kernel: bump 4.14 to 4.14.136

Refreshed all patches.

Altered patches:
- 306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch

Remove upstreamed:
- 100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch
- 088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch
- 500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch

Fixes:
- CVE-2019-13648
- CVE-2019-10207

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

26 files changed, 58 insertions, 171 deletions

diff --git a/target/linux/apm821xx/patches-4.14/100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch b/target/linux/apm821xx/patches-4.14/100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch
deleted file mode 100644
index ee4eeb6963..0000000000
--- a/target/linux/apm821xx/patches-4.14/100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 9b84ad676e248a3e3c81db7f5d39e1739b3780aa Mon Sep 17 00:00:00 2001
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Sat, 15 Jun 2019 16:35:26 +0200
-Subject: [PATCH] powerpc/4xx/uic: clear pending interrupt after irq type/pol
- change
-
-When testing out gpio-keys with a button, a spurious
-interrupt (and therefore a key press or release event)
-gets triggered as soon as the driver enables the irq
-line for the first time.
-
-This patch clears any potential bogus generated interrupt
-that was caused by the switching of the associated irq's
-type and polarity.
-
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
----
- arch/powerpc/platforms/4xx/uic.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/arch/powerpc/platforms/4xx/uic.c
-+++ b/arch/powerpc/platforms/4xx/uic.c
-@@ -158,6 +158,7 @@ static int uic_set_irq_type(struct irq_d
- 
- 	mtdcr(uic->dcrbase + UIC_PR, pr);
- 	mtdcr(uic->dcrbase + UIC_TR, tr);
-+	mtdcr(uic->dcrbase + UIC_SR, ~mask);
- 
- 	raw_spin_unlock_irqrestore(&uic->lock, flags);
- 
diff --git a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
index ade5c6cc23..1c501867a9 100644
--- a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
+++ b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
@@ -48,7 +48,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  #define	INADDR_ANY		((unsigned long int) 0x00000000)
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
-@@ -921,7 +921,7 @@ static int inet_abc_len(__be32 addr)
+@@ -929,7 +929,7 @@ static int inet_abc_len(__be32 addr)
  {
  	int rc = -1;	/* Something else, probably a multicast. */
  
@@ -57,7 +57,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  		rc = 0;
  	else {
  		__u32 haddr = ntohl(addr);
-@@ -932,6 +932,8 @@ static int inet_abc_len(__be32 addr)
+@@ -940,6 +940,8 @@ static int inet_abc_len(__be32 addr)
  			rc = 16;
  		else if (IN_CLASSC(haddr))
  			rc = 24;
diff --git a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
index 5e339865d3..aad588f19b 100644
--- a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
+++ b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
@@ -159,7 +159,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -202,6 +202,23 @@ repeat:
+@@ -206,6 +206,23 @@ repeat:
  	return NF_ACCEPT;
  }
  
@@ -183,7 +183,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  /* Caller must hold rcu read-side lock */
  void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
  {
-@@ -217,12 +234,12 @@ void nf_reinject(struct nf_queue_entry *
+@@ -221,12 +238,12 @@ void nf_reinject(struct nf_queue_entry *
  	net = entry->state.net;
  	pf = entry->state.pf;
  
diff --git a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
index b27b02f506..41675c3494 100644
--- a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
+++ b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
@@ -152,7 +152,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  #endif
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -205,8 +205,10 @@ repeat:
+@@ -209,8 +209,10 @@ repeat:
  static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
  {
  	switch (pf) {
diff --git a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
index b02ad8a0d7..943b3eed30 100644
--- a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
+++ b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
@@ -212,10 +212,10 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
  		      const struct nf_hook_entries *entries,
  		      unsigned int index, unsigned int queuenum)
-@@ -144,7 +175,16 @@ static int __nf_queue(struct sk_buff *sk
+@@ -148,7 +179,16 @@ static int __nf_queue(struct sk_buff *sk
+ 	};
  
