl@redhat.com>
+Acked-by: Joe Stringer <joe@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/conntrack.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 86a75105af1a..0aeb34c6389d 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1624,10 +1624,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
+ OVS_NLERR(log, "Failed to allocate conntrack template");
+ return -ENOMEM;
+ }
+-
+- __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
+- nf_conntrack_get(&ct_info.ct->ct_general);
+-
+ if (helper) {
+ err = ovs_ct_add_helper(&ct_info, helper, key, log);
+ if (err)
+@@ -1639,6 +1635,8 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
+ if (err)
+ goto err_free_ct;
+
++ __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
++ nf_conntrack_get(&ct_info.ct->ct_general);
+ return 0;
+ err_free_ct:
+ __ovs_ct_free_action(&ct_info);
+--
+2.16.4
+
diff --git a/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch b/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
new file mode 100644
index 0000000000..49eb304aaa
--- /dev/null
+++ b/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
@@ -0,0 +1,72 @@
+From 83e37e0bdd1470bbe6612250b745ad39b1a7b130 Mon Sep 17 00:00:00 2001
+From: Rakesh Pillai <pillair@codeaurora.org>
+Date: Fri, 15 Feb 2019 14:16:02 +0530
+Subject: [PATCH] mac80211: Restore vif beacon interval if start ap fails
+Git-commit: 83e37e0bdd1470bbe6612250b745ad39b1a7b130
+Patch-mainline: v5.0
+References: bsc#1051510
+
+The starting of AP interface can fail due to invalid
+beacon interval, which does not match the minimum gcd
+requirement set by the wifi driver. In such case, the
+beacon interval of that interface gets updated with
+that invalid beacon interval.
+
+The next time that interface is brought up in AP mode,
+an interface combination check is performed and the
+beacon interval is taken from the previously set value.
+
+In a case where an invalid beacon interval, i.e. a beacon
+interval value which does not satisfy the minimum gcd criteria
+set by the driver, is set, all the subsequent trials to
+bring that interface in AP mode will fail, even if the
+subsequent trials have a valid beacon interval.
+
+To avoid this, in case of a failure in bringing up an
+interface in AP mode due to interface combination error,
+the interface beacon interval which is stored in bss
+conf, needs to be restored with the last working value
+of beacon interval.
+
+Tested on ath10k using WCN3990.
+
+Cc: stable@vger.kernel.org
+Fixes: 0c317a02ca98 ("cfg80211: support virtual interfaces with different beacon intervals")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/cfg.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -884,6 +884,7 @@ static int ieee80211_start_ap(struct wip
+ BSS_CHANGED_P2P_PS |
+ BSS_CHANGED_TXPOWER;
+ int err;
++ int prev_beacon_int;
+
+ old = sdata_dereference(sdata->u.ap.beacon, sdata);
+ if (old)
+@@ -906,6 +907,7 @@ static int ieee80211_start_ap(struct wip
+
+ sdata->needed_rx_chains = sdata->local->rx_chains;
+
++ prev_beacon_int = sdata->vif.bss_conf.beacon_int;
+ sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+
+ mutex_lock(&local->mtx);
+@@ -914,8 +916,10 @@ static int ieee80211_start_ap(struct wip
+ if (!err)
+ ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+ mutex_unlock(&local->mtx);
+- if (err)
++ if (err) {
++ sdata->vif.bss_conf.beacon_int = prev_beacon_int;
+ return err;
++ }
+
+ /*
+ * Apply control port protocol, this allows us to
diff --git a/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch b/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
new file mode 100644
index 0000000000..613522517e
--- /dev/null
+++ b/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
@@ -0,0 +1,61 @@
+From 9d0f50b80222dc273e67e4e14410fcfa4130a90c Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 29 Jan 2019 11:10:57 +0100
+Subject: [PATCH] mac80211: ensure that mgmt tx skbs have tailroom for encryption
+Git-commit: 9d0f50b80222dc273e67e4e14410fcfa4130a90c
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
+frames need to be software encrypted. Since normal data packets are still
+encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
+after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb,
+which don't have the necessary tailroom for software encryption.
