Fix CVE-2017-1000405 (rhbz 1516514 1519115)

Originally from Ido Schimmel <idosch@mellanox.com>

0001-Input-gpio_keys-Allow-suppression-of-input-events-fo.patch

@@ -0,0 +1,163 @@
+From 25bb14c1e78e641049fd1ee0c404a9ccd2755e44 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 22 Jul 2017 13:00:05 +0200
+Subject: [PATCH 1/2] Input: gpio_keys - Allow suppression of input events for
+ wakeup button presses
+
+In some cases it is undesirable for a wakeup button to send input events
+to userspace if pressed to wakeup the system (if pressed during suspend).
+
+A typical example of this is the power-button on laptops / tablets,
+sending a KEY_POWER event to userspace when woken up with the power-button
+will cause userspace to immediately suspend the system again which is
+undesirable.
+
+For power-buttons attached to a PMIC, or handled by e.g. ACPI, not sending
+an input event in this case is take care of by the PMIC / ACPI hardware /
+code. But in the case of a GPIO button we need to explicitly suppress the
+sending of the input event.
+
+This commit adds support for this by adding a no_wakeup_events bool to
+struct gpio_keys_button, which platform code can set to suppress the
+input events for presses of wakeup keys during suspend.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-This is a rewrite if my "Input: gpio_keys - Do not report wake button
+ presses as evdev events" patch.
+-Instead of unconditionally ignoring presses of all wake-up buttons during
+ suspend, this rewrite makes this configurable per button
+-This version uses a timer to delay clearing the suspended flag for software
+ debouncing, rather then jiffy compare magic
+---
+ drivers/input/keyboard/gpio_keys.c | 33 +++++++++++++++++++++++++++++++--
+ include/linux/gpio_keys.h          |  3 +++
+ 2 files changed, 34 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
+index a047b9af8369..fa3a58620407 100644
+--- a/drivers/input/keyboard/gpio_keys.c
++++ b/drivers/input/keyboard/gpio_keys.c
+@@ -38,6 +38,7 @@ struct gpio_button_data {
+ 
+ 	unsigned short *code;
+ 
++	struct timer_list unsuspend_timer;
+ 	struct timer_list release_timer;
+ 	unsigned int release_delay;	/* in msecs, for IRQ-only buttons */
+ 
+@@ -371,6 +372,9 @@ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ 		return;
+ 	}
+ 
++	if (state && bdata->button->no_wakeup_events && bdata->suspended)
++		return;
++
+ 	if (type == EV_ABS) {
+ 		if (state)
+ 			input_event(input, type, button->code, button->value);
+@@ -400,6 +404,9 @@ static irqreturn_t gpio_keys_gpio_isr(int irq, void *dev_id)
+ 	if (bdata->button->wakeup) {
+ 		const struct gpio_keys_button *button = bdata->button;
+ 
++		if (bdata->button->no_wakeup_events && bdata->suspended)
++			return IRQ_HANDLED;
++
+ 		pm_stay_awake(bdata->input->dev.parent);
+ 		if (bdata->suspended  &&
+ 		    (button->type == 0 || button->type == EV_KEY)) {
+@@ -445,9 +452,13 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 	spin_lock_irqsave(&bdata->lock, flags);
+ 
+ 	if (!bdata->key_pressed) {
+-		if (bdata->button->wakeup)
++		if (bdata->button->wakeup) {
+ 			pm_wakeup_event(bdata->input->dev.parent, 0);
+ 
++			if (bdata->button->no_wakeup_events && bdata->suspended)
++				goto out;
++		}
++
+ 		input_event(input, EV_KEY, *bdata->code, 1);
+ 		input_sync(input);
+ 
+@@ -468,6 +479,13 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
++static void gpio_keys_unsuspend_timer(unsigned long _data)
++{
++	struct gpio_button_data *bdata = (struct gpio_button_data *)_data;
++
++	bdata->suspended = false;
++}
++
+ static void gpio_keys_quiesce_key(void *data)
+ {
+ 	struct gpio_button_data *bdata = data;
+@@ -476,6 +494,8 @@ static void gpio_keys_quiesce_key(void *data)
+ 		cancel_delayed_work_sync(&bdata->work);
+ 	else
+ 		del_timer_sync(&bdata->release_timer);
++
++	del_timer_sync(&bdata->unsuspend_timer);
+ }
+ 
+ static int gpio_keys_setup_key(struct platform_device *pdev,
+@@ -496,6 +516,8 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
+ 	bdata->input = input;
+ 	bdata->button = button;
+ 	spin_lock_init(&bdata->lock);
++	setup_timer(&bdata->unsuspend_timer, gpio_keys_unsuspend_timer,
++		    (unsigned long)bdata);
+ 
+ 	if (child) {
+ 		bdata->gpiod = devm_fwnode_get_gpiod_from_child(dev, NULL,
+@@ -868,6 +890,7 @@ static int __maybe_unused gpio_keys_suspend(struct device *dev)
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+ 			if (bdata->button->wakeup)
+ 				enable_irq_wake(bdata->irq);
++			del_timer_sync(&bdata->unsuspend_timer);
+ 			bdata->suspended = true;
+ 		}
+ 	} else {
+@@ -892,7 +915,13 @@ static int __maybe_unused gpio_keys_resume(struct device *dev)
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+ 			if (bdata->button->wakeup)
+ 				disable_irq_wake(bdata->irq);
+-			bdata->suspended = false;
++			if (bdata->button->no_wakeup_events) {
++				mod_timer(&bdata->unsuspend_timer, jiffies +
++					  msecs_to_jiffies(
++						    bdata->software_debounce));
++			} else {
++				bdata->suspended = false;
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+diff --git a/include/linux/gpio_keys.h b/include/linux/gpio_keys.h
+index 0b71024c082c..d8a85e52b6bb 100644
+--- a/include/linux/gpio_keys.h
++++ b/include/linux/gpio_keys.h
+@@ -15,6 +15,8 @@ struct device;
+  * @debounce_interval:	debounce ticks interval in msecs
+  * @can_disable:	%true indicates that userspace is allowed to
+  *			disable button via sysfs
++ * @no_wakeup_events:	For wake-up source buttons only, if %true then no input
++ *			events will be generated if pressed while suspended
+  * @value:		axis value for %EV_ABS
+  * @irq:		Irq number in case of interrupt keys
+  */
+@@ -27,6 +29,7 @@ struct gpio_keys_button {
+ 	int wakeup;
+ 	int debounce_interval;
+ 	bool can_disable;
++	bool no_wakeup_events;
+ 	int value;
+ 	unsigned int irq;
+ };
+-- 
+2.13.4
+

0001-cpupower-Correct-return-type-of-cpu_power_is_cpu_onl.patch

@@ -1,49 +0,0 @@
-From 9f692cbe4a01dd9e3c3e954ec6b59662b68f9ce4 Mon Sep 17 00:00:00 2001
-From: Laura Abbott <labbott@redhat.com>
-Date: Fri, 9 Sep 2016 10:19:02 -0700
-Subject: [PATCH] cpupower: Correct return type of cpu_power_is_cpu_online in
- cpufreq
-To: Thomas Renninger <trenn@suse.com>
-Cc: linux-pm@vger.kernel.org
-Cc: linux-kernel@vger.kernel.org
-
-When converting to a shared library in ac5a181d065d ("cpupower: Add
-cpuidle parts into library"), cpu_freq_cpu_exists was converted to
-cpupower_is_cpu_online. cpu_req_cpu_exists returned 0 on success and
--ENOSYS on failure whereas cpupower_is_cpu_online returns 1 on success.
-Check for the correct return value in cpufreq-set.
-
-See https://bugzilla.redhat.com/show_bug.cgi?id=1374212
-
-Fixes: ac5a181d065d ("cpupower: Add cpuidle parts into library")
-Reported-by: Julian Seward <jseward@acm.org>
-Signed-off-by: Laura Abbott <labbott@redhat.com>
----
- tools/power/cpupower/utils/cpufreq-set.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
-index b4bf769..8971d71 100644
---- a/tools/power/cpupower/utils/cpufreq-set.c
-+++ b/tools/power/cpupower/utils/cpufreq-set.c
-@@ -296,7 +296,7 @@ int cmd_freq_set(int argc, char **argv)
- 			struct cpufreq_affected_cpus *cpus;
- 
- 			if (!bitmask_isbitset(cpus_chosen, cpu) ||
--			    cpupower_is_cpu_online(cpu))
-+			    cpupower_is_cpu_online(cpu) != 1)
- 				continue;
- 
- 			cpus = cpufreq_get_related_cpus(cpu);
-@@ -316,7 +316,7 @@ int cmd_freq_set(int argc, char **argv)
- 	     cpu <= bitmask_last(cpus_chosen); cpu++) {
- 
- 		if (!bitmask_isbitset(cpus_chosen, cpu) ||
--		    cpupower_is_cpu_online(cpu))
-+		    cpupower_is_cpu_online(cpu) != 1)
- 			continue;
- 
- 		if (cpupower_is_cpu_online(cpu) != 1)
--- 
-2.10.0
-

0001-fs-locks-Remove-fl_nspid-and-use-fs-specific-l_pid-f.patch

@@ -0,0 +1,296 @@
+From 9d5b86ac13c573795525ecac6ed2db39ab23e2a8 Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Sun, 16 Jul 2017 10:28:22 -0400
+Subject: [PATCH] fs/locks: Remove fl_nspid and use fs-specific l_pid for
+ remote locks
+
+Since commit c69899a17ca4 "NFSv4: Update of VFS byte range lock must be
+atomic with the stateid update", NFSv4 has been inserting locks in rpciod
+worker context.  The result is that the file_lock's fl_nspid is the
+kworker's pid instead of the original userspace pid.
+
+The fl_nspid is only used to represent the namespaced virtual pid number
+when displaying locks or returning from F_GETLK.  There's no reason to set
+it for every inserted lock, since we can usually just look it up from
+fl_pid.  So, instead of looking up and holding struct pid for every lock,
+let's just look up the virtual pid number from fl_pid when it is needed.
+That means we can remove fl_nspid entirely.
+
+The translaton and presentation of fl_pid should handle the following four
+cases:
+
+1 - F_GETLK on a remote file with a remote lock:
+    In this case, the filesystem should determine the l_pid to return here.
+    Filesystems should indicate that the fl_pid represents a non-local pid
+    value that should not be translated by returning an fl_pid <= 0.
+
+2 - F_GETLK on a local file with a remote lock:
+    This should be the l_pid of the lock manager process, and translated.
+
+3 - F_GETLK on a remote file with a local lock, and
+4 - F_GETLK on a local file with a local lock:
+    These should be the translated l_pid of the local locking process.
+
+Fuse was already doing the correct thing by translating the pid into the
+caller's namespace.  With this change we must update fuse to translate
+to init's pid namespace, so that the locks API can then translate from
+init's pid namespace into the pid namespace of the caller.
+
+With this change, the locks API will expect that if a filesystem returns
+a remote pid as opposed to a local pid for F_GETLK, that remote pid will
+be <= 0.  This signifies that the pid is remote, and the locks API will
+forego translating that pid into the pid namespace of the local calling
+process.
+
+Finally, we convert remote filesystems to present remote pids using
+negative numbers. Have lustre, 9p, ceph, cifs, and dlm negate the remote
+pid returned for F_GETLK lock requests.
+
+Since local pids will never be larger than PID_MAX_LIMIT (which is
+currently defined as <= 4 million), but pid_t is an unsigned int, we
+should have plenty of room to represent remote pids with negative
+numbers if we assume that remote pid numbers are similarly limited.
+
+If this is not the case, then we run the risk of having a remote pid
+returned for which there is also a corresponding local pid.  This is a
+problem we have now, but this patch should reduce the chances of that
+occurring, while also returning those remote pid numbers, for whatever
+that may be worth.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+---
+ drivers/staging/lustre/lustre/ldlm/ldlm_flock.c |  2 +-
+ fs/9p/vfs_file.c                                |  2 +-
+ fs/ceph/locks.c                                 |  2 +-
+ fs/cifs/cifssmb.c                               |  2 +-
+ fs/dlm/plock.c                                  |  2 +-
+ fs/fuse/file.c                                  |  6 +--
+ fs/locks.c                                      | 62 +++++++++++++++----------
+ include/linux/fs.h                              |  1 -
+ 8 files changed, 45 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
+index b7f28b39c7b3..abcbf075acc0 100644
+--- a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
+@@ -596,7 +596,7 @@ ldlm_flock_completion_ast(struct ldlm_lock *lock, __u64 flags, void *data)
+ 		default:
+ 			getlk->fl_type = F_UNLCK;
+ 		}
+-		getlk->fl_pid = (pid_t)lock->l_policy_data.l_flock.pid;
++		getlk->fl_pid = -(pid_t)lock->l_policy_data.l_flock.pid;
+ 		getlk->fl_start = (loff_t)lock->l_policy_data.l_flock.start;
+ 		getlk->fl_end = (loff_t)lock->l_policy_data.l_flock.end;
+ 	} else {
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 3de3b4a89d89..43c242e17132 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -288,7 +288,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+ 			fl->fl_end = OFFSET_MAX;
+ 		else
+ 			fl->fl_end = glock.start + glock.length - 1;
+-		fl->fl_pid = glock.proc_id;
++		fl->fl_pid = -glock.proc_id;
+ 	}
+ 	kfree(glock.client_id);
+ 	return res;
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 64ae74472046..8cd63e8123d8 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -79,7 +79,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct file *file,
+ 	err = ceph_mdsc_do_request(mdsc, inode, req);
+ 
+ 	if (operation == CEPH_MDS_OP_GETFILELOCK) {
+-		fl->fl_pid = le64_to_cpu(req->r_reply_info.filelock_reply->pid);
++		fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
+ 		if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
+ 			fl->fl_type = F_RDLCK;
+ 		else if (CEPH_LOCK_EXCL == req->r_reply_info.filelock_reply->type)
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 72a53bd19865..118a63e7e221 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2522,7 +2522,7 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon,
+ 			pLockData->fl_start = le64_to_cpu(parm_data->start);
+ 			pLockData->fl_end = pLockData->fl_start +
+ 					le64_to_cpu(parm_data->length) - 1;
+-			pLockData->fl_pid = le32_to_cpu(parm_data->pid);
++			pLockData->fl_pid = -le32_to_cpu(parm_data->pid);
+ 		}
+ 	}
+ 
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index d401425f602a..e631b1689228 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -367,7 +367,7 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ 		locks_init_lock(fl);
+ 		fl->fl_type = (op->info.ex) ? F_WRLCK : F_RDLCK;
+ 		fl->fl_flags = FL_POSIX;
+-		fl->fl_pid = op->info.pid;
++		fl->fl_pid = -op->info.pid;
+ 		fl->fl_start = op->info.start;
+ 		fl->fl_end = op->info.end;
+ 		rv = 0;
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 3ee4fdc3da9e..7cd692f51d1d 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2101,11 +2101,11 @@ static int convert_fuse_file_lock(struct fuse_conn *fc,
+ 		fl->fl_end = ffl->end;
+ 
+ 		/*
+-		 * Convert pid into the caller's pid namespace. If the pid
+-		 * does not map into the namespace fl_pid will get set to 0.
++		 * Convert pid into init's pid namespace.  The locks API will
++		 * translate it into the caller's pid namespace.
+ 		 */
+ 		rcu_read_lock();
+-		fl->fl_pid = pid_vnr(find_pid_ns(ffl->pid, fc->pid_ns));
++		fl->fl_pid = pid_nr_ns(find_pid_ns(ffl->pid, fc->pid_ns), &init_pid_ns);
+ 		rcu_read_unlock();
+ 		break;
+ 
+diff --git a/fs/locks.c b/fs/locks.c
+index d7daa6c8932f..6d0949880ebd 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -137,6 +137,7 @@
+ #define IS_FLOCK(fl)	(fl->fl_flags & FL_FLOCK)
+ #define IS_LEASE(fl)	(fl->fl_flags & (FL_LEASE|FL_DELEG|FL_LAYOUT))
+ #define IS_OFDLCK(fl)	(fl->fl_flags & FL_OFDLCK)
++#define IS_REMOTELCK(fl)	(fl->fl_pid <= 0)
+ 
+ static inline bool is_remote_lock(struct file *filp)
+ {
+@@ -733,7 +734,6 @@ static void locks_wake_up_blocks(struct file_lock *blocker)
+ static void
+ locks_insert_lock_ctx(struct file_lock *fl, struct list_head *before)
+ {
+-	fl->fl_nspid = get_pid(task_tgid(current));
+ 	list_add_tail(&fl->fl_list, before);
+ 	locks_insert_global_locks(fl);
+ }
+@@ -743,10 +743,6 @@ locks_unlink_lock_ctx(struct file_lock *fl)
+ {
+ 	locks_delete_global_locks(fl);
+ 	list_del_init(&fl->fl_list);
+-	if (fl->fl_nspid) {
+-		put_pid(fl->fl_nspid);
+-		fl->fl_nspid = NULL;
+-	}
+ 	locks_wake_up_blocks(fl);
+ }
+ 
+@@ -823,8 +819,6 @@ posix_test_lock(struct file *filp, struct file_lock *fl)
+ 	list_for_each_entry(cfl, &ctx->flc_posix, fl_list) {
+ 		if (posix_locks_conflict(fl, cfl)) {
+ 			locks_copy_conflock(fl, cfl);
+-			if (cfl->fl_nspid)
+-				fl->fl_pid = pid_vnr(cfl->fl_nspid);
+ 			goto out;
+ 		}
+ 	}
+@@ -2048,9 +2042,33 @@ int vfs_test_lock(struct file *filp, struct file_lock *fl)
+ }
+ EXPORT_SYMBOL_GPL(vfs_test_lock);
+ 
++/**
++ * locks_translate_pid - translate a file_lock's fl_pid number into a namespace
++ * @fl: The file_lock who's fl_pid should be translated
++ * @ns: The namespace into which the pid should be translated
++ *
++ * Used to tranlate a fl_pid into a namespace virtual pid number
++ */
++static pid_t locks_translate_pid(struct file_lock *fl, struct pid_namespace *ns)
++{
++	pid_t vnr;
++	struct pid *pid;
++
++	if (IS_OFDLCK(fl))
++		return -1;
++	if (IS_REMOTELCK(fl))
++		return fl->fl_pid;
++
++	rcu_read_lock();
++	pid = find_pid_ns(fl->fl_pid, &init_pid_ns);
++	vnr = pid_nr_ns(pid, ns);
++	rcu_read_unlock();
++	return vnr;
++}
++
+ static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
+ {
+-	flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
++	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
+ #if BITS_PER_LONG == 32
+ 	/*
+ 	 * Make sure we can represent the posix lock via
+@@ -2072,7 +2090,7 @@ static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
+ #if BITS_PER_LONG == 32
+ static void posix_lock_to_flock64(struct flock64 *flock, struct file_lock *fl)
+ {
+-	flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
++	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
+ 	flock->l_start = fl->fl_start;
+ 	flock->l_len = fl->fl_end == OFFSET_MAX ? 0 :
+ 		fl->fl_end - fl->fl_start + 1;
+@@ -2584,22 +2602,16 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
+ {
+ 	struct inode *inode = NULL;
+ 	unsigned int fl_pid;
++	struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
+ 
+-	if (fl->fl_nspid) {
+-		struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
+-
+-		/* Don't let fl_pid change based on who is reading the file */
+-		fl_pid = pid_nr_ns(fl->fl_nspid, proc_pidns);
+-
+-		/*
+-		 * If there isn't a fl_pid don't display who is waiting on
+-		 * the lock if we are called from locks_show, or if we are
+-		 * called from __show_fd_info - skip lock entirely
+-		 */
+-		if (fl_pid == 0)
+-			return;
+-	} else
+-		fl_pid = fl->fl_pid;
++	fl_pid = locks_translate_pid(fl, proc_pidns);
++	/*
++	 * If there isn't a fl_pid don't display who is waiting on
++	 * the lock if we are called from locks_show, or if we are
++	 * called from __show_fd_info - skip lock entirely
++	 */
++	if (fl_pid == 0)
++		return;
+ 
+ 	if (fl->fl_file != NULL)
+ 		inode = locks_inode(fl->fl_file);
+@@ -2674,7 +2686,7 @@ static int locks_show(struct seq_file *f, void *v)
+ 
+ 	fl = hlist_entry(v, struct file_lock, fl_link);
+ 
+-	if (fl->fl_nspid && !pid_nr_ns(fl->fl_nspid, proc_pidns))
++	if (locks_translate_pid(fl, proc_pidns) == 0)
+ 		return 0;
+ 
+ 	lock_get_status(f, fl, iter->li_pos, "");
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 7b5d6816542b..f0b108af9b02 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -999,7 +999,6 @@ struct file_lock {
+ 	unsigned char fl_type;
+ 	unsigned int fl_pid;
+ 	int fl_link_cpu;		/* what cpu's list is this on? */
+-	struct pid *fl_nspid;
+ 	wait_queue_head_t fl_wait;
+ 	struct file *fl_file;
+ 	loff_t fl_start;
+-- 
+2.14.1
+

0001-mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch

@@ -0,0 +1,108 @@
+From a8f97366452ed491d13cf1e44241bc0b5740b1f0 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Mon, 27 Nov 2017 06:21:25 +0300
+Subject: [PATCH] mm, thp: Do not make page table dirty unconditionally in
+ touch_p[mu]d()
+
+Currently, we unconditionally make page table dirty in touch_pmd().
+It may result in false-positive can_follow_write_pmd().
+
+We may avoid the situation, if we would only make the page table entry
+dirty if caller asks for write access -- FOLL_WRITE.
+
+The patch also changes touch_pud() in the same way.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ mm/huge_memory.c | 36 +++++++++++++-----------------------
+ 1 file changed, 13 insertions(+), 23 deletions(-)
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 86fe697e8bfb..0e7ded98d114 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -842,20 +842,15 @@ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pud);
+ #endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */
+
+ static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
+-		pmd_t *pmd)
++		pmd_t *pmd, int flags)
+ {
+ 	pmd_t _pmd;
+
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pmd is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pmd to
+-	 * set the young bit, instead of the current set_pmd_at.
+-	 */
+-	_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
++	_pmd = pmd_mkyoung(*pmd);
++	if (flags & FOLL_WRITE)
++		_pmd = pmd_mkdirty(_pmd);
+ 	if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
+-				pmd, _pmd,  1))
++				pmd, _pmd, flags & FOLL_WRITE))
+ 		update_mmu_cache_pmd(vma, addr, pmd);
+ }
+
+@@ -884,7 +879,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -995,20 +990,15 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+
+ #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+ static void touch_pud(struct vm_area_struct *vma, unsigned long addr,
+-		pud_t *pud)
++		pud_t *pud, int flags)
+ {
+ 	pud_t _pud;
+
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pud is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pud to
+-	 * set the young bit, instead of the current set_pud_at.
+-	 */
+-	_pud = pud_mkyoung(pud_mkdirty(*pud));
++	_pud = pud_mkyoung(*pud);
++	if (flags & FOLL_WRITE)
++		_pud = pud_mkdirty(_pud);
+ 	if (pudp_set_access_flags(vma, addr & HPAGE_PUD_MASK,
+-				pud, _pud,  1))
++				pud, _pud, flags & FOLL_WRITE))
+ 		update_mmu_cache_pud(vma, addr, pud);
+ }
+
+@@ -1031,7 +1021,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+
+ 	if (flags & FOLL_TOUCH)
+-		touch_pud(vma, addr, pud);
++		touch_pud(vma, addr, pud, flags);
+
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -1424,7 +1414,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
+ 	page = pmd_page(*pmd);
+ 	VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
+ 		/*
+ 		 * We don't mlock() pte-mapped THPs. This way we can avoid
+-- 
+2.14.3
+

0001-platform-x86-Add-driver-for-ACPI-INT0002-Virtual-GPI.patch

@@ -0,0 +1,339 @@
+From 3bbfe49a1d965b951527cde0da48f5d7677db264 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 21 May 2017 13:15:11 +0200
+Subject: [PATCH 01/16] platform/x86: Add driver for ACPI INT0002 Virtual GPIO
+ device
+
+Some peripherals on Bay Trail and Cherry Trail platforms signal a
+Power Management Event (PME) to the Power Management Controller (PMC)
+to wakeup the system. When this happens software needs to explicitly
+clear the PME bus 0 status bit in the GPE0a_STS register to avoid an
+IRQ storm on IRQ 9.
+
+This is modelled in ACPI through the INT0002 ACPI device, which is
+called a "Virtual GPIO controller" in ACPI because it defines the
+event handler to call when the PME triggers through _AEI and _L02
+methods as would be done for a real GPIO interrupt in ACPI.
+
+This commit adds a driver which registers the Virtual GPIOs expected
+by the DSDT on these devices, letting gpiolib-acpi claim the
+virtual GPIO and install a GPIO-interrupt handler which call the _L02
+handler as it would for a real GPIO controller.
+
+Cc: joeyli <jlee@suse.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+---
+Changes in v2:
+-Remove dev_err after malloc failure
+-Remove unused empty runtime pm callbacks
+-s/GPE0A_PME_/GPE0A_PME_B0_/
+-Fixed some checkpatch warnings (I forgot to run checkpatch on v1)
+
+Changes in v3:
+-Rewrite as gpiochip driver letting gpiolib-acpi deal with claiming the pin
+ 0x0002 and calling the _L02 event handler when the virtual gpio-irq triggers
+-Rebase on 4.12-rc1
+
+Changes in v4:
+-Drop device_init_wakeup() from _probe(), use pm_system_wakeup() instead
+ of pm_wakeup_hard_event(chip->parent)
+-Improve commit message
+
+Changes in v5:
+-Use BIT() macro for FOO_BIT defines
+-Drop unneeded ACPI_PTR macro usage
+
+Changes in v6:
+-Move back to drivers/platform/x86
+-Expand certain acronyms (PME, PMC)
+-Use linux/gpio/driver.h include instead of linux/gpio.h
+-Document why the get / set / direction_output functions are dummys
+-No functional changes
+
+Changes in v7:
+-Some minor cleanups from Andy:
+ -Move asm/ includes below linux/ includes
+ -s/APCI/ACPI/
+ -Use bitmap_clear on chip->irq_valid_mask
+-Add Linus Walleij's Reviewed-by
+---
+ drivers/platform/x86/Kconfig               |  19 +++
+ drivers/platform/x86/Makefile              |   1 +
+ drivers/platform/x86/intel_int0002_vgpio.c | 219 +++++++++++++++++++++++++++++
+ 3 files changed, 239 insertions(+)
+ create mode 100644 drivers/platform/x86/intel_int0002_vgpio.c
+
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 8489020ecf44..a3ccc3c795a5 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -794,6 +794,25 @@ config INTEL_CHT_INT33FE
+ 	  This driver instantiates i2c-clients for these, so that standard
+ 	  i2c drivers for these chips can bind to the them.
+ 
++config INTEL_INT0002_VGPIO
++	tristate "Intel ACPI INT0002 Virtual GPIO driver"
++	depends on GPIOLIB && ACPI
++	select GPIOLIB_IRQCHIP
++	---help---
++	  Some peripherals on Bay Trail and Cherry Trail platforms signal a
++	  Power Management Event (PME) to the Power Management Controller (PMC)
++	  to wakeup the system. When this happens software needs to explicitly
++	  clear the PME bus 0 status bit in the GPE0a_STS register to avoid an
++	  IRQ storm on IRQ 9.
++
++	  This is modelled in ACPI through the INT0002 ACPI device, which is
++	  called a "Virtual GPIO controller" in ACPI because it defines the
++	  event handler to call when the PME triggers through _AEI and _L02
++	  methods as would be done for a real GPIO interrupt in ACPI.
++
++	  To compile this driver as a module, choose M here: the module will
++	  be called intel_int0002_vgpio.
++
+ config INTEL_HID_EVENT
+ 	tristate "INTEL HID Event"
+ 	depends on ACPI
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index 182a3ed6605a..ab22ce77fb66 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -46,6 +46,7 @@ obj-$(CONFIG_TOSHIBA_BT_RFKILL)	+= toshiba_bluetooth.o
+ obj-$(CONFIG_TOSHIBA_HAPS)	+= toshiba_haps.o
+ obj-$(CONFIG_TOSHIBA_WMI)	+= toshiba-wmi.o
+ obj-$(CONFIG_INTEL_CHT_INT33FE)	+= intel_cht_int33fe.o
++obj-$(CONFIG_INTEL_INT0002_VGPIO) += intel_int0002_vgpio.o
+ obj-$(CONFIG_INTEL_HID_EVENT)	+= intel-hid.o
+ obj-$(CONFIG_INTEL_VBTN)	+= intel-vbtn.o
+ obj-$(CONFIG_INTEL_SCU_IPC)	+= intel_scu_ipc.o
+diff --git a/drivers/platform/x86/intel_int0002_vgpio.c b/drivers/platform/x86/intel_int0002_vgpio.c
+new file mode 100644
+index 000000000000..92dc230ef5b2
+--- /dev/null
++++ b/drivers/platform/x86/intel_int0002_vgpio.c
+@@ -0,0 +1,219 @@
++/*
++ * Intel INT0002 "Virtual GPIO" driver
++ *
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Loosely based on android x86 kernel code which is:
++ *
++ * Copyright (c) 2014, Intel Corporation.
++ *
++ * Author: Dyut Kumar Sil <dyut.k.sil@intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * Some peripherals on Bay Trail and Cherry Trail platforms signal a Power
++ * Management Event (PME) to the Power Management Controller (PMC) to wakeup
++ * the system. When this happens software needs to clear the PME bus 0 status
++ * bit in the GPE0a_STS register to avoid an IRQ storm on IRQ 9.
++ *
++ * This is modelled in ACPI through the INT0002 ACPI device, which is
++ * called a "Virtual GPIO controller" in ACPI because it defines the event
++ * handler to call when the PME triggers through _AEI and _L02 / _E02
++ * methods as would be done for a real GPIO interrupt in ACPI. Note this
++ * is a hack to define an AML event handler for the PME while using existing
++ * ACPI mechanisms, this is not a real GPIO at all.
++ *
++ * This driver will bind to the INT0002 device, and register as a GPIO
++ * controller, letting gpiolib-acpi.c call the _L02 handler as it would
++ * for a real GPIO controller.
++ */
++
++#include <linux/acpi.h>
++#include <linux/bitmap.h>
++#include <linux/gpio/driver.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/suspend.h>
++
++#include <asm/cpu_device_id.h>
++#include <asm/intel-family.h>
++
++#define DRV_NAME			"INT0002 Virtual GPIO"
++
++/* For some reason the virtual GPIO pin tied to the GPE is numbered pin 2 */
++#define GPE0A_PME_B0_VIRT_GPIO_PIN	2
++
++#define GPE0A_PME_B0_STS_BIT		BIT(13)
++#define GPE0A_PME_B0_EN_BIT		BIT(13)
++#define GPE0A_STS_PORT			0x420
++#define GPE0A_EN_PORT			0x428
++
++#define ICPU(model)	{ X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
++
++static const struct x86_cpu_id int0002_cpu_ids[] = {
++/*
++ * Limit ourselves to Cherry Trail for now, until testing shows we
++ * need to handle the INT0002 device on Baytrail too.
++ *	ICPU(INTEL_FAM6_ATOM_SILVERMONT1),	 * Valleyview, Bay Trail *
++ */
++	ICPU(INTEL_FAM6_ATOM_AIRMONT),		/* Braswell, Cherry Trail */
++	{}
++};
++
++/*
++ * As this is not a real GPIO at all, but just a hack to model an event in
++ * ACPI the get / set functions are dummy functions.
++ */
++
++static int int0002_gpio_get(struct gpio_chip *chip, unsigned int offset)
++{
++	return 0;
++}
++
++static void int0002_gpio_set(struct gpio_chip *chip, unsigned int offset,
++			     int value)
++{
++}
++
++static int int0002_gpio_direction_output(struct gpio_chip *chip,
++					 unsigned int offset, int value)
++{
++	return 0;
++}
++
++static void int0002_irq_ack(struct irq_data *data)
++{
++	outl(GPE0A_PME_B0_STS_BIT, GPE0A_STS_PORT);
++}
++
++static void int0002_irq_unmask(struct irq_data *data)
++{
++	u32 gpe_en_reg;
++
++	gpe_en_reg = inl(GPE0A_EN_PORT);
++	gpe_en_reg |= GPE0A_PME_B0_EN_BIT;
++	outl(gpe_en_reg, GPE0A_EN_PORT);
++}
++
++static void int0002_irq_mask(struct irq_data *data)
++{
++	u32 gpe_en_reg;
++
++	gpe_en_reg = inl(GPE0A_EN_PORT);
++	gpe_en_reg &= ~GPE0A_PME_B0_EN_BIT;
++	outl(gpe_en_reg, GPE0A_EN_PORT);
++}
++
++static irqreturn_t int0002_irq(int irq, void *data)
++{
++	struct gpio_chip *chip = data;
++	u32 gpe_sts_reg;
++
++	gpe_sts_reg = inl(GPE0A_STS_PORT);
++	if (!(gpe_sts_reg & GPE0A_PME_B0_STS_BIT))
++		return IRQ_NONE;
++
++	generic_handle_irq(irq_find_mapping(chip->irqdomain,
++					    GPE0A_PME_B0_VIRT_GPIO_PIN));
++
++	pm_system_wakeup();
++
++	return IRQ_HANDLED;
++}
++
++static struct irq_chip int0002_irqchip = {
++	.name			= DRV_NAME,
++	.irq_ack		= int0002_irq_ack,
++	.irq_mask		= int0002_irq_mask,
++	.irq_unmask		= int0002_irq_unmask,
++};
++
++static int int0002_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct x86_cpu_id *cpu_id;
++	struct gpio_chip *chip;
++	int irq, ret;
++
++	/* Menlow has a different INT0002 device? <sigh> */
++	cpu_id = x86_match_cpu(int0002_cpu_ids);
++	if (!cpu_id)
++		return -ENODEV;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(dev, "Error getting IRQ: %d\n", irq);
++		return irq;
++	}
++
++	chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
++	if (!chip)
++		return -ENOMEM;
++
++	chip->label = DRV_NAME;
++	chip->parent = dev;
++	chip->owner = THIS_MODULE;
++	chip->get = int0002_gpio_get;
++	chip->set = int0002_gpio_set;
++	chip->direction_input = int0002_gpio_get;
++	chip->direction_output = int0002_gpio_direction_output;
++	chip->base = -1;
++	chip->ngpio = GPE0A_PME_B0_VIRT_GPIO_PIN + 1;
++	chip->irq_need_valid_mask = true;
++
++	ret = devm_gpiochip_add_data(&pdev->dev, chip, NULL);
++	if (ret) {
++		dev_err(dev, "Error adding gpio chip: %d\n", ret);
++		return ret;
++	}
++
++	bitmap_clear(chip->irq_valid_mask, 0, GPE0A_PME_B0_VIRT_GPIO_PIN);
++
++	/*
++	 * We manually request the irq here instead of passing a flow-handler
++	 * to gpiochip_set_chained_irqchip, because the irq is shared.
++	 */
++	ret = devm_request_irq(dev, irq, int0002_irq,
++			       IRQF_SHARED | IRQF_NO_THREAD, "INT0002", chip);
++	if (ret) {
++		dev_err(dev, "Error requesting IRQ %d: %d\n", irq, ret);
++		return ret;
++	}
++
++	ret = gpiochip_irqchip_add(chip, &int0002_irqchip, 0, handle_edge_irq,
++				   IRQ_TYPE_NONE);
++	if (ret) {
++		dev_err(dev, "Error adding irqchip: %d\n", ret);
++		return ret;
++	}
++
++	gpiochip_set_chained_irqchip(chip, &int0002_irqchip, irq, NULL);
++
++	return 0;
++}
++
++static const struct acpi_device_id int0002_acpi_ids[] = {
++	{ "INT0002", 0 },
++	{ },
++};
++MODULE_DEVICE_TABLE(acpi, int0002_acpi_ids);
++
++static struct platform_driver int0002_driver = {
++	.driver = {
++		.name			= DRV_NAME,
++		.acpi_match_table	= int0002_acpi_ids,
++	},
++	.probe	= int0002_probe,
++};
++
++module_platform_driver(int0002_driver);
++
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_DESCRIPTION("Intel INT0002 Virtual GPIO driver");
++MODULE_LICENSE("GPL");
+-- 
+2.13.0
+

0001-power-supply-max17042_battery-Add-support-for-ACPI-e.patch

@@ -0,0 +1,78 @@
+From 075bb90dbb4d894938c5859e3850987238db9cd8 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 11 Aug 2017 22:30:55 +0200
+Subject: [PATCH 1/2] power: supply: max17042_battery: Add support for ACPI
+ enumeration
+
+Some x86 devices enumerate a max17047 fuel-gauge through a MAX17047
+ACPI firmware-node, add support for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/max17042_battery.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index aecaaa2b0586..b2ddb7eb69c6 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -22,6 +22,7 @@
+  * This driver is based on max17040_battery.c
+  */
+ 
++#include <linux/acpi.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
+@@ -982,6 +983,8 @@ static int max17042_probe(struct i2c_client *client,
+ 	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+ 	const struct power_supply_desc *max17042_desc = &max17042_psy_desc;
+ 	struct power_supply_config psy_cfg = {};
++	const struct acpi_device_id *acpi_id;
++	struct device *dev = &client->dev;
+ 	struct max17042_chip *chip;
+ 	int ret;
+ 	int i;
+@@ -995,7 +998,15 @@ static int max17042_probe(struct i2c_client *client,
+ 		return -ENOMEM;
+ 
+ 	chip->client = client;
+-	chip->chip_type = id->driver_data;
++	if (id) {
++		chip->chip_type = id->driver_data;
++	} else {
++		acpi_id = acpi_match_device(dev->driver->acpi_match_table, dev);
++		if (!acpi_id)
++			return -ENODEV;
++
++		chip->chip_type = acpi_id->driver_data;
++	}
+ 	chip->regmap = devm_regmap_init_i2c(client, &max17042_regmap_config);
+ 	if (IS_ERR(chip->regmap)) {
+ 		dev_err(&client->dev, "Failed to initialize regmap\n");
+@@ -1104,6 +1115,14 @@ static int max17042_resume(struct device *dev)
+ static SIMPLE_DEV_PM_OPS(max17042_pm_ops, max17042_suspend,
+ 			max17042_resume);
+ 
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id max17042_acpi_match[] = {
++	{ "MAX17047", MAXIM_DEVICE_TYPE_MAX17047 },
++	{ }
++};
++MODULE_DEVICE_TABLE(acpi, max17042_acpi_match);
++#endif
++
+ #ifdef CONFIG_OF
+ static const struct of_device_id max17042_dt_match[] = {
+ 	{ .compatible = "maxim,max17042" },
+@@ -1125,6 +1144,7 @@ MODULE_DEVICE_TABLE(i2c, max17042_id);
+ static struct i2c_driver max17042_i2c_driver = {
+ 	.driver	= {
+ 		.name	= "max17042",
++		.acpi_match_table = ACPI_PTR(max17042_acpi_match),
+ 		.of_match_table = of_match_ptr(max17042_dt_match),
+ 		.pm	= &max17042_pm_ops,
+ 	},
+-- 
+2.13.4
+

0001-usb-usbtest-fix-NULL-pointer-dereference.patch

@@ -0,0 +1,41 @@
+From 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 29 Sep 2017 10:54:24 -0400
+Subject: [PATCH] usb: usbtest: fix NULL pointer dereference
+
+If the usbtest driver encounters a device with an IN bulk endpoint but
+no OUT bulk endpoint, it will try to dereference a NULL pointer
+(out->desc.bEndpointAddress).  The problem can be solved by adding a
+missing test.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+---
+ drivers/usb/misc/usbtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 113e38bfe0ef..b3fc602b2e24 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
+ 			return tmp;
+ 	}
+
+-	if (in) {
++	if (in)
+ 		dev->in_pipe = usb_rcvbulkpipe(udev,
+ 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
++	if (out)
+ 		dev->out_pipe = usb_sndbulkpipe(udev,
+ 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+-	}
++
+ 	if (iso_in) {
+ 		dev->iso_in = &iso_in->desc;
+ 		dev->in_iso_pipe = usb_rcvisocpipe(udev,
+-- 
+2.13.6
+

0002-Input-soc_button_array-Suppress-power-button-presses.patch

@@ -0,0 +1,62 @@
+From d561f0543506bc12e7b3355efddb0bfd7ca83c74 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 22 Jul 2017 13:17:36 +0200
+Subject: [PATCH 2/2] Input: soc_button_array - Suppress power button presses
+ during suspend
+
+If the power-button is pressed to wakeup the laptop/tablet from suspend
+and we report a KEY_POWER event to userspace when woken up this will cause
+userspace to immediately suspend the system again which is undesirable.
+
+This commit sets the new no_wakeup_events flag in the gpio_keys_button
+struct for the power-button suppressing the undesirable KEY_POWER input
+events on wake-up.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-New patch in v2 of this patch-set
+---
+ drivers/input/misc/soc_button_array.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
+index f600f3a7a3c6..27b99831cb97 100644
+--- a/drivers/input/misc/soc_button_array.c
++++ b/drivers/input/misc/soc_button_array.c
+@@ -27,6 +27,7 @@ struct soc_button_info {
+ 	unsigned int event_code;
+ 	bool autorepeat;
+ 	bool wakeup;
++	bool no_wakeup_events;
+ };
+ 
+ /*
+@@ -100,6 +101,7 @@ soc_button_device_create(struct platform_device *pdev,
+ 		gpio_keys[n_buttons].active_low = 1;
+ 		gpio_keys[n_buttons].desc = info->name;
+ 		gpio_keys[n_buttons].wakeup = info->wakeup;
++		gpio_keys[n_buttons].no_wakeup_events = info->no_wakeup_events;
+ 		/* These devices often use cheap buttons, use 50 ms debounce */
+ 		gpio_keys[n_buttons].debounce_interval = 50;
+ 		n_buttons++;
+@@ -185,6 +187,7 @@ static int soc_button_parse_btn_desc(struct device *dev,
+ 		info->name = "power";
+ 		info->event_code = KEY_POWER;
+ 		info->wakeup = true;
++		info->no_wakeup_events = true;
+ 	} else if (upage == 0x07 && usage == 0xe3) {
+ 		info->name = "home";
+ 		info->event_code = KEY_LEFTMETA;
+@@ -369,7 +372,7 @@ static int soc_button_probe(struct platform_device *pdev)
+  * Platforms"
+  */
+ static struct soc_button_info soc_button_PNP0C40[] = {
+-	{ "power", 0, EV_KEY, KEY_POWER, false, true },
++	{ "power", 0, EV_KEY, KEY_POWER, false, true, true },
+ 	{ "home", 1, EV_KEY, KEY_LEFTMETA, false, true },
+ 	{ "volume_up", 2, EV_KEY, KEY_VOLUMEUP, true, false },
+ 	{ "volume_down", 3, EV_KEY, KEY_VOLUMEDOWN, true, false },
+-- 
+2.13.4
+

