Fix CVE-2017-1000405 (rhbz 1516514 1519115)

Originally from Ido Schimmel <idosch@mellanox.com>

.gitignore

@@ -1,2 +1,7 @@
+clog
 *.xz
 *.bz2
+*.rpm
+*.orig
+kernel-[234].*/
+perf-man-*.tar.gz

0001-Input-gpio_keys-Allow-suppression-of-input-events-fo.patch

@@ -0,0 +1,163 @@
+From 25bb14c1e78e641049fd1ee0c404a9ccd2755e44 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 22 Jul 2017 13:00:05 +0200
+Subject: [PATCH 1/2] Input: gpio_keys - Allow suppression of input events for
+ wakeup button presses
+
+In some cases it is undesirable for a wakeup button to send input events
+to userspace if pressed to wakeup the system (if pressed during suspend).
+
+A typical example of this is the power-button on laptops / tablets,
+sending a KEY_POWER event to userspace when woken up with the power-button
+will cause userspace to immediately suspend the system again which is
+undesirable.
+
+For power-buttons attached to a PMIC, or handled by e.g. ACPI, not sending
+an input event in this case is take care of by the PMIC / ACPI hardware /
+code. But in the case of a GPIO button we need to explicitly suppress the
+sending of the input event.
+
+This commit adds support for this by adding a no_wakeup_events bool to
+struct gpio_keys_button, which platform code can set to suppress the
+input events for presses of wakeup keys during suspend.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-This is a rewrite if my "Input: gpio_keys - Do not report wake button
+ presses as evdev events" patch.
+-Instead of unconditionally ignoring presses of all wake-up buttons during
+ suspend, this rewrite makes this configurable per button
+-This version uses a timer to delay clearing the suspended flag for software
+ debouncing, rather then jiffy compare magic
+---
+ drivers/input/keyboard/gpio_keys.c | 33 +++++++++++++++++++++++++++++++--
+ include/linux/gpio_keys.h          |  3 +++
+ 2 files changed, 34 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
+index a047b9af8369..fa3a58620407 100644
+--- a/drivers/input/keyboard/gpio_keys.c
++++ b/drivers/input/keyboard/gpio_keys.c
+@@ -38,6 +38,7 @@ struct gpio_button_data {
+ 
+ 	unsigned short *code;
+ 
++	struct timer_list unsuspend_timer;
+ 	struct timer_list release_timer;
+ 	unsigned int release_delay;	/* in msecs, for IRQ-only buttons */
+ 
+@@ -371,6 +372,9 @@ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ 		return;
+ 	}
+ 
++	if (state && bdata->button->no_wakeup_events && bdata->suspended)
++		return;
++
+ 	if (type == EV_ABS) {
+ 		if (state)
+ 			input_event(input, type, button->code, button->value);
+@@ -400,6 +404,9 @@ static irqreturn_t gpio_keys_gpio_isr(int irq, void *dev_id)
+ 	if (bdata->button->wakeup) {
+ 		const struct gpio_keys_button *button = bdata->button;
+ 
++		if (bdata->button->no_wakeup_events && bdata->suspended)
++			return IRQ_HANDLED;
++
+ 		pm_stay_awake(bdata->input->dev.parent);
+ 		if (bdata->suspended  &&
+ 		    (button->type == 0 || button->type == EV_KEY)) {