+
+Change the code to add tailroom for encrypted management packets, even if
+crypto_tx_tailroom_needed_cnt is 0.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/tx.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index f170d6c6629a..928f13a208b0 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1938,9 +1938,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ int head_need, bool may_encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
++ struct ieee80211_hdr *hdr;
++ bool enc_tailroom;
+ int tail_need = 0;
+
+- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
++ hdr = (struct ieee80211_hdr *) skb->data;
++ enc_tailroom = may_encrypt &&
++ (sdata->crypto_tx_tailroom_needed_cnt ||
++ ieee80211_is_mgmt(hdr->frame_control));
++
++ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+ tail_need -= skb_tailroom(skb);
+ tail_need = max_t(int, tail_need, 0);
+@@ -1948,8 +1955,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+
+ if (skb_cloned(skb) &&
+ (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
+- !skb_clone_writable(skb, ETH_HLEN) ||
+- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
++ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
+ I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+ else if (head_need || tail_need)
+ I802_DEBUG_INC(local->tx_expand_skb_head);
+--
+2.16.4
+
diff --git a/patches.fixes/netrom-switch-to-sock-timer-API.patch b/patches.fixes/netrom-switch-to-sock-timer-API.patch
new file mode 100644
index 0000000000..a79a660511
--- /dev/null
+++ b/patches.fixes/netrom-switch-to-sock-timer-API.patch
@@ -0,0 +1,100 @@
+From 63346650c1a94a92be61a57416ac88c0a47c4327 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 24 Jan 2019 14:18:18 -0800
+Subject: [PATCH] netrom: switch to sock timer API
+Git-commit: 63346650c1a94a92be61a57416ac88c0a47c4327
+Patch-mainline: v5.0-rc5
+References: bsc#1051510
+
+sk_reset_timer() and sk_stop_timer() properly handle
+sock refcnt for timer function. Switching to them
+could fix a refcounting bug reported by syzbot.
+
+Reported-and-tested-by: syzbot+defa700d16f1bd1b9a05@syzkaller.appspotmail.com
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-hams@vger.kernel.org
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/netrom/nr_timer.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
+index cbd51ed5a2d7..908e53ab47a4 100644
+--- a/net/netrom/nr_timer.c
++++ b/net/netrom/nr_timer.c
+@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t1timer, jiffies + nr->t1);
++ sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
+ }
+
+ void nr_start_t2timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t2timer, jiffies + nr->t2);
++ sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
+ }
+
+ void nr_start_t4timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t4timer, jiffies + nr->t4);
++ sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
+ }
+
+ void nr_start_idletimer(struct sock *sk)
+@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
+ struct nr_sock *nr = nr_sk(sk);
+
+ if (nr->idle > 0)
+- mod_timer(&nr->idletimer, jiffies + nr->idle);
++ sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
+ }
+
+ void nr_start_heartbeat(struct sock *sk)
+ {
+- mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
+ }
+
+ void nr_stop_t1timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t1timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t1timer);
+ }
+
+ void nr_stop_t2timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t2timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t2timer);
+ }
+
+ void nr_stop_t4timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t4timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t4timer);
+ }
+
+ void nr_stop_idletimer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->idletimer);
++ sk_stop_timer(sk, &nr_sk(sk)->idletimer);
+ }
+
+ void nr_stop_heartbeat(struct sock *sk)
+ {
+- del_timer(&sk->sk_timer);
++ sk_stop_timer(sk, &sk->sk_timer);
+ }
+
+ int nr_t1timer_running(struct sock *sk)
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch b/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
new file mode 100644
index 0000000000..8e6ce7936d
--- /dev/null
+++ b/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
@@ -0,0 +1,39 @@