0002-mfd-Add-Cherry-Trail-Whiskey-Cove-PMIC-driver.patch

@@ -0,0 +1,355 @@
+From c0f9254fdd0703ade018b2ff3a8cca433f781a11 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 26 Feb 2017 21:07:29 +0100
+Subject: [PATCH 02/16] mfd: Add Cherry Trail Whiskey Cove PMIC driver
+
+Add mfd driver for Intel CHT Whiskey Cove PMIC, based on various non
+upstreamed CHT Whiskey Cove PMIC patches.
+
+This is a somewhat minimal version which adds irqchip support and cells
+for: ACPI PMIC opregion support, the i2c-controller driving the external
+charger irc and the pwrsrc/extcon block.
+
+Further cells can be added in the future if/when drivers are upstreamed
+for them.
+
+Cc: Bin Gao <bin.gao@intel.com>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+---
+Changes in v2:
+-Since this uses plain mfd and not the intel_soc_pmic stuff give it
+ its own Kconfig and allow this to be built as a module
+-Add missing #include <acpi/acpi_bus.h>
+
+Changes in v3:
+-Drop #include <acpi/acpi_bus.h> again, not the right fix for the build errors
+-Error out when the upper byte of the register-address passed to the regmap
+ functions is 0 rather then hardcoding an address in that case
+-Various minor style tweaks / cleanups
+-Move defines of regulator register addresses to intel_pmic_chtwc.c,
+ it is the only place where they are used
+-Drop now empty include/linux/mfd/intel_chtwc.h
+-Rename intel_soc_pmic_chtwc.c to intel_cht_wc.c to match Kconfig option name
+-Add irqchip support
+-Add external charger cell
+-Add pwrsrc cell
+
+Changes in v4:
+-Use PLATFORM_DEVID_NONE
+
+Changes in v5:
+-Change Kconfig option from tristate to boolean and add a select for the
+ i2c-bus driver, this is necessary because the chtwc PMIC provides an ACPI
+ OPRegion handler, which must be available before other drivers using it
+ are loaded, which can only be ensured if the mfd, opregion and i2c-bus
+ drivers are built in. This fixes errors like these during boot:
+ mmc0: SDHCI controller on ACPI [80860F14:00] using ADMA
+ ACPI Error: No handler for Region [REGS] (ffff93543b0cc3a8) [UserDefinedRegion] (20170119/evregion-166)
+ ACPI Error: Region UserDefinedRegion (ID=143) has no handler (20170119/exfldio-299)
+ ACPI Error: Method parse/execution failed [\_SB.PCI0.I2C7.PMI5.GET] (Node ffff93543b0cde10), AE_NOT_EXIST (20170119/psparse-543)
+ ACPI Error: Method parse/execution failed [\_SB.PCI0.SHC1._PS0] (Node ffff93543b0b5cd0), AE_NOT_EXIST (20170119/psparse-543)
+ acpi 80860F14:02: Failed to change power state to D0
+-Some minor style and capitalization fixes from review by Lee Jones
+
+Changes in v6:
+-Fix Kconfig depends and selects to fix warning reported by kbuild test robot
+
+Changes in v7:
+-Add explanation why this is a bool and why it selects i2c-designwaree
+ to the help text rather then as comments in the Kconfig
+
+Changes in v8:
+-Remove MODULE macros, etc. now that this driver is a bool in Kconfig
+
+Changes in v9:
+-Some whitespace tweaks
+-Return -EINVAL from probe on invalid irq
+-Use probe_new i2c_driver callback
+---
+ drivers/mfd/Kconfig                |  16 +++
+ drivers/mfd/Makefile               |   1 +
+ drivers/mfd/intel_soc_pmic_chtwc.c | 230 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 247 insertions(+)
+ create mode 100644 drivers/mfd/intel_soc_pmic_chtwc.c
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 3eb5c93595f6..5203a86b8f6c 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -470,6 +470,22 @@ config INTEL_SOC_PMIC_BXTWC
+ 	  thermal, charger and related power management functions
+ 	  on these systems.
+ 
++config INTEL_SOC_PMIC_CHTWC
++	bool "Support for Intel Cherry Trail Whiskey Cove PMIC"
++	depends on ACPI && HAS_IOMEM && I2C=y && COMMON_CLK
++	depends on X86 || COMPILE_TEST
++	select MFD_CORE
++	select REGMAP_I2C
++	select REGMAP_IRQ
++	select I2C_DESIGNWARE_PLATFORM
++	help
++	  Select this option to enable support for the Intel Cherry Trail
++	  Whiskey Cove PMIC found on some Intel Cherry Trail systems.
++
++	  This option is a bool as it provides an ACPI OpRegion which must be
++	  available before any devices using it are probed. This option also
++	  causes the designware-i2c driver to be builtin for the same reason.
++
+ config MFD_INTEL_LPSS
+ 	tristate
+ 	select COMMON_CLK
+diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
+index c16bf1ea0ea9..6f6aed8cfccc 100644
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -214,6 +214,7 @@ obj-$(CONFIG_MFD_SKY81452)	+= sky81452.o
+ intel-soc-pmic-objs		:= intel_soc_pmic_core.o intel_soc_pmic_crc.o
+ obj-$(CONFIG_INTEL_SOC_PMIC)	+= intel-soc-pmic.o
+ obj-$(CONFIG_INTEL_SOC_PMIC_BXTWC)	+= intel_soc_pmic_bxtwc.o
++obj-$(CONFIG_INTEL_SOC_PMIC_CHTWC)	+= intel_soc_pmic_chtwc.o
+ obj-$(CONFIG_MFD_MT6397)	+= mt6397-core.o
+ 
+ obj-$(CONFIG_MFD_ALTERA_A10SR)	+= altera-a10sr.o
+diff --git a/drivers/mfd/intel_soc_pmic_chtwc.c b/drivers/mfd/intel_soc_pmic_chtwc.c
+new file mode 100644
+index 000000000000..b35da01d5bcf
+--- /dev/null
++++ b/drivers/mfd/intel_soc_pmic_chtwc.c
+@@ -0,0 +1,230 @@
++/*
++ * MFD core driver for Intel Cherrytrail Whiskey Cove PMIC
++ *
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Based on various non upstream patches to support the CHT Whiskey Cove PMIC:
++ * Copyright (C) 2013-2015 Intel Corporation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/acpi.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/kernel.h>
++#include <linux/mfd/core.h>
++#include <linux/mfd/intel_soc_pmic.h>
++#include <linux/regmap.h>
++
++/* PMIC device registers */
++#define REG_OFFSET_MASK		GENMASK(7, 0)
++#define REG_ADDR_MASK		GENMASK(15, 8)
++#define REG_ADDR_SHIFT		8
++
++#define CHT_WC_IRQLVL1		0x6e02
++#define CHT_WC_IRQLVL1_MASK	0x6e0e
++
++/* Whiskey Cove PMIC share same ACPI ID between different platforms */
++#define CHT_WC_HRV		3
++
++/* Level 1 IRQs (level 2 IRQs are handled in the child device drivers) */
++enum {
++	CHT_WC_PWRSRC_IRQ = 0,
++	CHT_WC_THRM_IRQ,
++	CHT_WC_BCU_IRQ,
++	CHT_WC_ADC_IRQ,
++	CHT_WC_EXT_CHGR_IRQ,
++	CHT_WC_GPIO_IRQ,
++	/* There is no irq 6 */
++	CHT_WC_CRIT_IRQ = 7,
++};
++
++static struct resource cht_wc_pwrsrc_resources[] = {
++	DEFINE_RES_IRQ(CHT_WC_PWRSRC_IRQ),
++};
++
++static struct resource cht_wc_ext_charger_resources[] = {
++	DEFINE_RES_IRQ(CHT_WC_EXT_CHGR_IRQ),
++};
++
++static struct mfd_cell cht_wc_dev[] = {
++	{
++		.name = "cht_wcove_pwrsrc",
++		.num_resources = ARRAY_SIZE(cht_wc_pwrsrc_resources),
++		.resources = cht_wc_pwrsrc_resources,
++	}, {
++		.name = "cht_wcove_ext_chgr",
++		.num_resources = ARRAY_SIZE(cht_wc_ext_charger_resources),
++		.resources = cht_wc_ext_charger_resources,
++	},
++	{	.name = "cht_wcove_region", },
++};
++
++/*
++ * The CHT Whiskey Cove covers multiple I2C addresses, with a 1 Byte
++ * register address space per I2C address, so we use 16 bit register
++ * addresses where the high 8 bits contain the I2C client address.
++ */
++static int cht_wc_byte_reg_read(void *context, unsigned int reg,
++				unsigned int *val)
++{
++	struct i2c_client *client = context;
++	int ret, orig_addr = client->addr;
++
++	if (!(reg & REG_ADDR_MASK)) {
++		dev_err(&client->dev, "Error I2C address not specified\n");
++		return -EINVAL;
++	}
++
++	client->addr = (reg & REG_ADDR_MASK) >> REG_ADDR_SHIFT;
++	ret = i2c_smbus_read_byte_data(client, reg & REG_OFFSET_MASK);
++	client->addr = orig_addr;
++
++	if (ret < 0)
++		return ret;
++
++	*val = ret;
++	return 0;
++}
++
++static int cht_wc_byte_reg_write(void *context, unsigned int reg,
++				 unsigned int val)
++{
++	struct i2c_client *client = context;
++	int ret, orig_addr = client->addr;
++
++	if (!(reg & REG_ADDR_MASK)) {
++		dev_err(&client->dev, "Error I2C address not specified\n");
++		return -EINVAL;
++	}
++
++	client->addr = (reg & REG_ADDR_MASK) >> REG_ADDR_SHIFT;
++	ret = i2c_smbus_write_byte_data(client, reg & REG_OFFSET_MASK, val);
++	client->addr = orig_addr;
++
++	return ret;
++}
++
++static const struct regmap_config cht_wc_regmap_cfg = {
++	.reg_bits = 16,
++	.val_bits = 8,
++	.reg_write = cht_wc_byte_reg_write,
++	.reg_read = cht_wc_byte_reg_read,
++};
++
++static const struct regmap_irq cht_wc_regmap_irqs[] = {
++	REGMAP_IRQ_REG(CHT_WC_PWRSRC_IRQ, 0, BIT(CHT_WC_PWRSRC_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_THRM_IRQ, 0, BIT(CHT_WC_THRM_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_BCU_IRQ, 0, BIT(CHT_WC_BCU_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_ADC_IRQ, 0, BIT(CHT_WC_ADC_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_EXT_CHGR_IRQ, 0, BIT(CHT_WC_EXT_CHGR_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_GPIO_IRQ, 0, BIT(CHT_WC_GPIO_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_CRIT_IRQ, 0, BIT(CHT_WC_CRIT_IRQ)),
++};
++
++static const struct regmap_irq_chip cht_wc_regmap_irq_chip = {
++	.name = "cht_wc_irq_chip",
++	.status_base = CHT_WC_IRQLVL1,
++	.mask_base = CHT_WC_IRQLVL1_MASK,
++	.irqs = cht_wc_regmap_irqs,
++	.num_irqs = ARRAY_SIZE(cht_wc_regmap_irqs),
++	.num_regs = 1,
++};
++
++static int cht_wc_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct intel_soc_pmic *pmic;
++	acpi_status status;
++	unsigned long long hrv;
++	int ret;
++
++	status = acpi_evaluate_integer(ACPI_HANDLE(dev), "_HRV", NULL, &hrv);
++	if (ACPI_FAILURE(status)) {
++		dev_err(dev, "Failed to get PMIC hardware revision\n");
++		return -ENODEV;
++	}
++	if (hrv != CHT_WC_HRV) {
++		dev_err(dev, "Invalid PMIC hardware revision: %llu\n", hrv);
++		return -ENODEV;
++	}
++	if (client->irq < 0) {
++		dev_err(dev, "Invalid IRQ\n");
++		return -EINVAL;
++	}
++
++	pmic = devm_kzalloc(dev, sizeof(*pmic), GFP_KERNEL);
++	if (!pmic)
++		return -ENOMEM;
++
++	pmic->irq = client->irq;
++	pmic->dev = dev;
++	i2c_set_clientdata(client, pmic);
++
++	pmic->regmap = devm_regmap_init(dev, NULL, client, &cht_wc_regmap_cfg);
++	if (IS_ERR(pmic->regmap))
++		return PTR_ERR(pmic->regmap);
++
++	ret = devm_regmap_add_irq_chip(dev, pmic->regmap, pmic->irq,
++				       IRQF_ONESHOT | IRQF_SHARED, 0,
++				       &cht_wc_regmap_irq_chip,
++				       &pmic->irq_chip_data);
++	if (ret)
++		return ret;
++
++	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
++				cht_wc_dev, ARRAY_SIZE(cht_wc_dev), NULL, 0,
++				regmap_irq_get_domain(pmic->irq_chip_data));
++}
++
++static void cht_wc_shutdown(struct i2c_client *client)
++{
++	struct intel_soc_pmic *pmic = i2c_get_clientdata(client);
++
++	disable_irq(pmic->irq);
++}
++
++static int __maybe_unused cht_wc_suspend(struct device *dev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(dev);
++
++	disable_irq(pmic->irq);
++
++	return 0;
++}
++
++static int __maybe_unused cht_wc_resume(struct device *dev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(dev);
++
++	enable_irq(pmic->irq);
++
++	return 0;
++}
++static SIMPLE_DEV_PM_OPS(cht_wc_pm_ops, cht_wc_suspend, cht_wc_resume);
++
++static const struct i2c_device_id cht_wc_i2c_id[] = {
++	{ }
++};
++
++static const struct acpi_device_id cht_wc_acpi_ids[] = {
++	{ "INT34D3", },
++	{ }
++};
++
++static struct i2c_driver cht_wc_driver = {
++	.driver	= {
++		.name	= "CHT Whiskey Cove PMIC",
++		.pm     = &cht_wc_pm_ops,
++		.acpi_match_table = cht_wc_acpi_ids,
++	},
++	.probe_new = cht_wc_probe,
++	.shutdown = cht_wc_shutdown,
++	.id_table = cht_wc_i2c_id,
++};
++builtin_i2c_driver(cht_wc_driver);
+-- 
+2.13.0
+

0002-power-supply-max17042_battery-Fix-ACPI-interrupt-iss.patch

@@ -0,0 +1,80 @@
+From 27b9d46d25c873b351757c44ce523bf0ede1d08e Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 14 Aug 2017 11:02:59 +0200
+Subject: [PATCH 2/2] power: supply: max17042_battery: Fix ACPI interrupt
+ issues
+
+On some x86/ACPI boards the DSDT defines an ACPI event handler for
+the max17047 IRQ, this causes several problems:
+
+1) We need to share the IRQ to avoid an error getting it
+
+2) Even of we are willing to share, we may fail to share because some
+   DSDTs claim it exclusivly
+
+3) If we are unable to share the IRQ, or the IRQ is only listed as an
+   ACPI event source and not in the max1704 firmware node, then the
+   charge threshold IRQ (which is used to give an IRQ every 1 percent
+   charge change) becomes a problem, the ACPI event handler will not
+   update this to the next 1 percent threshold, so the IRQ keeps firing
+   and we get an IRQ storm pegging 1 CPU core.
+
+   This happens despite the max17042 driver not setting the charge
+   threshold because Windows uses it and leaves it set on reboot.
+
+   So if we are unable to get the IRQ we need to reprogram the
+   charge threshold to its disabled setting.
+
+This commit fixes al of the above, while at it it also makes the error
+msg when being unable to get the IRQ consistent with other messages.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/max17042_battery.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index b2ddb7eb69c6..18a44e4ed6ff 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -1050,11 +1050,18 @@ static int max17042_probe(struct i2c_client *client,
+ 	}
+ 
+ 	if (client->irq) {
++		unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT;
++
++		/*
++		 * On ACPI systems the IRQ may be handled by ACPI-event code,
++		 * so we need to share (if the ACPI code is willing to share).
++		 */
++		if (acpi_id)
++			flags |= IRQF_SHARED | IRQF_PROBE_SHARED;
++
+ 		ret = devm_request_threaded_irq(&client->dev, client->irq,
+ 						NULL,
+-						max17042_thread_handler,
+-						IRQF_TRIGGER_FALLING |
+-						IRQF_ONESHOT,
++						max17042_thread_handler, flags,
+ 						chip->battery->desc->name,
+ 						chip);
+ 		if (!ret) {
+@@ -1064,10 +1071,13 @@ static int max17042_probe(struct i2c_client *client,
+ 			max17042_set_soc_threshold(chip, 1);
+ 		} else {
+ 			client->irq = 0;
+-			dev_err(&client->dev, "%s(): cannot get IRQ\n",
+-				__func__);
++			if (ret != -EBUSY)
++				dev_err(&client->dev, "Failed to get IRQ\n");
+ 		}
+ 	}
++	/* Not able to update the charge threshold when exceeded? -> disable */
++	if (!client->irq)
++		regmap_write(chip->regmap, MAX17042_SALRT_Th, 0xff00);
+ 
+ 	regmap_read(chip->regmap, MAX17042_STATUS, &val);
+ 	if (val & STATUS_POR_BIT) {
+-- 
+2.13.4
+

0003-power-supply-core-Add-support-for-supplied-from-devi.patch

@@ -0,0 +1,57 @@
+From 69dd0606a0d8680fe0a5e9b959f6662e582e1674 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 2 May 2017 13:43:34 +0200
+Subject: [PATCH 03/16] power: supply: core: Add support for supplied-from
+ device-property
+
+On devicetree using platforms the devicetree can provide info on which
+power-supplies supply another power-supply through phandles.
+
+This commit adds support for providing this info on non devicetree
+platforms through the platform code setting a supplied-from
+device-property on the power-supplies parent device.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/power_supply_core.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 7ec7c7c202bd..0c09144193a6 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -274,8 +274,30 @@ static int power_supply_check_supplies(struct power_supply *psy)
+ 	return power_supply_populate_supplied_from(psy);
+ }
+ #else
+-static inline int power_supply_check_supplies(struct power_supply *psy)
++static int power_supply_check_supplies(struct power_supply *psy)
+ {
++	int nval, ret;
++
++	if (!psy->dev.parent)
++		return 0;
++
++	nval = device_property_read_string_array(psy->dev.parent,
++						 "supplied-from", NULL, 0);
++	if (nval <= 0)
++		return 0;
++
++	psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
++						sizeof(char *), GFP_KERNEL);
++	if (!psy->supplied_from)
++		return -ENOMEM;
++
++	ret = device_property_read_string_array(psy->dev.parent,
++		"supplied-from", (const char **)psy->supplied_from, nval);
++	if (ret < 0)
++		return ret;
++
++	psy->num_supplies = nval;
++
+ 	return 0;
+ }
+ #endif
+-- 
+2.13.0
+

0004-platform-x86-intel_cht_int33fe-Set-supplied-from-pro.patch

@@ -0,0 +1,48 @@
+From 99c44df299d96db6a170ccce9b8108fc2e7f8bae Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 2 May 2017 13:40:44 +0200
+Subject: [PATCH 04/16] platform/x86: intel_cht_int33fe: Set supplied-from
+ property on max17047 dev
+
+Devices with the intel_cht_int33fe ACPI device use a max17047 fuel-gauge
+combined with a bq24272i charger, in order for the fuel-gauge driver to
+correctly display charging / discharging status it needs to know which
+charger is supplying the battery.
+
+This commit sets the supplied-from device property to the name of the
+bq24272i charger for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/intel_cht_int33fe.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/intel_cht_int33fe.c b/drivers/platform/x86/intel_cht_int33fe.c
+index 6a1b2ca5b6fe..da706e2c4232 100644
+--- a/drivers/platform/x86/intel_cht_int33fe.c
++++ b/drivers/platform/x86/intel_cht_int33fe.c
+@@ -34,6 +34,13 @@ struct cht_int33fe_data {
+ 	struct i2c_client *pi3usb30532;
+ };
+ 
++static const char * const max17047_suppliers[] = { "bq24190-charger" };
++
++static const struct property_entry max17047_props[] = {
++	PROPERTY_ENTRY_STRING_ARRAY("supplied-from", max17047_suppliers),
++	{ }
++};
++
+ static int cht_int33fe_probe(struct i2c_client *client)
+ {
+ 	struct device *dev = &client->dev;
+@@ -70,6 +77,7 @@ static int cht_int33fe_probe(struct i2c_client *client)
+ 
+ 	memset(&board_info, 0, sizeof(board_info));
+ 	strlcpy(board_info.type, "max17047", I2C_NAME_SIZE);
++	board_info.properties = max17047_props;
+ 
+ 	data->max17047 = i2c_acpi_new_device(dev, 1, &board_info);
+ 	if (!data->max17047)
+-- 
+2.13.0
+

0005-ACPI-PMIC-xpower-Add-support-for-the-GPI1-regulator-.patch

@@ -0,0 +1,80 @@
+From cc2b0e2c164d02ab42efa736f91f53baf8d8bc36 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 20 Apr 2017 22:41:20 +0200
+Subject: [PATCH 05/16] ACPI / PMIC: xpower: Add support for the GPI1 regulator
+ to the OpRegion handler
+
+Some Bay Trail devices use a GPI1 regulator field (address 0x4c) in
+their 0x8d power OpRegion, add support for this.
+
+This fixes AE_BAD_PARAMETER errors getting thrown on these devices and
+fixes these errors causing these devices to not suspend.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+---
+Changes in v2:
+-Simplify reg == 0x92 handling (suggested by Andy Shevchenko)
+-Add special handling for reg == 0x92 to intel_xpower_pmic_get_power() too
+Changes in v3:
+-Use defines for GPI1 reg and bits, rather then hardcoded hex values
+---
+ drivers/acpi/pmic/intel_pmic_xpower.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c
+index 1a76c784cd4c..3b7d5be5b7ed 100644
+--- a/drivers/acpi/pmic/intel_pmic_xpower.c
++++ b/drivers/acpi/pmic/intel_pmic_xpower.c
+@@ -21,6 +21,11 @@
+ #include "intel_pmic.h"
+ 
+ #define XPOWER_GPADC_LOW	0x5b
++#define XPOWER_GPI1_CTRL	0x92
++
++#define GPI1_LDO_MASK		GENMASK(2, 0)
++#define GPI1_LDO_ON		(3 << 0)
++#define GPI1_LDO_OFF		(4 << 0)
+ 
+ static struct pmic_table power_table[] = {
+ 	{
+@@ -118,6 +123,10 @@ static struct pmic_table power_table[] = {
+ 		.reg = 0x10,
+ 		.bit = 0x00
+ 	}, /* BUC6 */
++	{
++		.address = 0x4c,
++		.reg = 0x92,
++	}, /* GPI1 */
+ };
+ 
+ /* TMP0 - TMP5 are the same, all from GPADC */
+@@ -156,7 +165,12 @@ static int intel_xpower_pmic_get_power(struct regmap *regmap, int reg,
+ 	if (regmap_read(regmap, reg, &data))
+ 		return -EIO;
+ 
+-	*value = (data & BIT(bit)) ? 1 : 0;
++	/* GPIO1 LDO regulator needs special handling */
++	if (reg == XPOWER_GPI1_CTRL)
++		*value = ((data & GPI1_LDO_MASK) == GPI1_LDO_ON);
++	else
++		*value = (data & BIT(bit)) ? 1 : 0;
++
+ 	return 0;
+ }
+ 
+@@ -165,6 +179,11 @@ static int intel_xpower_pmic_update_power(struct regmap *regmap, int reg,
+ {
+ 	int data;
+ 
++	/* GPIO1 LDO regulator needs special handling */
++	if (reg == XPOWER_GPI1_CTRL)
++		return regmap_update_bits(regmap, reg, GPI1_LDO_MASK,
++					  on ? GPI1_LDO_ON : GPI1_LDO_OFF);
++
+ 	if (regmap_read(regmap, reg, &data))
+ 		return -EIO;
+ 
+-- 
+2.13.0
+

0006-Input-axp20x-pek-Add-wakeup-support.patch

@@ -0,0 +1,67 @@
+From fbac4c05ec1d7c2d949f50baf1e934cbfbb6a494 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 17 Apr 2017 22:06:25 +0200
+Subject: [PATCH 06/16] Input: axp20x-pek - Add wakeup support
+
+At least on devices with the AXP288 PMIC the device is expected to
+wakeup from suspend when the power-button gets pressed, add support
+for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/misc/axp20x-pek.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
+index 400869e61a06..5f16fceaae83 100644
+--- a/drivers/input/misc/axp20x-pek.c
++++ b/drivers/input/misc/axp20x-pek.c
+@@ -253,6 +253,9 @@ static int axp20x_pek_probe_input_device(struct axp20x_pek *axp20x_pek,
+ 		return error;
+ 	}
+ 
++	if (axp20x_pek->axp20x->variant == AXP288_ID)
++		enable_irq_wake(axp20x_pek->irq_dbr);
++
+ 	return 0;
+ }
+ 
+@@ -331,10 +334,35 @@ static int axp20x_pek_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static int __maybe_unused axp20x_pek_resume_noirq(struct device *dev)
++{
++	struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
++
++	if (axp20x_pek->axp20x->variant != AXP288_ID)
++		return 0;
++
++	/*
++	 * Clear interrupts from button presses during suspend, to avoid
++	 * a wakeup power-button press getting reported to userspace.
++	 */
++	regmap_write(axp20x_pek->axp20x->regmap,
++		     AXP20X_IRQ1_STATE + AXP288_IRQ_POKN / 8,
++		     BIT(AXP288_IRQ_POKN % 8));
++
++	return 0;
++}
++
++const struct dev_pm_ops axp20x_pek_pm_ops = {
++#ifdef CONFIG_PM_SLEEP
++	.resume_noirq = axp20x_pek_resume_noirq,
++#endif
++};
++
+ static struct platform_driver axp20x_pek_driver = {
+ 	.probe		= axp20x_pek_probe,
+ 	.driver		= {
+ 		.name		= "axp20x-pek",
++		.pm		= &axp20x_pek_pm_ops,
+ 	},
+ };
+ module_platform_driver(axp20x_pek_driver);
+-- 
+2.13.0
+

0007-platform-x86-silead_dmi-Add-touchscreen-info-for-GP-.patch

@@ -0,0 +1,56 @@
+From d95c127c48ef784214671359a41ac505ac30098a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 7 May 2017 12:32:11 +0200
+Subject: [PATCH 07/16] platform/x86: silead_dmi: Add touchscreen info for
+ GP-electronic T701
+
+Add touchscreen info for the GP-electronic T701 tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index a3a57d93cf06..db3a877d2160 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -80,6 +80,19 @@ static const struct silead_ts_dmi_data surftab_wintron70_st70416_6_data = {
+ 	.properties	= surftab_wintron70_st70416_6_props,
+ };
+ 
++static const struct property_entry gp_electronic_t701_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 960),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 640),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl1680-gp-electronic-t701.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data gp_electronic_t701_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= gp_electronic_t701_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -117,6 +130,15 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_VERSION, "TREK.G.WI71C.JGBMRBA04"),
+ 		},
+ 	},
++	{
++		/* GP-electronic T701 */
++		.driver_data = (void *)&gp_electronic_t701_data,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "T701"),
++			DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0008-platform-x86-silead_dmi-Add-touchscreen-info-for-PoV.patch

@@ -0,0 +1,59 @@
+From 55b347c61b2850d1e11e159ab02dc71f13b06481 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 11 Jun 2017 17:42:31 +0200
+Subject: [PATCH 08/16] platform/x86: silead_dmi: Add touchscreen info for PoV
+ mobii wintab p800w
+
+Add touchscreen info for the Point of View mobii wintab p800w tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index db3a877d2160..46c5e1ebfb53 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -93,6 +93,20 @@ static const struct silead_ts_dmi_data gp_electronic_t701_data = {
+ 	.properties	= gp_electronic_t701_props,
+ };
+ 
++static const struct property_entry pov_mobii_wintab_p800w_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 1800),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 1150),
++	PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl3692-pov-mobii-wintab-p800w.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data pov_mobii_wintab_p800w_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= pov_mobii_wintab_p800w_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -139,6 +153,17 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
+ 		},
+ 	},
++	{
++		/* Point of View mobii wintab p800w */
++		.driver_data = (void *)&pov_mobii_wintab_p800w_data,
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++			DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++			DMI_MATCH(DMI_BIOS_VERSION, "3BAIR1013"),
++			/* Above matches are too generic, add bios-date match */
++			DMI_MATCH(DMI_BIOS_DATE, "08/22/2014"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0009-platform-x86-silead_dmi-Add-touchscreen-info-for-Pip.patch

@@ -0,0 +1,57 @@
+From b239a7a0c2a1435aa5cbab3f233e0c37e82943dd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 13 Jun 2017 18:17:07 +0200
+Subject: [PATCH 09/16] platform/x86: silead_dmi: Add touchscreen info for Pipo
+ W2S tablet
+
+Add touchscreen info for Pipo W2S tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index 46c5e1ebfb53..25cbea307a5e 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -107,6 +107,21 @@ static const struct silead_ts_dmi_data pov_mobii_wintab_p800w_data = {
+ 	.properties	= pov_mobii_wintab_p800w_props,
+ };
+ 
++static const struct property_entry pipo_w2s_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 1660),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 880),
++	PROPERTY_ENTRY_BOOL("touchscreen-inverted-x"),
++	PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl1680-pipo-w2s.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data pipo_w2s_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= pipo_w2s_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -164,6 +179,14 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_DATE, "08/22/2014"),
+ 		},
+ 	},
++	{
++		/* Pipo W2S */
++		.driver_data = (void *)&pipo_w2s_data,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "PIPO"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "W2S"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0010-Input-silead-Add-support-for-capactive-home-button-f.patch

@@ -0,0 +1,114 @@
+From 33fc16fd8aa3684e19b1d1f0a712593e2e570ab1 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 11 Jun 2017 21:24:50 +0200
+Subject: [PATCH 10/16] Input: silead: Add support for capactive home button
+ found on some x86 tablets
+
+On some x86 tablets with a silead touchscreen the windows logo on the
+front is a capacitive home button. Touching this button results in a touch
+with bits 12-15 of the Y coordinates set, while normally only the lower 12
+are used.
+
+Detect this and report a KEY_LEFTMETA press when this happens. Note for
+now we only respond to the Y coordinate bits 12-15 containing 0x01, on some
+tablets *without* a capacative button I've noticed these bits containing
+0x04 when crossing the edges of the screen.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/touchscreen/silead.c | 45 ++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index 0dbcf105f7db..c0ba40c09699 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -56,7 +56,7 @@
+ #define SILEAD_POINT_Y_MSB_OFF	0x01
+ #define SILEAD_POINT_X_OFF	0x02
+ #define SILEAD_POINT_X_MSB_OFF	0x03
+-#define SILEAD_TOUCH_ID_MASK	0xF0
++#define SILEAD_EXTRA_DATA_MASK	0xF0
+ 
+ #define SILEAD_CMD_SLEEP_MIN	10000
+ #define SILEAD_CMD_SLEEP_MAX	20000
+@@ -109,6 +109,8 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data)
+ 			    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED |
+ 			    INPUT_MT_TRACK);
+ 
++	input_set_capability(data->input, EV_KEY, KEY_LEFTMETA);
++
+ 	data->input->name = SILEAD_TS_NAME;
+ 	data->input->phys = "input/ts";
+ 	data->input->id.bustype = BUS_I2C;
+@@ -139,7 +141,8 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 	struct input_dev *input = data->input;
+ 	struct device *dev = &client->dev;
+ 	u8 *bufp, buf[SILEAD_TS_DATA_LEN];
+-	int touch_nr, error, i;
++	int touch_nr, softbutton, error, i;
++	bool softbutton_pressed = false;
+ 
+ 	error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_DATA,
+ 					      SILEAD_TS_DATA_LEN, buf);
+@@ -148,21 +151,40 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 		return;
+ 	}
+ 
+-	touch_nr = buf[0];
+-	if (touch_nr > data->max_fingers) {
++	if (buf[0] > data->max_fingers) {
+ 		dev_warn(dev, "More touches reported then supported %d > %d\n",
+-			 touch_nr, data->max_fingers);
+-		touch_nr = data->max_fingers;
++			 buf[0], data->max_fingers);
++		buf[0] = data->max_fingers;
+ 	}
+ 
++	touch_nr = 0;
+ 	bufp = buf + SILEAD_POINT_DATA_LEN;
+-	for (i = 0; i < touch_nr; i++, bufp += SILEAD_POINT_DATA_LEN) {
+-		/* Bits 4-7 are the touch id */
+-		data->id[i] = (bufp[SILEAD_POINT_X_MSB_OFF] &
+-			       SILEAD_TOUCH_ID_MASK) >> 4;
+-		touchscreen_set_mt_pos(&data->pos[i], &data->prop,
++	for (i = 0; i < buf[0]; i++, bufp += SILEAD_POINT_DATA_LEN) {
++		softbutton = (bufp[SILEAD_POINT_Y_MSB_OFF] &
++			      SILEAD_EXTRA_DATA_MASK) >> 4;
++
++		if (softbutton) {
++			/*
++			 * For now only respond to softbutton == 0x01, some
++			 * tablets *without* a capacative button send 0x04
++			 * when crossing the edges of the screen.
++			 */
++			if (softbutton == 0x01)
++				softbutton_pressed = true;
++
++			continue;
++		}
++
++		/*
++		 * Bits 4-7 are the touch id, note not all models have
++		 * hardware touch ids so atm we don't use these.
++		 */
++		data->id[touch_nr] = (bufp[SILEAD_POINT_X_MSB_OFF] &
++				      SILEAD_EXTRA_DATA_MASK) >> 4;
++		touchscreen_set_mt_pos(&data->pos[touch_nr], &data->prop,
+ 			get_unaligned_le16(&bufp[SILEAD_POINT_X_OFF]) & 0xfff,
+ 			get_unaligned_le16(&bufp[SILEAD_POINT_Y_OFF]) & 0xfff);
++		touch_nr++;
+ 	}
+ 
+ 	input_mt_assign_slots(input, data->slots, data->pos, touch_nr, 0);
+@@ -178,6 +200,7 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 	}
+ 
+ 	input_mt_sync_frame(input);
++	input_report_key(input, KEY_LEFTMETA, softbutton_pressed);
+ 	input_sync(input);
+ }
+ 
+-- 
+2.13.0
+

0011-Input-goodix-Add-support-for-capacitive-home-button.patch

@@ -0,0 +1,53 @@
+From 2a99775c336303d2efc43eab4f24b34722a28faa Mon Sep 17 00:00:00 2001
+From: "Sergei A. Trusov" <sergei.a.trusov@ya.ru>
+Date: Tue, 20 Jun 2017 18:08:35 +0200
+Subject: [PATCH 11/16] Input: goodix: Add support for capacitive home button
+
+On some x86 tablets with a Goodix touchscreen, the Windows logo on the
+front is a capacitive home button. Touching this button results in a touch
+with bit 4 of the first byte set, while only the lower 4 bits (0-3) are
+used to indicate the number of touches.
+
+Report a KEY_LEFTMETA press when this happens.
+
+Note that the hardware might support more than one button, in which
+case the "id" byte of coor_data would identify the button in question.
+This is not implemented as we don't have access to hardware with
+multiple buttons.
+
+Signed-off-by: Sergei A. Trusov <sergei.a.trusov@ya.ru>
+Acked-by: Bastien Nocera <hadess@hadess.net>
+---
+ drivers/input/touchscreen/goodix.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index 240b16f3ee97..903137d9cf7d 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -267,6 +267,12 @@ static void goodix_process_events(struct goodix_ts_data *ts)
+ 	if (touch_num < 0)
+ 		return;
+ 
++	/*
++	 * Bit 4 of the first byte reports the status of the capacitive
++	 * Windows/Home button.
++	 */
++	input_report_key(ts->input_dev, KEY_LEFTMETA, !!(point_data[0] & BIT(4)));
++
+ 	for (i = 0; i < touch_num; i++)
+ 		goodix_ts_report_touch(ts,
+ 				&point_data[1 + GOODIX_CONTACT_SIZE * i]);
+@@ -612,6 +618,9 @@ static int goodix_request_input_dev(struct goodix_ts_data *ts)
+ 	ts->input_dev->id.product = ts->id;
+ 	ts->input_dev->id.version = ts->version;
+ 
++	/* Capacitive Windows/Home button on some devices */
++	input_set_capability(ts->input_dev, EV_KEY, KEY_LEFTMETA);
++
+ 	error = input_register_device(ts->input_dev);
+ 	if (error) {
+ 		dev_err(&ts->client->dev,
+-- 
+2.13.0
+

0012-Input-gpio_keys-Do-not-report-wake-button-presses-as.patch

@@ -0,0 +1,150 @@
+From 02b823a4d28ffb5fde5192799abd934d9de95630 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 6 Jan 2017 20:08:11 +0100
+Subject: [PATCH 12/16] Input: gpio_keys - Do not report wake button presses as
+ evdev events
+
+If a button is a wake button, it may still be bouncing from the press
+to wakeup the device by the time the gpio interrupts get enabled again
+and / or the gpio_keys_report_state call from gpio_keys_resume may
+find the button still pressed and report this as a new press.
+
+This is undesirable, esp. since the powerbutton on tablets is typically
+a wakeup source and uses the gpio_keys driver on some tablets, leading
+to userspace immediately re-suspending the tablet after the powerbutton
+is pressed, due to it seeing a powerbutton press.
+
+This commit ignores wakeup button presses for the first 1 second after
+resume (and while resumed, as the workqueue may run before the resume
+function runs), avoiding this problem.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Note: maybe we should make WAKE_DEBOUNCE part of gpio_keys_button and
+only do this when drivers / platform-data set this to a non-zero value ?
+---
+ drivers/input/keyboard/gpio_keys.c | 49 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
+index da3d362f21b1..e1488b534e7d 100644
+--- a/drivers/input/keyboard/gpio_keys.c
++++ b/drivers/input/keyboard/gpio_keys.c
+@@ -31,6 +31,8 @@
+ #include <linux/of_irq.h>
+ #include <linux/spinlock.h>
+ 
++#define WAKE_DEBOUNCE msecs_to_jiffies(1000)
++
+ struct gpio_button_data {
+ 	const struct gpio_keys_button *button;
+ 	struct input_dev *input;
+@@ -44,10 +46,14 @@ struct gpio_button_data {
+ 	struct delayed_work work;
+ 	unsigned int software_debounce;	/* in msecs, for GPIO-driven buttons */
+ 
++	unsigned long resume_time;	/* in jiffies, for wakeup buttons */
++
+ 	unsigned int irq;
+ 	spinlock_t lock;
+ 	bool disabled;
+ 	bool key_pressed;
++	bool suspended;
++	bool resume_time_valid;
+ };
+ 
+ struct gpio_keys_drvdata {
+@@ -356,6 +362,27 @@ static struct attribute_group gpio_keys_attr_group = {
+ 	.attrs = gpio_keys_attrs,
+ };
+ 
++static bool gpio_keys_ignore_wakeup_button_press(struct gpio_button_data *bdata)
++{
++	unsigned long flags;
++	bool ret = false;
++
++	if (!bdata->button->wakeup)
++		return ret;
++
++	spin_lock_irqsave(&bdata->lock, flags);
++
++	if (bdata->suspended)
++		ret = true; /* Our resume method did not run yet */
++	else if (bdata->resume_time_valid &&
++		 time_before(jiffies, bdata->resume_time + WAKE_DEBOUNCE))
++		ret = true; /* Assume this is a wakeup press and ignore */
++
++	spin_unlock_irqrestore(&bdata->lock, flags);
++
++	return ret;
++}
++
+ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ {
+ 	const struct gpio_keys_button *button = bdata->button;
+@@ -370,6 +397,9 @@ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ 		return;
+ 	}
+ 
++	if (state && gpio_keys_ignore_wakeup_button_press(bdata))
++		return;
++
+ 	if (type == EV_ABS) {
+ 		if (state)
+ 			input_event(input, type, button->code, button->value);
+@@ -429,6 +459,9 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 
+ 	BUG_ON(irq != bdata->irq);
+ 
++	if (gpio_keys_ignore_wakeup_button_press(bdata))
++		return IRQ_HANDLED;
++
+ 	spin_lock_irqsave(&bdata->lock, flags);
+ 
+ 	if (!bdata->key_pressed) {
+@@ -848,13 +881,18 @@ static int __maybe_unused gpio_keys_suspend(struct device *dev)
+ {
+ 	struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev);
+ 	struct input_dev *input = ddata->input;
++	unsigned long flags;
+ 	int i;
+ 
+ 	if (device_may_wakeup(dev)) {
+ 		for (i = 0; i < ddata->pdata->nbuttons; i++) {
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+-			if (bdata->button->wakeup)
++			if (bdata->button->wakeup) {
++				spin_lock_irqsave(&bdata->lock, flags);
++				bdata->suspended = true;
++				spin_unlock_irqrestore(&bdata->lock, flags);
+ 				enable_irq_wake(bdata->irq);
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+@@ -870,14 +908,21 @@ static int __maybe_unused gpio_keys_resume(struct device *dev)
+ {
+ 	struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev);
+ 	struct input_dev *input = ddata->input;
++	unsigned long flags;
+ 	int error = 0;
+ 	int i;
+ 
+ 	if (device_may_wakeup(dev)) {
+ 		for (i = 0; i < ddata->pdata->nbuttons; i++) {
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+-			if (bdata->button->wakeup)
++			if (bdata->button->wakeup) {
+ 				disable_irq_wake(bdata->irq);
++				spin_lock_irqsave(&bdata->lock, flags);
++				bdata->resume_time = jiffies;
++				bdata->resume_time_valid = true;
++				bdata->suspended = false;
++				spin_unlock_irqrestore(&bdata->lock, flags);
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+-- 
+2.13.0
+

0013-iio-accel-bmc150-Add-support-for-BOSC0200-ACPI-devic.patch

@@ -0,0 +1,32 @@
+From bf3e9581e10a19b2ce77a45fe001116d269b4c7f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 18 Jun 2017 12:47:38 +0200
+Subject: [PATCH 13/16] iio: accel: bmc150: Add support for BOSC0200 ACPI
+ device id
+
+Add support for the BOSC0200 ACPI device id used on some x86 tablets.
+note driver_data is not set to a specific model, driver_data is not
+used anyways (instead detection is done on the chip_id reg) and the
+2 tablets with a BOSC0200 ACPI device id I've have 2 different chips,
+one has a BMA250E, the other a BMA222E.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/iio/accel/bmc150-accel-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/accel/bmc150-accel-i2c.c b/drivers/iio/accel/bmc150-accel-i2c.c
+index 8ca8041267ef..f85014fbaa12 100644
+--- a/drivers/iio/accel/bmc150-accel-i2c.c
++++ b/drivers/iio/accel/bmc150-accel-i2c.c
+@@ -64,6 +64,7 @@ static const struct acpi_device_id bmc150_accel_acpi_match[] = {
+ 	{"BMA250E",	bma250e},
+ 	{"BMA222E",	bma222e},
+ 	{"BMA0280",	bma280},
++	{"BOSC0200"},
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(acpi, bmc150_accel_acpi_match);
+-- 
+2.13.0
+

0014-mmc-sdhci-acpi-Workaround-conflict-with-PCI-wifi-on-.patch

@@ -0,0 +1,143 @@
+From 51eb7454942c68c84b82782e47637de3ba37f113 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 21 Jun 2017 15:08:39 +0300
+Subject: [PATCH 14/16] mmc: sdhci-acpi: Workaround conflict with PCI wifi on
+ GPD Win handheld
+
+GPDwin uses PCI wifi which conflicts with SDIO's use of
+acpi_device_fix_up_power() on child device nodes. Specifically
+acpi_device_fix_up_power() causes the wifi module to get turned off.
+Identifying GPDwin is problematic, but since SDIO is only used for wifi,
+the presence of the PCI wifi card in the expected slot with an ACPI
+companion node, is used to indicate that acpi_device_fix_up_power() should
+be avoided.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Cc: stable@vger.kernel.org
+---
+ drivers/mmc/host/sdhci-acpi.c | 70 +++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 64 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index c6a9a1bfaa22..b3fb155f50e4 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -45,6 +45,7 @@
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+ #include <asm/iosf_mbi.h>
++#include <linux/pci.h>
+ #endif
+ 
+ #include "sdhci.h"
+@@ -134,6 +135,16 @@ static bool sdhci_acpi_byt(void)
+ 	return x86_match_cpu(byt);
+ }
+ 
++static bool sdhci_acpi_cht(void)
++{
++	static const struct x86_cpu_id cht[] = {
++		{ X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
++		{}
++	};
++
++	return x86_match_cpu(cht);
++}
++
+ #define BYT_IOSF_SCCEP			0x63
+ #define BYT_IOSF_OCP_NETCTRL0		0x1078
+ #define BYT_IOSF_OCP_TIMEOUT_BASE	GENMASK(10, 8)
+@@ -178,6 +189,45 @@ static bool sdhci_acpi_byt_defer(struct device *dev)
+ 	return false;
+ }
+ 
++static bool sdhci_acpi_cht_pci_wifi(unsigned int vendor, unsigned int device,
++				    unsigned int slot, unsigned int parent_slot)
++{
++	struct pci_dev *dev, *parent, *from = NULL;
++
++	while (1) {
++		dev = pci_get_device(vendor, device, from);
++		pci_dev_put(from);
++		if (!dev)
++			break;
++		parent = pci_upstream_bridge(dev);
++		if (ACPI_COMPANION(&dev->dev) && PCI_SLOT(dev->devfn) == slot &&
++		    parent && PCI_SLOT(parent->devfn) == parent_slot &&
++		    !pci_upstream_bridge(parent)) {
++			pci_dev_put(dev);
++			return true;
++		}
++		from = dev;
++	}
++
++	return false;
++}
++
++/*
++ * GPDwin uses PCI wifi which conflicts with SDIO's use of
++ * acpi_device_fix_up_power() on child device nodes. Identifying GPDwin is
++ * problematic, but since SDIO is only used for wifi, the presence of the PCI
++ * wifi card in the expected slot with an ACPI companion node, is used to
++ * indicate that acpi_device_fix_up_power() should be avoided.
++ */
++static inline bool sdhci_acpi_no_fixup_child_power(const char *hid,
++						   const char *uid)
++{
++	return sdhci_acpi_cht() &&
++	       !strcmp(hid, "80860F14") &&
++	       !strcmp(uid, "2") &&
++	       sdhci_acpi_cht_pci_wifi(0x14e4, 0x43ec, 0, 28);
++}
++
+ #else
+ 
+ static inline void sdhci_acpi_byt_setting(struct device *dev)
+@@ -189,6 +239,12 @@ static inline bool sdhci_acpi_byt_defer(struct device *dev)
+ 	return false;
+ }
+ 
++static inline bool sdhci_acpi_no_fixup_child_power(const char *hid,
++						   const char *uid)
++{
++	return false;
++}
++
+ #endif
+ 
+ static int bxt_get_cd(struct mmc_host *mmc)
+@@ -390,11 +446,16 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	if (acpi_bus_get_device(handle, &device))
+ 		return -ENODEV;
+ 
++	hid = acpi_device_hid(device);
++	uid = device->pnp.unique_id;
++
+ 	/* Power on the SDHCI controller and its children */
+ 	acpi_device_fix_up_power(device);
+-	list_for_each_entry(child, &device->children, node)
+-		if (child->status.present && child->status.enabled)
+-			acpi_device_fix_up_power(child);
++	if (!sdhci_acpi_no_fixup_child_power(hid, uid)) {
++		list_for_each_entry(child, &device->children, node)
++			if (child->status.present && child->status.enabled)
++				acpi_device_fix_up_power(child);
++	}
+ 
+ 	if (acpi_bus_get_status(device) || !device->status.present)
+ 		return -ENODEV;
+@@ -402,9 +463,6 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	if (sdhci_acpi_byt_defer(dev))
+ 		return -EPROBE_DEFER;
+ 
+-	hid = acpi_device_hid(device);
+-	uid = device->pnp.unique_id;
+-
+ 	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!iomem)
+ 		return -ENOMEM;
+-- 
+2.13.0
+