  	nf_queue_entry_get_refs(entry);
- 	skb_dst_force(skb);
 -	afinfo->saveroute(skb, entry);
 +
 +	switch (entry->state.pf) {
diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
index 9303a0b777..810f57ca19 100644
--- a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
+++ b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
@@ -171,7 +171,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -267,7 +267,6 @@ void nf_reinject(struct nf_queue_entry *
+@@ -271,7 +271,6 @@ void nf_reinject(struct nf_queue_entry *
  	const struct nf_hook_entry *hook_entry;
  	const struct nf_hook_entries *hooks;
  	struct sk_buff *skb = entry->skb;
@@ -179,7 +179,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	const struct net *net;
  	unsigned int i;
  	int err;
-@@ -294,8 +293,7 @@ void nf_reinject(struct nf_queue_entry *
+@@ -298,8 +297,7 @@ void nf_reinject(struct nf_queue_entry *
  		verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
  
  	if (verdict == NF_ACCEPT) {
diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
index b4a13dd539..20820e40ca 100644
--- a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
+++ b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
@@ -83,7 +83,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	if (!entry) {
  		status = -ENOMEM;
  		goto err;
-@@ -170,7 +180,7 @@ static int __nf_queue(struct sk_buff *sk
+@@ -175,7 +185,7 @@ static int __nf_queue(struct sk_buff *sk
  		.skb	= skb,
  		.state	= *state,
  		.hook_index = index,
diff --git a/target/linux/generic/hack-4.14/207-disable-modorder.patch b/target/linux/generic/hack-4.14/207-disable-modorder.patch
index 6744cd726e..b45a8e3bc2 100644
--- a/target/linux/generic/hack-4.14/207-disable-modorder.patch
+++ b/target/linux/generic/hack-4.14/207-disable-modorder.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1239,7 +1239,6 @@ all: modules
+@@ -1240,7 +1240,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  
-@@ -1268,7 +1267,6 @@ _modinst_:
+@@ -1269,7 +1268,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/hack-4.14/220-gc_sections.patch b/target/linux/generic/hack-4.14/220-gc_sections.patch
index 2f3f43c07f..d257232403 100644
--- a/target/linux/generic/hack-4.14/220-gc_sections.patch
+++ b/target/linux/generic/hack-4.14/220-gc_sections.patch
@@ -33,7 +33,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  # Read KERNELRELEASE from include/config/kernel.release (if it exists)
  KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
  KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION)
-@@ -787,11 +792,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
+@@ -788,11 +793,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
  KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
  endif
  
diff --git a/target/linux/generic/hack-4.14/259-regmap_dynamic.patch b/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
index 59dfbf3ad2..2cbd791b28 100644
--- a/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
+++ b/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/mutex.h>
  #include <linux/err.h>
  #include <linux/of.h>
-@@ -2926,3 +2927,5 @@ static int __init regmap_initcall(void)
+@@ -2928,3 +2929,5 @@ static int __init regmap_initcall(void)
  	return 0;
  }
  postcore_initcall(regmap_initcall);
diff --git a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
index 24d3cdffa3..97bbee96a9 100644
--- a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
+++ b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1455,6 +1455,9 @@ int genphy_update_link(struct phy_device
+@@ -1461,6 +1461,9 @@ int genphy_update_link(struct phy_device
  {
  	int status;
  
diff --git a/target/linux/generic/hack-4.14/902-debloat_proc.patch b/target/linux/generic/hack-4.14/902-debloat_proc.patch
index 12809bb1be..2a20058ed3 100644
--- a/target/linux/generic/hack-4.14/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.14/902-debloat_proc.patch
@@ -221,7 +221,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!root_irq_dir)
 --- a/kernel/time/timer_list.c
 +++ b/kernel/time/timer_list.c
-@@ -389,6 +389,8 @@ static int __init init_timer_list_procfs
+@@ -390,6 +390,8 @@ static int __init init_timer_list_procfs
  {
  	struct proc_dir_entry *pe;
  
diff --git a/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch b/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
index 4d9f947edc..195507996f 100644
--- a/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #include <uapi/linux/dma-buf.h>
  