+From 04a4af334b971814eedf4e4a413343ad3287d9a9 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Mon, 14 Jan 2019 09:16:56 +0000
+Subject: [PATCH] openvswitch: Avoid OOB read when parsing flow nlattrs
+Git-commit: 04a4af334b971814eedf4e4a413343ad3287d9a9
+Patch-mainline: v5.0-rc3
+References: bsc#1051510
+
+For nested and variable attributes, the expected length of an attribute
+is not known and marked by a negative number. This results in an OOB
+read when the expected length is later used to check if the attribute is
+all zeros. Fix this by using the actual length of the attribute rather
+than the expected length.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/flow_netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 435a4bdf8f89..691da853bef5 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -500,7 +500,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
+ return -EINVAL;
+ }
+
+- if (!nz || !is_all_zero(nla_data(nla), expected_len)) {
++ if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
+ attrs |= 1 << type;
+ a[type] = nla;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch b/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
new file mode 100644
index 0000000000..1dbdf20ad5
--- /dev/null
+++ b/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
@@ -0,0 +1,103 @@
+From 9382fe71c0058465e942a633869629929102843d Mon Sep 17 00:00:00 2001
+From: Ed Swierk <eswierk@skyportsystems.com>
+Date: Wed, 31 Jan 2018 18:48:02 -0800
+Subject: [PATCH] openvswitch: Remove padding from packet before L3+ conntrack processing
+Git-commit: 9382fe71c0058465e942a633869629929102843d
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+IPv4 and IPv6 packets may arrive with lower-layer padding that is not
+included in the L3 length. For example, a short IPv4 packet may have
+up to 6 bytes of padding following the IP payload when received on an
+Ethernet device with a minimum packet length of 64 bytes.
+
+Higher-layer processing functions in netfilter (e.g. nf_ip_checksum(),
+and help() in nf_conntrack_ftp) assume skb->len reflects the length of
+the L3 header and payload, rather than referring back to
+ip_hdr->tot_len or ipv6_hdr->payload_len, and get confused by
+lower-layer padding.
+
+In the normal IPv4 receive path, ip_rcv() trims the packet to
+ip_hdr->tot_len before invoking netfilter hooks. In the IPv6 receive
+path, ip6_rcv() does the same using ipv6_hdr->payload_len. Similarly
+in the br_netfilter receive path, br_validate_ipv4() and
+br_validate_ipv6() trim the packet to the L3 length before invoking
+netfilter hooks.
+
+Currently in the OVS conntrack receive path, ovs_ct_execute() pulls
+the skb to the L3 header but does not trim it to the L3 length before
+calling nf_conntrack_in(NF_INET_PRE_ROUTING). When
+nf_conntrack_proto_tcp encounters a packet with lower-layer padding,
+nf_ip_checksum() fails causing a "nf_ct_tcp: bad TCP checksum" log
+message. While extra zero bytes don't affect the checksum, the length
+in the IP pseudoheader does. That length is based on skb->len, and
+without trimming, it doesn't match the length the sender used when
+computing the checksum.
+
+In ovs_ct_execute(), trim the skb to the L3 length before higher-layer
+processing.
+
+Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/conntrack.c | 34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 62f36cc938ca..c5904f629091 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1098,6 +1098,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
+ return 0;
+ }
+
++/* Trim the skb to the length specified by the IP/IPv6 header,
++ * removing any trailing lower-layer padding. This prepares the skb
++ * for higher-layer processing that assumes skb->len excludes padding
++ * (such as nf_ip_checksum). The caller needs to pull the skb to the
++ * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
++ */
++static int ovs_skb_network_trim(struct sk_buff *skb)
++{
++ unsigned int len;
++ int err;
++
++ switch (skb->protocol) {
++ case htons(ETH_P_IP):
++ len = ntohs(ip_hdr(skb)->tot_len);
++ break;
++ case htons(ETH_P_IPV6):
++ len = sizeof(struct ipv6hdr)
++ + ntohs(ipv6_hdr(skb)->payload_len);
++ break;
++ default:
++ len = skb->len;
++ }
++
++ err = pskb_trim_rcsum(skb, len);
++ if (err)
++ kfree_skb(skb);
++
++ return err;
++}
++
+ /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
+ * value if 'skb' is freed.