0015-i2c-cht-wc-Add-Intel-Cherry-Trail-Whiskey-Cove-SMBUS.patch

@@ -0,0 +1,410 @@
+From bd0d7169342e47919f68e75d659968f02b62f84b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 3 Mar 2017 23:48:50 +0100
+Subject: [PATCH 15/16] i2c-cht-wc: Add Intel Cherry Trail Whiskey Cove SMBUS
+ controller driver
+
+The Intel Cherry Trail Whiskey Cove PMIC does not contain a builtin
+battery charger, instead boards with this PMIC use an external TI
+bq24292i charger IC, which is connected to a SMBUS controller built into
+the PMIC.
+
+This commit adds an i2c-bus driver for the PMIC's builtin SMBUS
+controller. The probe function for this i2c-bus will also register an
+i2c-client for the TI bq24292i charger after the i2c-bus has been
+registered.
+
+Note that several device-properties are set on the client-device to
+tell the bq24190 power-supply driver to integrate the Whiskey Cove PMIC
+and e.g. use the PMIC's BC1.2 detection (through extcon) to determine
+the maximum input current.
+
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-Various style (mostly captialization and variable name) fixes
+-Use device-properties instead of platform_data for the i2c_board_info
+---
+ drivers/i2c/busses/Kconfig      |   8 +
+ drivers/i2c/busses/Makefile     |   1 +
+ drivers/i2c/busses/i2c-cht-wc.c | 336 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 345 insertions(+)
+ create mode 100644 drivers/i2c/busses/i2c-cht-wc.c
+
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 144cbadc7c72..18c96178b177 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -187,6 +187,14 @@ config I2C_PIIX4
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called i2c-piix4.
+ 
++config I2C_CHT_WC
++	tristate "Intel Cherry Trail Whiskey Cove PMIC smbus controller"
++	depends on INTEL_SOC_PMIC_CHTWC
++	help
++	  If you say yes to this option, support will be included for the
++	  SMBus controller found in the Intel Cherry Trail Whiskey Cove PMIC
++	  found on some Intel Cherry Trail systems.
++
+ config I2C_NFORCE2
+ 	tristate "Nvidia nForce2, nForce3 and nForce4"
+ 	depends on PCI
+diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
+index 30b60855fbcd..f6443fa44f61 100644
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_I2C_ALI15X3)	+= i2c-ali15x3.o
+ obj-$(CONFIG_I2C_AMD756)	+= i2c-amd756.o
+ obj-$(CONFIG_I2C_AMD756_S4882)	+= i2c-amd756-s4882.o
+ obj-$(CONFIG_I2C_AMD8111)	+= i2c-amd8111.o
++obj-$(CONFIG_I2C_CHT_WC)	+= i2c-cht-wc.o
+ obj-$(CONFIG_I2C_I801)		+= i2c-i801.o
+ obj-$(CONFIG_I2C_ISCH)		+= i2c-isch.o
+ obj-$(CONFIG_I2C_ISMT)		+= i2c-ismt.o
+diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
+new file mode 100644
+index 000000000000..ccf0785bcb75
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-cht-wc.c
+@@ -0,0 +1,336 @@
++/*
++ * Intel CHT Whiskey Cove PMIC I2C Master driver
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Based on various non upstream patches to support the CHT Whiskey Cove PMIC:
++ * Copyright (C) 2011 - 2014 Intel Corporation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version
++ * 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/completion.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdomain.h>
++#include <linux/mfd/intel_soc_pmic.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++#define CHT_WC_I2C_CTRL			0x5e24
++#define CHT_WC_I2C_CTRL_WR		BIT(0)
++#define CHT_WC_I2C_CTRL_RD		BIT(1)
++#define CHT_WC_I2C_CLIENT_ADDR		0x5e25
++#define CHT_WC_I2C_REG_OFFSET		0x5e26
++#define CHT_WC_I2C_WRDATA		0x5e27
++#define CHT_WC_I2C_RDDATA		0x5e28
++
++#define CHT_WC_EXTCHGRIRQ		0x6e0a
++#define CHT_WC_EXTCHGRIRQ_CLIENT_IRQ	BIT(0)
++#define CHT_WC_EXTCHGRIRQ_WRITE_IRQ	BIT(1)
++#define CHT_WC_EXTCHGRIRQ_READ_IRQ	BIT(2)
++#define CHT_WC_EXTCHGRIRQ_NACK_IRQ	BIT(3)
++#define CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK	((u8)GENMASK(3, 1))
++#define CHT_WC_EXTCHGRIRQ_MSK		0x6e17
++
++struct cht_wc_i2c_adap {
++	struct i2c_adapter adapter;
++	wait_queue_head_t wait;
++	struct irq_chip irqchip;
++	struct mutex irqchip_lock;
++	struct regmap *regmap;
++	struct irq_domain *irq_domain;
++	struct i2c_client *client;
++	int client_irq;
++	u8 irq_mask;
++	u8 old_irq_mask;
++	bool nack;
++	bool done;
++};
++
++static irqreturn_t cht_wc_i2c_adap_thread_handler(int id, void *data)
++{
++	struct cht_wc_i2c_adap *adap = data;
++	int ret, reg;
++
++	/* Read IRQs */
++	ret = regmap_read(adap->regmap, CHT_WC_EXTCHGRIRQ, &reg);
++	if (ret) {
++		dev_err(&adap->adapter.dev, "Error reading extchgrirq reg\n");
++		return IRQ_NONE;
++	}
++
++	reg &= ~adap->irq_mask;
++
++	/*
++	 * Immediately ack IRQs, so that if new IRQs arrives while we're
++	 * handling the previous ones our irq will re-trigger when we're done.
++	 */
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ, reg);
++	if (ret)
++		dev_err(&adap->adapter.dev, "Error writing extchgrirq reg\n");
++
++	/*
++	 * Do NOT use handle_nested_irq here, the client irq handler will
++	 * likely want to do i2c transfers and the i2c controller uses this
++	 * interrupt handler as well, so running the client irq handler from
++	 * this thread will cause things to lock up.
++	 */
++	if (reg & CHT_WC_EXTCHGRIRQ_CLIENT_IRQ) {
++		/*
++		 * generic_handle_irq expects local IRQs to be disabled
++		 * as normally it is called from interrupt context.
++		 */
++		local_irq_disable();
++		generic_handle_irq(adap->client_irq);
++		local_irq_enable();
++	}
++
++	if (reg & CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK) {
++		adap->nack = !!(reg & CHT_WC_EXTCHGRIRQ_NACK_IRQ);
++		adap->done = true;
++		wake_up(&adap->wait);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static u32 cht_wc_i2c_adap_master_func(struct i2c_adapter *adap)
++{
++	/* This i2c adapter only supports SMBUS byte transfers */
++	return I2C_FUNC_SMBUS_BYTE_DATA;
++}
++
++static int cht_wc_i2c_adap_smbus_xfer(struct i2c_adapter *_adap, u16 addr,
++				      unsigned short flags, char read_write,
++				      u8 command, int size,
++				      union i2c_smbus_data *data)
++{
++	struct cht_wc_i2c_adap *adap = i2c_get_adapdata(_adap);
++	int ret, reg;
++
++	adap->nack = false;
++	adap->done = false;
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_CLIENT_ADDR, addr);
++	if (ret)
++		return ret;
++
++	if (read_write == I2C_SMBUS_WRITE) {
++		ret = regmap_write(adap->regmap, CHT_WC_I2C_WRDATA, data->byte);
++		if (ret)
++			return ret;
++	}
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_REG_OFFSET, command);
++	if (ret)
++		return ret;
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_CTRL,
++			   (read_write == I2C_SMBUS_WRITE) ?
++			   CHT_WC_I2C_CTRL_WR : CHT_WC_I2C_CTRL_RD);
++	if (ret)
++		return ret;
++
++	/* 3 second timeout, during cable plug the PMIC responds quite slow */
++	ret = wait_event_timeout(adap->wait, adap->done, 3 * HZ);
++	if (ret == 0)
++		return -ETIMEDOUT;
++	if (adap->nack)
++		return -EIO;
++
++	if (read_write == I2C_SMBUS_READ) {
++		ret = regmap_read(adap->regmap, CHT_WC_I2C_RDDATA, &reg);
++		if (ret)
++			return ret;
++
++		data->byte = reg;
++	}
++
++	return 0;
++}
++
++static const struct i2c_algorithm cht_wc_i2c_adap_algo = {
++	.functionality = cht_wc_i2c_adap_master_func,
++	.smbus_xfer = cht_wc_i2c_adap_smbus_xfer,
++};
++
++/**** irqchip for the client connected to the extchgr i2c adapter ****/
++static void cht_wc_i2c_irq_lock(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	mutex_lock(&adap->irqchip_lock);
++}
++
++static void cht_wc_i2c_irq_sync_unlock(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++	int ret;
++
++	if (adap->irq_mask != adap->old_irq_mask) {
++		ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ_MSK,
++				   adap->irq_mask);
++		if (ret == 0)
++			adap->old_irq_mask = adap->irq_mask;
++		else
++			dev_err(&adap->adapter.dev, "Error writing EXTCHGRIRQ_MSK\n");
++	}
++
++	mutex_unlock(&adap->irqchip_lock);
++}
++
++static void cht_wc_i2c_irq_enable(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	adap->irq_mask &= ~CHT_WC_EXTCHGRIRQ_CLIENT_IRQ;
++}
++
++static void cht_wc_i2c_irq_disable(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	adap->irq_mask |= CHT_WC_EXTCHGRIRQ_CLIENT_IRQ;
++}
++
++static const struct irq_chip cht_wc_i2c_irq_chip = {
++	.irq_bus_lock		= cht_wc_i2c_irq_lock,
++	.irq_bus_sync_unlock	= cht_wc_i2c_irq_sync_unlock,
++	.irq_disable		= cht_wc_i2c_irq_disable,
++	.irq_enable		= cht_wc_i2c_irq_enable,
++	.name			= "cht_wc_ext_chrg_irq_chip",
++};
++
++static const struct property_entry bq24190_props[] = {
++	PROPERTY_ENTRY_STRING("extcon-name", "cht_wcove_pwrsrc"),
++	PROPERTY_ENTRY_BOOL("omit-battery-class"),
++	PROPERTY_ENTRY_BOOL("disable-reset"),
++	{ }
++};
++
++static int cht_wc_i2c_adap_i2c_probe(struct platform_device *pdev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent);
++	struct cht_wc_i2c_adap *adap;
++	struct i2c_board_info board_info = {
++		.type = "bq24190",
++		.addr = 0x6b,
++		.properties = bq24190_props,
++	};
++	int ret, irq;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(&pdev->dev, "Error missing irq resource\n");
++		return -EINVAL;
++	}
++
++	adap = devm_kzalloc(&pdev->dev, sizeof(*adap), GFP_KERNEL);
++	if (!adap)
++		return -ENOMEM;
++
++	init_waitqueue_head(&adap->wait);
++	mutex_init(&adap->irqchip_lock);
++	adap->irqchip = cht_wc_i2c_irq_chip;
++	adap->regmap = pmic->regmap;
++	adap->adapter.owner = THIS_MODULE;
++	adap->adapter.class = I2C_CLASS_HWMON;
++	adap->adapter.algo = &cht_wc_i2c_adap_algo;
++	strlcpy(adap->adapter.name, "PMIC I2C Adapter",
++		sizeof(adap->adapter.name));
++	adap->adapter.dev.parent = &pdev->dev;
++
++	/* Clear and activate i2c-adapter interrupts, disable client IRQ */
++	adap->old_irq_mask = adap->irq_mask = ~CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK;
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ, ~adap->irq_mask);
++	if (ret)
++		return ret;
++
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ_MSK, adap->irq_mask);
++	if (ret)
++		return ret;
++
++	/* Alloc and register client IRQ */
++	adap->irq_domain = irq_domain_add_linear(pdev->dev.of_node, 1,
++						 &irq_domain_simple_ops, NULL);
++	if (!adap->irq_domain)
++		return -ENOMEM;
++
++	adap->client_irq = irq_create_mapping(adap->irq_domain, 0);
++	if (!adap->client_irq) {
++		ret = -ENOMEM;
++		goto remove_irq_domain;
++	}
++
++	irq_set_chip_data(adap->client_irq, adap);
++	irq_set_chip_and_handler(adap->client_irq, &adap->irqchip,
++				 handle_simple_irq);
++
++	ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
++					cht_wc_i2c_adap_thread_handler,
++					IRQF_ONESHOT, "PMIC I2C Adapter", adap);
++	if (ret)
++		goto remove_irq_domain;
++
++	i2c_set_adapdata(&adap->adapter, adap);
++	ret = i2c_add_adapter(&adap->adapter);
++	if (ret)
++		goto remove_irq_domain;
++
++	board_info.irq = adap->client_irq;
++	adap->client = i2c_new_device(&adap->adapter, &board_info);
++	if (!adap->client) {
++		ret = -ENOMEM;
++		goto del_adapter;
++	}
++
++	platform_set_drvdata(pdev, adap);
++	return 0;
++
++del_adapter:
++	i2c_del_adapter(&adap->adapter);
++remove_irq_domain:
++	irq_domain_remove(adap->irq_domain);
++	return ret;
++}
++
++static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev)
++{
++	struct cht_wc_i2c_adap *adap = platform_get_drvdata(pdev);
++
++	i2c_unregister_device(adap->client);
++	i2c_del_adapter(&adap->adapter);
++	irq_domain_remove(adap->irq_domain);
++
++	return 0;
++}
++
++static struct platform_device_id cht_wc_i2c_adap_id_table[] = {
++	{ .name = "cht_wcove_ext_chgr" },
++	{},
++};
++MODULE_DEVICE_TABLE(platform, cht_wc_i2c_adap_id_table);
++
++struct platform_driver cht_wc_i2c_adap_driver = {
++	.probe = cht_wc_i2c_adap_i2c_probe,
++	.remove = cht_wc_i2c_adap_i2c_remove,
++	.driver = {
++		.name = "cht_wcove_ext_chgr",
++	},
++	.id_table = cht_wc_i2c_adap_id_table,
++};
++module_platform_driver(cht_wc_i2c_adap_driver);
++
++MODULE_DESCRIPTION("Intel CHT Whiskey Cove PMIC I2C Master driver");
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.13.0
+

0016-Input-silead-Do-not-try-to-directly-access-the-GPIO-.patch

@@ -0,0 +1,54 @@
+From fd4fb1f6633b21042ff084868323e15e708fe1cd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 1 Jan 2017 22:11:20 +0100
+Subject: [PATCH 16/16] Input: silead: Do not try to directly access the GPIO
+ when using ACPI pm
+
+On some x86 tablets we cannot directly access the GPIOs as they are
+claimed by the ACPI tables, so check it the i2c client is not being
+power-managed by ACPI before trying to get the power pin GPIO.
+
+Note this is a workaround patch to fix this until Andy' gpiolib-ACPI
+patches which make gpiolib more strict land, once those are landed this
+patch is no longer needed.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/touchscreen/silead.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index c0ba40c09699..30fba3cbe277 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -517,12 +518,21 @@ static int silead_ts_probe(struct i2c_client *client,
+ 	if (error)
+ 		return error;
+ 
+-	/* Power GPIO pin */
+-	data->gpio_power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+-	if (IS_ERR(data->gpio_power)) {
+-		if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
+-			dev_err(dev, "Shutdown GPIO request failed\n");
+-		return PTR_ERR(data->gpio_power);
++	/*
++	 * If device power is not managed by ACPI, get the power_gpio
++	 * and manage it ourselves.
++	 */
++#ifdef CONFIG_ACPI
++	if (!acpi_bus_power_manageable(ACPI_HANDLE(dev)))
++#endif
++	{
++		data->gpio_power = devm_gpiod_get_optional(dev, "power",
++							   GPIOD_OUT_LOW);
++		if (IS_ERR(data->gpio_power)) {
++			if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
++				dev_err(dev, "Power GPIO request failed\n");
++			return PTR_ERR(data->gpio_power);
++		}
+ 	}
+ 
+ 	error = silead_ts_setup(client);
+-- 
+2.13.0
+

1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch

@@ -0,0 +1,296 @@
+From patchwork Mon Nov  6 12:31:12 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] kvm: vmx: Reinstate support for CPUs without virtual NMI
+From: Paolo Bonzini <pbonzini@redhat.com>
+X-Patchwork-Id: 10043403
+Message-Id: <1509971473-74491-2-git-send-email-pbonzini@redhat.com>
+To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
+Cc: rkrcmar@redhat.com, stable@vger.kernel.org
+Date: Mon,  6 Nov 2017 13:31:12 +0100
+
+This is more or less a revert of commit 2c82878b0cb3 ("KVM: VMX: require
+virtual NMI support", 2017-03-27); it turns out that Core 2 Duo machines
+only had virtual NMIs in some SKUs.
+
+The revert is not trivial because in the meanwhile there have been several
+fixes to nested NMI injection.  Therefore, the entire vNMI state is moved
+to struct loaded_vmcs.
+
+Another change compared to before the patch is a simplification here:
+
+       if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked &&
+           !(is_guest_mode(vcpu) && nested_cpu_has_virtual_nmis(
+                                       get_vmcs12(vcpu))))) {
+
+The final condition here is always true (because nested_cpu_has_virtual_nmis
+is always false) and is removed.
+
+Fixes: 2c82878b0cb38fd516fd612c67852a6bbf282003
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1490803
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ arch/x86/kvm/vmx.c | 150 +++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 106 insertions(+), 44 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e6c8ffa84968..d6b3b12ae1e2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -202,6 +202,10 @@ struct loaded_vmcs {
+ 	bool nmi_known_unmasked;
+ 	unsigned long vmcs_host_cr3;	/* May not match real cr3 */
+ 	unsigned long vmcs_host_cr4;	/* May not match real cr4 */
++	/* Support for vnmi-less CPUs */
++	int soft_vnmi_blocked;
++	ktime_t entry_time;
++	s64 vnmi_blocked_time;
+ 	struct list_head loaded_vmcss_on_cpu_link;
+ };
+ 
+@@ -1291,6 +1295,11 @@ static inline bool cpu_has_vmx_invpcid(void)
+ 		SECONDARY_EXEC_ENABLE_INVPCID;
+ }
+ 
++static inline bool cpu_has_virtual_nmis(void)
++{
++	return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
+ static inline bool cpu_has_vmx_wbinvd_exit(void)
+ {
+ 	return vmcs_config.cpu_based_2nd_exec_ctrl &
+@@ -1348,11 +1357,6 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+ 		(vmcs12->secondary_vm_exec_control & bit);
+ }
+ 
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+-	return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+ static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+ {
+ 	return vmcs12->pin_based_vm_exec_control &
+@@ -3712,9 +3716,9 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 				&_vmexit_control) < 0)
+ 		return -EIO;
+ 
+-	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING |
+-		PIN_BASED_VIRTUAL_NMIS;
+-	opt = PIN_BASED_POSTED_INTR | PIN_BASED_VMX_PREEMPTION_TIMER;
++	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++	opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++		 PIN_BASED_VMX_PREEMPTION_TIMER;
+ 	if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+ 				&_pin_based_exec_control) < 0)
+ 		return -EIO;
+@@ -5669,7 +5673,8 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ 
+ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ {
+-	if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++	if (!cpu_has_virtual_nmis() ||
++	    vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+ 		enable_irq_window(vcpu);
+ 		return;
+ 	}
+@@ -5709,6 +5714,19 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
++	if (!cpu_has_virtual_nmis()) {
++		/*
++		 * Tracking the NMI-blocked state in software is built upon
++		 * finding the next open IRQ window. This, in turn, depends on
++		 * well-behaving guests: They have to keep IRQs disabled at
++		 * least as long as the NMI handler runs. Otherwise we may
++		 * cause NMI nesting, maybe breaking the guest. But as this is
++		 * highly unlikely, we can live with the residual risk.
++		 */
++		vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++		vmx->loaded_vmcs->vnmi_blocked_time = 0;
++	}
++
+ 	++vcpu->stat.nmi_injections;
+ 	vmx->loaded_vmcs->nmi_known_unmasked = false;
+ 
+@@ -5727,6 +5745,8 @@ static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	bool masked;
+ 
++	if (!cpu_has_virtual_nmis())
++		return vmx->loaded_vmcs->soft_vnmi_blocked;
+ 	if (vmx->loaded_vmcs->nmi_known_unmasked)
+ 		return false;
+ 	masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+@@ -5738,13 +5758,20 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+-	vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+-	if (masked)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+-				GUEST_INTR_STATE_NMI);
++	if (!cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++			vmx->loaded_vmcs->vnmi_blocked_time = 0;
++		}
++	} else {
++		vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++		if (masked)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++					GUEST_INTR_STATE_NMI);
++	}
+ }
+ 
+ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+@@ -5752,6 +5779,10 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+ 	if (to_vmx(vcpu)->nested.nested_run_pending)
+ 		return 0;
+ 
++	if (!cpu_has_virtual_nmis() &&
++	    to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++		return 0;
++
+ 	return	!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ 		  (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+ 		   | GUEST_INTR_STATE_NMI));
+@@ -6479,6 +6510,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
+ 	 * AAK134, BY25.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+ 
+@@ -6965,7 +6997,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
+ 	}
+ 
+ 	/* Create a new VMCS */
+-	item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
++	item = kzalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
+ 	if (!item)
+ 		return NULL;
+ 	item->vmcs02.vmcs = alloc_vmcs();
+@@ -7982,6 +8014,7 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)
+ 	 * "blocked by NMI" bit has to be set before next VM entry.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ 				GUEST_INTR_STATE_NMI);
+@@ -8826,6 +8859,25 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ 		return 0;
+ 	}
+ 
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked)) {
++		if (vmx_interrupt_allowed(vcpu)) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		} else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++			   vcpu->arch.nmi_pending) {
++			/*
++			 * This CPU don't support us in finding the end of an
++			 * NMI-blocked window if the guest runs with IRQs
++			 * disabled. So we pull the trigger after 1 s of
++			 * futile waiting, but inform the user about this.
++			 */
++			printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++			       "state on VCPU %d after 1 s timeout\n",
++			       __func__, vcpu->vcpu_id);
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		}
++	}
++
+ 	if (exit_reason < kvm_vmx_max_exit_handlers
+ 	    && kvm_vmx_exit_handlers[exit_reason])
+ 		return kvm_vmx_exit_handlers[exit_reason](vcpu);
+@@ -9108,33 +9160,38 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+ 
+ 	idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ 
+-	if (vmx->loaded_vmcs->nmi_known_unmasked)
+-		return;
+-	/*
+-	 * Can't use vmx->exit_intr_info since we're not sure what
+-	 * the exit reason is.
+-	 */
+-	exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-	unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+-	vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+-	/*
+-	 * SDM 3: 27.7.1.2 (September 2008)
+-	 * Re-set bit "block by NMI" before VM entry if vmexit caused by
+-	 * a guest IRET fault.
+-	 * SDM 3: 23.2.2 (September 2008)
+-	 * Bit 12 is undefined in any of the following cases:
+-	 *  If the VM exit sets the valid bit in the IDT-vectoring
+-	 *   information field.
+-	 *  If the VM exit is due to a double fault.
+-	 */
+-	if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+-	    vector != DF_VECTOR && !idtv_info_valid)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmx->loaded_vmcs->nmi_known_unmasked =
+-			!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+-			  & GUEST_INTR_STATE_NMI);
++	if (cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->nmi_known_unmasked)
++			return;
++		/*
++		 * Can't use vmx->exit_intr_info since we're not sure what
++		 * the exit reason is.
++		 */
++		exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++		unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++		vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++		/*
++		 * SDM 3: 27.7.1.2 (September 2008)
++		 * Re-set bit "block by NMI" before VM entry if vmexit caused by
++		 * a guest IRET fault.
++		 * SDM 3: 23.2.2 (September 2008)
++		 * Bit 12 is undefined in any of the following cases:
++		 *  If the VM exit sets the valid bit in the IDT-vectoring
++		 *   information field.
++		 *  If the VM exit is due to a double fault.
++		 */
++		if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++		    vector != DF_VECTOR && !idtv_info_valid)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmx->loaded_vmcs->nmi_known_unmasked =
++				!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++				  & GUEST_INTR_STATE_NMI);
++	} else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->vnmi_blocked_time +=
++			ktime_to_ns(ktime_sub(ktime_get(),
++					      vmx->loaded_vmcs->entry_time));
+ }
+ 
+ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+@@ -9251,6 +9308,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	unsigned long debugctlmsr, cr3, cr4;
+ 
++	/* Record the guest's net vcpu time for enforced NMI injections. */
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->entry_time = ktime_get();
++
+ 	/* Don't enter VMX if guest state is invalid, let the exit handler
+ 	   start emulation until we arrive back to a valid state */
+ 	if (vmx->emulation_required)

1-3-net-set-tb--fast_sk_family.patch

@@ -0,0 +1,50 @@
+From patchwork Mon Sep 18 16:28:55 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/3] net: set tb->fast_sk_family
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815031
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-2-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:55 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+We need to set the tb->fast_sk_family properly so we can use the proper
+comparison function for all subsequent reuseport bind requests.
+
+Cc: stable@vger.kernel.org
+Fixes: 637bc8bbe6c0 ("inet: reset tb->fastreuseport when adding a reuseport sk")
+Reported-and-tested-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index b9c64b40a83a..f87f4805e244 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -328,6 +328,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 			tb->fastuid = uid;
+ 			tb->fast_rcv_saddr = sk->sk_rcv_saddr;
+ 			tb->fast_ipv6_only = ipv6_only_sock(sk);
++			tb->fast_sk_family = sk->sk_family;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 			tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ #endif
+@@ -354,6 +355,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 				tb->fastuid = uid;
+ 				tb->fast_rcv_saddr = sk->sk_rcv_saddr;
+ 				tb->fast_ipv6_only = ipv6_only_sock(sk);
++				tb->fast_sk_family = sk->sk_family;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 				tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ #endif

2-3-net-use-inet6_rcv_saddr-to-compare-sockets.patch

@@ -0,0 +1,44 @@
+From patchwork Mon Sep 18 16:28:56 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [2/3] net: use inet6_rcv_saddr to compare sockets
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815028
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-3-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:56 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+In ipv6_rcv_saddr_equal() we need to use inet6_rcv_saddr(sk) for the
+ipv6 compare with the fast socket information to make sure we're doing
+the proper comparisons.
+
+Cc: stable@vger.kernel.org
+Fixes: 637bc8bbe6c0 ("inet: reset tb->fastreuseport when adding a reuseport sk")
+Reported-and-tested-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index f87f4805e244..a1bf30438bc5 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -266,7 +266,7 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	if (tb->fast_sk_family == AF_INET6)
+ 		return ipv6_rcv_saddr_equal(&tb->fast_v6_rcv_saddr,
+-					    &sk->sk_v6_rcv_saddr,
++					    inet6_rcv_saddr(sk),
+ 					    tb->fast_rcv_saddr,
+ 					    sk->sk_rcv_saddr,
+ 					    tb->fast_ipv6_only,

3-3-inet-fix-improper-empty-comparison.patch

@@ -0,0 +1,53 @@
+From patchwork Mon Sep 18 16:28:57 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [3/3] inet: fix improper empty comparison
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815029
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-4-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:57 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+When doing my reuseport rework I screwed up and changed a
+
+if (hlist_empty(&tb->owners))
+
+to
+
+if (!hlist_empty(&tb->owners))
+
+This is obviously bad as all of the reuseport/reuse logic was reversed,
+which caused weird problems like allowing an ipv4 bind conflict if we
+opened an ipv4 only socket on a port followed by an ipv6 only socket on
+the same port.
+
+Cc: stable@vger.kernel.org
+Fixes: b9470c27607b ("inet: kill smallest_size and smallest_port")
+Reported-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index a1bf30438bc5..c039c937ba90 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -321,7 +321,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 			goto fail_unlock;
+ 	}
+ success:
+-	if (!hlist_empty(&tb->owners)) {
++	if (hlist_empty(&tb->owners)) {
+ 		tb->fastreuse = reuse;
+ 		if (sk->sk_reuseport) {
+ 			tb->fastreuseport = FASTREUSEPORT_ANY;

ACPI-Limit-access-to-custom_method.patch

@@ -1,31 +0,0 @@
-From 4b85149b764cd024e3dd2aff9eb22a9e1aadd1fa Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Mar 2012 08:39:37 -0500
-Subject: [PATCH 04/20] ACPI: Limit access to custom_method
-
-custom_method effectively allows arbitrary access to system memory, making
-it possible for an attacker to circumvent restrictions on module loading.
-Disable it if any such restrictions have been enabled.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- drivers/acpi/custom_method.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
-index c68e72414a67..4277938af700 100644
---- a/drivers/acpi/custom_method.c
-+++ b/drivers/acpi/custom_method.c
-@@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
- 	struct acpi_table_header table;
- 	acpi_status status;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	if (!(*ppos)) {
- 		/* parse the table header to get the table length */
- 		if (count <= sizeof(struct acpi_table_header))
--- 
-2.4.3
-

Add-EFI-signature-data-types.patch

@@ -1,37 +1,36 @@
-From 5216de8394ff599e41c8540c0572368c18c51459 Mon Sep 17 00:00:00 2001
+From 0451d4e795929a69a0fda6d960aa4b077c5bd179 Mon Sep 17 00:00:00 2001
 From: Dave Howells <dhowells@redhat.com>
-Date: Tue, 23 Oct 2012 09:30:54 -0400
-Subject: [PATCH 4/9] Add EFI signature data types
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 1/4] efi: Add EFI signature data types
 
-Add the data types that are used for containing hashes, keys and certificates
-for cryptographic verification.
-
-Bugzilla: N/A
-Upstream-status: Fedora mustard for now
+Add the data types that are used for containing hashes, keys and
+certificates for cryptographic verification along with their corresponding
+type GUIDs.
 
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- include/linux/efi.h | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
+ include/linux/efi.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
 
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 8cb38cfcba74..8c274b4ea8e6 100644
+index ec36f42..3259ad6 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -647,6 +647,9 @@ void efi_native_runtime_setup(void);
- #define LINUX_EFI_ARM_SCREEN_INFO_TABLE_GUID	EFI_GUID(0xe03fc20a, 0x85dc, 0x406e,  0xb9, 0x0e, 0x4a, 0xb5, 0x02, 0x37, 0x1d, 0x95)
- #define LINUX_EFI_LOADER_ENTRY_GUID		EFI_GUID(0x4a67b082, 0x0a4c, 0x41cf,  0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f)
- 
-+#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092,  0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
-+#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7,  0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
+@@ -614,6 +614,10 @@ void efi_native_runtime_setup(void);
+ #define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596,  0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
+ #define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300,  0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
+
++#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
++#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
++#define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed)
 +
- typedef struct {
- 	efi_guid_t guid;
- 	u64 table;
-@@ -879,6 +885,20 @@ typedef struct {
+ /*
+  * This GUID is used to pass to the kernel proper the struct screen_info
+  * structure that was populated by the stub based on the GOP protocol instance
+@@ -873,6 +877,27 @@ typedef struct {
  	efi_memory_desc_t entry[0];
  } efi_memory_attributes_table_t;
- 
+
 +typedef struct  {
 +	efi_guid_t signature_owner;
 +	u8 signature_data[];
@@ -45,10 +44,17 @@ index 8cb38cfcba74..8c274b4ea8e6 100644
 +	u8 signature_header[];
 +	/* efi_signature_data_t signatures[][] */
 +} efi_signature_list_t;
++
++typedef u8 efi_sha256_hash_t[32];
++
++typedef struct {
++	efi_sha256_hash_t to_be_signed_hash;
++	efi_time_t time_of_revocation;
++} efi_cert_x509_sha256_t;
 +
  /*
   * All runtime access to EFI goes through this structure:
   */
 -- 
-2.5.5
+2.9.3
 

Add-an-EFI-signature-blob-parser-and-key-loader.patch

@@ -1,29 +1,38 @@
-From e36a2d65e25fdf42b50aa5dc17583d7bfd09c4c4 Mon Sep 17 00:00:00 2001
+From e4c62c12635a371e43bd17e8d33a936668264491 Mon Sep 17 00:00:00 2001
 From: Dave Howells <dhowells@redhat.com>
-Date: Tue, 23 Oct 2012 09:36:28 -0400
-Subject: [PATCH 5/9] Add an EFI signature blob parser and key loader.
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 2/4] efi: Add an EFI signature blob parser
 
-X.509 certificates are loaded into the specified keyring as asymmetric type
-keys.
+Add a function to parse an EFI signature blob looking for elements of
+interest.  A list is made up of a series of sublists, where all the
+elements in a sublist are of the same type, but sublists can be of
+different types.
+
+For each sublist encountered, the function pointed to by the
+get_handler_for_guid argument is called with the type specifier GUID and
+returns either a pointer to a function to handle elements of that type or
+NULL if the type is not of interest.
+
+If the sublist is of interest, each element is passed to the handler
+function in turn.
 
-[labbott@fedoraproject.org: Drop KEY_ALLOC_TRUSTED]
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- crypto/asymmetric_keys/Kconfig      |   8 +++
- crypto/asymmetric_keys/Makefile     |   1 +
- crypto/asymmetric_keys/efi_parser.c | 108 ++++++++++++++++++++++++++++++++++++
- include/linux/efi.h                 |   4 ++
- 4 files changed, 121 insertions(+)
- create mode 100644 crypto/asymmetric_keys/efi_parser.c
+ certs/Kconfig       |   8 ++++
+ certs/Makefile      |   1 +
+ certs/efi_parser.c  | 112 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/efi.h |   9 +++++
+ 4 files changed, 130 insertions(+)
+ create mode 100644 certs/efi_parser.c
+
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 6ce51ed..630ae09 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -82,4 +82,12 @@ config SYSTEM_BLACKLIST_HASH_LIST
+ 	  wrapper to incorporate the list into the kernel.  Each <hash> should
+ 	  be a string of hex digits.
 
-diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
-index e28e912000a7..94024e8aedaa 100644
---- a/crypto/asymmetric_keys/Kconfig
-+++ b/crypto/asymmetric_keys/Kconfig
-@@ -60,4 +60,12 @@ config SIGNED_PE_FILE_VERIFICATION
- 	  This option provides support for verifying the signature(s) on a
- 	  signed PE binary.
- 
 +config EFI_SIGNATURE_LIST_PARSER
 +	bool "EFI signature list parser"
 +	depends on EFI
@@ -32,28 +41,28 @@ index e28e912000a7..94024e8aedaa 100644
 +	  This option provides support for parsing EFI signature lists for
 +	  X.509 certificates and turning them into keys.
 +
- endif # ASYMMETRIC_KEY_TYPE
-diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
-index 6516855bec18..c099fe15ed6d 100644
---- a/crypto/asymmetric_keys/Makefile
-+++ b/crypto/asymmetric_keys/Makefile
-@@ -10,6 +10,7 @@ asymmetric_keys-y := \
- 	signature.o
- 
- obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 4119bb3..738151a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
+ else
+ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
 +obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
- 
- #
- # X.509 Certificate handling
-diff --git a/crypto/asymmetric_keys/efi_parser.c b/crypto/asymmetric_keys/efi_parser.c
+
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+
+diff --git a/certs/efi_parser.c b/certs/efi_parser.c
 new file mode 100644
-index 000000000000..636feb18b733
+index 0000000..4e396f9
 --- /dev/null
-+++ b/crypto/asymmetric_keys/efi_parser.c
-@@ -0,0 +1,108 @@
++++ b/certs/efi_parser.c
+@@ -0,0 +1,112 @@
 +/* EFI signature/key/certificate list parser
 + *
-+ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
++ * Copyright (C) 2012, 2016 Red Hat, Inc. All Rights Reserved.
 + * Written by David Howells (dhowells@redhat.com)
 + *
 + * This program is free software; you can redistribute it and/or
@@ -67,27 +76,44 @@ index 000000000000..636feb18b733
 +#include <linux/printk.h>
 +#include <linux/err.h>
 +#include <linux/efi.h>
-+#include <keys/asymmetric-type.h>
-+
-+static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID;
 +
 +/**
 + * parse_efi_signature_list - Parse an EFI signature list for certificates
++ * @source: The source of the key
 + * @data: The data blob to parse
 + * @size: The size of the data blob
-+ * @keyring: The keyring to add extracted keys to
++ * @get_handler_for_guid: Get the handler func for the sig type (or NULL)
++ *
++ * Parse an EFI signature list looking for elements of interest.  A list is
++ * made up of a series of sublists, where all the elements in a sublist are of
++ * the same type, but sublists can be of different types.
++ *
++ * For each sublist encountered, the @get_handler_for_guid function is called
++ * with the type specifier GUID and returns either a pointer to a function to
++ * handle elements of that type or NULL if the type is not of interest.
++ *
++ * If the sublist is of interest, each element is passed to the handler
++ * function in turn.
++ *
++ * Error EBADMSG is returned if the list doesn't parse correctly and 0 is
++ * returned if the list was parsed correctly.  No error can be returned from
++ * the @get_handler_for_guid function or the element handler function it
++ * returns.
 + */
-+int __init parse_efi_signature_list(const void *data, size_t size, struct key *keyring)
++int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *))
 +{
++	efi_element_handler_t handler;
 +	unsigned offs = 0;
-+	size_t lsize, esize, hsize, elsize;
 +
 +	pr_devel("-->%s(,%zu)\n", __func__, size);
 +
 +	while (size > 0) {
-+		efi_signature_list_t list;
 +		const efi_signature_data_t *elem;
-+		key_ref_t key;
++		efi_signature_list_t list;
++		size_t lsize, esize, hsize, elsize;
 +
 +		if (size < sizeof(list))
 +			return -EBADMSG;
@@ -108,6 +134,7 @@ index 000000000000..636feb18b733
 +				 __func__, offs);
 +			return -EBADMSG;
 +		}
++
 +		if (lsize < sizeof(list) ||
 +		    lsize - sizeof(list) < hsize ||
 +		    esize < sizeof(*elem) ||
@@ -117,7 +144,8 @@ index 000000000000..636feb18b733
 +			return -EBADMSG;
 +		}
 +
-+		if (efi_guidcmp(list.signature_type, efi_cert_x509_guid) != 0) {
++		handler = get_handler_for_guid(&list.signature_type);
++		if (!handler) {
 +			data += lsize;
 +			size -= lsize;
 +			offs += lsize;
@@ -132,24 +160,9 @@ index 000000000000..636feb18b733
 +			elem = data;
 +
 +			pr_devel("ELEM[%04x]\n", offs);
-+
-+			key = key_create_or_update(
-+				make_key_ref(keyring, 1),
-+				"asymmetric",
-+				NULL,
++			handler(source,
 +				&elem->signature_data,
-+				esize - sizeof(*elem),
-+				(KEY_POS_ALL & ~KEY_POS_SETATTR) |
-+				KEY_USR_VIEW,
-+				KEY_ALLOC_NOT_IN_QUOTA);
-+
-+			if (IS_ERR(key))
-+				pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
-+				       PTR_ERR(key));
-+			else
-+				pr_notice("Loaded cert '%s' linked to '%s'\n",
-+					  key_ref_to_ptr(key)->description,
-+					  keyring->description);
++				esize - sizeof(*elem));
 +
 +			data += esize;
 +			size -= esize;
@@ -160,20 +173,25 @@ index 000000000000..636feb18b733
 +	return 0;
 +}
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 8c274b4ea8e6..ff1877145aa4 100644
+index 3259ad6..08024c6 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -1044,6 +1044,10 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
+@@ -1055,6 +1055,15 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
  char * __init efi_md_typeattr_format(char *buf, size_t size,
  				     const efi_memory_desc_t *md);
- 
-+struct key;
-+extern int __init parse_efi_signature_list(const void *data, size_t size,
-+					   struct key *keyring);
+
++
++typedef void (*efi_element_handler_t)(const char *source,
++				      const void *element_data,
++				      size_t element_size);
++extern int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *));
 +
  /**
   * efi_range_is_wc - check the WC bit on an address range
   * @start: starting kvirt address
 -- 
-2.5.5
+2.9.3
 