-@@ -1205,4 +1206,5 @@ static void __exit dma_buf_deinit(void)
+@@ -1206,4 +1207,5 @@ static void __exit dma_buf_deinit(void)
  {
  	dma_buf_uninit_debugfs();
  }
diff --git a/target/linux/generic/pending-4.14/201-extra_optimization.patch b/target/linux/generic/pending-4.14/201-extra_optimization.patch
index 857951cbf9..6f4e465f65 100644
--- a/target/linux/generic/pending-4.14/201-extra_optimization.patch
+++ b/target/linux/generic/pending-4.14/201-extra_optimization.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -654,12 +654,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
+@@ -655,12 +655,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
  KBUILD_CFLAGS	+= $(call cc-disable-warning, attribute-alias)
  
  ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
diff --git a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
index 5f66c3d501..b0cd863be4 100644
--- a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int absolute_percpu = 0;
  static char symbol_prefix_char = '\0';
  static int base_relative = 0;
-@@ -458,6 +459,9 @@ static void write_src(void)
+@@ -461,6 +462,9 @@ static void write_src(void)
  
  	free(markers);
  
@@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	output_label("kallsyms_token_table");
  	off = 0;
  	for (i = 0; i < 256; i++) {
-@@ -516,6 +520,9 @@ static void *find_token(unsigned char *s
+@@ -519,6 +523,9 @@ static void *find_token(unsigned char *s
  {
  	int i;
  
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	for (i = 0; i < len - 1; i++) {
  		if (str[i] == token[0] && str[i+1] == token[1])
  			return &str[i];
-@@ -588,6 +595,9 @@ static void optimize_result(void)
+@@ -591,6 +598,9 @@ static void optimize_result(void)
  {
  	int i, best;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* using the '\0' symbol last allows compress_symbols to use standard
  	 * fast string functions */
  	for (i = 255; i >= 0; i--) {
-@@ -776,6 +786,8 @@ int main(int argc, char **argv)
+@@ -779,6 +789,8 @@ int main(int argc, char **argv)
  				symbol_prefix_char = *p;
  			} else if (strcmp(argv[i], "--base-relative") == 0)
  				base_relative = 1;
diff --git a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
index 119b53c6d7..4ba722183c 100644
--- a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1099,6 +1099,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1105,6 +1105,9 @@ void phy_detach(struct phy_device *phyde
  	struct module *ndev_owner = dev->dev.parent->driver->owner;
  	struct mii_bus *bus;
  
diff --git a/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch b/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
index f40214c29b..aeb13c5ef7 100644
--- a/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
+++ b/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static struct amd_chipset_info {
  	struct pci_dev	*nb_dev;
  	struct pci_dev	*smbus_dev;
-@@ -620,6 +622,10 @@ bool usb_amd_pt_check_port(struct device
+@@ -627,6 +629,10 @@ bool usb_amd_pt_check_port(struct device
  }
  EXPORT_SYMBOL_GPL(usb_amd_pt_check_port);
  