+@@ -445,9 +452,13 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 	spin_lock_irqsave(&bdata->lock, flags);
+ 
+ 	if (!bdata->key_pressed) {
+-		if (bdata->button->wakeup)
++		if (bdata->button->wakeup) {
+ 			pm_wakeup_event(bdata->input->dev.parent, 0);
+ 
++			if (bdata->button->no_wakeup_events && bdata->suspended)
++				goto out;
++		}
++
+ 		input_event(input, EV_KEY, *bdata->code, 1);
+ 		input_sync(input);
+ 
+@@ -468,6 +479,13 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
++static void gpio_keys_unsuspend_timer(unsigned long _data)
++{
++	struct gpio_button_data *bdata = (struct gpio_button_data *)_data;
++
++	bdata->suspended = false;
++}
++
+ static void gpio_keys_quiesce_key(void *data)
+ {
+ 	struct gpio_button_data *bdata = data;
+@@ -476,6 +494,8 @@ static void gpio_keys_quiesce_key(void *data)
+ 		cancel_delayed_work_sync(&bdata->work);
+ 	else
+ 		del_timer_sync(&bdata->release_timer);
++
++	del_timer_sync(&bdata->unsuspend_timer);
+ }
+ 
+ static int gpio_keys_setup_key(struct platform_device *pdev,
+@@ -496,6 +516,8 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
+ 	bdata->input = input;
+ 	bdata->button = button;
+ 	spin_lock_init(&bdata->lock);
++	setup_timer(&bdata->unsuspend_timer, gpio_keys_unsuspend_timer,
++		    (unsigned long)bdata);
+ 
+ 	if (child) {
+ 		bdata->gpiod = devm_fwnode_get_gpiod_from_child(dev, NULL,
+@@ -868,6 +890,7 @@ static int __maybe_unused gpio_keys_suspend(struct device *dev)
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+ 			if (bdata->button->wakeup)
+ 				enable_irq_wake(bdata->irq);
++			del_timer_sync(&bdata->unsuspend_timer);
+ 			bdata->suspended = true;
+ 		}
+ 	} else {
+@@ -892,7 +915,13 @@ static int __maybe_unused gpio_keys_resume(struct device *dev)
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+ 			if (bdata->button->wakeup)
+ 				disable_irq_wake(bdata->irq);
+-			bdata->suspended = false;
++			if (bdata->button->no_wakeup_events) {
++				mod_timer(&bdata->unsuspend_timer, jiffies +
++					  msecs_to_jiffies(
++						    bdata->software_debounce));
++			} else {
++				bdata->suspended = false;
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+diff --git a/include/linux/gpio_keys.h b/include/linux/gpio_keys.h
+index 0b71024c082c..d8a85e52b6bb 100644
+--- a/include/linux/gpio_keys.h
++++ b/include/linux/gpio_keys.h
+@@ -15,6 +15,8 @@ struct device;
+  * @debounce_interval:	debounce ticks interval in msecs
+  * @can_disable:	%true indicates that userspace is allowed to
+  *			disable button via sysfs
++ * @no_wakeup_events:	For wake-up source buttons only, if %true then no input
++ *			events will be generated if pressed while suspended
+  * @value:		axis value for %EV_ABS
+  * @irq:		Irq number in case of interrupt keys
+  */
+@@ -27,6 +29,7 @@ struct gpio_keys_button {
+ 	int wakeup;
+ 	int debounce_interval;
+ 	bool can_disable;
++	bool no_wakeup_events;
+ 	int value;
+ 	unsigned int irq;
+ };
+-- 
+2.13.4
+