+ */
+@@ -1112,6 +1142,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
+ nh_ofs = skb_network_offset(skb);
+ skb_pull_rcsum(skb, nh_ofs);
+
++ err = ovs_skb_network_trim(skb);
++ if (err)
++ return err;
++
+ if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
+ err = handle_fragments(net, key, info->zone.id, skb);
+ if (err)
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch b/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
new file mode 100644
index 0000000000..b7444d4595
--- /dev/null
+++ b/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
@@ -0,0 +1,86 @@
+From 67c8d22a73128ff910e2287567132530abcf5b71 Mon Sep 17 00:00:00 2001
+From: zhangliping <zhangliping02@baidu.com>
+Date: Sat, 25 Nov 2017 22:02:12 +0800
+Subject: [PATCH] openvswitch: fix the incorrect flow action alloc size
+Git-commit: 67c8d22a73128ff910e2287567132530abcf5b71
+Patch-mainline: v4.15-rc2
+References: bsc#1051510
+
+If we want to add a datapath flow, which has more than 500 vxlan outputs'
+action, we will get the following error reports:
+ openvswitch: netlink: Flow action size 32832 bytes exceeds max
+ openvswitch: netlink: Flow action size 32832 bytes exceeds max
+ openvswitch: netlink: Actions may not be safe on all matching packets
+ ... ...
+
+It seems that we can simply enlarge the MAX_ACTIONS_BUFSIZE to fix it, but
+this is not the root cause. For example, for a vxlan output action, we need
+about 60 bytes for the nlattr, but after it is converted to the flow
+action, it only occupies 24 bytes. This means that we can still support
+more than 1000 vxlan output actions for a single datapath flow under the
+the current 32k max limitation.
+
+So even if the nla_len(attr) is larger than MAX_ACTIONS_BUFSIZE, we
+shouldn't report EINVAL and keep it move on, as the judgement can be
+done by the reserve_sfa_size.
+
+Signed-off-by: zhangliping <zhangliping02@baidu.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/flow_netlink.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index dc424798ba6f..624ea74353dd 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2241,14 +2241,11 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
+
+ #define MAX_ACTIONS_BUFSIZE (32 * 1024)
+
+-static struct sw_flow_actions *nla_alloc_flow_actions(int size, bool log)
++static struct sw_flow_actions *nla_alloc_flow_actions(int size)
+ {
+ struct sw_flow_actions *sfa;
+
+- if (size > MAX_ACTIONS_BUFSIZE) {
+- OVS_NLERR(log, "Flow action size %u bytes exceeds max", size);
+- return ERR_PTR(-EINVAL);
+- }
++ WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
+
+ sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
+ if (!sfa)
+@@ -2321,12 +2318,15 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
+ new_acts_size = ksize(*sfa) * 2;
+
+ if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
+- if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size)
++ if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
++ OVS_NLERR(log, "Flow action size exceeds max %u",
++ MAX_ACTIONS_BUFSIZE);
+ return ERR_PTR(-EMSGSIZE);
++ }
+ new_acts_size = MAX_ACTIONS_BUFSIZE;
+ }
+
+- acts = nla_alloc_flow_actions(new_acts_size, log);
++ acts = nla_alloc_flow_actions(new_acts_size);
+ if (IS_ERR(acts))
+ return (void *)acts;
+
+@@ -3059,7 +3059,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ {
+ int err;
+
+- *sfa = nla_alloc_flow_actions(nla_len(attr), log);
++ *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
+ if (IS_ERR(*sfa))
+ return PTR_ERR(*sfa);
+
+--
+2.16.4
+
diff --git a/rpm/klp-symbols b/rpm/klp-symbols
index 012fca43c3..c108030a9e 100755
--- a/rpm/klp-symbols
+++ b/rpm/klp-symbols
@@ -36,7 +36,7 @@ fi
get_symbols()
{
- nm -f posix "$1" | grep -v '\( [UN] \)\|\(\.L\|__crc_\)' | cut -d\ -f1,2
+ nm -f posix "$1" | grep -v '\( [UN] \)\|\(\.L\|__crc_\)' | cut -d\ -f1