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /*
   * Make sure the controller is completely inactive, unable to
   * generate interrupts or do DMA.
-@@ -699,8 +705,17 @@ reset_needed:
+@@ -706,8 +712,17 @@ reset_needed:
  	uhci_reset_hc(pdev, base);
  	return 1;
  }
@@ -48,7 +48,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
  {
  	u16 cmd;
-@@ -1287,3 +1302,4 @@ bool usb_xhci_needs_pci_reset(struct pci
+@@ -1294,3 +1309,4 @@ bool usb_xhci_needs_pci_reset(struct pci
  	return false;
  }
  EXPORT_SYMBOL_GPL(usb_xhci_needs_pci_reset);
diff --git a/target/linux/ipq40xx/patches-4.14/088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch b/target/linux/ipq40xx/patches-4.14/088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch
deleted file mode 100644
index 25d0366ec6..0000000000
--- a/target/linux/ipq40xx/patches-4.14/088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 7239872fb3400b21a8f5547257f9f86455867bd6 Mon Sep 17 00:00:00 2001
-From: Abhishek Sahu <absahu@codeaurora.org>
-Date: Mon, 12 Mar 2018 18:44:51 +0530
-Subject: [PATCH 02/13] i2c: qup: fixed releasing dma without flush operation
- completion
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The QUP BSLP BAM generates the following error sometimes if the
-current I2C DMA transfer fails and the flush operation has been
-scheduled
-
-    “bam-dma-engine 7884000.dma: Cannot free busy channel”
-
-If any I2C error comes during BAM DMA transfer, then the QUP I2C
-interrupt will be generated and the flush operation will be
-carried out to make I2C consume all scheduled DMA transfer.
-Currently, the same completion structure is being used for BAM
-transfer which has already completed without reinit. It will make
-flush operation wait_for_completion_timeout completed immediately
-and will proceed for freeing the DMA resources where the
-descriptors are still in process.
-
-Signed-off-by: Abhishek Sahu <absahu@codeaurora.org>
-Acked-by: Sricharan R <sricharan@codeaurora.org>
-Reviewed-by: Austin Christ <austinwc@codeaurora.org>
-Reviewed-by: Andy Gross <andy.gross@linaro.org>
-Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
----
- drivers/i2c/busses/i2c-qup.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/i2c/busses/i2c-qup.c
-+++ b/drivers/i2c/busses/i2c-qup.c
-@@ -835,6 +835,8 @@ static int qup_i2c_bam_do_xfer(struct qu
- 	}
- 
- 	if (ret || qup->bus_err || qup->qup_err) {
-+		reinit_completion(&qup->xfer);
-+
- 		if (qup_i2c_change_state(qup, QUP_RUN_STATE)) {
- 			dev_err(qup->dev, "change to run state timed out");
- 			goto desc_err;
diff --git a/target/linux/layerscape/patches-4.14/816-pcie-support-layerscape.patch b/target/linux/layerscape/patches-4.14/816-pcie-support-layerscape.patch
index 45141a32dc..588be3ce7c 100644
--- a/target/linux/layerscape/patches-4.14/816-pcie-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.14/816-pcie-support-layerscape.patch
@@ -830,7 +830,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  obj-$(CONFIG_PCIE_ARTPEC6) += pcie-artpec6.o
 --- a/drivers/pci/dwc/pci-dra7xx.c
 +++ b/drivers/pci/dwc/pci-dra7xx.c
-@@ -337,15 +337,6 @@ static irqreturn_t dra7xx_pcie_irq_handl
+@@ -338,15 +338,6 @@ static irqreturn_t dra7xx_pcie_irq_handl
  	return IRQ_HANDLED;
  }
  
@@ -3209,7 +3209,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	/* Parse and map our Configuration Space windows */
 --- a/drivers/pci/host/pcie-xilinx-nwl.c
 +++ b/drivers/pci/host/pcie-xilinx-nwl.c
-@@ -779,16 +779,7 @@ static int nwl_pcie_parse_dt(struct nwl_
+@@ -778,16 +778,7 @@ static int nwl_pcie_parse_dt(struct nwl_
  			     struct platform_device *pdev)
  {
  	struct device *dev = pcie->dev;
diff --git a/target/linux/layerscape/patches-4.14/820-sec-support-layerscape.patch b/target/linux/layerscape/patches-4.14/820-sec-support-layerscape.patch
index 95e6894b93..d79c34d2e1 100644
--- a/target/linux/layerscape/patches-4.14/820-sec-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.14/820-sec-support-layerscape.patch
@@ -1917,7 +1917,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  
  	return 0;
  }
-@@ -987,9 +1080,6 @@ static void init_aead_job(struct aead_re
+@@ -989,9 +1082,6 @@ static void init_aead_job(struct aead_re
  		append_seq_out_ptr(desc, dst_dma,
  				   req->assoclen + req->cryptlen - authsize,
  				   out_options);
@@ -1927,7 +1927,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  }
  