0001-fs-locks-Remove-fl_nspid-and-use-fs-specific-l_pid-f.patch

@@ -0,0 +1,296 @@
+From 9d5b86ac13c573795525ecac6ed2db39ab23e2a8 Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Sun, 16 Jul 2017 10:28:22 -0400
+Subject: [PATCH] fs/locks: Remove fl_nspid and use fs-specific l_pid for
+ remote locks
+
+Since commit c69899a17ca4 "NFSv4: Update of VFS byte range lock must be
+atomic with the stateid update", NFSv4 has been inserting locks in rpciod
+worker context.  The result is that the file_lock's fl_nspid is the
+kworker's pid instead of the original userspace pid.
+
+The fl_nspid is only used to represent the namespaced virtual pid number
+when displaying locks or returning from F_GETLK.  There's no reason to set
+it for every inserted lock, since we can usually just look it up from
+fl_pid.  So, instead of looking up and holding struct pid for every lock,
+let's just look up the virtual pid number from fl_pid when it is needed.
+That means we can remove fl_nspid entirely.
+
+The translaton and presentation of fl_pid should handle the following four
+cases:
+
+1 - F_GETLK on a remote file with a remote lock:
+    In this case, the filesystem should determine the l_pid to return here.
+    Filesystems should indicate that the fl_pid represents a non-local pid
+    value that should not be translated by returning an fl_pid <= 0.
+
+2 - F_GETLK on a local file with a remote lock:
+    This should be the l_pid of the lock manager process, and translated.
+
+3 - F_GETLK on a remote file with a local lock, and
+4 - F_GETLK on a local file with a local lock:
+    These should be the translated l_pid of the local locking process.
+
+Fuse was already doing the correct thing by translating the pid into the
+caller's namespace.  With this change we must update fuse to translate
+to init's pid namespace, so that the locks API can then translate from
+init's pid namespace into the pid namespace of the caller.
+
+With this change, the locks API will expect that if a filesystem returns
+a remote pid as opposed to a local pid for F_GETLK, that remote pid will
+be <= 0.  This signifies that the pid is remote, and the locks API will
+forego translating that pid into the pid namespace of the local calling
+process.
+
+Finally, we convert remote filesystems to present remote pids using
+negative numbers. Have lustre, 9p, ceph, cifs, and dlm negate the remote
+pid returned for F_GETLK lock requests.
+
+Since local pids will never be larger than PID_MAX_LIMIT (which is
+currently defined as <= 4 million), but pid_t is an unsigned int, we
+should have plenty of room to represent remote pids with negative
+numbers if we assume that remote pid numbers are similarly limited.
+
+If this is not the case, then we run the risk of having a remote pid
+returned for which there is also a corresponding local pid.  This is a
+problem we have now, but this patch should reduce the chances of that
+occurring, while also returning those remote pid numbers, for whatever
+that may be worth.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+---
+ drivers/staging/lustre/lustre/ldlm/ldlm_flock.c |  2 +-
+ fs/9p/vfs_file.c                                |  2 +-
+ fs/ceph/locks.c                                 |  2 +-
+ fs/cifs/cifssmb.c                               |  2 +-
+ fs/dlm/plock.c                                  |  2 +-
+ fs/fuse/file.c                                  |  6 +--
+ fs/locks.c                                      | 62 +++++++++++++++----------
+ include/linux/fs.h                              |  1 -
+ 8 files changed, 45 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
+index b7f28b39c7b3..abcbf075acc0 100644
+--- a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