Add-option-to-automatically-enforce-module-signature.patch

@@ -1,217 +0,0 @@
-From 0000dc9edd5997cc49b8893a9d5407f89dfa1307 Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Aug 2013 18:36:30 -0400
-Subject: [PATCH] Add option to automatically enforce module signatures when in
- Secure Boot mode
-
-UEFI Secure Boot provides a mechanism for ensuring that the firmware will
-only load signed bootloaders and kernels. Certain use cases may also
-require that all kernel modules also be signed. Add a configuration option
-that enforces this automatically when enabled.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- Documentation/x86/zero-page.txt       |  2 ++
- arch/x86/Kconfig                      | 11 ++++++
- arch/x86/boot/compressed/eboot.c      | 66 +++++++++++++++++++++++++++++++++++
- arch/x86/include/uapi/asm/bootparam.h |  3 +-
- arch/x86/kernel/setup.c               |  6 ++++
- include/linux/module.h                |  6 ++++
- kernel/module.c                       |  7 ++++
- 7 files changed, 100 insertions(+), 1 deletion(-)
-
-diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
-index 95a4d34af3fd..b8527c6b7646 100644
---- a/Documentation/x86/zero-page.txt
-+++ b/Documentation/x86/zero-page.txt
-@@ -31,6 +31,8 @@ Offset	Proto	Name		Meaning
- 1E9/001	ALL	eddbuf_entries	Number of entries in eddbuf (below)
- 1EA/001	ALL	edd_mbr_sig_buf_entries	Number of entries in edd_mbr_sig_buffer
- 				(below)
-+1EB/001	ALL     kbd_status      Numlock is enabled
-+1EC/001	ALL     secure_boot	Secure boot is enabled in the firmware
- 1EF/001	ALL	sentinel	Used to detect broken bootloaders
- 290/040	ALL	edd_mbr_sig_buffer EDD MBR signatures
- 2D0/A00	ALL	e820_map	E820 memory map table
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 0a7b885964ba..29b8ba9ae713 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -1776,6 +1776,17 @@ config EFI_MIXED
- 
- 	   If unsure, say N.
- 
-+config EFI_SECURE_BOOT_SIG_ENFORCE
-+	def_bool n
-+	depends on EFI
-+	prompt "Force module signing when UEFI Secure Boot is enabled"
-+	---help---
-+	  UEFI Secure Boot provides a mechanism for ensuring that the
-+	  firmware will only load signed bootloaders and kernels. Certain
-+	  use cases may also require that all kernel modules also be signed.
-+	  Say Y here to automatically enable module signature enforcement
-+	  when a system boots with UEFI Secure Boot enabled.
-+
- config SECCOMP
- 	def_bool y
- 	prompt "Enable seccomp to safely compute untrusted bytecode"
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 52fef606bc54..6b8b9a775b46 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -12,6 +12,7 @@
- #include <asm/efi.h>
- #include <asm/setup.h>
- #include <asm/desc.h>
-+#include <asm/bootparam_utils.h>
- 
- #include "../string.h"
- #include "eboot.h"
-@@ -571,6 +572,67 @@ free_handle:
- 	efi_call_early(free_pool, pci_handle);
- }
- 
-+static int get_secure_boot(void)
-+{
-+	u8 sb, setup;
-+	unsigned long datasize = sizeof(sb);
-+	efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
-+	efi_status_t status;
-+
-+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
-+				L"SecureBoot", &var_guid, NULL, &datasize, &sb);
-+
-+	if (status != EFI_SUCCESS)
-+		return 0;
-+
-+	if (sb == 0)
-+		return 0;
-+
-+
-+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
-+				L"SetupMode", &var_guid, NULL, &datasize,
-+				&setup);
-+
-+	if (status != EFI_SUCCESS)
-+		return 0;
-+
-+	if (setup == 1)
-+		return 0;
-+
-+	return 1;
-+}
-+
-+
-+/*
-+ * See if we have Graphics Output Protocol
-+ */
-+static efi_status_t setup_gop(struct screen_info *si, efi_guid_t *proto,
-+			      unsigned long size)
-+{
-+	efi_status_t status;
-+	void **gop_handle = NULL;
-+
-+	status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-+				size, (void **)&gop_handle);
-+	if (status != EFI_SUCCESS)
-+		return status;
-+
-+	status = efi_call_early(locate_handle,
-+				EFI_LOCATE_BY_PROTOCOL,
-+				proto, NULL, &size, gop_handle);
-+	if (status != EFI_SUCCESS)
-+		goto free_handle;
-+
-+	if (efi_early->is64)
-+		status = setup_gop64(si, proto, size, gop_handle);
-+	else
-+		status = setup_gop32(si, proto, size, gop_handle);
-+
-+free_handle:
-+	efi_call_early(free_pool, gop_handle);
-+	return status;
-+}
-+
- static efi_status_t
- setup_uga32(void **uga_handle, unsigned long size, u32 *width, u32 *height)
- {
-@@ -1126,6 +1188,10 @@ struct boot_params *efi_main(struct efi_config *c,
- 	else
- 		setup_boot_services32(efi_early);
- 
-+	sanitize_boot_params(boot_params);
-+
-+	boot_params->secure_boot = get_secure_boot();
-+
- 	setup_graphics(boot_params);
- 
- 	setup_efi_pci(boot_params);
-diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
-index c18ce67495fa..2b3e5427097b 100644
---- a/arch/x86/include/uapi/asm/bootparam.h
-+++ b/arch/x86/include/uapi/asm/bootparam.h
-@@ -134,7 +134,8 @@ struct boot_params {
- 	__u8  eddbuf_entries;				/* 0x1e9 */
- 	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
- 	__u8  kbd_status;				/* 0x1eb */
--	__u8  _pad5[3];					/* 0x1ec */
-+	__u8  secure_boot;				/* 0x1ec */
-+	__u8  _pad5[2];					/* 0x1ed */
- 	/*
- 	 * The sentinel is set to a nonzero value (0xff) in header.S.
- 	 *
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index c4e7b3991b60..bdb9881c7afd 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -1152,6 +1152,12 @@ void __init setup_arch(char **cmdline_p)
- 
- 	io_delay_init();
- 
-+#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
-+	if (boot_params.secure_boot) {
-+		enforce_signed_modules();
-+	}
-+#endif
-+
- 	/*
- 	 * Parse the ACPI tables for possible boot-time SMP configuration.
- 	 */
-diff --git a/include/linux/module.h b/include/linux/module.h
-index 082298a09df1..38d0597f7615 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -273,6 +273,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add);
- 
- struct notifier_block;
- 
-+#ifdef CONFIG_MODULE_SIG
-+extern void enforce_signed_modules(void);
-+#else
-+static inline void enforce_signed_modules(void) {};
-+#endif
-+
- #ifdef CONFIG_MODULES
- 
- extern int modules_disabled; /* for sysctl */
-diff --git a/kernel/module.c b/kernel/module.c
-index 3c384968f553..ea484f3a35b2 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -4200,6 +4200,13 @@ void module_layout(struct module *mod,
- EXPORT_SYMBOL(module_layout);
- #endif
- 
-+#ifdef CONFIG_MODULE_SIG
-+void enforce_signed_modules(void)
-+{
-+	sig_enforce = true;
-+}
-+#endif
-+
- bool secure_modules(void)
- {
- #ifdef CONFIG_MODULE_SIG
--- 
-2.5.5
-

Add-secure_modules-call.patch

@@ -1,63 +0,0 @@
-From 3213f1513a744fb21b6b9e4d4f2650a204855b3e Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Aug 2013 17:58:15 -0400
-Subject: [PATCH] Add secure_modules() call
-
-Provide a single call to allow kernel code to determine whether the system
-has been configured to either disable module loading entirely or to load
-only modules signed with a trusted key.
-
-Bugzilla: N/A
-Upstream-status: Fedora mustard.  Replaced by securelevels, but that was nak'd
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- include/linux/module.h |  6 ++++++
- kernel/module.c        | 10 ++++++++++
- 2 files changed, 16 insertions(+)
-
-diff --git a/include/linux/module.h b/include/linux/module.h
-index 0c3207d..05bd6c9 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -641,6 +641,8 @@ static inline bool is_livepatch_module(struct module *mod)
- }
- #endif /* CONFIG_LIVEPATCH */
- 
-+extern bool secure_modules(void);
-+
- #else /* !CONFIG_MODULES... */
- 
- static inline struct module *__module_address(unsigned long addr)
-@@ -750,6 +752,10 @@ static inline bool module_requested_async_probing(struct module *module)
- 	return false;
- }
- 
-+static inline bool secure_modules(void)
-+{
-+	return false;
-+}
- #endif /* CONFIG_MODULES */
- 
- #ifdef CONFIG_SYSFS
-diff --git a/kernel/module.c b/kernel/module.c
-index 529efae..0332fdd 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -4279,3 +4279,13 @@ void module_layout(struct module *mod,
- }
- EXPORT_SYMBOL(module_layout);
- #endif
-+
-+bool secure_modules(void)
-+{
-+#ifdef CONFIG_MODULE_SIG
-+	return (sig_enforce || modules_disabled);
-+#else
-+	return modules_disabled;
-+#endif
-+}
-+EXPORT_SYMBOL(secure_modules);
--- 
-2.9.2
-

Add-sysrq-option-to-disable-secure-boot-mode.patch

@@ -1,246 +0,0 @@
-From e27a9a98dcf3ff95568593026da065a72ad21b92 Mon Sep 17 00:00:00 2001
-From: Kyle McMartin <kyle@redhat.com>
-Date: Fri, 30 Aug 2013 09:28:51 -0400
-Subject: [PATCH 9/9] Add sysrq option to disable secure boot mode
-
-Bugzilla: N/A
-Upstream-status: Fedora mustard
----
- arch/x86/kernel/setup.c     | 36 ++++++++++++++++++++++++++++++++++++
- drivers/input/misc/uinput.c |  1 +
- drivers/tty/sysrq.c         | 19 +++++++++++++------
- include/linux/input.h       |  5 +++++
- include/linux/sysrq.h       |  8 +++++++-
- kernel/debug/kdb/kdb_main.c |  2 +-
- kernel/module.c             |  2 +-
- 7 files changed, 64 insertions(+), 9 deletions(-)
-
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index a666b6c29c77..7732c769937b 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -70,6 +70,11 @@
- #include <linux/tboot.h>
- #include <linux/jiffies.h>
- 
-+#include <linux/fips.h>
-+#include <linux/cred.h>
-+#include <linux/sysrq.h>
-+#include <linux/init_task.h>
-+
- #include <video/edid.h>
- 
- #include <asm/mtrr.h>
-@@ -1286,6 +1291,37 @@ void __init i386_reserve_resources(void)
- 
- #endif /* CONFIG_X86_32 */
- 
-+#ifdef CONFIG_MAGIC_SYSRQ
-+#ifdef CONFIG_MODULE_SIG
-+extern bool sig_enforce;
-+#endif
-+
-+static void sysrq_handle_secure_boot(int key)
-+{
-+	if (!efi_enabled(EFI_SECURE_BOOT))
-+		return;
-+
-+	pr_info("Secure boot disabled\n");
-+#ifdef CONFIG_MODULE_SIG
-+	sig_enforce = fips_enabled;
-+#endif
-+}
-+static struct sysrq_key_op secure_boot_sysrq_op = {
-+	.handler	=	sysrq_handle_secure_boot,
-+	.help_msg	=	"unSB(x)",
-+	.action_msg	=	"Disabling Secure Boot restrictions",
-+	.enable_mask	=	SYSRQ_DISABLE_USERSPACE,
-+};
-+static int __init secure_boot_sysrq(void)
-+{
-+	if (efi_enabled(EFI_SECURE_BOOT))
-+		register_sysrq_key('x', &secure_boot_sysrq_op);
-+	return 0;
-+}
-+late_initcall(secure_boot_sysrq);
-+#endif /*CONFIG_MAGIC_SYSRQ*/
-+
-+
- static struct notifier_block kernel_offset_notifier = {
- 	.notifier_call = dump_kernel_offset
- };
-diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
-index abe1a927b332..f4126fcec10c 100644
---- a/drivers/input/misc/uinput.c
-+++ b/drivers/input/misc/uinput.c
-@@ -379,6 +379,7 @@ static int uinput_allocate_device(struct uinput_device *udev)
- 	if (!udev->dev)
- 		return -ENOMEM;
- 
-+	udev->dev->flags |= INPUTDEV_FLAGS_SYNTHETIC;
- 	udev->dev->event = uinput_dev_event;
- 	input_set_drvdata(udev->dev, udev);
- 
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index e5139402e7f8..5ef2e04a03ad 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -478,6 +478,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
- 	/* x: May be registered on mips for TLB dump */
- 	/* x: May be registered on ppc/powerpc for xmon */
- 	/* x: May be registered on sparc64 for global PMU dump */
-+	/* x: May be registered on x86_64 for disabling secure boot */
- 	NULL,				/* x */
- 	/* y: May be registered on sparc64 for global register dump */
- 	NULL,				/* y */
-@@ -521,7 +522,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
-                 sysrq_key_table[i] = op_p;
- }
- 
--void __handle_sysrq(int key, bool check_mask)
-+void __handle_sysrq(int key, int from)
- {
- 	struct sysrq_key_op *op_p;
- 	int orig_log_level;
-@@ -541,11 +542,15 @@ void __handle_sysrq(int key, bool check_mask)
- 
-         op_p = __sysrq_get_key_op(key);
-         if (op_p) {
-+		/* Ban synthetic events from some sysrq functionality */
-+		if ((from == SYSRQ_FROM_PROC || from == SYSRQ_FROM_SYNTHETIC) &&
-+		    op_p->enable_mask & SYSRQ_DISABLE_USERSPACE)
-+			printk("This sysrq operation is disabled from userspace.\n");
- 		/*
- 		 * Should we check for enabled operations (/proc/sysrq-trigger
- 		 * should not) and is the invoked operation enabled?
- 		 */
--		if (!check_mask || sysrq_on_mask(op_p->enable_mask)) {
-+		if (from == SYSRQ_FROM_KERNEL || sysrq_on_mask(op_p->enable_mask)) {
- 			pr_cont("%s\n", op_p->action_msg);
- 			console_loglevel = orig_log_level;
- 			op_p->handler(key);
-@@ -577,7 +582,7 @@ void __handle_sysrq(int key, bool check_mask)
- void handle_sysrq(int key)
- {
- 	if (sysrq_on())
--		__handle_sysrq(key, true);
-+		__handle_sysrq(key, SYSRQ_FROM_KERNEL);
- }
- EXPORT_SYMBOL(handle_sysrq);
- 
-@@ -658,7 +663,7 @@ static void sysrq_do_reset(unsigned long _state)
- static void sysrq_handle_reset_request(struct sysrq_state *state)
- {
- 	if (state->reset_requested)
--		__handle_sysrq(sysrq_xlate[KEY_B], false);
-+		__handle_sysrq(sysrq_xlate[KEY_B], SYSRQ_FROM_KERNEL);
- 
- 	if (sysrq_reset_downtime_ms)
- 		mod_timer(&state->keyreset_timer,
-@@ -809,8 +814,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq,
- 
- 	default:
- 		if (sysrq->active && value && value != 2) {
-+			int from = sysrq->handle.dev->flags & INPUTDEV_FLAGS_SYNTHETIC ?
-+					SYSRQ_FROM_SYNTHETIC : 0;
- 			sysrq->need_reinject = false;
--			__handle_sysrq(sysrq_xlate[code], true);
-+			__handle_sysrq(sysrq_xlate[code], from);
- 		}
- 		break;
- 	}
-@@ -1094,7 +1101,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
- 
- 		if (get_user(c, buf))
- 			return -EFAULT;
--		__handle_sysrq(c, false);
-+		__handle_sysrq(c, SYSRQ_FROM_PROC);
- 	}
- 
- 	return count;
-diff --git a/include/linux/input.h b/include/linux/input.h
-index 1e967694e9a5..2b56c6f9673c 100644
---- a/include/linux/input.h
-+++ b/include/linux/input.h
-@@ -42,6 +42,7 @@ struct input_value {
-  * @phys: physical path to the device in the system hierarchy
-  * @uniq: unique identification code for the device (if device has it)
-  * @id: id of the device (struct input_id)
-+ * @flags: input device flags (SYNTHETIC, etc.)
-  * @propbit: bitmap of device properties and quirks
-  * @evbit: bitmap of types of events supported by the device (EV_KEY,
-  *	EV_REL, etc.)
-@@ -124,6 +125,8 @@ struct input_dev {
- 	const char *uniq;
- 	struct input_id id;
- 
-+	unsigned int flags;
-+
- 	unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
- 
- 	unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
-@@ -190,6 +193,8 @@ struct input_dev {
- };
- #define to_input_dev(d) container_of(d, struct input_dev, dev)
- 
-+#define	INPUTDEV_FLAGS_SYNTHETIC	0x000000001
-+
- /*
-  * Verify that we are in sync with input_device_id mod_devicetable.h #defines
-  */
-diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 387fa7d05c98..4b07e30b3279 100644
---- a/include/linux/sysrq.h
-+++ b/include/linux/sysrq.h
-@@ -28,6 +28,8 @@
- #define SYSRQ_ENABLE_BOOT	0x0080
- #define SYSRQ_ENABLE_RTNICE	0x0100
- 
-+#define SYSRQ_DISABLE_USERSPACE	0x00010000
-+
- struct sysrq_key_op {
- 	void (*handler)(int);
- 	char *help_msg;
-@@ -42,8 +44,12 @@ struct sysrq_key_op {
-  * are available -- else NULL's).
-  */
- 
-+#define SYSRQ_FROM_KERNEL	0x0001
-+#define SYSRQ_FROM_PROC		0x0002
-+#define SYSRQ_FROM_SYNTHETIC	0x0004
-+
- void handle_sysrq(int key);
--void __handle_sysrq(int key, bool check_mask);
-+void __handle_sysrq(int key, int from);
- int register_sysrq_key(int key, struct sysrq_key_op *op);
- int unregister_sysrq_key(int key, struct sysrq_key_op *op);
- struct sysrq_key_op *__sysrq_get_key_op(int key);
-diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
-index 2a20c0dfdafc..3d17205dab77 100644
---- a/kernel/debug/kdb/kdb_main.c
-+++ b/kernel/debug/kdb/kdb_main.c
-@@ -1968,7 +1968,7 @@ static int kdb_sr(int argc, const char **argv)
- 		return KDB_ARGCOUNT;
- 
- 	kdb_trap_printk++;
--	__handle_sysrq(*argv[1], check_mask);
-+	__handle_sysrq(*argv[1], check_mask & SYSRQ_FROM_KERNEL);
- 	kdb_trap_printk--;
- 
- 	return 0;
-diff --git a/kernel/module.c b/kernel/module.c
-index ea484f3a35b2..84b00659b0ee 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -269,7 +269,7 @@ static void module_assert_mutex_or_preempt(void)
- #endif
- }
- 
--static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
-+bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
- #ifndef CONFIG_MODULE_SIG_FORCE
- module_param(sig_enforce, bool_enable_only, 0644);
- #endif /* !CONFIG_MODULE_SIG_FORCE */
--- 
-2.5.5
-

CVE-2017-16538.patch

@@ -0,0 +1,166 @@
+From patchwork Tue Sep 26 21:10:20 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm
+ start.
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44566
+Message-Id: <20170926211021.11036-1-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:20 +0100
+
+Warm start has no check as whether a genuine device has
+connected and proceeds to next execution path.
+
+Check device should read 0x47 at offset of 2 on USB descriptor read
+and it is the amount requested of 6 bytes.
+
+Fix for
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access as
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 5e320fa4a795..992f2011a6ba 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -494,18 +494,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
+ 
+ static int lme2510_return_status(struct dvb_usb_device *d)
+ {
+-	int ret = 0;
++	int ret;
+ 	u8 *data;
+ 
+-	data = kzalloc(10, GFP_KERNEL);
++	data = kzalloc(6, GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
+-	ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
+-			0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
+-	info("Firmware Status: %x (%x)", ret , data[2]);
++	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
++			      0x06, 0x80, 0x0302, 0x00,
++			      data, 0x6, 200);
++	if (ret != 6)
++		ret = -EINVAL;
++	else
++		ret = data[2];
++
++	info("Firmware Status: %6ph", data);
+ 
+-	ret = (ret < 0) ? -ENODEV : data[2];
+ 	kfree(data);
+ 	return ret;
+ }
+@@ -1189,6 +1194,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d)
+ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ {
+ 	struct lme2510_state *st = d->priv;
++	int status;
+ 
+ 	usb_reset_configuration(d->udev);
+ 
+@@ -1197,12 +1203,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ 
+ 	st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
+ 
+-	if (lme2510_return_status(d) == 0x44) {
++	status = lme2510_return_status(d);
++	if (status == 0x44) {
+ 		*name = lme_firmware_switch(d, 0);
+ 		return COLD;
+ 	}
+ 
+-	return 0;
++	if (status != 0x47)
++		return -EINVAL;
++
++	return WARM;
+ }
+ 
+ static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
+From patchwork Tue Sep 26 21:10:21 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to
+ dm04_lme2510_tuner
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44567
+Message-Id: <20170926211021.11036-2-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:21 +0100
+
+When the tuner was split from m88rs2000 the attach function is in wrong
+place.
+
+Move to dm04_lme2510_tuner to trap errors on failure and removing
+a call to lme_coldreset.
+
+Prevents driver starting up without any tuner connected.
+
+Fixes to trap for ts2020 fail.
+LME2510(C): FE Found M88RS2000
+ts2020: probe of 0-0060 failed with error -11
+...
+LME2510(C): TUN Found RS2000 tuner
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] PREEMPT SMP KASAN
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 992f2011a6ba..be26c029546b 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -1076,8 +1076,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap)
+ 
+ 		if (adap->fe[0]) {
+ 			info("FE Found M88RS2000");
+-			dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,
+-					&d->i2c_adap);
+ 			st->i2c_tuner_gate_w = 5;
+ 			st->i2c_tuner_gate_r = 5;
+ 			st->i2c_tuner_addr = 0x60;
+@@ -1143,17 +1141,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap)
+ 			ret = st->tuner_config;
+ 		break;
+ 	case TUNER_RS2000:
+-		ret = st->tuner_config;
++		if (dvb_attach(ts2020_attach, adap->fe[0],
++			       &ts2020_config, &d->i2c_adap))
++			ret = st->tuner_config;
+ 		break;
+ 	default:
+ 		break;
+ 	}
+ 
+-	if (ret)
++	if (ret) {
+ 		info("TUN Found %s tuner", tun_msg[ret]);
+-	else {
+-		info("TUN No tuner found --- resetting device");
+-		lme_coldreset(d);
++	} else {
++		info("TUN No tuner found");
+ 		return -ENODEV;
+ 	}
+ 

CVE-2017-7477.patch

@@ -0,0 +1,73 @@
+From 4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Fri, 21 Apr 2017 23:14:48 +0200
+Subject: macsec: avoid heap overflow in skb_to_sgvec
+
+While this may appear as a humdrum one line change, it's actually quite
+important. An sk_buff stores data in three places:
+
+1. A linear chunk of allocated memory in skb->data. This is the easiest
+   one to work with, but it precludes using scatterdata since the memory
+   must be linear.
+2. The array skb_shinfo(skb)->frags, which is of maximum length
+   MAX_SKB_FRAGS. This is nice for scattergather, since these fragments
+   can point to different pages.
+3. skb_shinfo(skb)->frag_list, which is a pointer to another sk_buff,
+   which in turn can have data in either (1) or (2).
+
+The first two are rather easy to deal with, since they're of a fixed
+maximum length, while the third one is not, since there can be
+potentially limitless chains of fragments. Fortunately dealing with
+frag_list is opt-in for drivers, so drivers don't actually have to deal
+with this mess. For whatever reason, macsec decided it wanted pain, and
+so it explicitly specified NETIF_F_FRAGLIST.
+
+Because dealing with (1), (2), and (3) is insane, most users of sk_buff
+doing any sort of crypto or paging operation calls a convenient function
+called skb_to_sgvec (which happens to be recursive if (3) is in use!).
+This takes a sk_buff as input, and writes into its output pointer an
+array of scattergather list items. Sometimes people like to declare a
+fixed size scattergather list on the stack; othertimes people like to
+allocate a fixed size scattergather list on the heap. However, if you're
+doing it in a fixed-size fashion, you really shouldn't be using
+NETIF_F_FRAGLIST too (unless you're also ensuring the sk_buff and its
+frag_list children arent't shared and then you check the number of
+fragments in total required.)
+
+Macsec specifically does this:
+
+        size += sizeof(struct scatterlist) * (MAX_SKB_FRAGS + 1);
+        tmp = kmalloc(size, GFP_ATOMIC);
+        *sg = (struct scatterlist *)(tmp + sg_offset);
+	...
+        sg_init_table(sg, MAX_SKB_FRAGS + 1);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+Specifying MAX_SKB_FRAGS + 1 is the right answer usually, but not if you're
+using NETIF_F_FRAGLIST, in which case the call to skb_to_sgvec will
+overflow the heap, and disaster ensues.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: stable@vger.kernel.org
+Cc: security@kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/macsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index ff0a5ed..dbab05a 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2716,7 +2716,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
+ }
+ 
+ #define MACSEC_FEATURES \
+-	(NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
++	(NETIF_F_SG | NETIF_F_HIGHDMA)
+ static struct lock_class_key macsec_netdev_addr_lock_key;
+ 
+ static int macsec_dev_init(struct net_device *dev)
+-- 
+cgit v1.1
+

Fix-for-module-sig-verification.patch

@@ -0,0 +1,24 @@
+From ea6e7d9d0fe3e448aef19b3943d4897ae0bef128 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Thu, 3 Aug 2017 13:46:51 -0500
+Subject: [PATCH] Fix for module sig verification
+
+---
+ kernel/module_signing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/module_signing.c b/kernel/module_signing.c
+index 937c844..d3d6f95 100644
+--- a/kernel/module_signing.c
++++ b/kernel/module_signing.c
+@@ -81,6 +81,6 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
+ 	}
+
+ 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+-				      NULL, VERIFYING_MODULE_SIGNATURE,
++				      (void *)1UL, VERIFYING_MODULE_SIGNATURE,
+ 				      NULL, NULL);
+ }
+-- 
+2.13.3
+

HID-microsoft-Add-Surface-4-type-cover-pro-4-JP.patch

@@ -1,76 +0,0 @@
-From b490a8537df60d449199e162417da74ee9262515 Mon Sep 17 00:00:00 2001
-From: Yuta Kobayashi <alu.ula@outlook.com>
-Date: Fri, 12 Aug 2016 07:49:17 +0000
-Subject: [PATCH] HID: microsoft: Add Surface 4 type cover pro 4 (JP)
-
-Adding support for the Microsoft Surface 4 Type Cover Pro (JP).
-
-Signed-off-by: Yuta Kobayashi <alu.ula@outlook.com>
-Signed-off-by: Jiri Kosina <jkosina@suse.cz>
----
- drivers/hid/hid-core.c          | 2 ++
- drivers/hid/hid-ids.h           | 1 +
- drivers/hid/hid-microsoft.c     | 2 ++
- drivers/hid/usbhid/hid-quirks.c | 1 +
- 4 files changed, 6 insertions(+)
-
-diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index ed10d4f..45400de 100644
---- a/drivers/hid/hid-core.c
-+++ b/drivers/hid/hid-core.c
-@@ -727,6 +727,7 @@ static void hid_scan_collection(struct hid_parser *parser, unsigned type)
- 	    (hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 ||
- 	     hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 ||
- 	     hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP ||
-+	     hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP ||
- 	     hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
- 	     hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
- 	    hid->group == HID_GROUP_MULTITOUCH)
-@@ -1982,6 +1983,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) },
-+	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_7K) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600) },
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index da1c58e..3466f0d 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -713,6 +713,7 @@
- #define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3    0x07dc
- #define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2  0x07e2
- #define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd
-+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP 0x07e9
- #define USB_DEVICE_ID_MS_TYPE_COVER_3    0x07de
- #define USB_DEVICE_ID_MS_POWER_COVER     0x07da
-
-diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
-index e924d55..56c586f 100644
---- a/drivers/hid/hid-microsoft.c
-+++ b/drivers/hid/hid-microsoft.c
-@@ -288,6 +288,8 @@ static const struct hid_device_id ms_devices[] = {
- 		.driver_data = MS_HIDINPUT },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP),
- 		.driver_data = MS_HIDINPUT },
-+	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP),
-+		.driver_data = MS_HIDINPUT },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
- 		.driver_data = MS_HIDINPUT },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER),
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index b4b8c6a..1fccffd 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -98,6 +98,7 @@ static const struct hid_blacklist {
- 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS },
-+	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
--- 
-2.7.4
-

Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch

@@ -0,0 +1,51 @@
+From patchwork Thu Sep 28 20:07:19 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: Input: synaptics - Disable kernel tracking on SMBus devices
+From: Andrew Duggan <aduggan@synaptics.com>
+X-Patchwork-Id: 9976729
+Message-Id: <1506629239-5940-1-git-send-email-aduggan@synaptics.com>
+To: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: Andrew Duggan <aduggan@synaptics.com>,
+ Dmitry Torokhov <dmitry.torokhov@gmail.com>,
+ Benjamin Tissoires <benjamin.tissoires@redhat.com>,
+ =?UTF-8?q?Kamil=20P=C3=A1ral?= <kparal@redhat.com>
+Date: Thu, 28 Sep 2017 13:07:19 -0700
+
+In certain situations kernel tracking seems to be getting confused
+and incorrectly reporting the slot of a contact. On example is when
+the user does a three finger click or tap and then places two fingers
+on the touchpad in the same area. The kernel tracking code seems to
+continue to think that there are three contacts on the touchpad and
+incorrectly alternates the slot of one of the contacts. The result that
+is the input subsystem reports a stream of button press and release
+events as the reported slot changes.
+
+Kernel tracking was originally enabled to prevent cursor jumps, but it
+is unclear how much of an issue kernel jumps actually are. This patch
+simply disabled kernel tracking for now.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1482640
+
+Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
+Tested-by: Kamil Páral <kparal@redhat.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+---
+ drivers/input/mouse/synaptics.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 5af0b7d..ee5466a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1709,8 +1709,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
+ 		.sensor_pdata = {
+ 			.sensor_type = rmi_sensor_touchpad,
+ 			.axis_align.flip_y = true,
+-			/* to prevent cursors jumps: */
+-			.kernel_tracking = true,
++			.kernel_tracking = false,
+ 			.topbuttonpad = topbuttonpad,
+ 		},
+ 		.f30_data = {

KEYS-Add-a-system-blacklist-keyring.patch

@@ -1,102 +0,0 @@
-From 096da19de900a115ee3610b666ecb7e55926623d Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Fri, 26 Oct 2012 12:36:24 -0400
-Subject: [PATCH 6/9] KEYS: Add a system blacklist keyring
-
-This adds an additional keyring that is used to store certificates that
-are blacklisted.  This keyring is searched first when loading signed modules
-and if the module's certificate is found, it will refuse to load.  This is
-useful in cases where third party certificates are used for module signing.
-
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- certs/system_keyring.c        | 22 ++++++++++++++++++++++
- include/keys/system_keyring.h |  4 ++++
- init/Kconfig                  |  9 +++++++++
- 3 files changed, 35 insertions(+)
-
-diff --git a/certs/system_keyring.c b/certs/system_keyring.c
-index 50979d6dcecd..787eeead2f57 100644
---- a/certs/system_keyring.c
-+++ b/certs/system_keyring.c
-@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
- #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
- static struct key *secondary_trusted_keys;
- #endif
-+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
-+struct key *system_blacklist_keyring;
-+#endif
- 
- extern __initconst const u8 system_certificate_list[];
- extern __initconst const unsigned long system_certificate_list_size;
-@@ -99,6 +102,16 @@ static __init int system_trusted_keyring_init(void)
- 	if (key_link(secondary_trusted_keys, builtin_trusted_keys) < 0)
- 		panic("Can't link trusted keyrings\n");
- #endif
-+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
-+	system_blacklist_keyring = keyring_alloc(".system_blacklist_keyring",
-+			KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
-+			((KEY_POS_ALL & ~KEY_POS_SETATTR) |
-+			 KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
-+			KEY_ALLOC_NOT_IN_QUOTA,
-+			NULL, NULL);
-+	if (IS_ERR(system_blacklist_keyring))
-+		panic("Can't allocate system blacklist keyring\n");
-+#endif
- 
- 	return 0;
- }
-@@ -214,6 +227,15 @@ int verify_pkcs7_signature(const void *data, size_t len,
- 		trusted_keys = builtin_trusted_keys;
- #endif
- 	}
-+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
-+	ret = pkcs7_validate_trust(pkcs7, system_blacklist_keyring);
-+	if (!ret) {
-+		/* module is signed with a cert in the blacklist.  reject */
-+		pr_err("Module key is in the blacklist\n");
-+		ret = -EKEYREJECTED;
-+		goto error;
-+	}
-+#endif
- 	ret = pkcs7_validate_trust(pkcs7, trusted_keys);
- 	if (ret < 0) {
- 		if (ret == -ENOKEY)
-diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
-index fbd4647767e9..5bc291a3d261 100644
---- a/include/keys/system_keyring.h
-+++ b/include/keys/system_keyring.h
-@@ -33,6 +33,10 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
- #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
- #endif
- 
-+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
-+extern struct key *system_blacklist_keyring;
-+#endif
-+
- #ifdef CONFIG_IMA_BLACKLIST_KEYRING
- extern struct key *ima_blacklist_keyring;
- 
-diff --git a/init/Kconfig b/init/Kconfig
-index a9c4aefd5436..e5449d5aeff9 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -1829,6 +1829,15 @@ config SYSTEM_DATA_VERIFICATION
- 	  module verification, kexec image verification and firmware blob
- 	  verification.
- 
-+config SYSTEM_BLACKLIST_KEYRING
-+	bool "Provide system-wide ring of blacklisted keys"
-+	depends on KEYS
-+	help
-+	  Provide a system keyring to which blacklisted keys can be added.
-+	  Keys in the keyring are considered entirely untrusted.  Keys in this
-+	  keyring are used by the module signature checking to reject loading
-+	  of modules signed with a blacklisted key.
-+
- config PROFILING
- 	bool "Profiling support"
- 	help
--- 
-2.5.5
-

KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch

@@ -0,0 +1,95 @@
+From fb2ac204a70da565de9ef9a9d6d69a40c2d59727 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 5 May 2017 08:21:56 +0100
+Subject: [PATCH] KEYS: Allow unrestricted boot-time addition of keys to
+ secondary keyring
+
+Allow keys to be added to the system secondary certificates keyring during
+kernel initialisation in an unrestricted fashion.  Such keys are implicitly
+trusted and don't have their trust chains checked on link.
+
+This allows keys in the UEFI database to be added in secure boot mode for
+the purposes of module signing.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ certs/internal.h       | 18 ++++++++++++++++++
+ certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 51 insertions(+)
+ create mode 100644 certs/internal.h
+
+diff --git a/certs/internal.h b/certs/internal.h
+new file mode 100644
+index 0000000..5dcbefb
+--- /dev/null
++++ b/certs/internal.h
+@@ -0,0 +1,18 @@
++/* Internal definitions
++ *
++ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
++ * Written by David Howells (dhowells@redhat.com)
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public Licence
++ * as published by the Free Software Foundation; either version
++ * 2 of the Licence, or (at your option) any later version.
++ */
++
++/*
++ * system_keyring.c
++ */
++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
++extern void __init add_trusted_secondary_key(const char *source,
++					     const void *data, size_t len);
++#endif
+diff --git a/certs/system_keyring.c b/certs/system_keyring.c
+index 6251d1b..5ac8ba6 100644
+--- a/certs/system_keyring.c
++++ b/certs/system_keyring.c
+@@ -18,6 +18,7 @@
+ #include <keys/asymmetric-type.h>
+ #include <keys/system_keyring.h>
+ #include <crypto/pkcs7.h>
++#include "internal.h"
+
+ static struct key *builtin_trusted_keys;
+ #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+@@ -265,3 +266,35 @@ int verify_pkcs7_signature(const void *data, size_t len,
+ EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+
+ #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
++
++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
++/**
++ * add_trusted_secondary_key - Add to secondary keyring with no validation
++ * @source: Source of key
++ * @data: The blob holding the key
++ * @len: The length of the data blob
++ *
++ * Add a key to the secondary keyring without checking its trust chain.  This
++ * is available only during kernel initialisation.
++ */
++void __init add_trusted_secondary_key(const char *source,
++				      const void *data, size_t len)
++{
++	key_ref_t key;
++
++	key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1),
++				   "asymmetric",
++				   NULL, data, len,
++				   (KEY_POS_ALL & ~KEY_POS_SETATTR) |
++				   KEY_USR_VIEW,
++				   KEY_ALLOC_NOT_IN_QUOTA |
++				   KEY_ALLOC_BYPASS_RESTRICTION);
++
++	if (IS_ERR(key))
++		pr_err("Problem loading %s X.509 certificate (%ld)\n",
++		       source, PTR_ERR(key));
++	else
++		pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n",
++			  source, key_ref_to_ptr(key)->description);
++}
++#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */
+-- 
+2.9.3
+

MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch

@@ -1,7 +1,7 @@
-From ba2b209daf984514229626803472e0b055832345 Mon Sep 17 00:00:00 2001
+From 90dc66270b02981b19a085c6a9184e3452b7b3e8 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Fri, 26 Oct 2012 12:42:16 -0400
-Subject: [PATCH] MODSIGN: Import certificates from UEFI Secure Boot
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 3/4] MODSIGN: Import certificates from UEFI Secure Boot
 
 Secure Boot stores a list of allowed certificates in the 'db' variable.
 This imports those certificates into the system trusted keyring.  This
@@ -11,122 +11,68 @@ variable, a user can allow a module signed with that certificate to
 load.  The shim UEFI bootloader has a similar certificate list stored
 in the 'MokListRT' variable.  We import those as well.
 
-In the opposite case, Secure Boot maintains a list of disallowed
-certificates in the 'dbx' variable.  We load those certificates into
-the newly introduced system blacklist keyring and forbid any module
-signed with those from loading.
+Secure Boot also maintains a list of disallowed certificates in the 'dbx'
+variable.  We load those certificates into the newly introduced system
+blacklist keyring and forbid any module signed with those from loading and
+forbid the use within the kernel of any key with a matching hash.
+
+This facility is enabled by setting CONFIG_LOAD_UEFI_KEYS.
 
 Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- certs/system_keyring.c        | 13 ++++++
- include/keys/system_keyring.h |  1 +
- include/linux/efi.h           |  6 +++
- init/Kconfig                  |  9 ++++
- kernel/Makefile               |  3 ++
- kernel/modsign_uefi.c         | 99 +++++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 131 insertions(+)
- create mode 100644 kernel/modsign_uefi.c
+ certs/Kconfig     |  16 ++++++
+ certs/Makefile    |   4 ++
+ certs/load_uefi.c | 168 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 188 insertions(+)
+ create mode 100644 certs/load_uefi.c
 
-diff --git a/certs/system_keyring.c b/certs/system_keyring.c
-index 787eeead2f57..4d9123ed5c07 100644
---- a/certs/system_keyring.c
-+++ b/certs/system_keyring.c
-@@ -30,6 +30,19 @@ extern __initconst const u8 system_certificate_list[];
- extern __initconst const unsigned long system_certificate_list_size;
- 
- /**
-+ * get_system_keyring - Return a pointer to the system keyring
-+ *
-+ */
-+struct key *get_system_keyring(void)
-+{
-+	struct key *system_keyring = NULL;
-+
-+	system_keyring = builtin_trusted_keys;
-+	return system_keyring;
-+}
-+EXPORT_SYMBOL_GPL(get_system_keyring);
-+
-+/**
-  * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA
-  *
-  * Restrict the addition of keys into a keyring based on the key-to-be-added
-diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
-index 5bc291a3d261..56ff5715ab67 100644
---- a/include/keys/system_keyring.h
-+++ b/include/keys/system_keyring.h
-@@ -36,6 +36,7 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
- #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
- extern struct key *system_blacklist_keyring;
- #endif
-+extern struct key *get_system_keyring(void);
- 
- #ifdef CONFIG_IMA_BLACKLIST_KEYRING
- extern struct key *ima_blacklist_keyring;
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index ff1877145aa4..2483de19c719 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -658,6 +658,12 @@ typedef struct {
- 	u64 table;
- } efi_config_table_64_t;
- 
-+#define EFI_IMAGE_SECURITY_DATABASE_GUID \
-+    EFI_GUID(  0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f )
-+
-+#define EFI_SHIM_LOCK_GUID \
-+    EFI_GUID(  0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 )
-+
- typedef struct {
- 	efi_guid_t guid;
- 	u32 table;
-diff --git a/init/Kconfig b/init/Kconfig
-index e5449d5aeff9..5408c96f6604 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -1979,6 +1979,15 @@ config MODULE_SIG_ALL
- comment "Do not forget to sign required modules with scripts/sign-file"
- 	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
- 
-+config MODULE_SIG_UEFI
-+	bool "Allow modules signed with certs stored in UEFI"
-+	depends on MODULE_SIG && SYSTEM_BLACKLIST_KEYRING && EFI
-+	select EFI_SIGNATURE_LIST_PARSER
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 630ae09..edf9f75 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -90,4 +90,20 @@ config EFI_SIGNATURE_LIST_PARSER
+ 	  This option provides support for parsing EFI signature lists for
+ 	  X.509 certificates and turning them into keys.
+
++config LOAD_UEFI_KEYS
++	bool "Load certs and blacklist from UEFI db for module checking"
++	depends on SYSTEM_BLACKLIST_KEYRING
++	depends on SECONDARY_TRUSTED_KEYRING
++	depends on EFI
++	depends on EFI_SIGNATURE_LIST_PARSER
 +	help
-+	  This will import certificates stored in UEFI and allow modules
-+	  signed with those to be loaded.  It will also disallow loading
-+	  of modules stored in the UEFI dbx variable.
++	  If the kernel is booted in secure boot mode, this option will cause
++	  the kernel to load the certificates from the UEFI db and MokListRT
++	  into the secondary trusted keyring.  It will also load any X.509
++	  SHA256 hashes in the dbx list into the blacklist.
 +
- choice
- 	prompt "Which hash algorithm should modules be signed with?"
- 	depends on MODULE_SIG
-diff --git a/kernel/Makefile b/kernel/Makefile
-index e2ec54e2b952..8dab549985d8 100644
---- a/kernel/Makefile
-+++ b/kernel/Makefile
-@@ -57,6 +57,7 @@ endif
- obj-$(CONFIG_UID16) += uid16.o
- obj-$(CONFIG_MODULES) += module.o
- obj-$(CONFIG_MODULE_SIG) += module_signing.o
-+obj-$(CONFIG_MODULE_SIG_UEFI) += modsign_uefi.o
- obj-$(CONFIG_KALLSYMS) += kallsyms.o
- obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
- obj-$(CONFIG_KEXEC_CORE) += kexec_core.o
-@@ -113,6 +114,8 @@ obj-$(CONFIG_MEMBARRIER) += membarrier.o
- 
- obj-$(CONFIG_HAS_IOMEM) += memremap.o
- 
-+$(obj)/modsign_uefi.o: KBUILD_CFLAGS += -fshort-wchar
++	  The effect of this is that, if the kernel is booted in secure boot
++	  mode, modules signed with UEFI-stored keys will be permitted to be
++	  loaded and keys that match the blacklist will be rejected.
 +
- $(obj)/configs.o: $(obj)/config_data.h
- 
- # config_data.h contains the same information as ikconfig.h but gzipped.
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 738151a..a5e057a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -11,6 +11,10 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
+ obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
+
++obj-$(CONFIG_LOAD_UEFI_KEYS) += load_uefi.o
++$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar
++
++
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+
+ $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
 new file mode 100644
-index 000000000000..fe4a6f2bf10a
+index 0000000..b44e464
 --- /dev/null
-+++ b/kernel/modsign_uefi.c
-@@ -0,0 +1,99 @@
++++ b/certs/load_uefi.c
+@@ -0,0 +1,168 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/cred.h>
@@ -135,14 +81,22 @@ index 000000000000..fe4a6f2bf10a
 +#include <linux/slab.h>
 +#include <keys/asymmetric-type.h>
 +#include <keys/system_keyring.h>
-+#include "module-internal.h"
++#include "internal.h"
 +
-+static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size)
++static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID;
++static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GUID;
++static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
++
++/*
++ * Get a certificate list blob from the named EFI variable.
++ */
++static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
++				  unsigned long *size)
 +{
 +	efi_status_t status;
 +	unsigned long lsize = 4;
 +	unsigned long tmpdb[4];
-+	void *db = NULL;
++	void *db;
 +
 +	status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
 +	if (status != EFI_BUFFER_TOO_SMALL) {
@@ -153,23 +107,89 @@ index 000000000000..fe4a6f2bf10a
 +	db = kmalloc(lsize, GFP_KERNEL);
 +	if (!db) {
 +		pr_err("Couldn't allocate memory for uefi cert list\n");
-+		goto out;
++		return NULL;
 +	}
 +
 +	status = efi.get_variable(name, guid, NULL, &lsize, db);
 +	if (status != EFI_SUCCESS) {
 +		kfree(db);
-+		db = NULL;
 +		pr_err("Error reading db var: 0x%lx\n", status);
++		return NULL;
 +	}
-+out:
++
 +	*size = lsize;
 +	return db;
 +}
 +
 +/*
-+ *  * Load the certs contained in the UEFI databases
-+ *   */
++ * Blacklist an X509 TBS hash.
++ */
++static __init void uefi_blacklist_x509_tbs(const char *source,
++					   const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "tbs:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Blacklist the hash of an executable.
++ */
++static __init void uefi_blacklist_binary(const char *source,
++					 const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "bin:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI db and MokListRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
++		return add_trusted_secondary_key;
++	return 0;
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI dbx and MokListXRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0)
++		return uefi_blacklist_x509_tbs;
++	if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0)
++		return uefi_blacklist_binary;
++	return 0;
++}
++
++/*
++ * Load the certs contained in the UEFI databases
++ */
 +static int __init load_uefi_certs(void)
 +{
 +	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
@@ -177,17 +197,9 @@ index 000000000000..fe4a6f2bf10a
 +	void *db = NULL, *dbx = NULL, *mok = NULL;
 +	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
 +	int rc = 0;
-+	struct key *keyring = NULL;
 +
-+	/* Check if SB is enabled and just return if not */
-+	if (!efi_enabled(EFI_SECURE_BOOT))
-+		return 0;
-+
-+	keyring = get_system_keyring();
-+	if (!keyring) {
-+		pr_err("MODSIGN: Couldn't get system keyring\n");
-+		return -EINVAL;
-+	}
++	if (!efi.get_variable)
++		return false;
 +
 +	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
 +	 * an error if we can't get them.
@@ -196,7 +208,8 @@ index 000000000000..fe4a6f2bf10a
 +	if (!db) {
 +		pr_err("MODSIGN: Couldn't get UEFI db list\n");
 +	} else {
-+		rc = parse_efi_signature_list(db, dbsize, keyring);
++		rc = parse_efi_signature_list("UEFI:db",
++					      db, dbsize, get_handler_for_db);
 +		if (rc)
 +			pr_err("Couldn't parse db signatures: %d\n", rc);
 +		kfree(db);
@@ -206,7 +219,8 @@ index 000000000000..fe4a6f2bf10a
 +	if (!mok) {
 +		pr_info("MODSIGN: Couldn't get UEFI MokListRT\n");
 +	} else {
-+		rc = parse_efi_signature_list(mok, moksize, keyring);
++		rc = parse_efi_signature_list("UEFI:MokListRT",
++					      mok, moksize, get_handler_for_db);
 +		if (rc)
 +			pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
 +		kfree(mok);
@@ -216,8 +230,9 @@ index 000000000000..fe4a6f2bf10a
 +	if (!dbx) {
 +		pr_info("MODSIGN: Couldn't get UEFI dbx list\n");
 +	} else {
-+		rc = parse_efi_signature_list(dbx, dbxsize,
-+			system_blacklist_keyring);
++		rc = parse_efi_signature_list("UEFI:dbx",
++					      dbx, dbxsize,
++					      get_handler_for_dbx);
 +		if (rc)
 +			pr_err("Couldn't parse dbx signatures: %d\n", rc);
 +		kfree(dbx);
@@ -227,5 +242,5 @@ index 000000000000..fe4a6f2bf10a
 +}
 +late_initcall(load_uefi_certs);
 -- 
-2.5.5
+2.9.3
 

MODSIGN-Support-not-importing-certs-from-db.patch

@@ -1,62 +1,62 @@
-From 7ce860189df19a38176c1510f4e5615bf35495c1 Mon Sep 17 00:00:00 2001
+From 9f1958a0cc911e1f79b2733ee5029dbd819ff328 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 3 Oct 2013 10:14:23 -0400
-Subject: [PATCH 2/2] MODSIGN: Support not importing certs from db
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 4/4] MODSIGN: Allow the "db" UEFI variable to be suppressed
 
 If a user tells shim to not use the certs/hashes in the UEFI db variable
-for verification purposes, shim will set a UEFI variable called MokIgnoreDB.
-Have the uefi import code look for this and not import things from the db
-variable.
+for verification purposes, shim will set a UEFI variable called
+MokIgnoreDB.  Have the uefi import code look for this and ignore the db
+variable if it is found.
 
 Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- kernel/modsign_uefi.c | 40 +++++++++++++++++++++++++++++++---------
- 1 file changed, 31 insertions(+), 9 deletions(-)
+ certs/load_uefi.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
 
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
-index 03f601a0052c..321c79a3b282 100644
---- a/kernel/modsign_uefi.c
-+++ b/kernel/modsign_uefi.c
-@@ -8,6 +8,23 @@
- #include <keys/system_keyring.h>
- #include "module-internal.h"
- 
-+static __init int check_ignore_db(void)
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
+index b44e464..3d88459 100644
+--- a/certs/load_uefi.c
++++ b/certs/load_uefi.c
+@@ -13,6 +13,26 @@ static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GU
+ static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
+
+ /*
++ * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
++ * it does.
++ *
++ * This UEFI variable is set by the shim if a user tells the shim to not use
++ * the certs/hashes in the UEFI db variable for verification purposes.  If it
++ * is set, we should ignore the db variable also and the true return indicates
++ * this.
++ */
++static __init bool uefi_check_ignore_db(void)
 +{
 +	efi_status_t status;
 +	unsigned int db = 0;
 +	unsigned long size = sizeof(db);
 +	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
 +
-+	/* Check and see if the MokIgnoreDB variable exists.  If that fails
-+	 * then we don't ignore DB.  If it succeeds, we do.
-+	 */
 +	status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
-+	if (status != EFI_SUCCESS)
-+		return 0;
-+
-+	return 1;
++	return status == EFI_SUCCESS;
 +}
 +
- static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size)
++/*
+  * Get a certificate list blob from the named EFI variable.
+  */
+ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+@@ -113,7 +133,9 @@ static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_ty
+ }
+
+ /*
+- * Load the certs contained in the UEFI databases
++ * Load the certs contained in the UEFI databases into the secondary trusted
++ * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
++ * keyring.
+  */
+ static int __init load_uefi_certs(void)
  {
- 	efi_status_t status;
-@@ -47,7 +64,7 @@ static int __init load_uefi_certs(void)
- 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
- 	void *db = NULL, *dbx = NULL, *mok = NULL;
- 	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
--	int rc = 0;
-+	int ignore_db, rc = 0;
- 	struct key *keyring = NULL;
- 
- 	/* Check if SB is enabled and just return if not */
-@@ -60,17 +77,22 @@ static int __init load_uefi_certs(void)
- 		return -EINVAL;
- 	}
- 
-+	/* See if the user has setup Ignore DB mode */
-+	ignore_db = check_ignore_db();
-+
+@@ -129,15 +151,17 @@ static int __init load_uefi_certs(void)
  	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
  	 * an error if we can't get them.
  	 */
@@ -64,23 +64,25 @@ index 03f601a0052c..321c79a3b282 100644
 -	if (!db) {
 -		pr_err("MODSIGN: Couldn't get UEFI db list\n");
 -	} else {
--		rc = parse_efi_signature_list(db, dbsize, keyring);
+-		rc = parse_efi_signature_list("UEFI:db",
+-					      db, dbsize, get_handler_for_db);
 -		if (rc)
 -			pr_err("Couldn't parse db signatures: %d\n", rc);
 -		kfree(db);
-+	if (!ignore_db) {
++	if (!uefi_check_ignore_db()) {
 +		db = get_cert_list(L"db", &secure_var, &dbsize);
 +		if (!db) {
 +			pr_err("MODSIGN: Couldn't get UEFI db list\n");
 +		} else {
-+			rc = parse_efi_signature_list(db, dbsize, keyring);
++			rc = parse_efi_signature_list("UEFI:db",
++						      db, dbsize, get_handler_for_db);
 +			if (rc)
 +				pr_err("Couldn't parse db signatures: %d\n", rc);
 +			kfree(db);
 +		}
  	}
- 
+
  	mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
 -- 
-2.5.5
+2.9.3
 

Makefile

@@ -10,9 +10,7 @@ help:
 	@echo "Try fedpkg $@ or something like that"
 	@exit 1
 
-include Makefile.config
-
-prep:
+prep: config-files
 	fedpkg -v prep
 
 noarch:
@@ -25,91 +23,22 @@ local:
 extremedebug:
 	@perl -pi -e 's/# CONFIG_DEBUG_PAGEALLOC is not set/CONFIG_DEBUG_PAGEALLOC=y/' config-nodebug
 
+config-files:
+	@./build_configs.sh
+
 debug:
-	@perl -pi -e 's/# CONFIG_LOCK_STAT is not set/CONFIG_LOCK_STAT=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_STACK_USAGE is not set/CONFIG_DEBUG_STACK_USAGE=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_SLAB is not set/CONFIG_DEBUG_SLAB=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_MUTEXES is not set/CONFIG_DEBUG_MUTEXES=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_RT_MUTEXES is not set/CONFIG_DEBUG_RT_MUTEXES=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_LOCK_ALLOC is not set/CONFIG_DEBUG_LOCK_ALLOC=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_LOCK_TORTURE_TEST is not set/CONFIG_LOCK_TORTURE_TEST=m/' config-nodebug
-	@perl -pi -e 's/# CONFIG_PROVE_LOCKING is not set/CONFIG_PROVE_LOCKING=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_PROVE_RCU is not set/CONFIG_PROVE_RCU=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_SPINLOCK is not set/CONFIG_DEBUG_SPINLOCK=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_VM is not set/CONFIG_DEBUG_VM=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_VM_PGFLAGS is not set/CONFIG_DEBUG_VM_PGFLAGS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAULT_INJECTION is not set/CONFIG_FAULT_INJECTION=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAILSLAB is not set/CONFIG_FAILSLAB=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAIL_PAGE_ALLOC is not set/CONFIG_FAIL_PAGE_ALLOC=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAIL_IO_TIMEOUT is not set/CONFIG_FAIL_IO_TIMEOUT=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAIL_MAKE_REQUEST is not set/CONFIG_FAIL_MAKE_REQUEST=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAIL_MMC_REQUEST is not set/CONFIG_FAIL_MMC_REQUEST=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAULT_INJECTION_DEBUG_FS is not set/CONFIG_FAULT_INJECTION_DEBUG_FS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set/CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_SG is not set/CONFIG_DEBUG_SG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_PI_LIST is not set/CONFIG_DEBUG_PI_LIST=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS is not set/CONFIG_DEBUG_OBJECTS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_FREE is not set/CONFIG_DEBUG_OBJECTS_FREE=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_TIMERS is not set/CONFIG_DEBUG_OBJECTS_TIMERS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_WORK is not set/CONFIG_DEBUG_OBJECTS_WORK=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER is not set/CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_OBJECTS_RCU_HEAD is not set/CONFIG_DEBUG_OBJECTS_RCU_HEAD=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_X86_PTDUMP is not set/CONFIG_X86_PTDUMP=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_ARM64_PTDUMP is not set/CONFIG_ARM64_PTDUMP=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_EFI_PGT_DUMP is not set/CONFIG_EFI_PGT_DUMP=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_CAN_DEBUG_DEVICES is not set/CONFIG_CAN_DEBUG_DEVICES=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_MODULE_FORCE_UNLOAD is not set/CONFIG_MODULE_FORCE_UNLOAD=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_NOTIFIERS is not set/CONFIG_DEBUG_NOTIFIERS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DMA_API_DEBUG is not set/CONFIG_DMA_API_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_PM_TEST_SUSPEND is not set/CONFIG_PM_TEST_SUSPEND=y/' config-generic
-	@perl -pi -e 's/# CONFIG_PM_ADVANCED_DEBUG is not set/CONFIG_PM_ADVANCED_DEBUG=y/' config-generic
-	@perl -pi -e 's/# CONFIG_B43_DEBUG is not set/CONFIG_B43_DEBUG=y/' config-generic
-	@perl -pi -e 's/# CONFIG_B43LEGACY_DEBUG is not set/CONFIG_B43LEGACY_DEBUG=y/' config-generic
-	@perl -pi -e 's/# CONFIG_MMIOTRACE is not set/CONFIG_MMIOTRACE=y/' config-nodebug
-	@perl -pi -e 's/CONFIG_STRIP_ASM_SYMS=y/# CONFIG_STRIP_ASM_SYMS is not set/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_CREDENTIALS is not set/CONFIG_DEBUG_CREDENTIALS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set/CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_ACPI_DEBUG is not set/CONFIG_ACPI_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_EXT4_DEBUG is not set/CONFIG_EXT4_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_PERF_USE_VMALLOC is not set/CONFIG_DEBUG_PERF_USE_VMALLOC=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_JBD2_DEBUG is not set/CONFIG_JBD2_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_NFSD_FAULT_INJECTION is not set/CONFIG_NFSD_FAULT_INJECTION=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_BLK_CGROUP is not set/CONFIG_DEBUG_BLK_CGROUP=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DRBD_FAULT_INJECTION is not set/CONFIG_DRBD_FAULT_INJECTION=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_ATH_DEBUG is not set/CONFIG_ATH_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_CARL9170_DEBUGFS is not set/CONFIG_CARL9170_DEBUGFS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_IWLWIFI_DEVICE_TRACING is not set/CONFIG_IWLWIFI_DEVICE_TRACING=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DMADEVICES_DEBUG is not set/CONFIG_DMADEVICES_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_CEPH_LIB_PRETTYDEBUG is not set/CONFIG_CEPH_LIB_PRETTYDEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_QUOTA_DEBUG is not set/CONFIG_QUOTA_DEBUG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_KGDB_KDB is not set/CONFIG_KGDB_KDB=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_KDB_KEYBOARD is not set/CONFIG_KDB_KEYBOARD=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set/CONFIG_CPU_NOTIFIER_ERROR_INJECT=m/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_PER_CPU_MAPS is not set/CONFIG_DEBUG_PER_CPU_MAPS=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_TEST_LIST_SORT is not set/CONFIG_TEST_LIST_SORT=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_ATOMIC_SLEEP is not set/CONFIG_DEBUG_ATOMIC_SLEEP=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DETECT_HUNG_TASK is not set/CONFIG_DETECT_HUNG_TASK=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_WQ_WATCHDOG is not set/CONFIG_WQ_WATCHDOG=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set/CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y/' config-nodebug
-	@perl -pi -e 's/# CONFIG_DEBUG_KMEMLEAK is not set/CONFIG_DEBUG_KMEMLEAK=y/' config-nodebug
-
-	@# just in case we're going from extremedebug -> debug
-	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-nodebug
-
-	@perl -pi -e 's/# CONFIG_MAXSMP is not set/CONFIG_MAXSMP=y/' config-x86-generic
-
 	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
 	@rpmdev-bumpspec -c "Reenable debugging options." kernel.spec
 
-nodebuginfo:
-	@perl -pi -e 's/^%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 1\}/%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 0\}/' kernel.spec
-nodebug: release
-	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
-release: config-release
+release:
 	@perl -pi -e 's/^%define debugbuildsenabled 0/%define debugbuildsenabled 1/' kernel.spec
 	@rpmdev-bumpspec -c "Disable debugging options." kernel.spec
 
-include Makefile.release
+nodebuginfo:
+	@perl -pi -e 's/^%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 1\}/%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 0\}/' kernel.spec
+
+nodebug: release
+	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
 
 ifeq ($(MAKECMDGOALS),me a sandwich)
 .PHONY: me a sandwich

Makefile.config

@@ -1,129 +0,0 @@
-# Make rules for configuration files.
-#
-# $Id$
-
-CFG		= kernel-$(VERSION)
-
-CONFIGFILES	= \
-	$(CFG)-i686.config $(CFG)-i686-debug.config \
-	$(CFG)-i686-PAE.config $(CFG)-i686-PAEdebug.config \
-	$(CFG)-x86_64.config $(CFG)-x86_64-debug.config \
-	$(CFG)-s390x.config \
-	$(CFG)-armv7hl.config $(CFG)-armv7hl-lpae.config \
-	$(CFG)-aarch64.config \
-	$(CFG)-ppc64.config $(CFG)-ppc64p7.config $(CFG)-ppc64-debug.config \
-	$(CFG)-ppc64le.config $(CFG)-ppc64le-debug.config
-
-PLATFORMS	= x86 x86_64 powerpc s390x arm arm64
-TEMPFILES	= $(addprefix temp-, $(addsuffix -generic, $(PLATFORMS)))
-
-configs: $(CONFIGFILES)
-	@rm -f kernel-*-config
-	@rm -f $(TEMPFILES)
-	@rm -f temp-generic temp-*-generic temp-*-generic-tmp
-
-# Augment the clean target to clean up our own cruft
-clean ::
-	@rm -fv $(CONFIGFILES) $(TEMPFILES) temp-generic kernel-$(VERSION)*config
-
-temp-generic: config-generic config-nodebug
-	cat $^ > temp-generic
-
-temp-debug-generic: config-generic config-debug
-	cat $^ > temp-debug-generic
-
-temp-no-extra-generic: config-no-extra temp-generic
-	perl merge.pl $^ > $@
-
-temp-arm-generic: config-arm-generic temp-no-extra-generic
-	perl merge.pl $^ > $@
-
-temp-armv7-generic: config-armv7-generic temp-arm-generic
-	perl merge.pl $^ > $@
-
-temp-armv7: config-armv7 temp-armv7-generic
-	perl merge.pl $^ > $@
-
-temp-armv7-lpae: config-armv7-lpae temp-armv7-generic
-	perl merge.pl $^ > $@
-
-temp-arm-debug-generic: temp-arm-generic temp-debug-generic
-	perl merge.pl $^ > $@
-
-temp-arm64: config-arm64 temp-arm-generic
-	perl merge.pl $^ > $@
-
-temp-arm64-debug: config-arm64 temp-arm-debug-generic
-	perl merge.pl $^ > $@
-
-temp-x86-32: config-x86-32-generic config-x86-generic
-	perl merge.pl $^  > $@
-
-temp-x86-32-generic: temp-x86-32 temp-generic
-	perl merge.pl $^  > $@
-
-temp-x86-debug-generic: temp-x86-32 temp-debug-generic
-	perl merge.pl $^  > $@
-
-temp-x86-64: config-x86_64-generic config-x86-generic
-	perl merge.pl $^  > $@
-
-temp-x86_64-generic: temp-x86-64 temp-generic
-	perl merge.pl $^  > $@
-
-temp-x86_64-debug-generic: temp-x86-64 temp-debug-generic
-	perl merge.pl $^  > $@
-
-temp-powerpc64-generic: config-powerpc64-generic temp-generic
-	perl merge.pl $^  > $@
-
-temp-powerpc64-debug-generic: config-powerpc64-generic temp-debug-generic
-	perl merge.pl $^  > $@
-
-temp-s390-generic: config-s390x temp-generic
-	perl merge.pl $^ > $@
-
-$(CFG)-i686-PAE.config: config-i686-PAE temp-x86-32-generic
-	perl merge.pl $^ i386 > $@
-
-$(CFG)-i686-PAEdebug.config: config-i686-PAE temp-x86-debug-generic
-	perl merge.pl $^ i386 > $@
-
-$(CFG)-i686.config: /dev/null temp-x86-32-generic
-	perl merge.pl $^ i386 > $@
-
-$(CFG)-i686-debug.config: /dev/null temp-x86-debug-generic
-	perl merge.pl $^ i386 > $@
-
-$(CFG)-x86_64.config: /dev/null temp-x86_64-generic
-	perl merge.pl $^ x86_64 > $@
-
-$(CFG)-x86_64-debug.config: /dev/null temp-x86_64-debug-generic
-	perl merge.pl $^ x86_64 > $@
-
-$(CFG)-ppc64.config: config-powerpc64 temp-powerpc64-generic
-	perl merge.pl $^ powerpc > $@
-
-$(CFG)-ppc64-debug.config: config-powerpc64 temp-powerpc64-debug-generic
-	perl merge.pl $^ powerpc > $@
-
-$(CFG)-ppc64p7.config: config-powerpc64p7 temp-powerpc64-generic
-	perl merge.pl $^ powerpc > $@
-
-$(CFG)-ppc64le.config: config-powerpc64le temp-powerpc64-generic
-	perl merge.pl $^ powerpc > $@
-
-$(CFG)-ppc64le-debug.config: config-powerpc64le temp-powerpc64-debug-generic
-	perl merge.pl $^ powerpc > $@
-
-$(CFG)-s390x.config: config-s390x temp-s390-generic
-	perl merge.pl $^ s390 > $@
-
-$(CFG)-armv7hl.config: /dev/null temp-armv7
-	perl merge.pl $^ arm > $@
-
-$(CFG)-armv7hl-lpae.config: /dev/null temp-armv7-lpae
-	perl merge.pl $^ arm > $@
-
-$(CFG)-aarch64.config: /dev/null temp-arm64
-	perl merge.pl $^ arm64 > $@

Makefile.release

@@ -1,84 +0,0 @@
-# Make rules for configuration files.
-#
-# $Id$
-
-# This file contains only entries that change the config files.
-# Anything that changes kernel.spec itself should go in the main Makefile.
-
-config-release:
-	@perl -pi -e 's/CONFIG_LOCK_STAT=y/# CONFIG_LOCK_STAT is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_STACK_USAGE=y/# CONFIG_DEBUG_STACK_USAGE is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_SLAB=y/# CONFIG_DEBUG_SLAB is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_MUTEXES=y/# CONFIG_DEBUG_MUTEXES is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_RT_MUTEXES=y/# CONFIG_DEBUG_RT_MUTEXES is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_LOCK_ALLOC=y/# CONFIG_DEBUG_LOCK_ALLOC is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_LOCK_TORTURE_TEST=m/# CONFIG_LOCK_TORTURE_TEST is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_PROVE_LOCKING=y/# CONFIG_PROVE_LOCKING is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_PROVE_RCU=y/# CONFIG_PROVE_RCU is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_SPINLOCK=y/# CONFIG_DEBUG_SPINLOCK is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_VM=y/# CONFIG_DEBUG_VM is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_VM_PGFLAGS=y/# CONFIG_DEBUG_VM_PGFLAGS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAULT_INJECTION=y/# CONFIG_FAULT_INJECTION is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAILSLAB=y/# CONFIG_FAILSLAB is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAIL_PAGE_ALLOC=y/# CONFIG_FAIL_PAGE_ALLOC is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAIL_IO_TIMEOUT=y/# CONFIG_FAIL_IO_TIMEOUT is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAIL_MAKE_REQUEST=y/# CONFIG_FAIL_MAKE_REQUEST is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAIL_MMC_REQUEST=y/# CONFIG_FAIL_MMC_REQUEST is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAULT_INJECTION_DEBUG_FS=y/# CONFIG_FAULT_INJECTION_DEBUG_FS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y/# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_SG=y/# CONFIG_DEBUG_SG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_PI_LIST=y/# CONFIG_DEBUG_PI_LIST is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS=y/# CONFIG_DEBUG_OBJECTS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_FREE=y/# CONFIG_DEBUG_OBJECTS_FREE is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_TIMERS=y/# CONFIG_DEBUG_OBJECTS_TIMERS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_WORK=y/# CONFIG_DEBUG_OBJECTS_WORK is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y/# CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_OBJECTS_RCU_HEAD=y/# CONFIG_DEBUG_OBJECTS_RCU_HEAD is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_ARM64_PTDUMP=y/# CONFIG_ARM64_PTDUMP is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_EFI_PGT_DUMP=y/# CONFIG_EFI_PGT_DUMP is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_CAN_DEBUG_DEVICES=y/# CONFIG_CAN_DEBUG_DEVICES is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_MODULE_FORCE_UNLOAD=y/# CONFIG_MODULE_FORCE_UNLOAD is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_NOTIFIERS=y/# CONFIG_DEBUG_NOTIFIERS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DMA_API_DEBUG=y/# CONFIG_DMA_API_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_PM_TEST_SUSPEND=y/# CONFIG_PM_TEST_SUSPEND is not set/' config-generic
-	@perl -pi -e 's/CONFIG_PM_ADVANCED_DEBUG=y/# CONFIG_PM_ADVANCED_DEBUG is not set/' config-generic
-	@perl -pi -e 's/CONFIG_B43_DEBUG=y/# CONFIG_B43_DEBUG is not set/' config-generic
-	@perl -pi -e 's/CONFIG_B43LEGACY_DEBUG=y/# CONFIG_B43LEGACY_DEBUG is not set/' config-generic
-	@perl -pi -e 's/CONFIG_MMIOTRACE=y/# CONFIG_MMIOTRACE is not set/' config-nodebug
-	@perl -pi -e 's/# CONFIG_STRIP_ASM_SYMS is not set/CONFIG_STRIP_ASM_SYMS=y/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_CREDENTIALS=y/# CONFIG_DEBUG_CREDENTIALS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y/# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_ACPI_DEBUG=y/# CONFIG_ACPI_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_EXT4_DEBUG=y/# CONFIG_EXT4_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_PERF_USE_VMALLOC=y/# CONFIG_DEBUG_PERF_USE_VMALLOC is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_JBD2_DEBUG=y/# CONFIG_JBD2_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_NFSD_FAULT_INJECTION=y/# CONFIG_NFSD_FAULT_INJECTION is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_BLK_CGROUP=y/# CONFIG_DEBUG_BLK_CGROUP is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DRBD_FAULT_INJECTION=y/# CONFIG_DRBD_FAULT_INJECTION is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_ATH_DEBUG=y/# CONFIG_ATH_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_CARL9170_DEBUGFS=y/# CONFIG_CARL9170_DEBUGFS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_IWLWIFI_DEVICE_TRACING=y/# CONFIG_IWLWIFI_DEVICE_TRACING is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DMADEVICES_DEBUG=y/# CONFIG_DMADEVICES_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_CEPH_LIB_PRETTYDEBUG=y/# CONFIG_CEPH_LIB_PRETTYDEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_QUOTA_DEBUG=y/# CONFIG_QUOTA_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_CPU_NOTIFIER_ERROR_INJECT=m/# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_PER_CPU_MAPS=y/# CONFIG_DEBUG_PER_CPU_MAPS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_PERCPU_TEST=m/# CONFIG_PERCPU_TEST is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_TEST_LIST_SORT=y/# CONFIG_TEST_LIST_SORT is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_TEST_STRING_HELPERS=m/# CONFIG_TEST_STRING_HELPERS is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_ATOMIC_SLEEP=y/# CONFIG_DEBUG_ATOMIC_SLEEP is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DETECT_HUNG_TASK=y/# CONFIG_DETECT_HUNG_TASK is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_WQ_WATCHDOG=y/# CONFIG_WQ_WATCHDOG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y/# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_DEBUG_KMEMLEAK=y/# CONFIG_DEBUG_KMEMLEAK is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_MAC80211_MESSAGE_TRACING=y/# CONFIG_MAC80211_MESSAGE_TRACING is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_XFS_WARN=y/# CONFIG_XFS_WARN is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_EDAC_DEBUG=y/# CONFIG_EDAC_DEBUG is not set/' config-nodebug
-	@perl -pi -e 's/CONFIG_RTLWIFI_DEBUG=y/# CONFIG_RTLWIFI_DEBUG is not set/' config-nodebug
-
-	@# Undo anything that make extremedebug might have set
-	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-debug
-	@perl -pi -e 's/CONFIG_DEBUG_PAGEALLOC=y/# CONFIG_DEBUG_PAGEALLOC is not set/' config-nodebug
-
-	@# Change defaults back to sane things.
-	@perl -pi -e 's/CONFIG_MAXSMP=y/# CONFIG_MAXSMP is not set/' config-x86-generic

PCI-Lock-down-BAR-access-when-module-security-is-ena.patch

@@ -1,117 +0,0 @@
-From 6f756b32a45b022428e33ce20181e874c73ca82e Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Thu, 8 Mar 2012 10:10:38 -0500
-Subject: [PATCH] PCI: Lock down BAR access when module security is enabled
-
-Any hardware that can potentially generate DMA has to be locked down from
-userspace in order to avoid it being possible for an attacker to modify
-kernel code, allowing them to circumvent disabled module loading or module
-signing. Default to paranoid - in future we can potentially relax this for
-sufficiently IOMMU-isolated devices.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- drivers/pci/pci-sysfs.c | 10 ++++++++++
- drivers/pci/proc.c      |  8 +++++++-
- drivers/pci/syscall.c   |  3 ++-
- 3 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index bcd10c7..a950301 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -30,6 +30,7 @@
- #include <linux/vgaarb.h>
- #include <linux/pm_runtime.h>
- #include <linux/of.h>
-+#include <linux/module.h>
- #include "pci.h"
- 
- static int sysfs_initialized;	/* = 0 */
-@@ -716,6 +717,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
- 	loff_t init_off = off;
- 	u8 *data = (u8 *) buf;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	if (off > dev->cfg_size)
- 		return 0;
- 	if (off + count > dev->cfg_size) {
-@@ -1007,6 +1011,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
- 	resource_size_t start, end;
- 	int i;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	for (i = 0; i < PCI_ROM_RESOURCE; i++)
- 		if (res == &pdev->resource[i])
- 			break;
-@@ -1106,6 +1113,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
- 				     struct bin_attribute *attr, char *buf,
- 				     loff_t off, size_t count)
- {
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	return pci_resource_io(filp, kobj, attr, buf, off, count, true);
- }
- 
-diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index 2408abe..59f321c 100644
---- a/drivers/pci/proc.c
-+++ b/drivers/pci/proc.c
-@@ -116,6 +116,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
- 	int size = dev->cfg_size;
- 	int cnt;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	if (pos >= size)
- 		return 0;
- 	if (nbytes >= size)
-@@ -195,6 +198,9 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd,
- #endif /* HAVE_PCI_MMAP */
- 	int ret = 0;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	switch (cmd) {
- 	case PCIIOC_CONTROLLER:
- 		ret = pci_domain_nr(dev->bus);
-@@ -233,7 +239,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
- 	struct pci_filp_private *fpriv = file->private_data;
- 	int i, ret, write_combine;
- 
--	if (!capable(CAP_SYS_RAWIO))
-+	if (!capable(CAP_SYS_RAWIO) || secure_modules())
- 		return -EPERM;
- 
- 	/* Make sure the caller is mapping a real resource for this device */
-diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
-index b91c4da..98f5637 100644
---- a/drivers/pci/syscall.c
-+++ b/drivers/pci/syscall.c
-@@ -10,6 +10,7 @@
- #include <linux/errno.h>
- #include <linux/pci.h>
- #include <linux/syscalls.h>
-+#include <linux/module.h>
- #include <asm/uaccess.h>
- #include "pci.h"
- 
-@@ -92,7 +93,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
- 	u32 dword;
- 	int err = 0;
- 
--	if (!capable(CAP_SYS_ADMIN))
-+	if (!capable(CAP_SYS_ADMIN) || secure_modules())
- 		return -EPERM;
- 
- 	dev = pci_get_bus_and_slot(bus, dfn);
--- 
-2.9.2
-

PatchList.txt

@@ -60,8 +60,6 @@ disable-i8042-check-on-apple-mac.patch
 
 lis3-improve-handling-of-null-rate.patch
 
-watchdog-Disable-watchdog-on-virtual-machines.patch
-
 scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
 
 criu-no-expert.patch

RFC-audit-fix-a-race-condition-with-the-auditd-tracking-code.patch

@@ -0,0 +1,156 @@
+From patchwork Thu Jun 15 15:28:58 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [RFC] audit: fix a race condition with the auditd tracking code
+From: Paul Moore <pmoore@redhat.com>
+X-Patchwork-Id: 9789009
+Message-Id: <149754053819.11365.5047864735077505545.stgit@sifl>
+To: linux-audit@redhat.com
+Cc: Dusty Mabe <dustymabe@redhat.com>
+Date: Thu, 15 Jun 2017 11:28:58 -0400
+
+From: Paul Moore <paul@paul-moore.com>
+
+Originally reported by Adam and Dusty, it appears we have a small
+race window in kauditd_thread(), as documented in the Fedora BZ:
+
+ * https://bugzilla.redhat.com/show_bug.cgi?id=1459326#c35
+
+ "This issue is partly due to the read-copy nature of RCU, and
+  partly due to how we sync the auditd_connection state across
+  kauditd_thread and the audit control channel.  The kauditd_thread
+  thread is always running so it can service the record queues and
+  emit the multicast messages, if it happens to be just past the
+  "main_queue" label, but before the "if (sk == NULL || ...)"
+  if-statement which calls auditd_reset() when the new auditd
+  connection is registered it could end up resetting the auditd
+  connection, regardless of if it is valid or not.  This is a rather
+  small window and the variable nature of multi-core scheduling
+  explains why this is proving rather difficult to reproduce."
+
+The fix is to have functions only call auditd_reset() when they
+believe that the kernel/auditd connection is still valid, e.g.
+non-NULL, and to have these callers pass their local copy of the
+auditd_connection pointer to auditd_reset() where it can be compared
+with the current connection state before resetting.  If the caller
+has a stale state tracking pointer then the reset is ignored.
+
+We also make a small change to kauditd_thread() so that if the
+kernel/auditd connection is dead we skip the retry queue and send the
+records straight to the hold queue.  This is necessary as we used to
+rely on auditd_reset() to occasionally purge the retry queue but we
+are going to be calling the reset function much less now and we want
+to make sure the retry queue doesn't grow unbounded.
+
+Reported-by: Adam Williamson <awilliam@redhat.com>
+Reported-by: Dusty Mabe <dustymabe@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+---
+ kernel/audit.c |   36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+
+--
+Linux-audit mailing list
+Linux-audit@redhat.com
+https://www.redhat.com/mailman/listinfo/linux-audit
+
+diff --git a/kernel/audit.c b/kernel/audit.c
+index b2e877100242..e1e2b3abfb93 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -575,12 +575,16 @@ static void kauditd_retry_skb(struct sk_buff *skb)
+ 
+ /**
+  * auditd_reset - Disconnect the auditd connection
++ * @ac: auditd connection state
+  *
+  * Description:
+  * Break the auditd/kauditd connection and move all the queued records into the
+- * hold queue in case auditd reconnects.
++ * hold queue in case auditd reconnects.  It is important to note that the @ac
++ * pointer should never be dereferenced inside this function as it may be NULL
++ * or invalid, you can only compare the memory address!  If @ac is NULL then
++ * the connection will always be reset.
+  */
+-static void auditd_reset(void)
++static void auditd_reset(const struct auditd_connection *ac)
+ {
+ 	unsigned long flags;
+ 	struct sk_buff *skb;
+@@ -590,6 +594,11 @@ static void auditd_reset(void)
+ 	spin_lock_irqsave(&auditd_conn_lock, flags);
+ 	ac_old = rcu_dereference_protected(auditd_conn,
+ 					   lockdep_is_held(&auditd_conn_lock));
++	if (ac && ac != ac_old) {
++		/* someone already registered a new auditd connection */
++		spin_unlock_irqrestore(&auditd_conn_lock, flags);
++		return;
++	}
+ 	rcu_assign_pointer(auditd_conn, NULL);
+ 	spin_unlock_irqrestore(&auditd_conn_lock, flags);
+ 
+@@ -649,8 +658,8 @@ static int auditd_send_unicast_skb(struct sk_buff *skb)
+ 	return rc;
+ 
+ err:
+-	if (rc == -ECONNREFUSED)
+-		auditd_reset();
++	if (ac && rc == -ECONNREFUSED)
++		auditd_reset(ac);
+ 	return rc;
+ }
+ 
+@@ -795,9 +804,9 @@ static int kauditd_thread(void *dummy)
+ 		rc = kauditd_send_queue(sk, portid,
+ 					&audit_hold_queue, UNICAST_RETRIES,
+ 					NULL, kauditd_rehold_skb);
+-		if (rc < 0) {
++		if (ac && rc < 0) {
+ 			sk = NULL;
+-			auditd_reset();
++			auditd_reset(ac);
+ 			goto main_queue;
+ 		}
+ 
+@@ -805,9 +814,9 @@ static int kauditd_thread(void *dummy)
+ 		rc = kauditd_send_queue(sk, portid,
+ 					&audit_retry_queue, UNICAST_RETRIES,
+ 					NULL, kauditd_hold_skb);
+-		if (rc < 0) {
++		if (ac && rc < 0) {
+ 			sk = NULL;
+-			auditd_reset();
++			auditd_reset(ac);
+ 			goto main_queue;
+ 		}
+ 
+@@ -815,12 +824,13 @@ static int kauditd_thread(void *dummy)
+ 		/* process the main queue - do the multicast send and attempt
+ 		 * unicast, dump failed record sends to the retry queue; if
+ 		 * sk == NULL due to previous failures we will just do the
+-		 * multicast send and move the record to the retry queue */
++		 * multicast send and move the record to the hold queue */
+ 		rc = kauditd_send_queue(sk, portid, &audit_queue, 1,
+ 					kauditd_send_multicast_skb,
+-					kauditd_retry_skb);
+-		if (sk == NULL || rc < 0)
+-			auditd_reset();
++					(sk ?
++					 kauditd_retry_skb : kauditd_hold_skb));
++		if (ac && rc < 0)
++			auditd_reset(ac);
+ 		sk = NULL;
+ 
+ 		/* drop our netns reference, no auditd sends past this line */
+@@ -1230,7 +1240,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 								auditd_pid, 1);
+ 
+ 				/* unregister the auditd connection */
+-				auditd_reset();
++				auditd_reset(NULL);
+ 			}
+ 		}
+ 		if (s.mask & AUDIT_STATUS_RATE_LIMIT) {

Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch

@@ -1,42 +0,0 @@
-From d4ae417828427de74e9f857f9caa49580aecf1fe Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Mar 2012 09:28:15 -0500
-Subject: [PATCH 06/20] Restrict /dev/mem and /dev/kmem when module loading is
- restricted
-
-Allowing users to write to address space makes it possible for the kernel
-to be subverted, avoiding module loading restrictions. Prevent this when
-any restrictions have been imposed on loading modules.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- drivers/char/mem.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 53fe675f9bd7..b52c88860532 100644
---- a/drivers/char/mem.c
-+++ b/drivers/char/mem.c
-@@ -167,6 +167,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
- 	if (p != *ppos)
- 		return -EFBIG;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	if (!valid_phys_addr_range(p, count))
- 		return -EFAULT;
- 
-@@ -513,6 +516,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
- 	char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
- 	int err = 0;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	if (p < (unsigned long) high_memory) {
- 		unsigned long to_write = min_t(unsigned long, count,
- 					       (unsigned long)high_memory - p);
--- 
-2.4.3
-

V4-acpi-acpica-fix-acpi-parse-and-parseext-cache-leaks.patch

@@ -0,0 +1,231 @@
+From patchwork Fri Jun 23 09:36:37 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: [V4] acpi: acpica: fix acpi parse and parseext cache leaks
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9806085
+Message-Id: <1498210597-112293-1-git-send-email-kkamagui@gmail.com>
+To: lv.zheng@intel.com
+Cc: robert.moore@intel.com, rafael.j.wysocki@intel.com,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, Seunghun Han <kkamagui@gmail.com>
+Date: Fri, 23 Jun 2017 18:36:37 +0900
+
+I'm Seunghun Han, and I work for National Security Research Institute of
+South Korea.
+
+I have been doing a research on ACPI and found an ACPI cache leak in ACPI
+early abort cases.
+
+Boot log of ACPI cache leak is as follows:
+[    0.352414] ACPI: Added _OSI(Module Device)
+[    0.353182] ACPI: Added _OSI(Processor Device)
+[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)
+[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)
+[    0.356028] ACPI: Unable to start the ACPI Interpreter
+[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects
+[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #10
+[    0.361273] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.361873] Call Trace:
+[    0.362243]  ? dump_stack+0x5c/0x81
+[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.363296]  ? acpi_os_delete_cache+0xa/0x10
+[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b
+[    0.364000]  ? acpi_terminate+0xa/0x14
+[    0.364000]  ? acpi_init+0x2af/0x34f
+[    0.364000]  ? __class_create+0x4c/0x80
+[    0.364000]  ? video_setup+0x7f/0x7f
+[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.364000]  ? do_one_initcall+0x4e/0x1a0
+[    0.364000]  ? kernel_init_freeable+0x189/0x20a
+[    0.364000]  ? rest_init+0xc0/0xc0
+[    0.364000]  ? kernel_init+0xa/0x100
+[    0.364000]  ? ret_from_fork+0x25/0x30
+
+I analyzed this memory leak in detail. I found that “Acpi-State” cache and
+“Acpi-Parse” cache were merged because the size of cache objects was same
+slab cache size.
+
+I finally found “Acpi-Parse” cache and “Acpi-ParseExt” cache were leaked
+using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
+
+Real ACPI cache leak point is as follows:
+[    0.360101] ACPI: Added _OSI(Module Device)
+[    0.360101] ACPI: Added _OSI(Processor Device)
+[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)
+[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)
+[    0.364016] ACPI: Unable to start the ACPI Interpreter
+[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects
+[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #8
+[    0.371256] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.372000] Call Trace:
+[    0.372000]  ? dump_stack+0x5c/0x81
+[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.372000]  ? acpi_os_delete_cache+0xa/0x10
+[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b
+[    0.372000]  ? acpi_terminate+0xa/0x14
+[    0.372000]  ? acpi_init+0x2af/0x34f
+[    0.372000]  ? __class_create+0x4c/0x80
+[    0.372000]  ? video_setup+0x7f/0x7f
+[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.372000]  ? do_one_initcall+0x4e/0x1a0
+[    0.372000]  ? kernel_init_freeable+0x189/0x20a
+[    0.372000]  ? rest_init+0xc0/0xc0
+[    0.372000]  ? kernel_init+0xa/0x100
+[    0.372000]  ? ret_from_fork+0x25/0x30
+[    0.388039] kmem_cache_destroy Acpi-ParseExt: Slab cache still has objects
+[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #8
+[    0.390557] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.392000] Call Trace:
+[    0.392000]  ? dump_stack+0x5c/0x81
+[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.392000]  ? acpi_os_delete_cache+0xa/0x10
+[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b
+[    0.392000]  ? acpi_terminate+0xa/0x14
+[    0.392000]  ? acpi_init+0x2af/0x34f
+[    0.392000]  ? __class_create+0x4c/0x80
+[    0.392000]  ? video_setup+0x7f/0x7f
+[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.392000]  ? do_one_initcall+0x4e/0x1a0
+[    0.392000]  ? kernel_init_freeable+0x189/0x20a
+[    0.392000]  ? rest_init+0xc0/0xc0
+[    0.392000]  ? kernel_init+0xa/0x100
+[    0.392000]  ? ret_from_fork+0x25/0x30
+
+When early abort is occurred due to invalid ACPI information, Linux kernel
+terminates ACPI by calling acpi_terminate() function. The function calls
+acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_
+cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
+
+But the deletion codes in acpi_ut_delete_caches() function only delete
+slab caches using kmem_cache_destroy() function, therefore the cache
+objects should be flushed before acpi_ut_delete_caches() function.
+
+“Acpi-Parse” cache and “Acpi-ParseExt” cache are used in an AML parse
+function, acpi_ps_parse_loop(). The function should have flush codes to
+handle an error state due to invalid AML codes.
+
+This cache leak has a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+To fix ACPI cache leak for enhancing security, I made a patch which has
+flush codes in acpi_ps_parse_loop() function.
+
+I hope that this patch improves the security of Linux kernel.
+
+Thank you.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+Changes since v3: change control transfer according to reviewer's comments.
+Changes since v2: merge flush code with existing code and change comments.
+Changes since v1: move flush code to acpi_ps_complete_final_op() function.
+
+ drivers/acpi/acpica/psobject.c | 53 +++++++++++++-----------------------------
+ 1 file changed, 16 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c
+index 5bcb618..4539391 100644
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -608,7 +608,8 @@ acpi_status
+ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 			  union acpi_parse_object *op, acpi_status status)
+ {
+-	acpi_status status2;
++	acpi_status return_status = AE_OK;
++	u8 ascending = TRUE;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state);
+ 
+@@ -622,7 +623,8 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 			  op));
+ 	do {
+ 		if (op) {
+-			if (walk_state->ascending_callback != NULL) {
++			if (ascending &&
++			    walk_state->ascending_callback != NULL) {
+ 				walk_state->op = op;
+ 				walk_state->op_info =
+ 				    acpi_ps_get_opcode_info(op->common.
+@@ -644,49 +646,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 				}
+ 
+ 				if (status == AE_CTRL_TERMINATE) {
+-					status = AE_OK;
+-
+-					/* Clean up */
+-					do {
+-						if (op) {
+-							status2 =
+-							    acpi_ps_complete_this_op
+-							    (walk_state, op);
+-							if (ACPI_FAILURE
+-							    (status2)) {
+-								return_ACPI_STATUS
+-								    (status2);
+-							}
+-						}
+-
+-						acpi_ps_pop_scope(&
+-								  (walk_state->
+-								   parser_state),
+-								  &op,
+-								  &walk_state->
+-								  arg_types,
+-								  &walk_state->
+-								  arg_count);
+-
+-					} while (op);
+-
+-					return_ACPI_STATUS(status);
++					ascending = FALSE;
++					return_status = AE_CTRL_TERMINATE;
+ 				}
+ 
+ 				else if (ACPI_FAILURE(status)) {
+ 
+ 					/* First error is most important */
+ 
+-					(void)
+-					    acpi_ps_complete_this_op(walk_state,
+-								     op);
+-					return_ACPI_STATUS(status);
++					ascending = FALSE;
++					return_status = status;
+ 				}
+ 			}
+ 
+-			status2 = acpi_ps_complete_this_op(walk_state, op);
+-			if (ACPI_FAILURE(status2)) {
+-				return_ACPI_STATUS(status2);
++			status = acpi_ps_complete_this_op(walk_state, op);
++			if (ACPI_FAILURE(status)) {
++				ascending = FALSE;
++				if (ACPI_SUCCESS(return_status) ||
++				    return_status == AE_CTRL_TERMINATE) {
++					return_status = status;
++				}
+ 			}
+ 		}
+ 
+@@ -696,5 +675,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 
+ 	} while (op);
+ 
+-	return_ACPI_STATUS(status);
++	return_ACPI_STATUS(return_status);
+ }

acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch

@@ -1,39 +0,0 @@
-From 32d3dc2147823a32c8a7771d8fe0f2d1ef057c6a Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@redhat.com>
-Date: Mon, 25 Jun 2012 19:57:30 -0400
-Subject: [PATCH 07/20] acpi: Ignore acpi_rsdp kernel parameter when module
- loading is restricted
-
-This option allows userspace to pass the RSDP address to the kernel, which
-makes it possible for a user to circumvent any restrictions imposed on
-loading modules. Disable it in that case.
-
-Signed-off-by: Josh Boyer <jwboyer@redhat.com>
----
- drivers/acpi/osl.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 739a4a6b3b9b..9ef2a020a7a9 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -40,6 +40,7 @@
- #include <linux/list.h>
- #include <linux/jiffies.h>
- #include <linux/semaphore.h>
-+#include <linux/module.h>
- 
- #include <asm/io.h>
- #include <asm/uaccess.h>
-@@ -253,7 +254,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp);
- acpi_physical_address __init acpi_os_get_root_pointer(void)
- {
- #ifdef CONFIG_KEXEC
--	if (acpi_rsdp)
-+	if (acpi_rsdp && !secure_modules())
- 		return acpi_rsdp;
- #endif
- 
--- 
-2.4.3
-

acpi-acpica-fix-acpi-operand-cache-leak-in-dsutils.c.patch

@@ -0,0 +1,107 @@
+From patchwork Thu Aug 24 05:11:35 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: acpi: acpica: fix acpi operand cache leak in dsutils.c
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9919053
+Message-Id: <1503551495-33286-1-git-send-email-kkamagui@gmail.com>
+To: lv.zheng@intel.com
+Cc: robert.moore@intel.com, rafael.j.wysocki@intel.com,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, security@kernel.org,
+ Seunghun Han <kkamagui@gmail.com>
+Date: Thu, 24 Aug 2017 14:11:35 +0900
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination is occurred due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[    0.585957] ACPI: Added _OSI(Module Device)
+>[    0.587218] ACPI: Added _OSI(Processor Device)
+>[    0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[    0.589790] ACPI: Added _OSI(Processor Aggregator Device)
+>[    0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)
+>[    0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)
+>[    0.597858] ACPI: Unable to start the ACPI Interpreter
+>[    0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+>[    0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[    0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[    0.605159] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+>[    0.609177] Call Trace:
+>[    0.610063]  ? dump_stack+0x5c/0x81
+>[    0.611118]  ? kmem_cache_destroy+0x1aa/0x1c0
+>[    0.612632]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.613906]  ? acpi_os_delete_cache+0xa/0x10
+>[    0.617986]  ? acpi_ut_delete_caches+0x3f/0x7b
+>[    0.619293]  ? acpi_terminate+0xa/0x14
+>[    0.620394]  ? acpi_init+0x2af/0x34f
+>[    0.621616]  ? __class_create+0x4c/0x80
+>[    0.623412]  ? video_setup+0x7f/0x7f
+>[    0.624585]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.625861]  ? do_one_initcall+0x4e/0x1a0
+>[    0.627513]  ? kernel_init_freeable+0x19e/0x21f
+>[    0.628972]  ? rest_init+0x80/0x80
+>[    0.630043]  ? kernel_init+0xa/0x100
+>[    0.631084]  ? ret_from_fork+0x25/0x30
+>[    0.633343] vgaarb: loaded
+>[    0.635036] EDAC MC: Ver: 3.0.0
+>[    0.638601] PCI: Probing PCI hardware
+>[    0.639833] PCI host bridge to bus 0000:00
+>[    0.641031] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_
+delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()
+function uses walk_state->operand_index for start position of the top, but
+acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.
+Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+ drivers/acpi/acpica/dsutils.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
+index 0dabd9b..2c8a060 100644
+--- a/drivers/acpi/acpica/dsutils.c
++++ b/drivers/acpi/acpica/dsutils.c
+@@ -705,6 +705,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 	union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS];
+ 	u32 arg_count = 0;
+ 	u32 index = walk_state->num_operands;
++	u32 prev_num_operands = walk_state->num_operands;
++	u32 new_num_operands;
+ 	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg);
+@@ -733,6 +735,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 
+ 	/* Create the interpreter arguments, in reverse order */
+ 
++	new_num_operands = index;
+ 	index--;
+ 	for (i = 0; i < arg_count; i++) {
+ 		arg = arguments[index];
+@@ -757,7 +760,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 	 * pop everything off of the operand stack and delete those
+ 	 * objects
+ 	 */
+-	acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state);
++	walk_state->num_operands = i;
++	acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state);
++
++	/* Restore operand count */
++	walk_state->num_operands = prev_num_operands;
+ 
+ 	ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index));
+ 	return_ACPI_STATUS(status);

acpi-acpica-fix-acpi-operand-cache-leak-in-nseval.c.patch

@@ -0,0 +1,96 @@
+From patchwork Wed Jul 19 07:07:23 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: acpi: acpica: fix acpi operand cache leak in nseval.c
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9850567
+Message-Id: <1500448043-137615-1-git-send-email-kkamagui@gmail.com>
+To: Lv Zheng <lv.zheng@intel.com>
+Cc: Robert Moore <robert.moore@intel.com>,
+ "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, security@kernel.org,
+ Seunghun Han <kkamagui@gmail.com>
+Date: Wed, 19 Jul 2017 16:07:23 +0900
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination occurs due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[    0.464168] ACPI: Added _OSI(Module Device)
+>[    0.467022] ACPI: Added _OSI(Processor Device)
+>[    0.469376] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[    0.471647] ACPI: Added _OSI(Processor Aggregator Device)
+>[    0.477997] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
+>[    0.482706] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [OpcodeName unavailable] (20170303/dswexec-461)
+>[    0.487503] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.492136] ACPI Error: Method parse/execution failed [\_SB._INI] (Node ffff88021710a618), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.497683] ACPI: Interpreter enabled
+>[    0.499385] ACPI: (supports S0)
+>[    0.501151] ACPI: Using IOAPIC for interrupt routing
+>[    0.503342] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
+>[    0.506522] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [OpcodeName unavailable] (20170303/dswexec-461)
+>[    0.510463] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.514477] ACPI Error: Method parse/execution failed [\_PIC] (Node ffff88021710ab18), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.518867] ACPI Exception: AE_AML_INTERNAL, Evaluating _PIC (20170303/bus-991)
+>[    0.522384] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[    0.524597] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[    0.526795] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+>[    0.529668] Call Trace:
+>[    0.530811]  ? dump_stack+0x5c/0x81
+>[    0.532240]  ? kmem_cache_destroy+0x1aa/0x1c0
+>[    0.533905]  ? acpi_os_delete_cache+0xa/0x10
+>[    0.535497]  ? acpi_ut_delete_caches+0x3f/0x7b
+>[    0.537237]  ? acpi_terminate+0xa/0x14
+>[    0.538701]  ? acpi_init+0x2af/0x34f
+>[    0.540008]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.541593]  ? do_one_initcall+0x4e/0x1a0
+>[    0.543008]  ? kernel_init_freeable+0x19e/0x21f
+>[    0.546202]  ? rest_init+0x80/0x80
+>[    0.547513]  ? kernel_init+0xa/0x100
+>[    0.548817]  ? ret_from_fork+0x25/0x30
+>[    0.550587] vgaarb: loaded
+>[    0.551716] EDAC MC: Ver: 3.0.0
+>[    0.553744] PCI: Probing PCI hardware
+>[    0.555038] PCI host bridge to bus 0000:00
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ns_evaluate() function
+only removes info->return_object in AE_CTRL_RETURN_VALUE case. But, when errors
+occur, the status value is not AE_CTRL_RETURN_VALUE, and info->return_object is
+also not null. Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+ drivers/acpi/acpica/nseval.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
+index d22167c..f13d3cf 100644
+--- a/drivers/acpi/acpica/nseval.c
++++ b/drivers/acpi/acpica/nseval.c
+@@ -308,6 +308,14 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
+ 		/* Map AE_CTRL_RETURN_VALUE to AE_OK, we are done with it */
+ 
+ 		status = AE_OK;
++	} else if (ACPI_FAILURE(status)) {
++
++		/* If return_object exists, delete it */
++
++		if (info->return_object) {
++			acpi_ut_remove_reference(info->return_object);
++			info->return_object = NULL;
++		}
+ 	}
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_NAMES,

allwinner-net-emac.patch

@@ -0,0 +1,746 @@
+From 83e18f0ad4793ea83e03cb8e608bdd2939e76d78 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:34 +0100
+Subject: [PATCH 1/4] Revert "net: stmmac: sun8i: Remove the compatibles"
+
+This reverts commit ad4540cc5aa3dccb8e1e12458d57f8c40fae5a1c.
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 39c2122a4f26..fffd6d5fc907 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -979,6 +979,14 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id sun8i_dwmac_match[] = {
++	{ .compatible = "allwinner,sun8i-h3-emac",
++		.data = &emac_variant_h3 },
++	{ .compatible = "allwinner,sun8i-v3s-emac",
++		.data = &emac_variant_v3s },
++	{ .compatible = "allwinner,sun8i-a83t-emac",
++		.data = &emac_variant_a83t },
++	{ .compatible = "allwinner,sun50i-a64-emac",
++		.data = &emac_variant_a64 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
+-- 
+2.13.5
+
+From fa4788d88903c1e535d034c3dd3fcd386685a02c Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:41 +0100
+Subject: [PATCH 2/4] Revert "arm: dts: sunxi: Revert EMAC changes"
+
+This reverts commit fe45174b72aead678da581bab9e9a37c9b26a070.
+---
+ arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts |  9 ++++++++
+ arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts   | 19 +++++++++++++++++
+ arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts         |  7 ++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-2.dts         |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-one.dts       |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts   |  5 +++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts        |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts      | 22 +++++++++++++++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts    | 16 ++++++++++++++
+ arch/arm/boot/dts/sunxi-h3-h5.dtsi                | 26 +++++++++++++++++++++++
+ 10 files changed, 128 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+index b1502df7b509..6713d0f2b3f4 100644
+--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+@@ -56,6 +56,8 @@
+ 
+ 	aliases {
+ 		serial0 = &uart0;
++		/* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
++		ethernet0 = &emac;
+ 		ethernet1 = &xr819;
+ 	};
+ 
+@@ -102,6 +104,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+index a337af1de322..d756ff825116 100644
+--- a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "sinovoip,bpi-m2-plus", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+@@ -114,12 +115,30 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <0>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
+index 8d2cc6e9a03f..78f6c24952dd 100644
+--- a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
+@@ -46,3 +46,10 @@
+ 	model = "FriendlyARM NanoPi NEO";
+ 	compatible = "friendlyarm,nanopi-neo", "allwinner,sun8i-h3";
+ };
++
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
+index 8ff71b1bb45b..17cdeae19c6f 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
+@@ -54,6 +54,7 @@
+ 	aliases {
+ 		serial0 = &uart0;
+ 		/* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
++		ethernet0 = &emac;
+ 		ethernet1 = &rtl8189;
+ 	};
+ 
+@@ -117,6 +118,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+index 5fea430e0eb1..6880268e8b87 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "xunlong,orangepi-one", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -97,6 +98,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+index 8b93f5c781a7..a10281b455f5 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+@@ -53,6 +53,11 @@
+ 	};
+ };
+ 
++&emac {
++	/* LEDs changed to active high on the plus */
++	/delete-property/ allwinner,leds-active-low;
++};
++
+ &mmc1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc1_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
+index 1a044b17d6c6..998b60f8d295 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "xunlong,orangepi-pc", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -113,6 +114,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
+index 828ae7a526d9..331ed683ac62 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
+@@ -47,6 +47,10 @@
+ 	model = "Xunlong Orange Pi Plus / Plus 2";
+ 	compatible = "xunlong,orangepi-plus", "allwinner,sun8i-h3";
+ 
++	aliases {
++		ethernet0 = &emac;
++	};
++
+ 	reg_gmac_3v3: gmac-3v3 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "gmac-3v3";
+@@ -74,6 +78,24 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <0>;
++	};
++};
++
+ &mmc2 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc2_8bit_pins>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+index 97920b12a944..80026f3caafc 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+@@ -61,3 +61,19 @@
+ 		gpio = <&pio 3 6 GPIO_ACTIVE_HIGH>; /* PD6 */
+ 	};
+ };
++
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
+diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+index 11240a8313c2..d38282b9e5d4 100644
+--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
++++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+@@ -391,6 +391,32 @@
+ 			clocks = <&osc24M>;
+ 		};
+ 
++		emac: ethernet@1c30000 {
++			compatible = "allwinner,sun8i-h3-emac";
++			syscon = <&syscon>;
++			reg = <0x01c30000 0x10000>;
++			interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "macirq";
++			resets = <&ccu RST_BUS_EMAC>;
++			reset-names = "stmmaceth";
++			clocks = <&ccu CLK_BUS_EMAC>;
++			clock-names = "stmmaceth";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				int_mii_phy: ethernet-phy@1 {
++					compatible = "ethernet-phy-ieee802.3-c22";
++					reg = <1>;
++					clocks = <&ccu CLK_BUS_EPHY>;
++					resets = <&ccu RST_BUS_EPHY>;
++				};
++			};
++		};
++
+ 		spi0: spi@01c68000 {
+ 			compatible = "allwinner,sun8i-h3-spi";
+ 			reg = <0x01c68000 0x1000>;
+-- 
+2.13.5
+
+From 4aba5ca95496899165ee7ceef5d9c60a6e7b15dd Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:47 +0100
+Subject: [PATCH 3/4] Revert "arm64: dts: allwinner: Revert EMAC changes"
+
+This reverts commit 87e1f5e8bb4bd584de0a8f3b1e42196dca221d02.
+---
+ .../boot/dts/allwinner/sun50i-a64-bananapi-m64.dts   | 16 ++++++++++++++++
+ .../boot/dts/allwinner/sun50i-a64-pine64-plus.dts    | 15 +++++++++++++++
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts  | 17 +++++++++++++++++
+ .../dts/allwinner/sun50i-a64-sopine-baseboard.dts    | 16 ++++++++++++++++
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi        | 20 ++++++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts     | 17 +++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts    | 17 +++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-orangepi-prime.dts  | 17 +++++++++++++++++
+ 8 files changed, 135 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 6872135d7f84..ba2fde2909f9 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+@@ -67,6 +68,14 @@
+ 	};
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
+ &i2c1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&i2c1_pins>;
+@@ -77,6 +86,13 @@
+ 	bias-pull-up;
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index f82ccf332c0f..24f1aac366d6 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -48,3 +48,18 @@
+ 
+ 	/* TODO: Camera, touchscreen, etc. */
+ };
++
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+index 7c533b6d4ba9..827168bc22ed 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "pine64,pine64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 		serial2 = &uart2;
+@@ -78,6 +79,15 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rmii_pins>;
++	phy-mode = "rmii";
++	phy-handle = <&ext_rmii_phy1>;
++	status = "okay";
++
++};
++
+ &i2c1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&i2c1_pins>;
+@@ -88,6 +98,13 @@
+ 	bias-pull-up;
+ };
+ 
++&mdio {
++	ext_rmii_phy1: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+index d891a1a27f6c..216e3a5dafae 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+@@ -53,6 +53,7 @@
+ 		     "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -76,6 +77,21 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc2 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc2_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 68aadc9b96dc..bd0f33b77f57 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -449,6 +449,26 @@
+ 			#size-cells = <0>;
+ 		};
+ 
++		emac: ethernet@1c30000 {
++			compatible = "allwinner,sun50i-a64-emac";
++			syscon = <&syscon>;
++			reg = <0x01c30000 0x10000>;
++			interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "macirq";
++			resets = <&ccu RST_BUS_EMAC>;
++			reset-names = "stmmaceth";
++			clocks = <&ccu CLK_BUS_EMAC>;
++			clock-names = "stmmaceth";
++			status = "disabled";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++
+ 		gic: interrupt-controller@1c81000 {
+ 			compatible = "arm,gic-400";
+ 			reg = <0x01c81000 0x1000>,
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+index 1c2387bd5df6..968908761194 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+@@ -50,6 +50,7 @@
+ 	compatible = "friendlyarm,nanopi-neo2", "allwinner,sun50i-h5";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -108,6 +109,22 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@7 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <7>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+index 4f77c8470f6c..a8296feee884 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+@@ -59,6 +59,7 @@
+ 	};
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -136,12 +137,28 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+index 6be06873e5af..d906b302cbcd 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+@@ -54,6 +54,7 @@
+ 	compatible = "xunlong,orangepi-prime", "allwinner,sun50i-h5";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -143,12 +144,28 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+-- 
+2.13.5
+
+From 11190f020b948ccdf15061b6df8cc2836a2afcb1 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:55 +0100
+Subject: [PATCH 4/4] Revert "dt-bindings: net: Revert sun8i dwmac binding"
+
+This reverts commit 8aa33ec2f4812d1ee96f4c02ba013f5b9c514343.
+---
+ .../devicetree/bindings/net/dwmac-sun8i.txt        | 84 ++++++++++++++++++++++
+ 1 file changed, 84 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+
+diff --git a/Documentation/devicetree/bindings/net/dwmac-sun8i.txt b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+new file mode 100644
+index 000000000000..725f3b187886
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+@@ -0,0 +1,84 @@
++* Allwinner sun8i GMAC ethernet controller
++
++This device is a platform glue layer for stmmac.
++Please see stmmac.txt for the other unchanged properties.
++
++Required properties:
++- compatible: should be one of the following string:
++		"allwinner,sun8i-a83t-emac"
++		"allwinner,sun8i-h3-emac"
++		"allwinner,sun8i-v3s-emac"
++		"allwinner,sun50i-a64-emac"
++- reg: address and length of the register for the device.
++- interrupts: interrupt for the device
++- interrupt-names: should be "macirq"
++- clocks: A phandle to the reference clock for this device
++- clock-names: should be "stmmaceth"
++- resets: A phandle to the reset control for this device
++- reset-names: should be "stmmaceth"
++- phy-mode: See ethernet.txt
++- phy-handle: See ethernet.txt
++- #address-cells: shall be 1
++- #size-cells: shall be 0
++- syscon: A phandle to the syscon of the SoC with one of the following
++ compatible string:
++  - allwinner,sun8i-h3-system-controller
++  - allwinner,sun8i-v3s-system-controller
++  - allwinner,sun50i-a64-system-controller
++  - allwinner,sun8i-a83t-system-controller
++
++Optional properties:
++- allwinner,tx-delay-ps: TX clock delay chain value in ps. Range value is 0-700. Default is 0)
++- allwinner,rx-delay-ps: RX clock delay chain value in ps. Range value is 0-3100. Default is 0)
++Both delay properties need to be a multiple of 100. They control the delay for
++external PHY.
++
++Optional properties for the following compatibles:
++  - "allwinner,sun8i-h3-emac",
++  - "allwinner,sun8i-v3s-emac":
++- allwinner,leds-active-low: EPHY LEDs are active low
++
++Required child node of emac:
++- mdio bus node: should be named mdio
++
++Required properties of the mdio node:
++- #address-cells: shall be 1
++- #size-cells: shall be 0
++
++The device node referenced by "phy" or "phy-handle" should be a child node
++of the mdio node. See phy.txt for the generic PHY bindings.
++
++Required properties of the phy node with the following compatibles:
++  - "allwinner,sun8i-h3-emac",
++  - "allwinner,sun8i-v3s-emac":
++- clocks: a phandle to the reference clock for the EPHY
++- resets: a phandle to the reset control for the EPHY
++
++Example:
++
++emac: ethernet@1c0b000 {
++	compatible = "allwinner,sun8i-h3-emac";
++	syscon = <&syscon>;
++	reg = <0x01c0b000 0x104>;
++	interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++	interrupt-names = "macirq";
++	resets = <&ccu RST_BUS_EMAC>;
++	reset-names = "stmmaceth";
++	clocks = <&ccu CLK_BUS_EMAC>;
++	clock-names = "stmmaceth";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	mdio: mdio {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		int_mii_phy: ethernet-phy@1 {
++			reg = <1>;
++			clocks = <&ccu CLK_BUS_EPHY>;
++			resets = <&ccu RST_BUS_EPHY>;
++		};
++	};
++};
+-- 
+2.13.5
+

arcmsr-buffer-overflow-in-archmsr_iop_message_xfer.patch

@@ -1,41 +0,0 @@
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: 2016-09-15 13:44:56
-Subject: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()
-
-We need to put an upper bound on "user_len" so the memcpy() doesn't
-overflow.
-
-Reported-by: Marco Grassi <marco.gra@gmail.com>
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Tomas Henzl <thenzl@redhat.com>
-
-diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
-index 7640498..110eca9 100644
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -2388,7 +2388,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
- 	}
- 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
- 		unsigned char *ver_addr;
--		int32_t user_len, cnt2end;
-+		uint32_t user_len;
-+		int32_t cnt2end;
- 		uint8_t *pQbuffer, *ptmpuserbuffer;
- 		ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
- 		if (!ver_addr) {
-@@ -2397,6 +2398,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
- 		}
- 		ptmpuserbuffer = ver_addr;
- 		user_len = pcmdmessagefld->cmdmessage.Length;
-+		if (user_len > ARCMSR_API_DATA_BUFLEN) {
-+			retvalue = ARCMSR_MESSAGE_FAIL;
-+			kfree(ver_addr);
-+			goto message_out;
-+		}
- 		memcpy(ptmpuserbuffer,
- 			pcmdmessagefld->messagedatabuffer, user_len);
- 		spin_lock_irqsave(&acb->wqbuffer_lock, flags);
---
-To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html

arm-dts-boneblack-wireless-add-WL1835-Bluetooth-device-node.patch

@@ -0,0 +1,40 @@
+From patchwork Mon May 22 14:51:38 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: arm: dts: boneblack-wireless: add WL1835 Bluetooth device node
+From: Ricardo Salveti <ricardo.salveti@linaro.org>
+X-Patchwork-Id: 9740719
+Message-Id: <1495464701-12046-1-git-send-email-ricardo.salveti@linaro.org>
+To: linux-omap@vger.kernel.org
+Cc: Mark Rutland <mark.rutland@arm.com>,
+ Ricardo Salveti <ricardo.salveti@linaro.org>, devicetree@vger.kernel.org, 
+ Tony Lindgren <tony@atomide.com>, Russell King <linux@armlinux.org.uk>,
+ linux-kernel@vger.kernel.org, Rob Herring <robh+dt@kernel.org>,
+ =?UTF-8?q?Beno=C3=AEt=20Cousson?= <bcousson@baylibre.com>,
+ robertcnelson@gmail.com, linux-arm-kernel@lists.infradead.org
+Date: Mon, 22 May 2017 11:51:38 -0300
+
+This adds the serial slave device for the WL1835 Bluetooth interface.
+
+Signed-off-by: Ricardo Salveti <ricardo.salveti@linaro.org>
+---
+ arch/arm/boot/dts/am335x-boneblack-wireless.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-wireless.dts b/arch/arm/boot/dts/am335x-boneblack-wireless.dts
+index 105bd10..83f49f6 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-wireless.dts
++++ b/arch/arm/boot/dts/am335x-boneblack-wireless.dts
+@@ -97,6 +97,11 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart3_pins &bt_pins>;
+ 	status = "okay";
++
++	bluetooth {
++		compatible = "ti,wl1835-st";
++		enable-gpios = <&gpio0 28 GPIO_ACTIVE_HIGH>;
++	};
+ };
+ 
+ &gpio3 {

arm-imx6-hummingboard2.patch

@@ -0,0 +1,902 @@
+From e9e601215d294d473a593641b1ecfd1fa4586a90 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Thu, 6 Apr 2017 13:52:54 +0100
+Subject: [PATCH 1/4] [RFC,v2,1/4] ARM: dts: imx6qdl: add HummingBoard2 boards
+
+From: Jon Nettleton <jon@solid-run.com>
+
+This adds support for the Hummingboard Gate and Edge devices from
+SolidRun.
+
+Signed-off-by: Jon Nettleton <jon@solid-run.com>
+Signed-off-by: Rabeeh Khoury <rabeeh@solid-run.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+---
+ arch/arm/boot/dts/Makefile                   |   2 +
+ arch/arm/boot/dts/imx6dl-hummingboard2.dts   |  52 +++
+ arch/arm/boot/dts/imx6q-hummingboard2.dts    |  60 +++
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 543 +++++++++++++++++++++++++++
+ 4 files changed, 657 insertions(+)
+ create mode 100644 arch/arm/boot/dts/imx6dl-hummingboard2.dts
+ create mode 100644 arch/arm/boot/dts/imx6q-hummingboard2.dts
+ create mode 100644 arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index 011808490fed..ccdff6650541 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -353,6 +353,7 @@ dtb-$(CONFIG_SOC_IMX6Q) += \
+ 	imx6dl-gw5903.dtb \
+ 	imx6dl-gw5904.dtb \
+ 	imx6dl-hummingboard.dtb \
++	imx6dl-hummingboard2.dtb \
+ 	imx6dl-icore.dtb \
+ 	imx6dl-icore-rqs.dtb \
+ 	imx6dl-nit6xlite.dtb \
+@@ -397,6 +398,7 @@ dtb-$(CONFIG_SOC_IMX6Q) += \
+ 	imx6q-gw5904.dtb \
+ 	imx6q-h100.dtb \
+ 	imx6q-hummingboard.dtb \
++	imx6q-hummingboard2.dtb \
+ 	imx6q-icore.dtb \
+ 	imx6q-icore-ofcap10.dtb \
+ 	imx6q-icore-ofcap12.dtb \
+diff --git a/arch/arm/boot/dts/imx6dl-hummingboard2.dts b/arch/arm/boot/dts/imx6dl-hummingboard2.dts
+new file mode 100644
+index 000000000000..990b5050de5b
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6dl-hummingboard2.dts
+@@ -0,0 +1,52 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ * Based on work by Russell King
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++/dts-v1/;
++
++#include "imx6dl.dtsi"
++#include "imx6qdl-hummingboard2.dtsi"
++
++/ {
++	model = "SolidRun HummingBoard2 Solo/DualLite";
++	compatible = "solidrun,hummingboard2/dl", "fsl,imx6dl";
++};
+diff --git a/arch/arm/boot/dts/imx6q-hummingboard2.dts b/arch/arm/boot/dts/imx6q-hummingboard2.dts
+new file mode 100644
+index 000000000000..f5eec9163bb8
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6q-hummingboard2.dts
+@@ -0,0 +1,60 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ * Based on work by Russell King
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++/dts-v1/;
++
++#include "imx6q.dtsi"
++#include "imx6qdl-hummingboard2.dtsi"
++
++/ {
++	model = "SolidRun HummingBoard2 Dual/Quad";
++	compatible = "solidrun,hummingboard2/q", "fsl,imx6q";
++};
++
++&sata {
++	status = "okay";
++	fsl,transmit-level-mV = <1104>;
++	fsl,transmit-boost-mdB = <0>;
++	fsl,transmit-atten-16ths = <9>;
++	fsl,no-spread-spectrum;
++};
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+new file mode 100644
+index 000000000000..11b63f6f2b89
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -0,0 +1,543 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful,
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively,
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++#include "imx6qdl-microsom.dtsi"
++#include "imx6qdl-microsom-ar8035.dtsi"
++
++/ {
++	chosen {
++		stdout-path = &uart1;
++	};
++
++	ir_recv: ir-receiver {
++		compatible = "gpio-ir-receiver";
++		gpios = <&gpio7 9 1>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_gpio7_9>;
++		linux,rc-map-name = "rc-rc6-mce";
++	};
++
++	usdhc2_pwrseq: usdhc2-pwrseq {
++		compatible = "mmc-pwrseq-simple";
++		reset-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;
++	};
++
++	reg_3p3v: regulator-3p3v {
++		compatible = "regulator-fixed";
++		regulator-name = "3P3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
++	reg_1p8v: regulator-1p8v {
++		compatible = "regulator-fixed";
++		regulator-name = "1P8V";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <1800000>;
++		regulator-always-on;
++	};
++
++	reg_usbh1_vbus: regulator-usb-h1-vbus {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio1 0 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh1_vbus>;
++		regulator-name = "usb_h1_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usbotg_vbus: regulator-usb-otg-vbus {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio3 22 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbotg_vbus>;
++		regulator-name = "usb_otg_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usbh2_vbus: regulator-usb-h2-vbus {
++		compatible = "regulator-gpio";
++		enable-active-high;
++		enable-gpio = <&gpio2 13 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh2_vbus>;
++		regulator-name = "usb_h2_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-boot-on;
++	};
++
++	reg_usbh3_vbus: regulator-usb-h3-vbus {
++		compatible = "regulator-gpio";
++		enable-active-high;
++		enable-gpio = <&gpio7 10 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh3_vbus>;
++		regulator-name = "usb_h3_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-boot-on;
++	};
++
++	sound-sgtl5000 {
++		audio-codec = <&sgtl5000>;
++		audio-routing =
++			"MIC_IN", "Mic Jack",
++			"Mic Jack", "Mic Bias",
++			"Headphone Jack", "HP_OUT";
++		compatible = "fsl,imx-audio-sgtl5000";
++		model = "On-board Codec";
++		mux-ext-port = <5>;
++		mux-int-port = <1>;
++		ssi-controller = <&ssi1>;
++	};
++};
++
++&audmux {
++	status = "okay";
++};
++
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_ecspi2>;
++	cs-gpios = <&gpio2 26 0>;
++	status = "okay";
++};
++
++&hdmi {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_hdmi>;
++	ddc-i2c-bus = <&i2c2>;
++	status = "okay";
++};
++
++&i2c1 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c1>;
++	status = "okay";
++
++	pcf8523: rtc@68 {
++		compatible = "nxp,pcf8523";
++		reg = <0x68>;
++		nxp,12p5_pf;
++	};
++
++	sgtl5000: codec@0a {
++		clocks = <&clks IMX6QDL_CLK_CKO>;
++		compatible = "fsl,sgtl5000";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_sgtl5000>;
++		reg = <0x0a>;
++		VDDA-supply = <&reg_3p3v>;
++		VDDIO-supply = <&reg_3p3v>;
++	};
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c2>;
++	status = "okay";
++};
++
++&i2c3 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c3>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	hummingboard2 {
++		pinctrl_hog: hoggrp {
++		fsl,pins = <
++				/*
++				 * 36 pin headers GPIO description. The pins
++				 * numbering as following -
++				 *
++				 * 	3.2v	5v	74	75
++				 *	73	72	71	70
++				 *	69	68	67	66
++				 *
++				 *	77	78	79	76
++				 *	65	64	61	60
++				 *	53	52	51	50
++				 *	49	48	166	132
++				 *	95	94	90	91
++				 *	GND	54	24	204
++				 *
++				 * The GPIO numbers can be extracted using
++				 * signal name from below.
++				 * Example -
++				 * MX6QDL_PAD_EIM_DA10__GPIO3_IO10 is
++				 * GPIO(3,10) which is (3-1)*32+10 = gpio 74
++				 *
++				 * i.e. The mapping of GPIO(X,Y) to Linux gpio
++				 * number is : gpio number = (X-1) * 32 + Y
++				 */
++				/* DI1_PIN15 */
++				MX6QDL_PAD_EIM_DA10__GPIO3_IO10 0x400130b1
++				/* DI1_PIN02 */
++				MX6QDL_PAD_EIM_DA11__GPIO3_IO11 0x400130b1
++				/* DISP1_DATA00 */
++				MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x400130b1
++				/* DISP1_DATA01 */
++				MX6QDL_PAD_EIM_DA8__GPIO3_IO08 0x400130b1
++				/* DISP1_DATA02 */
++				MX6QDL_PAD_EIM_DA7__GPIO3_IO07 0x400130b1
++				/* DISP1_DATA03 */
++				MX6QDL_PAD_EIM_DA6__GPIO3_IO06 0x400130b1
++				/* DISP1_DATA04 */
++				MX6QDL_PAD_EIM_DA5__GPIO3_IO05 0x400130b1
++				/* DISP1_DATA05 */
++				MX6QDL_PAD_EIM_DA4__GPIO3_IO04 0x400130b1
++				/* DISP1_DATA06 */
++				MX6QDL_PAD_EIM_DA3__GPIO3_IO03 0x400130b1
++				/* DISP1_DATA07 */
++				MX6QDL_PAD_EIM_DA2__GPIO3_IO02 0x400130b1
++				/* DI1_D0_CS */
++				MX6QDL_PAD_EIM_DA13__GPIO3_IO13 0x400130b1
++				/* DI1_D1_CS */
++				MX6QDL_PAD_EIM_DA14__GPIO3_IO14 0x400130b1
++				/* DI1_PIN01 */
++				MX6QDL_PAD_EIM_DA15__GPIO3_IO15 0x400130b1
++				/* DI1_PIN03 */
++				MX6QDL_PAD_EIM_DA12__GPIO3_IO12 0x400130b1
++				/* DISP1_DATA08 */
++				MX6QDL_PAD_EIM_DA1__GPIO3_IO01 0x400130b1
++				/* DISP1_DATA09 */
++				MX6QDL_PAD_EIM_DA0__GPIO3_IO00 0x400130b1
++				/* DISP1_DATA10 */
++				MX6QDL_PAD_EIM_EB1__GPIO2_IO29 0x400130b1
++				/* DISP1_DATA11 */
++				MX6QDL_PAD_EIM_EB0__GPIO2_IO28 0x400130b1
++				/* DISP1_DATA12 */
++				MX6QDL_PAD_EIM_A17__GPIO2_IO21 0x400130b1
++				/* DISP1_DATA13 */
++				MX6QDL_PAD_EIM_A18__GPIO2_IO20 0x400130b1
++				/* DISP1_DATA14 */
++				MX6QDL_PAD_EIM_A19__GPIO2_IO19 0x400130b1
++				/* DISP1_DATA15 */
++				MX6QDL_PAD_EIM_A20__GPIO2_IO18 0x400130b1
++				/* DISP1_DATA16 */
++				MX6QDL_PAD_EIM_A21__GPIO2_IO17 0x400130b1
++				/* DISP1_DATA17 */
++				MX6QDL_PAD_EIM_A22__GPIO2_IO16 0x400130b1
++				/* DISP1_DATA18 */
++				MX6QDL_PAD_EIM_A23__GPIO6_IO06 0x400130b1
++				/* DISP1_DATA19 */
++				MX6QDL_PAD_EIM_A24__GPIO5_IO04 0x400130b1
++				/* DISP1_DATA20 */
++				MX6QDL_PAD_EIM_D31__GPIO3_IO31 0x400130b1
++				/* DISP1_DATA21 */
++				MX6QDL_PAD_EIM_D30__GPIO3_IO30 0x400130b1
++				/* DISP1_DATA22 */
++				MX6QDL_PAD_EIM_D26__GPIO3_IO26 0x400130b1
++				/* DISP1_DATA23 */
++				MX6QDL_PAD_EIM_D27__GPIO3_IO27 0x400130b1
++				/* DI1_DISP_CLK */
++				MX6QDL_PAD_EIM_A16__GPIO2_IO22 0x400130b1
++				/* SPDIF_IN */
++				MX6QDL_PAD_ENET_RX_ER__GPIO1_IO24 0x400130b1
++				/* SPDIF_OUT */
++				MX6QDL_PAD_GPIO_17__GPIO7_IO12 0x400130b1
++
++				/* MikroBUS GPIO pin number 10 */
++				MX6QDL_PAD_EIM_LBA__GPIO2_IO27 0x400130b1
++			>;
++		};
++
++		pinctrl_hummingboard2_ecspi2: hummingboard2-ecspi2grp {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_OE__ECSPI2_MISO	0x100b1
++				MX6QDL_PAD_EIM_CS1__ECSPI2_MOSI	0x100b1
++				MX6QDL_PAD_EIM_CS0__ECSPI2_SCLK	0x100b1
++				MX6QDL_PAD_EIM_RW__GPIO2_IO26	0x000b1 /* CS */
++			>;
++		};
++
++		pinctrl_hummingboard2_gpio7_9: hummingboard2-gpio7_9 {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_CMD__GPIO7_IO09 0x80000000
++			>;
++		};
++
++		pinctrl_hummingboard2_hdmi: hummingboard2-hdmi {
++			fsl,pins = <
++				MX6QDL_PAD_KEY_ROW2__HDMI_TX_CEC_LINE 0x1f8b0
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c1: hummingboard2-i2c1 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D21__I2C1_SCL 0x4001b8b1
++				MX6QDL_PAD_EIM_D28__I2C1_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c2: hummingboard2-i2c2 {
++			fsl,pins = <
++				MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1
++				MX6QDL_PAD_KEY_ROW3__I2C2_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c3: hummingboard2-i2c3 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D17__I2C3_SCL 0x4001b8b1
++				MX6QDL_PAD_EIM_D18__I2C3_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_mipi: hummingboard2_mipi {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_DAT2__GPIO2_IO10 0x4001b8b1
++				MX6QDL_PAD_KEY_COL4__GPIO4_IO14 0x4001b8b1
++				MX6QDL_PAD_NANDF_CS2__CCM_CLKO2 0x130b0
++			>;
++		};
++
++		pinctrl_hummingboard2_pcie_reset: hummingboard2-pcie-reset {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_DAT3__GPIO2_IO11 0x1b0b1
++			>;
++		};
++
++		pinctrl_hummingboard2_pwm1: pwm1grp {
++			fsl,pins = <
++				MX6QDL_PAD_DISP0_DAT8__PWM1_OUT 0x1b0b1
++			>;
++		};
++
++		pinctrl_hummingboard2_sgtl5000: hummingboard2-sgtl5000 {
++			fsl,pins = <
++				MX6QDL_PAD_DISP0_DAT19__AUD5_RXD 0x130b0
++				MX6QDL_PAD_KEY_COL0__AUD5_TXC 0x130b0
++				MX6QDL_PAD_KEY_ROW0__AUD5_TXD 0x110b0
++				MX6QDL_PAD_KEY_COL1__AUD5_TXFS 0x130b0
++				MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0
++			>;
++		};
++
++		pinctrl_hummingboard2_usbh1_vbus: hummingboard2-usbh1-vbus {
++			fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbh2_vbus: hummingboard2-usbh2-vbus {
++			fsl,pins = <MX6QDL_PAD_SD4_DAT5__GPIO2_IO13 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbh3_vbus: hummingboard2-usbh3-vbus {
++			fsl,pins = <MX6QDL_PAD_SD4_CLK__GPIO7_IO10 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbotg_id: hummingboard2-usbotg-id {
++			/*
++			 * Similar to pinctrl_usbotg_2, but we want it
++			 * pulled down for a fixed host connection.
++			 */
++			fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
++		};
++
++		pinctrl_hummingboard2_usbotg_vbus: hummingboard2-usbotg-vbus {
++			fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
++			fsl,pins = <
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x13071
++				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
++				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2: hummingboard2-usdhc2 {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x17059
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x10059
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x17059
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x17059
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x17059
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x13059
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_100mhz: hummingboard2-usdhc2-100mhz {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x170b9
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x100b9
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x170b9
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x170b9
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x170b9
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x130b9
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_200mhz: hummingboard2-usdhc2-200mhz {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x170f9
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x100f9
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x170f9
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x170f9
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x170f9
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x130f9
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc3: hummingboard2-usdhc3 {
++			fsl,pins = <
++				MX6QDL_PAD_SD3_CMD__SD3_CMD    0x17059
++				MX6QDL_PAD_SD3_CLK__SD3_CLK    0x10059
++				MX6QDL_PAD_SD3_DAT0__SD3_DATA0 0x17059
++				MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
++				MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
++				MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
++				MX6QDL_PAD_SD3_DAT4__SD3_DATA4 0x17059
++				MX6QDL_PAD_SD3_DAT5__SD3_DATA5 0x17059
++				MX6QDL_PAD_SD3_DAT6__SD3_DATA6 0x17059
++				MX6QDL_PAD_SD3_DAT7__SD3_DATA7 0x17059
++				MX6QDL_PAD_SD3_RST__SD3_RESET  0x17059
++			>;
++		};
++
++		pinctrl_hummingboard2_uart3: hummingboard2-uart3 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D25__UART3_TX_DATA	0x1b0b1
++				MX6QDL_PAD_EIM_D24__UART3_RX_DATA	0x40013000
++			>;
++		};
++	};
++};
++
++&ldb {
++	status = "disabled";
++
++	lvds-channel@0 {
++		fsl,data-mapping = "spwg";
++		fsl,data-width = <18>;
++	};
++};
++
++&pcie {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_pcie_reset>;
++	reset-gpio = <&gpio2 11 0>;
++	status = "okay";
++};
++
++&pwm1 {
++        pinctrl-names = "default";
++        pinctrl-0 = <&pinctrl_hummingboard2_pwm1>;
++        status = "okay";
++};
++
++&pwm3 {
++	status = "disabled";
++};
++
++&pwm4 {
++	status = "disabled";
++};
++
++&ssi1 {
++	status = "okay";
++};
++
++&usbh1 {
++	disable-over-current;
++	vbus-supply = <&reg_usbh1_vbus>;
++	status = "okay";
++};
++
++&usbotg {
++	disable-over-current;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_usbotg_id>;
++	vbus-supply = <&reg_usbotg_vbus>;
++	status = "okay";
++};
++
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2
++	>;
++	pinctrl-1 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2_100mhz
++	>;
++	pinctrl-2 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2_200mhz
++	>;
++	mmc-pwrseq = <&usdhc2_pwrseq>;
++	cd-gpios = <&gpio1 4 0>;
++	status = "okay";
++};
++
++&usdhc3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <
++		&pinctrl_hummingboard2_usdhc3
++	>;
++	vmmc-supply = <&reg_3p3v>;
++	vqmmc-supply = <&reg_3p3v>;
++	bus-width = <8>;
++	non-removable;
++	status = "okay";
++};
++
++&uart3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_uart3>;
++	status = "okay";
++};
+-- 
+2.12.2
+
+From 3da2a99c4a8f19e846b19071441d2c6b88e00c06 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:30 +0000
+Subject: [PATCH 2/4] ARM: dts: imx6*-hummingboard2: fix SD card detect
+
+Fix the SD card detect signal, which was missing the polarity
+specification, and the pull-up necessary for proper signalling.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 11b63f6f2b89..734487edf200 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -393,7 +393,7 @@
+ 
+ 		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
+ 			fsl,pins = <
+-				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x13071
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
+ 				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
+ 				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
+ 			>;
+@@ -520,7 +520,7 @@
+ 		&pinctrl_hummingboard2_usdhc2_200mhz
+ 	>;
+ 	mmc-pwrseq = <&usdhc2_pwrseq>;
+-	cd-gpios = <&gpio1 4 0>;
++	cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ 	status = "okay";
+ };
+ 
+-- 
+2.12.2
+
+From 57b0103b600a535a35e5ff9714649519a0b3a77a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:35 +0000
+Subject: [PATCH 3/4] ARM: dts: imx6*-hummingboard2: use proper gpio flags
+ definitions
+
+Use proper gpio flag definitions for GPIOs rather than using opaque
+uninformative numbers.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 734487edf200..88aaed26dd77 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -50,7 +50,7 @@
+ 
+ 	ir_recv: ir-receiver {
+ 		compatible = "gpio-ir-receiver";
+-		gpios = <&gpio7 9 1>;
++		gpios = <&gpio7 9 GPIO_ACTIVE_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_gpio7_9>;
+ 		linux,rc-map-name = "rc-rc6-mce";
+@@ -80,7 +80,7 @@
+ 	reg_usbh1_vbus: regulator-usb-h1-vbus {
+ 		compatible = "regulator-fixed";
+ 		enable-active-high;
+-		gpio = <&gpio1 0 0>;
++		gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh1_vbus>;
+ 		regulator-name = "usb_h1_vbus";
+@@ -91,7 +91,7 @@
+ 	reg_usbotg_vbus: regulator-usb-otg-vbus {
+ 		compatible = "regulator-fixed";
+ 		enable-active-high;
+-		gpio = <&gpio3 22 0>;
++		gpio = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbotg_vbus>;
+ 		regulator-name = "usb_otg_vbus";
+@@ -102,7 +102,7 @@
+ 	reg_usbh2_vbus: regulator-usb-h2-vbus {
+ 		compatible = "regulator-gpio";
+ 		enable-active-high;
+-		enable-gpio = <&gpio2 13 0>;
++		enable-gpio = <&gpio2 13 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh2_vbus>;
+ 		regulator-name = "usb_h2_vbus";
+@@ -114,7 +114,7 @@
+ 	reg_usbh3_vbus: regulator-usb-h3-vbus {
+ 		compatible = "regulator-gpio";
+ 		enable-active-high;
+-		enable-gpio = <&gpio7 10 0>;
++		enable-gpio = <&gpio7 10 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh3_vbus>;
+ 		regulator-name = "usb_h3_vbus";
+-- 
+2.12.2
+
+From f931de70370ff576f381cb9745bc54225a1a8056 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:40 +0000
+Subject: [PATCH 4/4] ARM: dts: imx6*-hummingboard2: convert to more
+ conventional vmmc-supply
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 88aaed26dd77..f19d30b34ac4 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -56,11 +56,6 @@
+ 		linux,rc-map-name = "rc-rc6-mce";
+ 	};
+ 
+-	usdhc2_pwrseq: usdhc2-pwrseq {
+-		compatible = "mmc-pwrseq-simple";
+-		reset-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;
+-	};
+-
+ 	reg_3p3v: regulator-3p3v {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "3P3V";
+@@ -123,6 +118,18 @@
+ 		regulator-boot-on;
+ 	};
+ 
++	reg_usdhc2_vmmc: reg-usdhc2-vmmc {
++		compatible = "regulator-fixed";
++		gpio = <&gpio4 30 GPIO_ACTIVE_HIGH>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_vmmc>;
++		regulator-boot-on;
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		regulator-name = "usdhc2_vmmc";
++		startup-delay-us = <1000>;
++	};
++
+ 	sound-sgtl5000 {
+ 		audio-codec = <&sgtl5000>;
+ 		audio-routing =
+@@ -393,7 +400,6 @@
+ 
+ 		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
+ 			fsl,pins = <
+-				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
+ 				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
+ 				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
+ 			>;
+@@ -432,6 +438,12 @@
+ 			>;
+ 		};
+ 
++		pinctrl_hummingboard2_vmmc: hummingboard2-vmmc {
++			fsl,pins = <
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
++			>;
++		};
++
+ 		pinctrl_hummingboard2_usdhc3: hummingboard2-usdhc3 {
+ 			fsl,pins = <
+ 				MX6QDL_PAD_SD3_CMD__SD3_CMD    0x17059
+@@ -519,7 +531,7 @@
+ 		&pinctrl_hummingboard2_usdhc2_aux
+ 		&pinctrl_hummingboard2_usdhc2_200mhz
+ 	>;
+-	mmc-pwrseq = <&usdhc2_pwrseq>;
++	vmmc-supply = <&reg_usdhc2_vmmc>;
+ 	cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ 	status = "okay";
+ };
+-- 
+2.12.2
+