  static void init_gcm_job(struct aead_request *req,
-@@ -1004,6 +1094,7 @@ static void init_gcm_job(struct aead_req
+@@ -1006,6 +1096,7 @@ static void init_gcm_job(struct aead_req
  	unsigned int last;
  
  	init_aead_job(req, edesc, all_contig, encrypt);
@@ -1935,7 +1935,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  
  	/* BUG This should not be specific to generic GCM. */
  	last = 0;
-@@ -1021,6 +1112,40 @@ static void init_gcm_job(struct aead_req
+@@ -1023,6 +1114,40 @@ static void init_gcm_job(struct aead_req
  	/* End of blank commands */
  }
  
@@ -1976,7 +1976,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  static void init_authenc_job(struct aead_request *req,
  			     struct aead_edesc *edesc,
  			     bool all_contig, bool encrypt)
-@@ -1030,6 +1155,7 @@ static void init_authenc_job(struct aead
+@@ -1032,6 +1157,7 @@ static void init_authenc_job(struct aead
  						 struct caam_aead_alg, aead);
  	unsigned int ivsize = crypto_aead_ivsize(aead);
  	struct caam_ctx *ctx = crypto_aead_ctx(aead);
@@ -1984,7 +1984,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	const bool ctr_mode = ((ctx->cdata.algtype & OP_ALG_AAI_MASK) ==
  			       OP_ALG_AAI_CTR_MOD128);
  	const bool is_rfc3686 = alg->caam.rfc3686;
-@@ -1053,6 +1179,15 @@ static void init_authenc_job(struct aead
+@@ -1055,6 +1181,15 @@ static void init_authenc_job(struct aead
  
  	init_aead_job(req, edesc, all_contig, encrypt);
  
@@ -2000,7 +2000,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
  		append_load_as_imm(desc, req->iv, ivsize,
  				   LDST_CLASS_1_CCB |
-@@ -1225,8 +1360,16 @@ static struct aead_edesc *aead_edesc_all
+@@ -1227,8 +1362,16 @@ static struct aead_edesc *aead_edesc_all
  		}
  	}
  
@@ -2018,7 +2018,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	sec4_sg_bytes = sec4_sg_len * sizeof(struct sec4_sg_entry);
  
  	/* allocate space for base edesc and hw desc commands, link tables */
-@@ -1307,6 +1450,72 @@ static int gcm_encrypt(struct aead_reque
+@@ -1309,6 +1452,72 @@ static int gcm_encrypt(struct aead_reque
  	return ret;
  }
  
@@ -2091,7 +2091,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  static int ipsec_gcm_encrypt(struct aead_request *req)
  {
  	if (req->assoclen < 8)
-@@ -1494,7 +1703,25 @@ static struct ablkcipher_edesc *ablkciph
+@@ -1496,7 +1705,25 @@ static struct ablkcipher_edesc *ablkciph
  
  	sec4_sg_ents = 1 + mapped_src_nents;
  	dst_sg_idx = sec4_sg_ents;
@@ -2118,7 +2118,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	sec4_sg_bytes = sec4_sg_ents * sizeof(struct sec4_sg_entry);
  
  	/*
-@@ -3196,6 +3423,50 @@ static struct caam_aead_alg driver_aeads
+@@ -3199,6 +3426,50 @@ static struct caam_aead_alg driver_aeads
  			.geniv = true,
  		},
  	},
@@ -2169,7 +2169,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  };
  
  struct caam_crypto_alg {
-@@ -3204,9 +3475,11 @@ struct caam_crypto_alg {
+@@ -3207,9 +3478,11 @@ struct caam_crypto_alg {
  	struct caam_alg_entry caam;
  };
  