+@@ -596,7 +596,7 @@ ldlm_flock_completion_ast(struct ldlm_lock *lock, __u64 flags, void *data)
+ 		default:
+ 			getlk->fl_type = F_UNLCK;
+ 		}
+-		getlk->fl_pid = (pid_t)lock->l_policy_data.l_flock.pid;
++		getlk->fl_pid = -(pid_t)lock->l_policy_data.l_flock.pid;
+ 		getlk->fl_start = (loff_t)lock->l_policy_data.l_flock.start;
+ 		getlk->fl_end = (loff_t)lock->l_policy_data.l_flock.end;
+ 	} else {
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 3de3b4a89d89..43c242e17132 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -288,7 +288,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+ 			fl->fl_end = OFFSET_MAX;
+ 		else
+ 			fl->fl_end = glock.start + glock.length - 1;
+-		fl->fl_pid = glock.proc_id;
++		fl->fl_pid = -glock.proc_id;
+ 	}
+ 	kfree(glock.client_id);
+ 	return res;
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 64ae74472046..8cd63e8123d8 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -79,7 +79,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct file *file,
+ 	err = ceph_mdsc_do_request(mdsc, inode, req);
+ 
+ 	if (operation == CEPH_MDS_OP_GETFILELOCK) {
+-		fl->fl_pid = le64_to_cpu(req->r_reply_info.filelock_reply->pid);
++		fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
+ 		if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
+ 			fl->fl_type = F_RDLCK;
+ 		else if (CEPH_LOCK_EXCL == req->r_reply_info.filelock_reply->type)
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 72a53bd19865..118a63e7e221 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2522,7 +2522,7 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon,
+ 			pLockData->fl_start = le64_to_cpu(parm_data->start);
+ 			pLockData->fl_end = pLockData->fl_start +
+ 					le64_to_cpu(parm_data->length) - 1;
+-			pLockData->fl_pid = le32_to_cpu(parm_data->pid);
++			pLockData->fl_pid = -le32_to_cpu(parm_data->pid);
+ 		}
+ 	}
+ 
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index d401425f602a..e631b1689228 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -367,7 +367,7 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ 		locks_init_lock(fl);
+ 		fl->fl_type = (op->info.ex) ? F_WRLCK : F_RDLCK;
+ 		fl->fl_flags = FL_POSIX;
+-		fl->fl_pid = op->info.pid;
++		fl->fl_pid = -op->info.pid;
+ 		fl->fl_start = op->info.start;
+ 		fl->fl_end = op->info.end;
+ 		rv = 0;
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 3ee4fdc3da9e..7cd692f51d1d 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2101,11 +2101,11 @@ static int convert_fuse_file_lock(struct fuse_conn *fc,
+ 		fl->fl_end = ffl->end;
+ 
+ 		/*
+-		 * Convert pid into the caller's pid namespace. If the pid
+-		 * does not map into the namespace fl_pid will get set to 0.
++		 * Convert pid into init's pid namespace.  The locks API will
++		 * translate it into the caller's pid namespace.
+ 		 */
+ 		rcu_read_lock();
+-		fl->fl_pid = pid_vnr(find_pid_ns(ffl->pid, fc->pid_ns));
++		fl->fl_pid = pid_nr_ns(find_pid_ns(ffl->pid, fc->pid_ns), &init_pid_ns);
+ 		rcu_read_unlock();
+ 		break;
+ 
+diff --git a/fs/locks.c b/fs/locks.c
+index d7daa6c8932f..6d0949880ebd 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -137,6 +137,7 @@
+ #define IS_FLOCK(fl)	(fl->fl_flags & FL_FLOCK)
+ #define IS_LEASE(fl)	(fl->fl_flags & (FL_LEASE|FL_DELEG|FL_LAYOUT))
+ #define IS_OFDLCK(fl)	(fl->fl_flags & FL_OFDLCK)
++#define IS_REMOTELCK(fl)	(fl->fl_pid <= 0)
+ 
+ static inline bool is_remote_lock(struct file *filp)
+ {
+@@ -733,7 +734,6 @@ static void locks_wake_up_blocks(struct file_lock *blocker)
+ static void
+ locks_insert_lock_ctx(struct file_lock *fl, struct list_head *before)
+ {
+-	fl->fl_nspid = get_pid(task_tgid(current));
+ 	list_add_tail(&fl->fl_list, before);
+ 	locks_insert_global_locks(fl);