arm-of-restrict-dma-configuration.patch

@@ -0,0 +1,121 @@
+From 723288836628bc1c0855f3bb7b64b1803e4b9e4a Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Thu, 31 Aug 2017 11:32:54 +0100
+Subject: of: restrict DMA configuration
+
+Moving DMA configuration to happen later at driver probe time had the
+unnoticed side-effect that we now perform DMA configuration for *every*
+device represented in DT, rather than only those explicitly created by
+the of_platform and PCI code.
+
+As Christoph points out, this is not really the best thing to do. Whilst
+there may well be other DMA-capable buses that can benefit from having
+their children automatically configured after the bridge has probed,
+there are also plenty of others like USB, MDIO, etc. that definitely do
+not support DMA and should not be indiscriminately processed.
+
+The good news is that in most cases the DT "dma-ranges" property serves
+as an appropriate indicator - per a strict interpretation of the spec,
+anything lacking a "dma-ranges" property should be considered not to
+have a mapping of DMA address space from its children to its parent,
+thus anything for which of_dma_get_range() does not succeed does not
+need DMA configuration. Certain bus types have a general expectation of
+DMA capability and carry a well-established precedent that an absent
+"dma-ranges" implies the same as the empty property, so we automatically
+opt those in to DMA configuration regardless, to avoid regressing most
+existing platforms.
+
+Fixes: 09515ef5ddad ("of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices")
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+---
+ drivers/of/device.c | 48 ++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index e0a28ea..04c4c95 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -9,6 +9,9 @@
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
++#include <linux/pci.h>
++#include <linux/platform_device.h>
++#include <linux/amba/bus.h>
+ 
+ #include <asm/errno.h>
+ #include "of_private.h"
+@@ -84,31 +87,28 @@ int of_device_add(struct platform_device *ofdev)
+  */
+ int of_dma_configure(struct device *dev, struct device_node *np)
+ {
+-	u64 dma_addr, paddr, size;
++	u64 dma_addr, paddr, size = 0;
+ 	int ret;
+ 	bool coherent;
+ 	unsigned long offset;
+ 	const struct iommu_ops *iommu;
+ 	u64 mask;
+ 
+-	/*
+-	 * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
+-	 * setup the correct supported mask.
+-	 */
+-	if (!dev->coherent_dma_mask)
+-		dev->coherent_dma_mask = DMA_BIT_MASK(32);
+-
+-	/*
+-	 * Set it to coherent_dma_mask by default if the architecture
+-	 * code has not set it.
+-	 */
+-	if (!dev->dma_mask)
+-		dev->dma_mask = &dev->coherent_dma_mask;
+-
+ 	ret = of_dma_get_range(np, &dma_addr, &paddr, &size);
+ 	if (ret < 0) {
++		/*
++		 * For legacy reasons, we have to assume some devices need
++		 * DMA configuration regardless of whether "dma-ranges" is
++		 * correctly specified or not.
++		 */
++		if (!dev_is_pci(dev) &&
++#ifdef CONFIG_ARM_AMBA
++		    dev->bus != &amba_bustype &&
++#endif
++		    dev->bus != &platform_bus_type)
++			return ret == -ENODEV ? 0 : ret;
++
+ 		dma_addr = offset = 0;
+-		size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
+ 	} else {
+ 		offset = PFN_DOWN(paddr - dma_addr);
+ 
+@@ -129,6 +129,22 @@ int of_dma_configure(struct device *dev, struct device_node *np)
+ 		dev_dbg(dev, "dma_pfn_offset(%#08lx)\n", offset);
+ 	}
+ 
++	/*
++	 * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
++	 * setup the correct supported mask.
++	 */
++	if (!dev->coherent_dma_mask)
++		dev->coherent_dma_mask = DMA_BIT_MASK(32);
++	/*
++	 * Set it to coherent_dma_mask by default if the architecture
++	 * code has not set it.
++	 */
++	if (!dev->dma_mask)
++		dev->dma_mask = &dev->coherent_dma_mask;
++
++	if (!size)
++		size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
++
+ 	dev->dma_pfn_offset = offset;
+ 
+ 	/*
+-- 
+cgit v1.1
+

arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch

@@ -0,0 +1,100 @@
+From bb3e08008c0e48fd4f51a0f0957eecae61a24d69 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 1 Nov 2016 09:35:30 +0000
+Subject: [PATCH] Revert "mmc: omap_hsmmc: Use dma_request_chan() for
+ requesting DMA channel"
+
+This reverts commit 81eef6ca92014845d40e3f1310e42b7010303acc.
+---
+ drivers/mmc/host/omap_hsmmc.c | 50 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 24ebc9a..3563321 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -32,6 +32,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/of_gpio.h>
+ #include <linux/of_device.h>
++#include <linux/omap-dmaengine.h>
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/core.h>
+ #include <linux/mmc/mmc.h>
+@@ -1992,6 +1993,8 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int ret, irq;
+ 	const struct of_device_id *match;
++	dma_cap_mask_t mask;
++	unsigned tx_req, rx_req;
+ 	const struct omap_mmc_of_data *data;
+ 	void __iomem *base;
+ 
+@@ -2121,17 +2124,44 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 
+ 	omap_hsmmc_conf_bus_power(host);
+ 
+-	host->rx_chan = dma_request_chan(&pdev->dev, "rx");
+-	if (IS_ERR(host->rx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "RX DMA channel request failed\n");
+-		ret = PTR_ERR(host->rx_chan);
++	if (!pdev->dev.of_node) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA TX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		tx_req = res->start;
++
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA RX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		rx_req = res->start;
++	}
++
++	dma_cap_zero(mask);
++	dma_cap_set(DMA_SLAVE, mask);
++
++	host->rx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &rx_req, &pdev->dev, "rx");
++
++	if (!host->rx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain RX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+-	host->tx_chan = dma_request_chan(&pdev->dev, "tx");
+-	if (IS_ERR(host->tx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "TX DMA channel request failed\n");
+-		ret = PTR_ERR(host->tx_chan);
++	host->tx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &tx_req, &pdev->dev, "tx");
++
++	if (!host->tx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain TX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+@@ -2189,9 +2219,9 @@ err_slot_name:
+ 	mmc_remove_host(mmc);
+ err_irq:
+ 	device_init_wakeup(&pdev->dev, false);
+-	if (!IS_ERR_OR_NULL(host->tx_chan))
++	if (host->tx_chan)
+ 		dma_release_channel(host->tx_chan);
+-	if (!IS_ERR_OR_NULL(host->rx_chan))
++	if (host->rx_chan)
+ 		dma_release_channel(host->rx_chan);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+-- 
+2.9.3
+

arm-tegra-fix-gpu-iommu.patch

@@ -0,0 +1,39 @@
+From patchwork Sun Jul  9 16:36:14 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: ARM: tegra: Register host1x node with iommu binding on tegra124
+From: Paul Kocialkowski <contact@paulk.fr>
+X-Patchwork-Id: 9831825
+Message-Id: <20170709163614.6746-1-contact@paulk.fr>
+To: linux-arm-kernel@lists.infradead.org, linux-tegra@vger.kernel.org,
+ linux-kernel@vger.kernel.org
+Cc: Thierry Reding <thierry.reding@gmail.com>,
+ Stephen Warren <swarren@wwwdotorg.org>,
+ Mikko Perttunen <mperttunen@nvidia.com>,
+ Paul Kocialkowski <contact@paulk.fr>, 
+ Jonathan Hunter <jonathanh@nvidia.com>
+Date: Sun,  9 Jul 2017 19:36:14 +0300
+
+This registers the host1x node with the SMMU (as HC swgroup) to allow
+the host1x code to attach to it. It avoid failing the probe sequence,
+which resulted in the tegra drm driver not probing and thus nothing
+being displayed on-screen.
+
+Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
+---
+ arch/arm/boot/dts/tegra124.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/tegra124.dtsi b/arch/arm/boot/dts/tegra124.dtsi
+index 187a36c6d0fc..b3b89befffeb 100644
+--- a/arch/arm/boot/dts/tegra124.dtsi
++++ b/arch/arm/boot/dts/tegra124.dtsi
+@@ -85,6 +85,7 @@
+ 		clocks = <&tegra_car TEGRA124_CLK_HOST1X>;
+ 		resets = <&tegra_car 28>;
+ 		reset-names = "host1x";
++		iommus = <&mc TEGRA_SWGROUP_HC>;
+ 
+ 		#address-cells = <2>;
+ 		#size-cells = <2>;

arm-thermal-fixes.patch

@@ -0,0 +1,224 @@
+From 0fe4d2181cc4cb3eba303c0e03f878d2558d0f3a Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Fri, 31 Mar 2017 20:03:04 +0000
+Subject: [PATCH] ARM: dts: bcm283x: Add CPU thermal zone with 1
+ trip point
+
+As suggested by Eduardo Valentin this adds the thermal zone for
+the bcm2835 SoC with its single thermal sensor. We start with
+the criticial trip point and leave the cooling devices empty
+since we don't have any at the moment. Since the coefficients
+could vary depending on the SoC we need to define them separate.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ arch/arm/boot/dts/bcm2835.dtsi |  4 ++++
+ arch/arm/boot/dts/bcm2836.dtsi |  4 ++++
+ arch/arm/boot/dts/bcm283x.dtsi | 21 +++++++++++++++++++++
+ 3 files changed, 29 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
+index 0890d97e674d..659b6e9513b1 100644
+--- a/arch/arm/boot/dts/bcm2835.dtsi
++++ b/arch/arm/boot/dts/bcm2835.dtsi
+@@ -24,6 +24,10 @@
+ 	};
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	407000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2835-thermal";
+diff --git a/arch/arm/boot/dts/bcm2836.dtsi b/arch/arm/boot/dts/bcm2836.dtsi
+index 519a44f5d25a..da3deeb42592 100644
+--- a/arch/arm/boot/dts/bcm2836.dtsi
++++ b/arch/arm/boot/dts/bcm2836.dtsi
+@@ -77,6 +77,10 @@
+ 	interrupts = <8>;
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	407000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2836-thermal";
+diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
+index 561f27d8d922..86a5db53da8f 100644
+--- a/arch/arm/boot/dts/bcm283x.dtsi
++++ b/arch/arm/boot/dts/bcm283x.dtsi
+@@ -19,6 +19,26 @@
+ 		bootargs = "earlyprintk console=ttyAMA0";
+ 	};
+ 
++	thermal-zones {
++		cpu_thermal: cpu-thermal {
++			polling-delay-passive = <0>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&thermal>;
++
++			trips {
++				cpu-crit {
++					temperature	= <80000>;
++					hysteresis	= <0>;
++					type		= "critical";
++				};
++			};
++
++			cooling-maps {
++			};
++		};
++	};
++
+ 	soc {
+ 		compatible = "simple-bus";
+ 		#address-cells = <1>;
+@@ -430,6 +450,7 @@
+ 			compatible = "brcm,bcm2835-thermal";
+ 			reg = <0x7e212000 0x8>;
+ 			clocks = <&clocks BCM2835_CLOCK_TSENS>;
++			#thermal-sensor-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.13.3
+
+From 4ae6f954b96c1fea86c6f21ae8fc413f5fc3444e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Fri, 31 Mar 2017 20:03:05 +0000
+Subject: [PATCH] ARM64: dts: bcm2837: Define CPU thermal coefficients
+
+This defines the bcm2837 SoC specific thermal coefficients in
+order to initialize the thermal driver correctly.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2837.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+index 19f2fe620a21..2d5de6f0f78d 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+@@ -75,6 +75,10 @@
+ 	interrupts = <8>;
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	412000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2837-thermal";
+-- 
+2.13.3
+
+From 1fe3854a83b580727c9464b37b62ba77ead1d6f6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 14 Jun 2017 12:13:27 +0300
+Subject: [PATCH] thermal: bcm2835: fix an error code in probe()
+
+This causes a static checker because we're passing a valid pointer to
+PTR_ERR().  "err" is already the correct error code, so we can just
+delete this line.
+
+Fixes: bcb7dd9ef206 ("thermal: bcm2835: add thermal driver for bcm2835 SoC")
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/broadcom/bcm2835_thermal.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
+index 0ecf80890c84..e6863c841662 100644
+--- a/drivers/thermal/broadcom/bcm2835_thermal.c
++++ b/drivers/thermal/broadcom/bcm2835_thermal.c
+@@ -245,7 +245,6 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+ 		 */
+ 		err = tz->ops->get_trip_temp(tz, 0, &trip_temp);
+ 		if (err < 0) {
+-			err = PTR_ERR(tz);
+ 			dev_err(&pdev->dev,
+ 				"Not able to read trip_temp: %d\n",
+ 				err);
+-- 
+2.13.3
+
+From e3bdc8d7623d5875403ad40443e7b049ae200fcd Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Tue, 6 Jun 2017 15:12:37 +0530
+Subject: [PATCH] thermal: imx: Handle return value of clk_prepare_enable
+
+clk_prepare_enable() can fail here and we must check its return value.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/imx_thermal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
+index f7ec39f46ee4..4798b4b1fd77 100644
+--- a/drivers/thermal/imx_thermal.c
++++ b/drivers/thermal/imx_thermal.c
+@@ -660,8 +660,11 @@ static int imx_thermal_resume(struct device *dev)
+ {
+ 	struct imx_thermal_data *data = dev_get_drvdata(dev);
+ 	struct regmap *map = data->tempmon;
++	int ret;
+ 
+-	clk_prepare_enable(data->thermal_clk);
++	ret = clk_prepare_enable(data->thermal_clk);
++	if (ret)
++		return ret;
+ 	/* Enabled thermal sensor after resume */
+ 	regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN);
+ 	regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP);
+-- 
+2.13.3
+
+From 919054fdfc8adf58c5512fe9872eb53ea0f5525d Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Tue, 6 Jun 2017 15:04:46 +0530
+Subject: [PATCH] thermal: hisilicon: Handle return value of clk_prepare_enable
+
+clk_prepare_enable() can fail here and we must check its return value.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/hisi_thermal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
+index f6429666a1cf..9c3ce341eb97 100644
+--- a/drivers/thermal/hisi_thermal.c
++++ b/drivers/thermal/hisi_thermal.c
+@@ -397,8 +397,11 @@ static int hisi_thermal_suspend(struct device *dev)
+ static int hisi_thermal_resume(struct device *dev)
+ {
+ 	struct hisi_thermal_data *data = dev_get_drvdata(dev);
++	int ret;
+ 
+-	clk_prepare_enable(data->clk);
++	ret = clk_prepare_enable(data->clk);
++	if (ret)
++		return ret;
+ 
+ 	data->irq_enabled = true;
+ 	hisi_thermal_enable_bind_irq_sensor(data);
+-- 
+2.13.3
+

arm64-ACPI-parse-SPCR-table.patch

@@ -1,596 +0,0 @@
-From patchwork Fri Aug 12 11:07:14 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v9,1/4] of/serial: move earlycon early_param handling to serial
-From: Aleksey Makarov <aleksey.makarov@linaro.org>
-X-Patchwork-Id: 9276727
-Message-Id: <20160812110717.12351-1-aleksey.makarov@linaro.org>
-To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
- Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: linux-serial@vger.kernel.org, linux-acpi@vger.kernel.org,
- linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
- Aleksey Makarov <aleksey.makarov@linaro.org>,
- Russell King <linux@arm.linux.org.uk>, Len Brown <lenb@kernel.org>,
- Leif Lindholm <leif.lindholm@linaro.org>,
- Graeme Gregory <graeme.gregory@linaro.org>, Al Stone <ahs3@redhat.com>,
- Christopher Covington <cov@codeaurora.org>,
- Yury Norov <ynorov@caviumnetworks.com>,
- Peter Hurley <peter@hurleysoftware.com>,
- Andy Shevchenko <andy.shevchenko@gmail.com>,
- "Zheng, Lv" <lv.zheng@intel.com>, Mark Salter <msalter@redhat.com>,
- Kefeng Wang <wangkefeng.wang@huawei.com>,
- Rob Herring <robh+dt@kernel.org>, Frank Rowand <frowand.list@gmail.com>,
- Jiri Slaby <jslaby@suse.com>, devicetree@vger.kernel.org
-Date: Fri, 12 Aug 2016 14:07:14 +0300
-
-From: Leif Lindholm <leif.lindholm@linaro.org>
-
-We have multiple "earlycon" early_param handlers - merge the DT one into
-the main earlycon one.  It's a cleanup that also will be useful
-to defer setting up DT console until ACPI/DT decision is made.
-
-Rename the exported function to avoid clashing with the function from
-arch/microblaze/kernel/prom.c
-
-Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
-Signed-off-by: Aleksey Makarov <aleksey.makarov@linaro.org>
-Acked-by: Rob Herring <robh@kernel.org>
-Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
-Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
----
- drivers/of/fdt.c              | 11 +----------
- drivers/tty/serial/earlycon.c |  2 +-
- include/linux/of_fdt.h        |  3 +++
- 3 files changed, 5 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
-index 55f1b83..741cac53 100644
---- a/drivers/of/fdt.c
-+++ b/drivers/of/fdt.c
-@@ -924,7 +924,7 @@ static inline void early_init_dt_check_for_initrd(unsigned long node)
- 
- #ifdef CONFIG_SERIAL_EARLYCON
- 
--static int __init early_init_dt_scan_chosen_serial(void)
-+int __init early_init_dt_scan_chosen_stdout(void)
- {
- 	int offset;
- 	const char *p, *q, *options = NULL;
-@@ -968,15 +968,6 @@ static int __init early_init_dt_scan_chosen_serial(void)
- 	}
- 	return -ENODEV;
- }
--
--static int __init setup_of_earlycon(char *buf)
--{
--	if (buf)
--		return 0;
--
--	return early_init_dt_scan_chosen_serial();
--}
--early_param("earlycon", setup_of_earlycon);
- #endif
- 
- /**
-diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
-index 067783f..7aae655 100644
---- a/drivers/tty/serial/earlycon.c
-+++ b/drivers/tty/serial/earlycon.c
-@@ -209,7 +209,7 @@ static int __init param_setup_earlycon(char *buf)
- 	 * don't generate a warning from parse_early_params() in that case
- 	 */
- 	if (!buf || !buf[0])
--		return 0;
-+		return early_init_dt_scan_chosen_stdout();
- 
- 	err = setup_earlycon(buf);
- 	if (err == -ENOENT || err == -EALREADY)
-diff --git a/include/linux/of_fdt.h b/include/linux/of_fdt.h
-index 26c3302..4341f32 100644
---- a/include/linux/of_fdt.h
-+++ b/include/linux/of_fdt.h
-@@ -14,6 +14,7 @@
- 
- #include <linux/types.h>
- #include <linux/init.h>
-+#include <linux/errno.h>
- 
- /* Definitions used by the flattened device tree */
- #define OF_DT_HEADER		0xd00dfeed	/* marker */
-@@ -66,6 +67,7 @@ extern int early_init_dt_scan_chosen(unsigned long node, const char *uname,
- 				     int depth, void *data);
- extern int early_init_dt_scan_memory(unsigned long node, const char *uname,
- 				     int depth, void *data);
-+extern int early_init_dt_scan_chosen_stdout(void);
- extern void early_init_fdt_scan_reserved_mem(void);
- extern void early_init_fdt_reserve_self(void);
- extern void early_init_dt_add_memory_arch(u64 base, u64 size);
-@@ -94,6 +96,7 @@ extern void early_get_first_memblock_info(void *, phys_addr_t *);
- extern u64 of_flat_dt_translate_address(unsigned long node);
- extern void of_fdt_limit_memory(int limit);
- #else /* CONFIG_OF_FLATTREE */
-+static inline int early_init_dt_scan_chosen_stdout(void) { return -ENODEV; }
- static inline void early_init_fdt_scan_reserved_mem(void) {}
- static inline void early_init_fdt_reserve_self(void) {}
- static inline const char *of_flat_dt_get_machine_name(void) { return NULL; }
-From patchwork Thu Aug 11 15:31:39 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v9,2/4] ACPI: parse SPCR and enable matching console
-From: Aleksey Makarov <aleksey.makarov@linaro.org>
-X-Patchwork-Id: 9275443
-Message-Id: <20160811153152.755-3-aleksey.makarov@linaro.org>
-To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
- Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: linux-serial@vger.kernel.org, linux-acpi@vger.kernel.org,
- linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
- Aleksey Makarov <aleksey.makarov@linaro.org>,
- Russell King <linux@arm.linux.org.uk>, Len Brown <lenb@kernel.org>,
- Leif Lindholm <leif.lindholm@linaro.org>,
- Graeme Gregory <graeme.gregory@linaro.org>, Al Stone <ahs3@redhat.com>,
- Christopher Covington <cov@codeaurora.org>,
- Yury Norov <ynorov@caviumnetworks.com>,
- Peter Hurley <peter@hurleysoftware.com>,
- Andy Shevchenko <andy.shevchenko@gmail.com>,
- "Zheng, Lv" <lv.zheng@intel.com>, Mark Salter <msalter@redhat.com>,
- Kefeng Wang <wangkefeng.wang@huawei.com>, Jiri Slaby <jslaby@suse.com>
-Date: Thu, 11 Aug 2016 18:31:39 +0300
-
-'ARM Server Base Boot Requiremets' [1] mentions SPCR (Serial Port
-Console Redirection Table) [2] as a mandatory ACPI table that
-specifies the configuration of serial console.
-
-Defer initialization of DT earlycon until ACPI/DT decision is made.
-
-Parse the ACPI SPCR table, setup earlycon if required,
-enable specified console.
-
-Thanks to Peter Hurley for explaining how this should work.
-
-[1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0044a/index.html
-[2] https://msdn.microsoft.com/en-us/library/windows/hardware/dn639132(v=vs.85).aspx
-
-Signed-off-by: Aleksey Makarov <aleksey.makarov@linaro.org>
-Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
-Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
-Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
----
- drivers/acpi/Kconfig          |   3 ++
- drivers/acpi/Makefile         |   1 +
- drivers/acpi/spcr.c           | 111 ++++++++++++++++++++++++++++++++++++++++++
- drivers/tty/serial/earlycon.c |  19 +++++++-
- include/linux/acpi.h          |   6 +++
- include/linux/serial_core.h   |   9 +++-
- 6 files changed, 146 insertions(+), 3 deletions(-)
- create mode 100644 drivers/acpi/spcr.c
-
-diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
-index 6cef2d1..4a269f9 100644
---- a/drivers/acpi/Kconfig
-+++ b/drivers/acpi/Kconfig
-@@ -77,6 +77,9 @@ config ACPI_DEBUGGER_USER
- 
- endif
- 
-+config ACPI_SPCR_TABLE
-+	bool
-+
- config ACPI_SLEEP
- 	bool
- 	depends on SUSPEND || HIBERNATION
-diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
-index e5ada78..d799593 100644
---- a/drivers/acpi/Makefile
-+++ b/drivers/acpi/Makefile
-@@ -81,6 +81,7 @@ obj-$(CONFIG_ACPI_EC_DEBUGFS)	+= ec_sys.o
- obj-$(CONFIG_ACPI_CUSTOM_METHOD)+= custom_method.o
- obj-$(CONFIG_ACPI_BGRT)		+= bgrt.o
- obj-$(CONFIG_ACPI_CPPC_LIB)	+= cppc_acpi.o
-+obj-$(CONFIG_ACPI_SPCR_TABLE)	+= spcr.o
- obj-$(CONFIG_ACPI_DEBUGGER_USER) += acpi_dbg.o
- 
- # processor has its own "processor." module_param namespace
-diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
-new file mode 100644
-index 0000000..e8d7bc7
---- /dev/null
-+++ b/drivers/acpi/spcr.c
-@@ -0,0 +1,111 @@
-+/*
-+ * Copyright (c) 2012, Intel Corporation
-+ * Copyright (c) 2015, Red Hat, Inc.
-+ * Copyright (c) 2015, 2016 Linaro Ltd.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ *
-+ */
-+
-+#define pr_fmt(fmt) "ACPI: SPCR: " fmt
-+
-+#include <linux/acpi.h>
-+#include <linux/console.h>
-+#include <linux/kernel.h>
-+#include <linux/serial_core.h>
-+
-+/**
-+ * parse_spcr() - parse ACPI SPCR table and add preferred console
-+ *
-+ * @earlycon: set up earlycon for the console specified by the table
-+ *
-+ * For the architectures with support for ACPI, CONFIG_ACPI_SPCR_TABLE may be
-+ * defined to parse ACPI SPCR table.  As a result of the parsing preferred
-+ * console is registered and if @earlycon is true, earlycon is set up.
-+ *
-+ * When CONFIG_ACPI_SPCR_TABLE is defined, this function should be called
-+ * from arch inintialization code as soon as the DT/ACPI decision is made.
-+ *
-+ */
-+int __init parse_spcr(bool earlycon)
-+{
-+	static char opts[64];
-+	struct acpi_table_spcr *table;
-+	acpi_size table_size;
-+	acpi_status status;
-+	char *uart;
-+	char *iotype;
-+	int baud_rate;
-+	int err;
-+
-+	if (acpi_disabled)
-+		return -ENODEV;
-+
-+	status = acpi_get_table_with_size(ACPI_SIG_SPCR, 0,
-+					  (struct acpi_table_header **)&table,
-+					  &table_size);
-+
-+	if (ACPI_FAILURE(status))
-+		return -ENOENT;
-+
-+	if (table->header.revision < 2) {
-+		err = -ENOENT;
-+		pr_err("wrong table version\n");
-+		goto done;
-+	}
-+
-+	iotype = table->serial_port.space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY ?
-+			"mmio" : "io";
-+
-+	switch (table->interface_type) {
-+	case ACPI_DBG2_ARM_SBSA_32BIT:
-+		iotype = "mmio32";
-+		/* fall through */
-+	case ACPI_DBG2_ARM_PL011:
-+	case ACPI_DBG2_ARM_SBSA_GENERIC:
-+	case ACPI_DBG2_BCM2835:
-+		uart = "pl011";
-+		break;
-+	case ACPI_DBG2_16550_COMPATIBLE:
-+	case ACPI_DBG2_16550_SUBSET:
-+		uart = "uart";
-+		break;
-+	default:
-+		err = -ENOENT;
-+		goto done;
-+	}
-+
-+	switch (table->baud_rate) {
-+	case 3:
-+		baud_rate = 9600;
-+		break;
-+	case 4:
-+		baud_rate = 19200;
-+		break;
-+	case 6:
-+		baud_rate = 57600;
-+		break;
-+	case 7:
-+		baud_rate = 115200;
-+		break;
-+	default:
-+		err = -ENOENT;
-+		goto done;
-+	}
-+
-+	snprintf(opts, sizeof(opts), "%s,%s,0x%llx,%d", uart, iotype,
-+		 table->serial_port.address, baud_rate);
-+
-+	pr_info("console: %s\n", opts);
-+
-+	if (earlycon)
-+		setup_earlycon(opts);
-+
-+	err = add_preferred_console(uart, 0, opts + strlen(uart) + 1);
-+
-+done:
-+	early_acpi_os_unmap_memory((void __iomem *)table, table_size);
-+	return err;
-+}
-diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
-index 7aae655..ea00b9f 100644
---- a/drivers/tty/serial/earlycon.c
-+++ b/drivers/tty/serial/earlycon.c
-@@ -21,6 +21,7 @@
- #include <linux/sizes.h>
- #include <linux/of.h>
- #include <linux/of_fdt.h>
-+#include <linux/acpi.h>
- 
- #ifdef CONFIG_FIX_EARLYCON_MEM
- #include <asm/fixmap.h>
-@@ -199,6 +200,14 @@ int __init setup_earlycon(char *buf)
- 	return -ENOENT;
- }
- 
-+/*
-+ * When CONFIG_ACPI_SPCR_TABLE is defined, "earlycon" without parameters in
-+ * command line does not start DT earlycon immediately, instead it defers
-+ * starting it until DT/ACPI decision is made.  At that time if ACPI is enabled
-+ * call parse_spcr(), else call early_init_dt_scan_chosen_stdout()
-+ */
-+bool earlycon_init_is_deferred __initdata;
-+
- /* early_param wrapper for setup_earlycon() */
- static int __init param_setup_earlycon(char *buf)
- {
-@@ -208,8 +217,14 @@ static int __init param_setup_earlycon(char *buf)
- 	 * Just 'earlycon' is a valid param for devicetree earlycons;
- 	 * don't generate a warning from parse_early_params() in that case
- 	 */
--	if (!buf || !buf[0])
--		return early_init_dt_scan_chosen_stdout();
-+	if (!buf || !buf[0]) {
-+		if (IS_ENABLED(CONFIG_ACPI_SPCR_TABLE)) {
-+			earlycon_init_is_deferred = true;
-+			return 0;
-+		} else {
-+			return early_init_dt_scan_chosen_stdout();
-+		}
-+	}
- 
- 	err = setup_earlycon(buf);
- 	if (err == -ENOENT || err == -EALREADY)
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 4d8452c..32407e4 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -1074,4 +1074,10 @@ void acpi_table_upgrade(void);
- static inline void acpi_table_upgrade(void) { }
- #endif
- 
-+#ifdef CONFIG_ACPI_SPCR_TABLE
-+int parse_spcr(bool earlycon);
-+#else
-+static inline int parse_spcr(bool earlycon) { return 0; }
-+#endif
-+
- #endif	/*_LINUX_ACPI_H*/
-diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
-index 2f44e20..04b8cfb 100644
---- a/include/linux/serial_core.h
-+++ b/include/linux/serial_core.h
-@@ -367,11 +367,18 @@ extern const struct earlycon_id __earlycon_table_end[];
- 
- #define EARLYCON_DECLARE(_name, fn)	OF_EARLYCON_DECLARE(_name, "", fn)
- 
--extern int setup_earlycon(char *buf);
- extern int of_setup_earlycon(const struct earlycon_id *match,
- 			     unsigned long node,
- 			     const char *options);
- 
-+#ifdef CONFIG_SERIAL_EARLYCON
-+extern bool earlycon_init_is_deferred __initdata;
-+extern int setup_earlycon(char *buf);
-+#else
-+static const bool earlycon_init_is_deferred;
-+static inline int setup_earlycon(char *buf) { return 0; }
-+#endif
-+
- struct uart_port *uart_get_console(struct uart_port *ports, int nr,
- 				   struct console *c);
- int uart_parse_earlycon(char *p, unsigned char *iotype, unsigned long *addr,
-From patchwork Thu Aug 11 15:31:40 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v9,3/4] ARM64: ACPI: enable ACPI_SPCR_TABLE
-From: Aleksey Makarov <aleksey.makarov@linaro.org>
-X-Patchwork-Id: 9275457
-Message-Id: <20160811153152.755-4-aleksey.makarov@linaro.org>
-To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
- Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: linux-serial@vger.kernel.org, linux-acpi@vger.kernel.org,
- linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
- Aleksey Makarov <aleksey.makarov@linaro.org>,
- Russell King <linux@arm.linux.org.uk>, Len Brown <lenb@kernel.org>,
- Leif Lindholm <leif.lindholm@linaro.org>,
- Graeme Gregory <graeme.gregory@linaro.org>, Al Stone <ahs3@redhat.com>,
- Christopher Covington <cov@codeaurora.org>,
- Yury Norov <ynorov@caviumnetworks.com>,
- Peter Hurley <peter@hurleysoftware.com>,
- Andy Shevchenko <andy.shevchenko@gmail.com>,
- "Zheng, Lv" <lv.zheng@intel.com>, Mark Salter <msalter@redhat.com>,
- Kefeng Wang <wangkefeng.wang@huawei.com>,
- Catalin Marinas <catalin.marinas@arm.com>,
- Will Deacon <will.deacon@arm.com>
-Date: Thu, 11 Aug 2016 18:31:40 +0300
-
-SBBR mentions SPCR as a mandatory ACPI table.  So enable it for ARM64
-
-Earlycon should be set up as early as possible.  ACPI boot tables are
-mapped in arch/arm64/kernel/acpi.c:acpi_boot_table_init() that
-is called from setup_arch() and that's where we parse SPCR.
-So it has to be opted-in per-arch.
-
-When ACPI_SPCR_TABLE is defined initialization of DT earlycon is
-deferred until the DT/ACPI decision is done.  Initialize DT earlycon
-if ACPI is disabled.
-
-Signed-off-by: Aleksey Makarov <aleksey.makarov@linaro.org>
-Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
----
- arch/arm64/Kconfig       |  1 +
- arch/arm64/kernel/acpi.c | 11 ++++++++++-
- 2 files changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
-index 69c8787..a54dfc0 100644
---- a/arch/arm64/Kconfig
-+++ b/arch/arm64/Kconfig
-@@ -4,6 +4,7 @@ config ARM64
- 	select ACPI_GENERIC_GSI if ACPI
- 	select ACPI_REDUCED_HARDWARE_ONLY if ACPI
- 	select ACPI_MCFG if ACPI
-+	select ACPI_SPCR_TABLE if ACPI
- 	select ARCH_HAS_DEVMEM_IS_ALLOWED
- 	select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
- 	select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
-index 3e4f1a4..252a6d9 100644
---- a/arch/arm64/kernel/acpi.c
-+++ b/arch/arm64/kernel/acpi.c
-@@ -24,6 +24,7 @@
- #include <linux/memblock.h>
- #include <linux/of_fdt.h>
- #include <linux/smp.h>
-+#include <linux/serial_core.h>
- 
- #include <asm/cputype.h>
- #include <asm/cpu_ops.h>
-@@ -206,7 +207,7 @@ void __init acpi_boot_table_init(void)
- 	if (param_acpi_off ||
- 	    (!param_acpi_on && !param_acpi_force &&
- 	     of_scan_flat_dt(dt_scan_depth1_nodes, NULL)))
--		return;
-+		goto done;
- 
- 	/*
- 	 * ACPI is disabled at this point. Enable it in order to parse
-@@ -226,6 +227,14 @@ void __init acpi_boot_table_init(void)
- 		if (!param_acpi_force)
- 			disable_acpi();
- 	}
-+
-+done:
-+	if (acpi_disabled) {
-+		if (earlycon_init_is_deferred)
-+			early_init_dt_scan_chosen_stdout();
-+	} else {
-+		parse_spcr(earlycon_init_is_deferred);
-+	}
- }
- 
- #ifdef CONFIG_ACPI_APEI
-From patchwork Mon Aug 15 13:35:03 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v9,4/4] serial: pl011: add console matching function
-From: Aleksey Makarov <aleksey.makarov@linaro.org>
-X-Patchwork-Id: 9280971
-Message-Id: <20160815133505.15294-1-aleksey.makarov@linaro.org>
-To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
- Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: linux-serial@vger.kernel.org, linux-acpi@vger.kernel.org,
- linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
- Aleksey Makarov <aleksey.makarov@linaro.org>,
- Russell King <linux@arm.linux.org.uk>, Len Brown <lenb@kernel.org>,
- Leif Lindholm <leif.lindholm@linaro.org>,
- Graeme Gregory <graeme.gregory@linaro.org>, Al Stone <ahs3@redhat.com>,
- Christopher Covington <cov@codeaurora.org>,
- Yury Norov <ynorov@caviumnetworks.com>,
- Peter Hurley <peter@hurleysoftware.com>,
- Andy Shevchenko <andy.shevchenko@gmail.com>,
- "Zheng, Lv" <lv.zheng@intel.com>, Mark Salter <msalter@redhat.com>,
- Kefeng Wang <wangkefeng.wang@huawei.com>,
- Russell King <linux@armlinux.org.uk>, Jiri Slaby <jslaby@suse.com>
-Date: Mon, 15 Aug 2016 16:35:03 +0300
-
-This patch adds function pl011_console_match() that implements
-method match of struct console.  It allows to match consoles against
-data specified in a string, for example taken from command line or
-compiled by ACPI SPCR table handler.
-
-Signed-off-by: Aleksey Makarov <aleksey.makarov@linaro.org>
-Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
-Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
----
- drivers/tty/serial/amba-pl011.c | 55 +++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 55 insertions(+)
-
-diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
-index 8a9e213..2f9af8a 100644
---- a/drivers/tty/serial/amba-pl011.c
-+++ b/drivers/tty/serial/amba-pl011.c
-@@ -2288,12 +2288,67 @@ static int __init pl011_console_setup(struct console *co, char *options)
- 	return uart_set_options(&uap->port, co, baud, parity, bits, flow);
- }
- 
-+/**
-+ *	pl011_console_match - non-standard console matching
-+ *	@co:	  registering console
-+ *	@name:	  name from console command line
-+ *	@idx:	  index from console command line
-+ *	@options: ptr to option string from console command line
-+ *
-+ *	Only attempts to match console command lines of the form:
-+ *	    console=pl011,mmio|mmio32,<addr>[,<options>]
-+ *	    console=pl011,0x<addr>[,<options>]
-+ *	This form is used to register an initial earlycon boot console and
-+ *	replace it with the amba_console at pl011 driver init.
-+ *
-+ *	Performs console setup for a match (as required by interface)
-+ *	If no <options> are specified, then assume the h/w is already setup.
-+ *
-+ *	Returns 0 if console matches; otherwise non-zero to use default matching
-+ */
-+static int __init pl011_console_match(struct console *co, char *name, int idx,
-+				      char *options)
-+{
-+	unsigned char iotype;
-+	unsigned long addr;
-+	int i;
-+
-+	if (strcmp(name, "pl011") != 0)
-+		return -ENODEV;
-+
-+	if (uart_parse_earlycon(options, &iotype, &addr, &options))
-+		return -ENODEV;
-+
-+	if (iotype != UPIO_MEM && iotype != UPIO_MEM32)
-+		return -ENODEV;
-+
-+	/* try to match the port specified on the command line */
-+	for (i = 0; i < ARRAY_SIZE(amba_ports); i++) {
-+		struct uart_port *port;
-+
-+		if (!amba_ports[i])
-+			continue;
-+
-+		port = &amba_ports[i]->port;
-+
-+		if (port->mapbase != addr)
-+			continue;
-+
-+		co->index = i;
-+		port->cons = co;
-+		return pl011_console_setup(co, options);
-+	}
-+
-+	return -ENODEV;
-+}
-+
- static struct uart_driver amba_reg;
- static struct console amba_console = {
- 	.name		= "ttyAMA",
- 	.write		= pl011_console_write,
- 	.device		= uart_console_device,
- 	.setup		= pl011_console_setup,
-+	.match		= pl011_console_match,
- 	.flags		= CON_PRINTBUFFER,
- 	.index		= -1,
- 	.data		= &amba_reg,

arm64-Add-option-of-13-for-FORCE_MAX_ZONEORDER.patch

@@ -0,0 +1,29 @@
+From 487ff7b0e537506057960a0c2d9482d19f2acf4a Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 26 Apr 2017 11:12:54 +0100
+Subject: [PATCH] Add option of 13 for FORCE_MAX_ZONEORDER
+
+This is a hack, but it's what the other distros currently use
+for aarch64 with 4K pages so we'll do the same while upstream
+decides what the best outcome is (which isn't this).
+
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 3741859765cf..deec9511f1d3 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -751,6 +751,7 @@ config XEN
+ config FORCE_MAX_ZONEORDER
+ 	int
+ 	default "14" if (ARM64_64K_PAGES && TRANSPARENT_HUGEPAGE)
++	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)
+ 	default "12" if (ARM64_16K_PAGES && TRANSPARENT_HUGEPAGE)
+ 	default "11"
+ 	help
+-- 
+2.12.2
+