@@ -2182,7 +2182,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  
  	ctx->jrdev = caam_jr_alloc();
  	if (IS_ERR(ctx->jrdev)) {
-@@ -3214,10 +3487,16 @@ static int caam_init_common(struct caam_
+@@ -3217,10 +3490,16 @@ static int caam_init_common(struct caam_
  		return PTR_ERR(ctx->jrdev);
  	}
  
@@ -2200,7 +2200,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	if (dma_mapping_error(ctx->jrdev, dma_addr)) {
  		dev_err(ctx->jrdev, "unable to map key, shared descriptors\n");
  		caam_jr_free(ctx->jrdev);
-@@ -3245,7 +3524,7 @@ static int caam_cra_init(struct crypto_t
+@@ -3248,7 +3527,7 @@ static int caam_cra_init(struct crypto_t
  		 container_of(alg, struct caam_crypto_alg, crypto_alg);
  	struct caam_ctx *ctx = crypto_tfm_ctx(tfm);
  
@@ -2209,7 +2209,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  }
  
  static int caam_aead_init(struct crypto_aead *tfm)
-@@ -3255,14 +3534,15 @@ static int caam_aead_init(struct crypto_
+@@ -3258,14 +3537,15 @@ static int caam_aead_init(struct crypto_
  		 container_of(alg, struct caam_aead_alg, aead);
  	struct caam_ctx *ctx = crypto_aead_ctx(tfm);
  
@@ -2227,7 +2227,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	caam_jr_free(ctx->jrdev);
  }
  
-@@ -3276,7 +3556,7 @@ static void caam_aead_exit(struct crypto
+@@ -3279,7 +3559,7 @@ static void caam_aead_exit(struct crypto
  	caam_exit_common(crypto_aead_ctx(tfm));
  }
  
@@ -2236,7 +2236,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  {
  
  	struct caam_crypto_alg *t_alg, *n;
-@@ -3355,56 +3635,52 @@ static void caam_aead_alg_init(struct ca
+@@ -3358,56 +3638,52 @@ static void caam_aead_alg_init(struct ca
  	alg->exit = caam_aead_exit;
  }
  
@@ -2326,7 +2326,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  		md_limit = SHA256_DIGEST_SIZE;
  
  	for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
-@@ -3426,10 +3702,10 @@ static int __init caam_algapi_init(void)
+@@ -3429,10 +3705,10 @@ static int __init caam_algapi_init(void)
  		 * Check support for AES modes not available
  		 * on LP devices.
  		 */
@@ -2341,7 +2341,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  
  		t_alg = caam_alg_alloc(alg);
  		if (IS_ERR(t_alg)) {
-@@ -3468,21 +3744,28 @@ static int __init caam_algapi_init(void)
+@@ -3471,21 +3747,28 @@ static int __init caam_algapi_init(void)
  		if (!aes_inst && (c1_alg_sel == OP_ALG_ALGSEL_AES))
  				continue;
  
@@ -2376,7 +2376,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  
  		caam_aead_alg_init(t_alg);
  
-@@ -3502,10 +3785,3 @@ static int __init caam_algapi_init(void)
+@@ -3505,10 +3788,3 @@ static int __init caam_algapi_init(void)
  
  	return err;
  }
@@ -15266,7 +15266,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  #endif /* __SG_SW_QM_H */
 --- a/drivers/crypto/talitos.c
 +++ b/drivers/crypto/talitos.c
-@@ -1241,6 +1241,14 @@ static int ipsec_esp(struct talitos_edes
+@@ -1247,6 +1247,14 @@ static int ipsec_esp(struct talitos_edes
  	ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
  				 sg_count, areq->assoclen, tbl_off, elen);
  