+ }
+@@ -743,10 +743,6 @@ locks_unlink_lock_ctx(struct file_lock *fl)
+ {
+ 	locks_delete_global_locks(fl);
+ 	list_del_init(&fl->fl_list);
+-	if (fl->fl_nspid) {
+-		put_pid(fl->fl_nspid);
+-		fl->fl_nspid = NULL;
+-	}
+ 	locks_wake_up_blocks(fl);
+ }
+ 
+@@ -823,8 +819,6 @@ posix_test_lock(struct file *filp, struct file_lock *fl)
+ 	list_for_each_entry(cfl, &ctx->flc_posix, fl_list) {
+ 		if (posix_locks_conflict(fl, cfl)) {
+ 			locks_copy_conflock(fl, cfl);
+-			if (cfl->fl_nspid)
+-				fl->fl_pid = pid_vnr(cfl->fl_nspid);
+ 			goto out;
+ 		}
+ 	}
+@@ -2048,9 +2042,33 @@ int vfs_test_lock(struct file *filp, struct file_lock *fl)
+ }
+ EXPORT_SYMBOL_GPL(vfs_test_lock);
+ 
++/**
++ * locks_translate_pid - translate a file_lock's fl_pid number into a namespace
++ * @fl: The file_lock who's fl_pid should be translated
++ * @ns: The namespace into which the pid should be translated
++ *
++ * Used to tranlate a fl_pid into a namespace virtual pid number
++ */
++static pid_t locks_translate_pid(struct file_lock *fl, struct pid_namespace *ns)
++{
++	pid_t vnr;
++	struct pid *pid;
++
++	if (IS_OFDLCK(fl))
++		return -1;
++	if (IS_REMOTELCK(fl))
++		return fl->fl_pid;
++
++	rcu_read_lock();
++	pid = find_pid_ns(fl->fl_pid, &init_pid_ns);
++	vnr = pid_nr_ns(pid, ns);
++	rcu_read_unlock();
++	return vnr;
++}
++
+ static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
+ {
+-	flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
++	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
+ #if BITS_PER_LONG == 32
+ 	/*
+ 	 * Make sure we can represent the posix lock via
+@@ -2072,7 +2090,7 @@ static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
+ #if BITS_PER_LONG == 32
+ static void posix_lock_to_flock64(struct flock64 *flock, struct file_lock *fl)
+ {
+-	flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
++	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
+ 	flock->l_start = fl->fl_start;
+ 	flock->l_len = fl->fl_end == OFFSET_MAX ? 0 :
+ 		fl->fl_end - fl->fl_start + 1;
+@@ -2584,22 +2602,16 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
+ {
+ 	struct inode *inode = NULL;
+ 	unsigned int fl_pid;
++	struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
+ 
+-	if (fl->fl_nspid) {
+-		struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
+-
+-		/* Don't let fl_pid change based on who is reading the file */
+-		fl_pid = pid_nr_ns(fl->fl_nspid, proc_pidns);
+-
+-		/*
+-		 * If there isn't a fl_pid don't display who is waiting on
+-		 * the lock if we are called from locks_show, or if we are
+-		 * called from __show_fd_info - skip lock entirely
+-		 */
+-		if (fl_pid == 0)
+-			return;
+-	} else
+-		fl_pid = fl->fl_pid;
++	fl_pid = locks_translate_pid(fl, proc_pidns);
++	/*
++	 * If there isn't a fl_pid don't display who is waiting on
++	 * the lock if we are called from locks_show, or if we are
++	 * called from __show_fd_info - skip lock entirely
++	 */
++	if (fl_pid == 0)
++		return;
+ 
+ 	if (fl->fl_file != NULL)
+ 		inode = locks_inode(fl->fl_file);
+@@ -2674,7 +2686,7 @@ static int locks_show(struct seq_file *f, void *v)
+ 
+ 	fl = hlist_entry(v, struct file_lock, fl_link);
+ 
+-	if (fl->fl_nspid && !pid_nr_ns(fl->fl_nspid, proc_pidns))
++	if (locks_translate_pid(fl, proc_pidns) == 0)
+ 		return 0;
+ 
+ 	lock_get_status(f, fl, iter->li_pos, "");
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 7b5d6816542b..f0b108af9b02 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -999,7 +999,6 @@ struct file_lock {
+ 	unsigned char fl_type;
+ 	unsigned int fl_pid;
+ 	int fl_link_cpu;		/* what cpu's list is this on? */
+-	struct pid *fl_nspid;
+ 	wait_queue_head_t fl_wait;
+ 	struct file *fl_file;
+ 	loff_t fl_start;
+-- 
+2.14.1
+