arm64-pcie-quirks.patch

@@ -1,977 +0,0 @@
-From 5c4f8b5b68451e5d208a5aefb195fdd108629da4 Mon Sep 17 00:00:00 2001
-From: Tomasz Nowicki <tn@semihalf.com>
-Date: Fri, 9 Sep 2016 21:24:03 +0200
-Subject: [PATCH 1/6] PCI/ACPI: Extend pci_mcfg_lookup() responsibilities
-
-In preparation for adding MCFG platform specific quirk handling move
-CFG resource calculation and ECAM ops assignment to pci_mcfg_lookup().
-It becomes the gate for further ops and CFG resource manipulation
-in arch-agnostic code (drivers/acpi/pci_mcfg.c).
-
-No functionality changes in this patch.
-
-Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
----
- arch/arm64/kernel/pci.c  | 17 +++++------------
- drivers/acpi/pci_mcfg.c  | 28 +++++++++++++++++++++++++---
- include/linux/pci-acpi.h |  4 +++-
- 3 files changed, 33 insertions(+), 16 deletions(-)
-
-diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
-index acf3872..fb439c7 100644
---- a/arch/arm64/kernel/pci.c
-+++ b/arch/arm64/kernel/pci.c
-@@ -125,24 +125,17 @@ pci_acpi_setup_ecam_mapping(struct acpi_pci_root *root)
- 	u16 seg = root->segment;
- 	struct pci_config_window *cfg;
- 	struct resource cfgres;
--	unsigned int bsz;
-+	struct pci_ecam_ops *ecam_ops;
-+	int ret;
- 
--	/* Use address from _CBA if present, otherwise lookup MCFG */
--	if (!root->mcfg_addr)
--		root->mcfg_addr = pci_mcfg_lookup(seg, bus_res);
--
--	if (!root->mcfg_addr) {
-+	ret = pci_mcfg_lookup(root, &cfgres, &ecam_ops);
-+	if (ret) {
- 		dev_err(&root->device->dev, "%04x:%pR ECAM region not found\n",
- 			seg, bus_res);
- 		return NULL;
- 	}
- 
--	bsz = 1 << pci_generic_ecam_ops.bus_shift;
--	cfgres.start = root->mcfg_addr + bus_res->start * bsz;
--	cfgres.end = cfgres.start + resource_size(bus_res) * bsz - 1;
--	cfgres.flags = IORESOURCE_MEM;
--	cfg = pci_ecam_create(&root->device->dev, &cfgres, bus_res,
--			      &pci_generic_ecam_ops);
-+	cfg = pci_ecam_create(&root->device->dev, &cfgres, bus_res, ecam_ops);
- 	if (IS_ERR(cfg)) {
- 		dev_err(&root->device->dev, "%04x:%pR error %ld mapping ECAM\n",
- 			seg, bus_res, PTR_ERR(cfg));
-diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
-index b5b376e..ffcc651 100644
---- a/drivers/acpi/pci_mcfg.c
-+++ b/drivers/acpi/pci_mcfg.c
-@@ -22,6 +22,7 @@
- #include <linux/kernel.h>
- #include <linux/pci.h>
- #include <linux/pci-acpi.h>
-+#include <linux/pci-ecam.h>
- 
- /* Structure to hold entries from the MCFG table */
- struct mcfg_entry {
-@@ -35,9 +36,18 @@ struct mcfg_entry {
- /* List to save MCFG entries */
- static LIST_HEAD(pci_mcfg_list);
- 
--phys_addr_t pci_mcfg_lookup(u16 seg, struct resource *bus_res)
-+int pci_mcfg_lookup(struct acpi_pci_root *root, struct resource *cfgres,
-+		    struct pci_ecam_ops **ecam_ops)
- {
-+	struct pci_ecam_ops *ops = &pci_generic_ecam_ops;
-+	struct resource *bus_res = &root->secondary;
-+	u16 seg = root->segment;
- 	struct mcfg_entry *e;
-+	struct resource res;
-+
-+	/* Use address from _CBA if present, otherwise lookup MCFG */
-+	if (root->mcfg_addr)
-+		goto skip_lookup;
- 
- 	/*
- 	 * We expect exact match, unless MCFG entry end bus covers more than
-@@ -45,10 +55,22 @@ phys_addr_t pci_mcfg_lookup(u16 seg, struct resource *bus_res)
- 	 */
- 	list_for_each_entry(e, &pci_mcfg_list, list) {
- 		if (e->segment == seg && e->bus_start == bus_res->start &&
--		    e->bus_end >= bus_res->end)
--			return e->addr;
-+		    e->bus_end >= bus_res->end) {
-+			root->mcfg_addr = e->addr;
-+		}
-+
- 	}
- 
-+	if (!root->mcfg_addr)
-+		return -ENXIO;
-+
-+skip_lookup:
-+	memset(&res, 0, sizeof(res));
-+	res.start = root->mcfg_addr + (bus_res->start << 20);
-+	res.end = res.start + (resource_size(bus_res) << 20) - 1;
-+	res.flags = IORESOURCE_MEM;
-+	*cfgres = res;
-+	*ecam_ops = ops;
- 	return 0;
- }
- 
-diff --git a/include/linux/pci-acpi.h b/include/linux/pci-acpi.h
-index 7d63a66..7a4e83a 100644
---- a/include/linux/pci-acpi.h
-+++ b/include/linux/pci-acpi.h
-@@ -24,7 +24,9 @@ static inline acpi_status pci_acpi_remove_pm_notifier(struct acpi_device *dev)
- }
- extern phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle);
- 
--extern phys_addr_t pci_mcfg_lookup(u16 domain, struct resource *bus_res);
-+struct pci_ecam_ops;
-+extern int pci_mcfg_lookup(struct acpi_pci_root *root, struct resource *cfgres,
-+			   struct pci_ecam_ops **ecam_ops);
- 
- static inline acpi_handle acpi_find_root_bridge_handle(struct pci_dev *pdev)
- {
--- 
-2.9.3
-
-From 16c02d9cc0e67b48c343aecc4b5566e729a97683 Mon Sep 17 00:00:00 2001
-From: Tomasz Nowicki <tn@semihalf.com>
-Date: Fri, 9 Sep 2016 21:24:04 +0200
-Subject: [PATCH 2/6] PCI/ACPI: Check platform specific ECAM quirks
-
-Some platforms may not be fully compliant with generic set of PCI config
-accessors. For these cases we implement the way to overwrite CFG accessors
-set and configuration space range.
-
-In first place pci_mcfg_parse() saves machine's IDs and revision number
-(these come from MCFG header) in order to match against known quirk entries.
-Then the algorithm traverses available quirk list (static array),
-matches against <oem_id, oem_table_id, rev, domain, bus number range> and
-returns custom PCI config ops and/or CFG resource structure.
-
-When adding new quirk there are two possibilities:
-1. Override default pci_generic_ecam_ops ops but CFG resource comes from MCFG
-{ "OEM_ID", "OEM_TABLE_ID", <REV>, <DOMAIN>, <BUS_NR>, &foo_ops, MCFG_RES_EMPTY },
-2. Override default pci_generic_ecam_ops ops and CFG resource. For this case
-it is also allowed get CFG resource from quirk entry w/o having it in MCFG.
-{ "OEM_ID", "OEM_TABLE_ID", <REV>, <DOMAIN>, <BUS_NR>, &boo_ops,
-  DEFINE_RES_MEM(START, SIZE) },
-
-pci_generic_ecam_ops and MCFG entries will be used for platforms
-free from quirks.
-
-Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
-Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
-Signed-off-by: Christopher Covington <cov@codeaurora.org>
----
- drivers/acpi/pci_mcfg.c | 80 +++++++++++++++++++++++++++++++++++++++++++++----
- 1 file changed, 74 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
-index ffcc651..2b8acc7 100644
---- a/drivers/acpi/pci_mcfg.c
-+++ b/drivers/acpi/pci_mcfg.c
-@@ -32,6 +32,59 @@ struct mcfg_entry {
- 	u8			bus_start;
- 	u8			bus_end;
- };
-+struct mcfg_fixup {
-+	char oem_id[ACPI_OEM_ID_SIZE + 1];
-+	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
-+	u32 oem_revision;
-+	u16 seg;
-+	struct resource bus_range;
-+	struct pci_ecam_ops *ops;
-+	struct resource cfgres;
-+};
-+
-+#define MCFG_DOM_ANY			(-1)
-+#define MCFG_BUS_RANGE(start, end)	DEFINE_RES_NAMED((start),	\
-+						((end) - (start) + 1),	\
-+						NULL, IORESOURCE_BUS)
-+#define MCFG_BUS_ANY		MCFG_BUS_RANGE(0x0, 0xff)
-+#define MCFG_RES_EMPTY		DEFINE_RES_NAMED(0, 0, NULL, 0)
-+
-+static struct mcfg_fixup mcfg_quirks[] = {
-+/*	{ OEM_ID, OEM_TABLE_ID, REV, DOMAIN, BUS_RANGE, cfgres, ops }, */
-+};
-+
-+static char mcfg_oem_id[ACPI_OEM_ID_SIZE];
-+static char mcfg_oem_table_id[ACPI_OEM_TABLE_ID_SIZE];
-+static u32 mcfg_oem_revision;
-+
-+static void pci_mcfg_match_quirks(struct acpi_pci_root *root,
-+				  struct resource *cfgres,
-+				  struct pci_ecam_ops **ecam_ops)
-+{
-+	struct mcfg_fixup *f;
-+	int i;
-+
-+	/*
-+	 * First match against PCI topology <domain:bus> then use OEM ID, OEM
-+	 * table ID, and OEM revision from MCFG table standard header.
-+	 */
-+	for (i = 0, f = mcfg_quirks; i < ARRAY_SIZE(mcfg_quirks); i++, f++) {
-+		if (f->seg == root->segment &&
-+		    resource_contains(&f->bus_range, &root->secondary) &&
-+		    !memcmp(f->oem_id, mcfg_oem_id, ACPI_OEM_ID_SIZE) &&
-+		    !memcmp(f->oem_table_id, mcfg_oem_table_id,
-+		            ACPI_OEM_TABLE_ID_SIZE) &&
-+		    f->oem_revision == mcfg_oem_revision) {
-+			if (f->cfgres.start)
-+				*cfgres = f->cfgres;
-+			if (f->ops)
-+				*ecam_ops =  f->ops;
-+			dev_info(&root->device->dev, "Applying PCI MCFG quirks for %s %s rev: %d\n",
-+				 f->oem_id, f->oem_table_id, f->oem_revision);
-+			return;
-+		}
-+	}
-+}
- 
- /* List to save MCFG entries */
- static LIST_HEAD(pci_mcfg_list);
-@@ -61,14 +114,24 @@ int pci_mcfg_lookup(struct acpi_pci_root *root, struct resource *cfgres,
- 
- 	}
- 
--	if (!root->mcfg_addr)
--		return -ENXIO;
--
- skip_lookup:
- 	memset(&res, 0, sizeof(res));
--	res.start = root->mcfg_addr + (bus_res->start << 20);
--	res.end = res.start + (resource_size(bus_res) << 20) - 1;
--	res.flags = IORESOURCE_MEM;
-+	if (root->mcfg_addr) {
-+		res.start = root->mcfg_addr + (bus_res->start << 20);
-+		res.end = res.start + (resource_size(bus_res) << 20) - 1;
-+		res.flags = IORESOURCE_MEM;
-+	}
-+
-+	/*
-+	 * Let to override default ECAM ops and CFG resource range.
-+	 * Also, this might even retrieve CFG resource range in case MCFG
-+	 * does not have it. Invalid CFG start address means MCFG firmware bug
-+	 * or we need another quirk in array.
-+	 */
-+	pci_mcfg_match_quirks(root, &res, &ops);
-+	if (!res.start)
-+		return -ENXIO;
-+
- 	*cfgres = res;
- 	*ecam_ops = ops;
- 	return 0;
-@@ -101,6 +164,11 @@ static __init int pci_mcfg_parse(struct acpi_table_header *header)
- 		list_add(&e->list, &pci_mcfg_list);
- 	}
- 
-+	/* Save MCFG IDs and revision for quirks matching */
-+	memcpy(mcfg_oem_id, header->oem_id, ACPI_OEM_ID_SIZE);
-+	memcpy(mcfg_oem_table_id, header->oem_table_id, ACPI_OEM_TABLE_ID_SIZE);
-+	mcfg_oem_revision = header->revision;
-+
- 	pr_info("MCFG table detected, %d entries\n", n);
- 	return 0;
- }
--- 
-2.9.3
-
-From 2243ab64c12a873e47b72c8e636b40ed09c5f0d4 Mon Sep 17 00:00:00 2001
-From: Tomasz Nowicki <tn@semihalf.com>
-Date: Fri, 9 Sep 2016 21:24:05 +0200
-Subject: [PATCH 3/6] PCI: thunder-pem: Allow to probe PEM-specific register
- range for ACPI case
-
-thunder-pem driver stands for being ACPI based PCI host controller.
-However, there is no standard way to describe its PEM-specific register
-ranges in ACPI tables. Thus we add thunder_pem_init() ACPI extension
-to obtain hardcoded addresses from static resource array.
-Although it is not pretty, it prevents from creating standard mechanism to
-handle similar cases in future.
-
-Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
----
- drivers/pci/host/pci-thunder-pem.c | 61 ++++++++++++++++++++++++++++++--------
- 1 file changed, 48 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/pci/host/pci-thunder-pem.c b/drivers/pci/host/pci-thunder-pem.c
-index 6abaf80..b048761 100644
---- a/drivers/pci/host/pci-thunder-pem.c
-+++ b/drivers/pci/host/pci-thunder-pem.c
-@@ -18,6 +18,7 @@
- #include <linux/init.h>
- #include <linux/of_address.h>
- #include <linux/of_pci.h>
-+#include <linux/pci-acpi.h>
- #include <linux/pci-ecam.h>
- #include <linux/platform_device.h>
- 
-@@ -284,6 +285,40 @@ static int thunder_pem_config_write(struct pci_bus *bus, unsigned int devfn,
- 	return pci_generic_config_write(bus, devfn, where, size, val);
- }
- 
-+#ifdef CONFIG_ACPI
-+static struct resource thunder_pem_reg_res[] = {
-+	[4] = DEFINE_RES_MEM(0x87e0c0000000UL, SZ_16M),
-+	[5] = DEFINE_RES_MEM(0x87e0c1000000UL, SZ_16M),
-+	[6] = DEFINE_RES_MEM(0x87e0c2000000UL, SZ_16M),
-+	[7] = DEFINE_RES_MEM(0x87e0c3000000UL, SZ_16M),
-+	[8] = DEFINE_RES_MEM(0x87e0c4000000UL, SZ_16M),
-+	[9] = DEFINE_RES_MEM(0x87e0c5000000UL, SZ_16M),
-+	[14] = DEFINE_RES_MEM(0x97e0c0000000UL, SZ_16M),
-+	[15] = DEFINE_RES_MEM(0x97e0c1000000UL, SZ_16M),
-+	[16] = DEFINE_RES_MEM(0x97e0c2000000UL, SZ_16M),
-+	[17] = DEFINE_RES_MEM(0x97e0c3000000UL, SZ_16M),
-+	[18] = DEFINE_RES_MEM(0x97e0c4000000UL, SZ_16M),
-+	[19] = DEFINE_RES_MEM(0x97e0c5000000UL, SZ_16M),
-+};
-+
-+static struct resource *thunder_pem_acpi_res(struct pci_config_window *cfg)
-+{
-+	struct acpi_device *adev = to_acpi_device(cfg->parent);
-+	struct acpi_pci_root *root = acpi_driver_data(adev);
-+
-+	if ((root->segment >= 4 && root->segment <= 9) ||
-+	    (root->segment >= 14 && root->segment <= 19))
-+		return &thunder_pem_reg_res[root->segment];
-+
-+	return NULL;
-+}
-+#else
-+static struct resource *thunder_pem_acpi_res(struct pci_config_window *cfg)
-+{
-+	return NULL;
-+}
-+#endif
-+
- static int thunder_pem_init(struct pci_config_window *cfg)
- {
- 	struct device *dev = cfg->parent;
-@@ -292,24 +327,24 @@ static int thunder_pem_init(struct pci_config_window *cfg)
- 	struct thunder_pem_pci *pem_pci;
- 	struct platform_device *pdev;
- 
--	/* Only OF support for now */
--	if (!dev->of_node)
--		return -EINVAL;
--
- 	pem_pci = devm_kzalloc(dev, sizeof(*pem_pci), GFP_KERNEL);
- 	if (!pem_pci)
- 		return -ENOMEM;
- 
--	pdev = to_platform_device(dev);
--
--	/*
--	 * The second register range is the PEM bridge to the PCIe
--	 * bus.  It has a different config access method than those
--	 * devices behind the bridge.
--	 */
--	res_pem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-+	if (acpi_disabled) {
-+		pdev = to_platform_device(dev);
-+
-+		/*
-+		 * The second register range is the PEM bridge to the PCIe
-+		 * bus.  It has a different config access method than those
-+		 * devices behind the bridge.
-+		 */
-+		res_pem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-+	} else {
-+		res_pem = thunder_pem_acpi_res(cfg);
-+	}
- 	if (!res_pem) {
--		dev_err(dev, "missing \"reg[1]\"property\n");
-+		dev_err(dev, "missing configuration region\n");
- 		return -EINVAL;
- 	}
- 
--- 
-2.9.3
-
-From 443d85d47ee00b3f0b6f39d470a11e7eb116817d Mon Sep 17 00:00:00 2001
-From: Tomasz Nowicki <tn@semihalf.com>
-Date: Fri, 9 Sep 2016 21:24:06 +0200
-Subject: [PATCH 4/6] PCI: thunder: Enable ACPI PCI controller for ThunderX
- pass2.x silicon version
-
-ThunderX PCIe controller to off-chip devices (so-called PEM) is not fully
-compliant with ECAM standard. It uses non-standard configuration space
-accessors (see pci_thunder_pem_ops) and custom configuration space granulation
-(see bus_shift = 24). In order to access configuration space and
-probe PEM as ACPI based PCI host controller we need to add MCFG quirk
-infrastructure. This involves:
-1. Export PEM pci_thunder_pem_ops structure so it is visible to MCFG quirk
-   code.
-2. New quirk entries for each PEM segment. Each contains platform IDs,
-   mentioned pci_thunder_pem_ops and CFG resources.
-
-Quirk is considered for ThunderX silicon pass2.x only which is identified
-via MCFG revision 1.
-
-Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
----
- drivers/acpi/pci_mcfg.c            | 27 +++++++++++++++++++++++++++
- drivers/pci/host/pci-thunder-pem.c |  2 +-
- include/linux/pci-ecam.h           |  4 ++++
- 3 files changed, 32 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
-index 2b8acc7..1f73d7b 100644
---- a/drivers/acpi/pci_mcfg.c
-+++ b/drivers/acpi/pci_mcfg.c
-@@ -51,6 +51,33 @@ struct mcfg_fixup {
- 
- static struct mcfg_fixup mcfg_quirks[] = {
- /*	{ OEM_ID, OEM_TABLE_ID, REV, DOMAIN, BUS_RANGE, cfgres, ops }, */
-+#ifdef CONFIG_PCI_HOST_THUNDER_PEM
-+	/* SoC pass2.x */
-+	{ "CAVIUM", "THUNDERX", 1, 4, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x88001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 5, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x884057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 6, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x88808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 7, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x89001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 8, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x894057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 9, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x89808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 14, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x98001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 15, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x984057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 16, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x98808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 17, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x99001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 18, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x994057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 1, 19, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x99808f000000UL, 0x39 * SZ_16M) },
-+#endif
- };
- 
- static char mcfg_oem_id[ACPI_OEM_ID_SIZE];
-diff --git a/drivers/pci/host/pci-thunder-pem.c b/drivers/pci/host/pci-thunder-pem.c
-index b048761..d7c10cc 100644
---- a/drivers/pci/host/pci-thunder-pem.c
-+++ b/drivers/pci/host/pci-thunder-pem.c
-@@ -367,7 +367,7 @@ static int thunder_pem_init(struct pci_config_window *cfg)
- 	return 0;
- }
- 
--static struct pci_ecam_ops pci_thunder_pem_ops = {
-+struct pci_ecam_ops pci_thunder_pem_ops = {
- 	.bus_shift	= 24,
- 	.init		= thunder_pem_init,
- 	.pci_ops	= {
-diff --git a/include/linux/pci-ecam.h b/include/linux/pci-ecam.h
-index 7adad20..65505ea 100644
---- a/include/linux/pci-ecam.h
-+++ b/include/linux/pci-ecam.h
-@@ -58,6 +58,10 @@ void __iomem *pci_ecam_map_bus(struct pci_bus *bus, unsigned int devfn,
- 			       int where);
- /* default ECAM ops */
- extern struct pci_ecam_ops pci_generic_ecam_ops;
-+/* ECAM ops for known quirks */
-+#ifdef CONFIG_PCI_HOST_THUNDER_PEM
-+extern struct pci_ecam_ops pci_thunder_pem_ops;
-+#endif
- 
- #ifdef CONFIG_PCI_HOST_GENERIC
- /* for DT-based PCI controllers that support ECAM */
--- 
-2.9.3
-
-From 6eca99cc392a11bb07b9ef88bca71a85f8bbe273 Mon Sep 17 00:00:00 2001
-From: Tomasz Nowicki <tn@semihalf.com>
-Date: Fri, 9 Sep 2016 21:24:07 +0200
-Subject: [PATCH 5/6] PCI: thunder: Enable ACPI PCI controller for ThunderX
- pass1.x silicon version
-
-ThunderX pass1.x requires to emulate the EA headers for on-chip devices
-hence it has to use custom pci_thunder_ecam_ops for accessing PCI config
-space (pci-thuner-ecam.c). Add new entries to MCFG quirk array where they
-can be applied while probing ACPI based PCI host controller.
-
-ThunderX pass1.x is using the same way for accessing off-chip devices
-(so-called PEM) as silicon pass-2.x so we need to add PEM quirk
-entries too.
-
-Quirk is considered for ThunderX silicon pass1.x only which is identified
-via MCFG revision 2.
-
-Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
----
- drivers/acpi/pci_mcfg.c             | 45 +++++++++++++++++++++++++++++++++++++
- drivers/pci/host/pci-thunder-ecam.c |  2 +-
- include/linux/pci-ecam.h            |  3 +++
- 3 files changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
-index 1f73d7b..eb14f74 100644
---- a/drivers/acpi/pci_mcfg.c
-+++ b/drivers/acpi/pci_mcfg.c
-@@ -77,6 +77,51 @@ static struct mcfg_fixup mcfg_quirks[] = {
- 	  DEFINE_RES_MEM(0x994057000000UL, 0x39 * SZ_16M) },
- 	{ "CAVIUM", "THUNDERX", 1, 19, MCFG_BUS_ANY, &pci_thunder_pem_ops,
- 	  DEFINE_RES_MEM(0x99808f000000UL, 0x39 * SZ_16M) },
-+
-+	/* SoC pass1.x */
-+	{ "CAVIUM", "THUNDERX", 2, 4, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x88001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 5, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x884057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 6, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x88808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 7, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x89001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 8, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x894057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 9, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x89808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 14, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x98001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 15, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x984057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 16, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x98808f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 17, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x99001f000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 18, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x994057000000UL, 0x39 * SZ_16M) },
-+	{ "CAVIUM", "THUNDERX", 2, 19, MCFG_BUS_ANY, &pci_thunder_pem_ops,
-+	  DEFINE_RES_MEM(0x99808f000000UL, 0x39 * SZ_16M) },
-+#endif
-+#ifdef CONFIG_PCI_HOST_THUNDER_ECAM
-+	/* SoC pass1.x */
-+	{ "CAVIUM", "THUNDERX", 2, 0, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 1, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 2, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 3, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 10, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 11, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 12, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
-+	{ "CAVIUM", "THUNDERX", 2, 13, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
-+	  MCFG_RES_EMPTY},
- #endif
- };
- 
-diff --git a/drivers/pci/host/pci-thunder-ecam.c b/drivers/pci/host/pci-thunder-ecam.c
-index d50a3dc..b6c17e2 100644
---- a/drivers/pci/host/pci-thunder-ecam.c
-+++ b/drivers/pci/host/pci-thunder-ecam.c
-@@ -346,7 +346,7 @@ static int thunder_ecam_config_write(struct pci_bus *bus, unsigned int devfn,
- 	return pci_generic_config_write(bus, devfn, where, size, val);
- }
- 
--static struct pci_ecam_ops pci_thunder_ecam_ops = {
-+struct pci_ecam_ops pci_thunder_ecam_ops = {
- 	.bus_shift	= 20,
- 	.pci_ops	= {
- 		.map_bus        = pci_ecam_map_bus,
-diff --git a/include/linux/pci-ecam.h b/include/linux/pci-ecam.h
-index 65505ea..35f0e81 100644
---- a/include/linux/pci-ecam.h
-+++ b/include/linux/pci-ecam.h
-@@ -62,6 +62,9 @@ extern struct pci_ecam_ops pci_generic_ecam_ops;
- #ifdef CONFIG_PCI_HOST_THUNDER_PEM
- extern struct pci_ecam_ops pci_thunder_pem_ops;
- #endif
-+#ifdef CONFIG_PCI_HOST_THUNDER_ECAM
-+extern struct pci_ecam_ops pci_thunder_ecam_ops;
-+#endif
- 
- #ifdef CONFIG_PCI_HOST_GENERIC
- /* for DT-based PCI controllers that support ECAM */
--- 
-2.9.3
-
-From 3080ac5bb527155ccdf8490ce221b1c6ad01f502 Mon Sep 17 00:00:00 2001
-From: Duc Dang <dhdang@apm.com>
-Date: Sat, 17 Sep 2016 07:24:38 -0700
-Subject: [PATCH 6/6] PCI/ACPI: xgene: Add ECAM quirk for X-Gene PCIe
- controller
-
-PCIe controller in X-Gene SoCs is not ECAM compliant: software
-needs to configure additional concontroller register to address
-device at bus:dev:function.
-
-This patch depends on "ECAM quirks handling for ARM64 platforms"
-series (http://www.spinics.net/lists/arm-kernel/msg530692.html)
-to address the limitation above for X-Gene PCIe controller.
-
-The quirk will only be applied for X-Gene PCIe MCFG table with
-OEM revison 1, 2, 3 or 4 (PCIe controller v1 and v2 on X-Gene SoCs).
-
-Signed-off-by: Duc Dang <dhdang@apm.com>
----
- drivers/acpi/pci_mcfg.c           |  32 +++++
- drivers/pci/host/Makefile         |   2 +-
- drivers/pci/host/pci-xgene-ecam.c | 280 ++++++++++++++++++++++++++++++++++++++
- include/linux/pci-ecam.h          |   5 +
- 4 files changed, 318 insertions(+), 1 deletion(-)
- create mode 100644 drivers/pci/host/pci-xgene-ecam.c
-
-diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
-index eb14f74..635ab24 100644
---- a/drivers/acpi/pci_mcfg.c
-+++ b/drivers/acpi/pci_mcfg.c
-@@ -123,6 +123,38 @@ static struct mcfg_fixup mcfg_quirks[] = {
- 	{ "CAVIUM", "THUNDERX", 2, 13, MCFG_BUS_ANY, &pci_thunder_ecam_ops,
- 	  MCFG_RES_EMPTY},
- #endif
-+#ifdef CONFIG_PCI_XGENE
-+	{"APM   ", "XGENE   ", 1, 0, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 1, 1, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 1, 2, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 1, 3, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 1, 4, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 2, 0, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 2, 1, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 2, 2, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 2, 3, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 2, 4, MCFG_BUS_ANY,
-+		&xgene_v1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 3, 0, MCFG_BUS_ANY,
-+		&xgene_v2_1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 3, 1, MCFG_BUS_ANY,
-+		&xgene_v2_1_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 4, 0, MCFG_BUS_ANY,
-+		&xgene_v2_2_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 4, 1, MCFG_BUS_ANY,
-+		&xgene_v2_2_pcie_ecam_ops, MCFG_RES_EMPTY},
-+	{"APM   ", "XGENE   ", 4, 2, MCFG_BUS_ANY,
-+		&xgene_v2_2_pcie_ecam_ops, MCFG_RES_EMPTY},
-+#endif
- };
- 
- static char mcfg_oem_id[ACPI_OEM_ID_SIZE];
-diff --git a/drivers/pci/host/Makefile b/drivers/pci/host/Makefile
-index 8843410..af4f505 100644
---- a/drivers/pci/host/Makefile
-+++ b/drivers/pci/host/Makefile
-@@ -15,7 +15,7 @@ obj-$(CONFIG_PCIE_SPEAR13XX) += pcie-spear13xx.o
- obj-$(CONFIG_PCI_KEYSTONE) += pci-keystone-dw.o pci-keystone.o
- obj-$(CONFIG_PCIE_XILINX) += pcie-xilinx.o
- obj-$(CONFIG_PCIE_XILINX_NWL) += pcie-xilinx-nwl.o
--obj-$(CONFIG_PCI_XGENE) += pci-xgene.o
-+obj-$(CONFIG_PCI_XGENE) += pci-xgene.o pci-xgene-ecam.o
- obj-$(CONFIG_PCI_XGENE_MSI) += pci-xgene-msi.o
- obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o
- obj-$(CONFIG_PCI_VERSATILE) += pci-versatile.o
-diff --git a/drivers/pci/host/pci-xgene-ecam.c b/drivers/pci/host/pci-xgene-ecam.c
-new file mode 100644
-index 0000000..b66a04f
---- /dev/null
-+++ b/drivers/pci/host/pci-xgene-ecam.c
-@@ -0,0 +1,280 @@
-+/*
-+ * APM X-Gene PCIe ECAM fixup driver
-+ *
-+ * Copyright (c) 2016, Applied Micro Circuits Corporation
-+ * Author:
-+ *	Duc Dang <dhdang@apm.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/of_address.h>
-+#include <linux/of_pci.h>
-+#include <linux/pci-acpi.h>
-+#include <linux/platform_device.h>
-+#include <linux/pci-ecam.h>
-+
-+#ifdef CONFIG_ACPI
-+#define RTDID			0x160
-+#define ROOT_CAP_AND_CTRL	0x5C
-+
-+/* PCIe IP version */
-+#define XGENE_PCIE_IP_VER_UNKN	0
-+#define XGENE_PCIE_IP_VER_1	1
-+#define XGENE_PCIE_IP_VER_2	2
-+
-+#define XGENE_CSR_LENGTH	0x10000
-+
-+struct xgene_pcie_acpi_root {
-+	void __iomem *csr_base;
-+	u32 version;
-+};
-+
-+static int xgene_v1_pcie_ecam_init(struct pci_config_window *cfg)
-+{
-+	struct xgene_pcie_acpi_root *xgene_root;
-+	struct device *dev = cfg->parent;
-+	u32 csr_base;
-+
-+	xgene_root = devm_kzalloc(dev, sizeof(*xgene_root), GFP_KERNEL);
-+	if (!xgene_root)
-+		return -ENOMEM;
-+
-+	switch (cfg->res.start) {
-+	case 0xE0D0000000ULL:
-+		csr_base = 0x1F2B0000;
-+		break;
-+	case 0xD0D0000000ULL:
-+		csr_base = 0x1F2C0000;
-+		break;
-+	case 0x90D0000000ULL:
-+		csr_base = 0x1F2D0000;
-+		break;
-+	case 0xA0D0000000ULL:
-+		csr_base = 0x1F500000;
-+		break;
-+	case 0xC0D0000000ULL:
-+		csr_base = 0x1F510000;
-+		break;
-+	default:
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->csr_base = ioremap(csr_base, XGENE_CSR_LENGTH);
-+	if (!xgene_root->csr_base) {
-+		kfree(xgene_root);
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->version = XGENE_PCIE_IP_VER_1;
-+
-+	cfg->priv = xgene_root;
-+
-+	return 0;
-+}
-+
-+static int xgene_v2_1_pcie_ecam_init(struct pci_config_window *cfg)
-+{
-+	struct xgene_pcie_acpi_root *xgene_root;
-+	struct device *dev = cfg->parent;
-+	resource_size_t csr_base;
-+
-+	xgene_root = devm_kzalloc(dev, sizeof(*xgene_root), GFP_KERNEL);
-+	if (!xgene_root)
-+		return -ENOMEM;
-+
-+	switch (cfg->res.start) {
-+	case 0xC0D0000000ULL:
-+		csr_base = 0x1F2B0000;
-+		break;
-+	case 0xA0D0000000ULL:
-+		csr_base = 0x1F2C0000;
-+		break;
-+	default:
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->csr_base = ioremap(csr_base, XGENE_CSR_LENGTH);
-+	if (!xgene_root->csr_base) {
-+		kfree(xgene_root);
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->version = XGENE_PCIE_IP_VER_2;
-+
-+	cfg->priv = xgene_root;
-+
-+	return 0;
-+}
-+
-+static int xgene_v2_2_pcie_ecam_init(struct pci_config_window *cfg)
-+{
-+	struct xgene_pcie_acpi_root *xgene_root;
-+	struct device *dev = cfg->parent;
-+	resource_size_t csr_base;
-+
-+	xgene_root = devm_kzalloc(dev, sizeof(*xgene_root), GFP_KERNEL);
-+	if (!xgene_root)
-+		return -ENOMEM;
-+
-+	switch (cfg->res.start) {
-+	case 0xE0D0000000ULL:
-+		csr_base = 0x1F2B0000;
-+		break;
-+	case 0xA0D0000000ULL:
-+		csr_base = 0x1F500000;
-+		break;
-+	case 0x90D0000000ULL:
-+		csr_base = 0x1F2D0000;
-+		break;
-+	default:
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->csr_base = ioremap(csr_base, XGENE_CSR_LENGTH);
-+	if (!xgene_root->csr_base) {
-+		kfree(xgene_root);
-+		return -ENODEV;
-+	}
-+
-+	xgene_root->version = XGENE_PCIE_IP_VER_2;
-+
-+	cfg->priv = xgene_root;
-+
-+	return 0;
-+}
-+/*
-+ * For Configuration request, RTDID register is used as Bus Number,
-+ * Device Number and Function number of the header fields.
-+ */
-+static void xgene_pcie_set_rtdid_reg(struct pci_bus *bus, uint devfn)
-+{
-+	struct pci_config_window *cfg = bus->sysdata;
-+	struct xgene_pcie_acpi_root *port = cfg->priv;
-+	unsigned int b, d, f;
-+	u32 rtdid_val = 0;
-+
-+	b = bus->number;
-+	d = PCI_SLOT(devfn);
-+	f = PCI_FUNC(devfn);
-+
-+	if (!pci_is_root_bus(bus))
-+		rtdid_val = (b << 8) | (d << 3) | f;
-+
-+	writel(rtdid_val, port->csr_base + RTDID);
-+	/* read the register back to ensure flush */
-+	readl(port->csr_base + RTDID);
-+}
-+
-+/*
-+ * X-Gene PCIe port uses BAR0-BAR1 of RC's configuration space as
-+ * the translation from PCI bus to native BUS.  Entire DDR region
-+ * is mapped into PCIe space using these registers, so it can be
-+ * reached by DMA from EP devices.  The BAR0/1 of bridge should be
-+ * hidden during enumeration to avoid the sizing and resource allocation
-+ * by PCIe core.
-+ */
-+static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
-+{
-+	if (pci_is_root_bus(bus) && ((offset == PCI_BASE_ADDRESS_0) ||
-+				     (offset == PCI_BASE_ADDRESS_1)))
-+		return true;
-+
-+	return false;
-+}
-+
-+void __iomem *xgene_pcie_ecam_map_bus(struct pci_bus *bus,
-+				      unsigned int devfn, int where)
-+{
-+	struct pci_config_window *cfg = bus->sysdata;
-+	unsigned int busn = bus->number;
-+	void __iomem *base;
-+
-+	if (busn < cfg->busr.start || busn > cfg->busr.end)
-+		return NULL;
-+
-+	if ((pci_is_root_bus(bus) && devfn != 0) ||
-+	    xgene_pcie_hide_rc_bars(bus, where))
-+		return NULL;
-+
-+	xgene_pcie_set_rtdid_reg(bus, devfn);
-+
-+	if (busn > cfg->busr.start)
-+		base = cfg->win + (1 << cfg->ops->bus_shift);
-+	else
-+		base = cfg->win;
-+
-+	return base + where;
-+}
-+
-+static int xgene_pcie_config_read32(struct pci_bus *bus, unsigned int devfn,
-+				    int where, int size, u32 *val)
-+{
-+	struct pci_config_window *cfg = bus->sysdata;
-+	struct xgene_pcie_acpi_root *port = cfg->priv;
-+
-+	if (pci_generic_config_read32(bus, devfn, where & ~0x3, 4, val) !=
-+	    PCIBIOS_SUCCESSFUL)
-+		return PCIBIOS_DEVICE_NOT_FOUND;
-+
-+	/*
-+	* The v1 controller has a bug in its Configuration Request
-+	* Retry Status (CRS) logic: when CRS is enabled and we read the
-+	* Vendor and Device ID of a non-existent device, the controller
-+	* fabricates return data of 0xFFFF0001 ("device exists but is not
-+	* ready") instead of 0xFFFFFFFF ("device does not exist").  This
-+	* causes the PCI core to retry the read until it times out.
-+	* Avoid this by not claiming to support CRS.
-+	*/
-+	if (pci_is_root_bus(bus) && (port->version == XGENE_PCIE_IP_VER_1) &&
-+	    ((where & ~0x3) == ROOT_CAP_AND_CTRL))
-+		*val &= ~(PCI_EXP_RTCAP_CRSVIS << 16);
-+
-+	if (size <= 2)
-+		*val = (*val >> (8 * (where & 3))) & ((1 << (size * 8)) - 1);
-+
-+	return PCIBIOS_SUCCESSFUL;
-+}
-+
-+struct pci_ecam_ops xgene_v1_pcie_ecam_ops = {
-+	.bus_shift	= 16,
-+	.init		= xgene_v1_pcie_ecam_init,
-+	.pci_ops	= {
-+		.map_bus	= xgene_pcie_ecam_map_bus,
-+		.read		= xgene_pcie_config_read32,
-+		.write		= pci_generic_config_write,
-+	}
-+};
-+
-+struct pci_ecam_ops xgene_v2_1_pcie_ecam_ops = {
-+	.bus_shift	= 16,
-+	.init		= xgene_v2_1_pcie_ecam_init,
-+	.pci_ops	= {
-+		.map_bus	= xgene_pcie_ecam_map_bus,
-+		.read		= xgene_pcie_config_read32,
-+		.write		= pci_generic_config_write,
-+	}
-+};
-+
-+struct pci_ecam_ops xgene_v2_2_pcie_ecam_ops = {
-+	.bus_shift	= 16,
-+	.init		= xgene_v2_2_pcie_ecam_init,
-+	.pci_ops	= {
-+		.map_bus	= xgene_pcie_ecam_map_bus,
-+		.read		= xgene_pcie_config_read32,
-+		.write		= pci_generic_config_write,
-+	}
-+};
-+#endif
-diff --git a/include/linux/pci-ecam.h b/include/linux/pci-ecam.h
-index 35f0e81..40da3e7 100644
---- a/include/linux/pci-ecam.h
-+++ b/include/linux/pci-ecam.h
-@@ -65,6 +65,11 @@ extern struct pci_ecam_ops pci_thunder_pem_ops;
- #ifdef CONFIG_PCI_HOST_THUNDER_ECAM
- extern struct pci_ecam_ops pci_thunder_ecam_ops;
- #endif
-+#ifdef CONFIG_PCI_XGENE
-+extern struct pci_ecam_ops xgene_v1_pcie_ecam_ops;
-+extern struct pci_ecam_ops xgene_v2_1_pcie_ecam_ops;
-+extern struct pci_ecam_ops xgene_v2_2_pcie_ecam_ops;
-+#endif
- 
- #ifdef CONFIG_PCI_HOST_GENERIC
- /* for DT-based PCI controllers that support ECAM */
--- 
-2.9.3
-

arm64-xgene-acpi-fix.patch

@@ -0,0 +1,38 @@
+From bdb9458a3382ba745a66be5526d3899103c76eda Mon Sep 17 00:00:00 2001
+From: Loc Ho <lho@apm.com>
+Date: Fri, 21 Jul 2017 11:24:37 -0700
+Subject: ACPI: APEI: Enable APEI multiple GHES source to share a single
+ external IRQ
+
+X-Gene platforms describe multiple GHES error sources with the same
+hardware error notification type (external interrupt) and interrupt
+number.
+
+Change the GHES interrupt request to support sharing the same IRQ.
+
+This change includs contributions from Tuan Phan <tphan@apm.com>.
+
+Signed-off-by: Loc Ho <lho@apm.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+---
+ drivers/acpi/apei/ghes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index d661d45..eed09fc 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1157,7 +1157,8 @@ static int ghes_probe(struct platform_device *ghes_dev)
+ 			       generic->header.source_id);
+ 			goto err_edac_unreg;
+ 		}
+-		rc = request_irq(ghes->irq, ghes_irq_func, 0, "GHES IRQ", ghes);
++		rc = request_irq(ghes->irq, ghes_irq_func, IRQF_SHARED,
++				 "GHES IRQ", ghes);
+ 		if (rc) {
+ 			pr_err(GHES_PFX "Failed to register IRQ for generic hardware error source: %d\n",
+ 			       generic->header.source_id);
+-- 
+cgit v1.1
+

asus-wmi-Restrict-debugfs-interface-when-module-load.patch

@@ -1,54 +0,0 @@
-From 32f701d40657cc3c982b8cba4bf73452ccdd6697 Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Mar 2012 08:46:50 -0500
-Subject: [PATCH 05/20] asus-wmi: Restrict debugfs interface when module
- loading is restricted
-
-We have no way of validating what all of the Asus WMI methods do on a
-given machine, and there's a risk that some will allow hardware state to
-be manipulated in such a way that arbitrary code can be executed in the
-kernel, circumventing module loading restrictions. Prevent that if any of
-these features are enabled.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- drivers/platform/x86/asus-wmi.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
-index efbc3f0c592b..071171be4b7f 100644
---- a/drivers/platform/x86/asus-wmi.c
-+++ b/drivers/platform/x86/asus-wmi.c
-@@ -1868,6 +1868,9 @@ static int show_dsts(struct seq_file *m, void *data)
- 	int err;
- 	u32 retval = -1;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval);
- 
- 	if (err < 0)
-@@ -1884,6 +1887,9 @@ static int show_devs(struct seq_file *m, void *data)
- 	int err;
- 	u32 retval = -1;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param,
- 				    &retval);
- 
-@@ -1908,6 +1914,9 @@ static int show_call(struct seq_file *m, void *data)
- 	union acpi_object *obj;
- 	acpi_status status;
- 
-+	if (secure_modules())
-+		return -EPERM;
-+
- 	status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID,
- 				     1, asus->debug.method_id,
- 				     &input, &output);
--- 
-2.4.3
-

baseconfig/CONFIG_60XX_WDT

@@ -0,0 +1 @@
+# CONFIG_60XX_WDT is not set

baseconfig/CONFIG_6LOWPAN

@@ -0,0 +1 @@
+CONFIG_6LOWPAN=m

baseconfig/CONFIG_6LOWPAN_DEBUGFS

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_DEBUGFS=y

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_DEST

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_HOP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m

baseconfig/CONFIG_6LOWPAN_GHC_ICMPV6

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_ICMPV6=m

baseconfig/CONFIG_6LOWPAN_GHC_UDP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_UDP=m

baseconfig/CONFIG_6LOWPAN_NHC

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC=m

baseconfig/CONFIG_6LOWPAN_NHC_DEST

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_DEST=m

baseconfig/CONFIG_6LOWPAN_NHC_FRAGMENT

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_FRAGMENT=m

baseconfig/CONFIG_6LOWPAN_NHC_HOP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_HOP=m

baseconfig/CONFIG_6LOWPAN_NHC_IPV6

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_IPV6=m

baseconfig/CONFIG_6LOWPAN_NHC_MOBILITY

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_MOBILITY=m

baseconfig/CONFIG_6LOWPAN_NHC_ROUTING

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_ROUTING=m

baseconfig/CONFIG_6LOWPAN_NHC_UDP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_UDP=m

baseconfig/CONFIG_6PACK

@@ -0,0 +1 @@
+CONFIG_6PACK=m

baseconfig/CONFIG_8139CP

@@ -0,0 +1 @@
+CONFIG_8139CP=m

baseconfig/CONFIG_8139TOO

@@ -0,0 +1 @@
+CONFIG_8139TOO=m

baseconfig/CONFIG_8139TOO_8129

@@ -0,0 +1 @@
+CONFIG_8139TOO_8129=y

baseconfig/CONFIG_8139TOO_PIO

@@ -0,0 +1 @@
+# CONFIG_8139TOO_PIO is not set

baseconfig/CONFIG_8139TOO_TUNE_TWISTER

@@ -0,0 +1 @@
+# CONFIG_8139TOO_TUNE_TWISTER is not set

baseconfig/CONFIG_8139_OLD_RX_RESET

@@ -0,0 +1 @@
+# CONFIG_8139_OLD_RX_RESET is not set

baseconfig/CONFIG_8723AU_AP_MODE

@@ -0,0 +1 @@
+# CONFIG_8723AU_AP_MODE is not set

baseconfig/CONFIG_8723AU_BT_COEXIST

@@ -0,0 +1 @@
+# CONFIG_8723AU_BT_COEXIST is not set

baseconfig/CONFIG_9P_FS

@@ -0,0 +1 @@
+CONFIG_9P_FS=m

baseconfig/CONFIG_9P_FSCACHE

@@ -0,0 +1 @@
+CONFIG_9P_FSCACHE=y

baseconfig/CONFIG_9P_FS_POSIX_ACL

@@ -0,0 +1 @@
+CONFIG_9P_FS_POSIX_ACL=y

baseconfig/CONFIG_9P_FS_SECURITY

@@ -0,0 +1 @@
+CONFIG_9P_FS_SECURITY=y

baseconfig/CONFIG_A11Y_BRAILLE_CONSOLE

@@ -0,0 +1 @@
+CONFIG_A11Y_BRAILLE_CONSOLE=y

baseconfig/CONFIG_AB3100_CORE

@@ -0,0 +1 @@
+# CONFIG_AB3100_CORE is not set