diff --git a/target/linux/layerscape/patches-4.14/821-smmu-support-layerscape.patch b/target/linux/layerscape/patches-4.14/821-smmu-support-layerscape.patch
index 973146cedf..8b845dd715 100644
--- a/target/linux/layerscape/patches-4.14/821-smmu-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.14/821-smmu-support-layerscape.patch
@@ -123,7 +123,7 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
  
  static struct kset *iommu_group_kset;
  static DEFINE_IDA(iommu_group_ida);
-@@ -987,6 +988,26 @@ struct iommu_group *pci_device_group(str
+@@ -989,6 +990,26 @@ struct iommu_group *pci_device_group(str
  	return iommu_group_alloc();
  }
  
diff --git a/target/linux/mediatek/patches-4.14/0052-net-phy-add-FC.patch b/target/linux/mediatek/patches-4.14/0052-net-phy-add-FC.patch
index 1e0f9a9b2a..c396e314a9 100644
--- a/target/linux/mediatek/patches-4.14/0052-net-phy-add-FC.patch
+++ b/target/linux/mediatek/patches-4.14/0052-net-phy-add-FC.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1937,7 +1937,7 @@ static struct phy_driver genphy_driver =
+@@ -1943,7 +1943,7 @@ static struct phy_driver genphy_driver =
  	.config_init	= genphy_config_init,
  	.features	= PHY_GBIT_FEATURES | SUPPORTED_MII |
  			  SUPPORTED_AUI | SUPPORTED_FIBRE |
diff --git a/target/linux/mvebu/patches-4.14/402-sfp-display-SFP-module-information.patch b/target/linux/mvebu/patches-4.14/402-sfp-display-SFP-module-information.patch
index ccc9896b50..c531c375a0 100644
--- a/target/linux/mvebu/patches-4.14/402-sfp-display-SFP-module-information.patch
+++ b/target/linux/mvebu/patches-4.14/402-sfp-display-SFP-module-information.patch
@@ -10,7 +10,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -264,6 +264,184 @@ static unsigned int sfp_check(void *buf,
+@@ -265,6 +265,184 @@ static unsigned int sfp_check(void *buf,
  	return check;
  }
  
@@ -195,7 +195,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
  /* Helpers */
  static void sfp_module_tx_disable(struct sfp *sfp)
  {
-@@ -432,6 +610,7 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -433,6 +611,7 @@ static int sfp_sm_mod_probe(struct sfp *
  	char sn[17];
  	char date[9];
  	char rev[5];
@@ -203,7 +203,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
  	u8 check;
  	int err;
  
-@@ -475,10 +654,83 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -476,10 +655,83 @@ static int sfp_sm_mod_probe(struct sfp *
  	rev[4] = '\0';
  	memcpy(sn, sfp->id.ext.vendor_sn, 16);
  	sn[16] = '\0';
diff --git a/target/linux/mvebu/patches-4.14/411-sfp-add-sfp-compatible.patch b/target/linux/mvebu/patches-4.14/411-sfp-add-sfp-compatible.patch
index d2e7d22ce5..9174765e6a 100644
--- a/target/linux/mvebu/patches-4.14/411-sfp-add-sfp-compatible.patch
+++ b/target/linux/mvebu/patches-4.14/411-sfp-add-sfp-compatible.patch
@@ -14,7 +14,7 @@ Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -1164,6 +1164,7 @@ static int sfp_remove(struct platform_de
+@@ -1168,6 +1168,7 @@ static int sfp_remove(struct platform_de
  
  static const struct of_device_id sfp_of_match[] = {
  	{ .compatible = "sff,sfp", },
diff --git a/target/linux/mvebu/patches-4.14/450-reprobe_sfp_phy.patch b/target/linux/mvebu/patches-4.14/450-reprobe_sfp_phy.patch
index 19c3d68ee5..b874d8265a 100644
--- a/target/linux/mvebu/patches-4.14/450-reprobe_sfp_phy.patch
+++ b/target/linux/mvebu/patches-4.14/450-reprobe_sfp_phy.patch
@@ -13,7 +13,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -505,7 +505,7 @@ static void sfp_sm_phy_detach(struct sfp
+@@ -506,7 +506,7 @@ static void sfp_sm_phy_detach(struct sfp
  	sfp->mod_phy = NULL;
  }
  