0001-iio-Use-event-header-from-kernel-tree.patch

@@ -0,0 +1,64 @@
+From 0eadbb65c0026fb4eec89c54f6b48a0febd87f92 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 9 Sep 2016 08:19:17 -0700
+Subject: [PATCH] iio: Use type header from kernel tree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+To: Jonathan Cameron <jic23@kernel.org>
+To: Hartmut Knaack <knaack.h@gmx.de>
+To: Lars-Peter Clausen <lars@metafoo.de>
+To: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
+Cc: linux-iio@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+
+
+The iio tools have been updated as new event types have been added to
+the kernel. The tools currently use the standard system headers which
+means that the system may not have the newest defintitions. This leads
+to build failures when building newer tools on older hosts:
+
+gcc -Wall -g -D_GNU_SOURCE   -c -o iio_event_monitor.o
+iio_event_monitor.c
+iio_event_monitor.c:59:3: error: ‘IIO_UVINDEX’ undeclared here (not in a
+function)
+  [IIO_UVINDEX] = "uvindex",
+   ^~~~~~~~~~~
+iio_event_monitor.c:59:3: error: array index in initializer not of
+integer type
+iio_event_monitor.c:59:3: note: (near initialization for
+‘iio_chan_type_name_spec’)
+iio_event_monitor.c:97:3: error: ‘IIO_MOD_LIGHT_UV’ undeclared here (not
+in a function)
+  [IIO_MOD_LIGHT_UV] = "uv",
+   ^~~~~~~~~~~~~~~~
+iio_event_monitor.c:97:3: error: array index in initializer not of
+integer type
+iio_event_monitor.c:97:3: note: (near initialization for
+‘iio_modifier_names’)
+<builtin>: recipe for target 'iio_event_monitor.o' failed
+
+Switch to using the header from the kernel tree to ensure the newest
+defintions are always picked up.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+---
+ tools/iio/iio_event_monitor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/iio/iio_event_monitor.c b/tools/iio/iio_event_monitor.c
+index d9b7e0f..f02523d 100644
+--- a/tools/iio/iio_event_monitor.c
++++ b/tools/iio/iio_event_monitor.c
+@@ -26,7 +26,7 @@
+ #include <sys/ioctl.h>
+ #include "iio_utils.h"
+ #include <linux/iio/events.h>
+-#include <linux/iio/types.h>
++#include "../../include/uapi/linux/iio/types.h"
+ 
+ static const char * const iio_chan_type_name_spec[] = {
+ 	[IIO_VOLTAGE] = "voltage",
+-- 
+2.7.4
+