}
echo "klp-convert-symbol-data.$KLP_DATA_VERSION" > "$KLP_SYMBOLS"
diff --git a/series.conf b/series.conf
index 7e3ffa8999..fd2d8aca5a 100644
--- a/series.conf
+++ b/series.conf
@@ -5338,6 +5338,7 @@
patches.drivers/0001-xhci-add-port-status-tracing.patch
patches.drivers/0021-usb-Increase-root-hub-reset-signaling-time-to-preven.patch
patches.drivers/0022-xhci-rework-bus_resume-and-check-ports-are-suspended.patch
+ patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
patches.drivers/dt-bindings-phy-sun4i-usb-phy-add-property-descriptions-for-h3.patch
patches.drivers/0037-phy-rockchip-inno-usb2-add-support-for-rockchip-usbg.patch
patches.drivers/0038-phy-rockchip-inno-usb2-add-support-for-otg-mux-inter.patch
@@ -10406,6 +10407,7 @@
patches.fixes/crypto-skcipher-Fix-skcipher_walk_aead_common
patches.drivers/net-thunderx-Fix-TCP-UDP-checksum-offload-for-IPv6-p.patch
patches.fixes/net-openvswitch-datapath-fix-data-type-in-queue_gso_.patch
+ patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
patches.fixes/sctp-set-sender-next_tsn-for-the-old-result-with-cts.patch
patches.drivers/mac80211-use-QoS-NDP-for-AP-probing
patches.drivers/mac80211-fix-the-update-of-path-metric-for-RANN-fram
@@ -11421,6 +11423,7 @@
patches.arch/powerpc-64s-Allow-control-of-RFI-flush-via-debugfs.patch
patches.arch/powerpc-pseries-include-linux-types.h-in-asm-hvcall.h.patch
patches.fixes/ARM-sunxi_defconfig-Enable-CMA.patch
+ patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
patches.fixes/workqueue-avoid-hard-lockups-in-show_workqueue_state.patch
patches.drivers/libata-apply-max_sec_1024-to-all-liteon-ep1-series-devices.patch
patches.drivers/Input-twl4030-vibra-fix-sibling-node-lookup
@@ -13102,6 +13105,7 @@
patches.drivers/net-create-skb_gso_validate_mac_len.patch
patches.drivers/bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
patches.fixes/tcp_bbr-fix-pacing_gain-to-always-be-unity-when-usin.patch
+ patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
patches.suse/rocker-fix-possible-null-pointer-dereference-in-rock.patch
patches.fixes/netfilter-x_tables-fix-pointer-leaks-to-userspace.patch
patches.fixes/netfilter-ipt_CLUSTERIP-fix-out-of-bounds-accesses-i.patch
@@ -14898,6 +14902,9 @@
patches.drivers/usbip-Correct-maximum-value-of-CONFIG_USBIP_VHCI_HC_.patch
patches.drivers/0001-usb-xhci-Clean-up-error-code-in-xhci_dbc_tty_registe.patch
patches.fixes/0001-xhci-zero-usb-device-slot_id-member-when-disabling-a.patch
+ patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
+ patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
+ patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
patches.drivers/USB-serial-ftdi_sio-add-RT-Systems-VX-8-cable.patch
patches.drivers/USB-serial-cp210x-add-ELDAT-Easywave-RX09-id.patch
patches.drivers/USB-serial-ftdi_sio-add-support-for-Harman-FirmwareH.patch
@@ -19067,6 +19074,7 @@
patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
patches.drivers/qlcnic-fix-Tx-descriptor-corruption-on-82xx-devices.patch
patches.fixes/Bluetooth-SMP-fix-crash-in-unpairing.patch
+ patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
patches.drivers/declance-Fix-continuation-with-the-adapter-identific.patch
patches.suse/inet-make-sure-to-grab-rcu_read_lock-before-using-ir.patch
patches.suse/bonding-fix-warning-message.patch
@@ -19134,6 +19142,7 @@
patches.fixes/tools-hv-fcopy-set-error-in-case-an-unknown-operation-was-requested.patch
patches.drivers/mach64-detect-the-dot-clock-divider-correctly-on-spa.patch
patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages
+ patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
patches.fixes/0001-dm-cache-destroy-migration_cache-if-cache-target-reg.patch
patches.fixes/0001-dm-fix-report-zone-remapping-to-account-for-partitio.patch