@@ -22,7 +22,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  {
  	struct phy_device *phy;
  	int err;
-@@ -515,11 +515,11 @@ static void sfp_sm_probe_phy(struct sfp
+@@ -516,11 +516,11 @@ static void sfp_sm_probe_phy(struct sfp
  	phy = mdiobus_scan(sfp->i2c_mii, SFP_PHY_ADDR);
  	if (phy == ERR_PTR(-ENODEV)) {
  		dev_info(sfp->dev, "no PHY detected\n");
@@ -36,7 +36,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  	}
  
  	err = sfp_add_phy(sfp->sfp_bus, phy);
-@@ -527,11 +527,13 @@ static void sfp_sm_probe_phy(struct sfp
+@@ -528,11 +528,13 @@ static void sfp_sm_probe_phy(struct sfp
  		phy_device_remove(phy);
  		phy_device_free(phy);
  		dev_err(sfp->dev, "sfp_add_phy failed: %d\n", err);
@@ -51,7 +51,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  }
  
  static void sfp_sm_link_up(struct sfp *sfp)
-@@ -577,14 +579,9 @@ static void sfp_sm_fault(struct sfp *sfp
+@@ -578,14 +580,9 @@ static void sfp_sm_fault(struct sfp *sfp
  
  static void sfp_sm_mod_init(struct sfp *sfp)
  {
@@ -68,7 +68,7 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  
  	/* Setting the serdes link mode is guesswork: there's no
  	 * field in the EEPROM which indicates what mode should
-@@ -598,7 +595,22 @@ static void sfp_sm_mod_init(struct sfp *
+@@ -599,7 +596,22 @@ static void sfp_sm_mod_init(struct sfp *
  	if (sfp->id.base.e1000_base_t ||
  	    sfp->id.base.e100_base_lx ||
  	    sfp->id.base.e100_base_fx)
diff --git a/target/linux/mvebu/patches-4.14/500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch b/target/linux/mvebu/patches-4.14/500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch
deleted file mode 100644
index 9e2b1c14eb..0000000000
--- a/target/linux/mvebu/patches-4.14/500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From c737abc193d16e62e23e2fb585b8b7398ab380d8 Mon Sep 17 00:00:00 2001
-From: allen yan <yanwei@marvell.com>
-Date: Thu, 7 Sep 2017 15:04:53 +0200
-Subject: arm64: dts: marvell: Fix A37xx UART0 register size
-
-Armada-37xx UART0 registers are 0x200 bytes wide. Right next to them are
-the UART1 registers that should not be declared in this node.
-
-Update the example in DT bindings document accordingly.
-
-Signed-off-by: allen yan <yanwei@marvell.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
-Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
----
- Documentation/devicetree/bindings/serial/mvebu-uart.txt | 2 +-
- arch/arm64/boot/dts/marvell/armada-37xx.dtsi            | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
---- a/Documentation/devicetree/bindings/serial/mvebu-uart.txt
-+++ b/Documentation/devicetree/bindings/serial/mvebu-uart.txt
-@@ -8,6 +8,6 @@ Required properties:
- Example:
- 	serial@12000 {
- 		compatible = "marvell,armada-3700-uart";
--		reg = <0x12000 0x400>;
-+		reg = <0x12000 0x200>;
- 		interrupts = <43>;
- 	};
---- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
-+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
-@@ -134,7 +134,7 @@
- 
- 			uart0: serial@12000 {
- 				compatible = "marvell,armada-3700-uart";
--				reg = <0x12000 0x400>;
-+				reg = <0x12000 0x200>;
- 				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
- 				status = "disabled";
- 			};