patches.fixes/0001-dm-linear-eliminate-linear_end_io-call-if-CONFIG_DM_.patch
@@ -19459,6 +19468,7 @@
patches.drivers/RDMA-bnxt_re-Add-missing-spin-lock-initialization.patch
patches.drivers/RDMA-bnxt_re-Avoid-NULL-check-after-accessing-the-po.patch
patches.drivers/RDMA-core-Fix-unwinding-flow-in-case-of-error-to-reg.patch
+ patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
patches.drivers/usb-gadget-udc-atmel-handle-at91sam9rl-PMC.patch
patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
@@ -19669,6 +19679,7 @@
patches.suse/0001-block-make-sure-discard-bio-is-aligned-with-logical-.patch
patches.suse/0001-block-cleanup-__blkdev_issue_discard.patch
patches.suse/0001-block-make-sure-writesame-bio-is-aligned-with-logica.patch
+ patches.drivers/of-numa-Validate-some-distance-map-rules.patch
patches.fixes/lib-raid6-Fix-arm64-test-build.patch
patches.fixes/0001-xen-fix-xen_qlock_wait.patch
patches.drivers/clk-fixed-factor-fix-of_node_get-put-imbalance.patch
@@ -20025,6 +20036,7 @@
patches.suse/net-8139cp-fix-a-BUG-triggered-by-changing-mtu-with-.patch
patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
patches.suse/sctp-kfree_rcu-asoc.patch
+ patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
patches.suse/net-mlx4_en-Change-min-MTU-size-to-ETH_MIN_MTU.patch
patches.suse/rtnetlink-ndo_dflt_fdb_dump-only-work-for-ARPHRD_ETH.patch
patches.drivers/ethernet-fman-fix-wrong-of_node_put-in-probe-function.patch
@@ -20329,6 +20341,7 @@
patches.drivers/gpiolib-Fix-return-value-of-gpio_to_desc-stub-if-GPI.patch
patches.drivers/power-supply-olpc_battery-correct-the-temperature-un.patch
patches.drivers/usb-hub-delay-hub-autosuspend-if-USB3-port-is-still-.patch
+ patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
patches.drivers/usb-dwc3-Correct-the-logic-for-checking-TRB-full-in-.patch
patches.drivers/usb-mtu3-fix-the-issue-about-SetFeature-U1-U2_Enable.patch
patches.drivers/usb-dwc2-host-use-hrtimer-for-nak-retries.patch
@@ -20489,6 +20502,7 @@
patches.fixes/blockdev-Fix-livelocks-on-loop-device.patch
patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets
patches.fixes/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbios_id.patch
+ patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
patches.drivers/amd-xgbe-Fix-mdio-access-for-non-zero-ports-and-clau.patch
patches.fixes/bpf-fix-inner-map-masking-to-prevent-oob-under-specu.patch
patches.fixes/pstore-ram-Avoid-allocation-and-leak-of-platform-dat.patch
@@ -20524,6 +20538,7 @@
patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch
patches.suse/sched-wait-Fix-rcuwait_wake_up-ordering.patch
+ patches.fixes/netrom-switch-to-sock-timer-API.patch
patches.drivers/gpio-pcf857x-Fix-interrupts-on-multiple-instances.patch
patches.drivers/gpio-altera-a10sr-Set-proper-output-level-for-direct.patch
patches.drivers/gpio-vf610-Mask-all-GPIO-interrupts.patch
@@ -20563,6 +20578,7 @@
patches.drivers/usb-phy-am335x-fix-race-condition-in-_probe.patch
patches.drivers/serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
+ patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch
@@ -20593,6 +20609,7 @@
patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch
patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch
patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch
+ patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
# git://linuxtv.org/media_tree.git
patches.fixes/0001-media-usb-pwc-Don-t-use-coherent-DMA-buffers-for-ISO.patch
@@ -21015,6 +21032,7 @@
# Sound
##########################################################
patches.drivers/ALSA-hda-Use-standard-device-registration-for-beep.patch
+ patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
patches.drivers/ASoC-cx2072x-Add-DT-bingings-documentation-for-CX207
patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072