0001-mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch

@@ -0,0 +1,108 @@
+From a8f97366452ed491d13cf1e44241bc0b5740b1f0 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Mon, 27 Nov 2017 06:21:25 +0300
+Subject: [PATCH] mm, thp: Do not make page table dirty unconditionally in
+ touch_p[mu]d()
+
+Currently, we unconditionally make page table dirty in touch_pmd().
+It may result in false-positive can_follow_write_pmd().
+
+We may avoid the situation, if we would only make the page table entry
+dirty if caller asks for write access -- FOLL_WRITE.
+
+The patch also changes touch_pud() in the same way.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ mm/huge_memory.c | 36 +++++++++++++-----------------------
+ 1 file changed, 13 insertions(+), 23 deletions(-)
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 86fe697e8bfb..0e7ded98d114 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -842,20 +842,15 @@ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pud);
+ #endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */
+
+ static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
+-		pmd_t *pmd)
++		pmd_t *pmd, int flags)
+ {
+ 	pmd_t _pmd;
+
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pmd is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pmd to
+-	 * set the young bit, instead of the current set_pmd_at.
+-	 */
+-	_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
++	_pmd = pmd_mkyoung(*pmd);
++	if (flags & FOLL_WRITE)
++		_pmd = pmd_mkdirty(_pmd);
+ 	if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
+-				pmd, _pmd,  1))
++				pmd, _pmd, flags & FOLL_WRITE))
+ 		update_mmu_cache_pmd(vma, addr, pmd);
+ }
+
+@@ -884,7 +879,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -995,20 +990,15 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+
+ #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+ static void touch_pud(struct vm_area_struct *vma, unsigned long addr,
+-		pud_t *pud)
++		pud_t *pud, int flags)
+ {
+ 	pud_t _pud;
+
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pud is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pud to
+-	 * set the young bit, instead of the current set_pud_at.
+-	 */
+-	_pud = pud_mkyoung(pud_mkdirty(*pud));
++	_pud = pud_mkyoung(*pud);
++	if (flags & FOLL_WRITE)
++		_pud = pud_mkdirty(_pud);
+ 	if (pudp_set_access_flags(vma, addr & HPAGE_PUD_MASK,
+-				pud, _pud,  1))
++				pud, _pud, flags & FOLL_WRITE))
+ 		update_mmu_cache_pud(vma, addr, pud);
+ }
+
+@@ -1031,7 +1021,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+
+ 	if (flags & FOLL_TOUCH)
+-		touch_pud(vma, addr, pud);
++		touch_pud(vma, addr, pud, flags);
+
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -1424,7 +1414,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
+ 	page = pmd_page(*pmd);
+ 	VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
+ 		/*
+ 		 * We don't mlock() pte-mapped THPs. This way we can avoid
+-- 
+2.14.3
+

0001-platform-x86-Add-driver-for-ACPI-INT0002-Virtual-GPI.patch

@@ -0,0 +1,339 @@
+From 3bbfe49a1d965b951527cde0da48f5d7677db264 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 21 May 2017 13:15:11 +0200
+Subject: [PATCH 01/16] platform/x86: Add driver for ACPI INT0002 Virtual GPIO
+ device
+
+Some peripherals on Bay Trail and Cherry Trail platforms signal a
+Power Management Event (PME) to the Power Management Controller (PMC)
+to wakeup the system. When this happens software needs to explicitly
+clear the PME bus 0 status bit in the GPE0a_STS register to avoid an
+IRQ storm on IRQ 9.
+
+This is modelled in ACPI through the INT0002 ACPI device, which is
+called a "Virtual GPIO controller" in ACPI because it defines the
+event handler to call when the PME triggers through _AEI and _L02
+methods as would be done for a real GPIO interrupt in ACPI.
+
+This commit adds a driver which registers the Virtual GPIOs expected
+by the DSDT on these devices, letting gpiolib-acpi claim the
+virtual GPIO and install a GPIO-interrupt handler which call the _L02
+handler as it would for a real GPIO controller.
+
+Cc: joeyli <jlee@suse.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+---
+Changes in v2:
+-Remove dev_err after malloc failure
+-Remove unused empty runtime pm callbacks
+-s/GPE0A_PME_/GPE0A_PME_B0_/
+-Fixed some checkpatch warnings (I forgot to run checkpatch on v1)
+
+Changes in v3:
+-Rewrite as gpiochip driver letting gpiolib-acpi deal with claiming the pin
+ 0x0002 and calling the _L02 event handler when the virtual gpio-irq triggers
+-Rebase on 4.12-rc1
+
+Changes in v4:
+-Drop device_init_wakeup() from _probe(), use pm_system_wakeup() instead
+ of pm_wakeup_hard_event(chip->parent)
+-Improve commit message
+
+Changes in v5:
+-Use BIT() macro for FOO_BIT defines
+-Drop unneeded ACPI_PTR macro usage
+
+Changes in v6:
+-Move back to drivers/platform/x86
+-Expand certain acronyms (PME, PMC)
+-Use linux/gpio/driver.h include instead of linux/gpio.h
+-Document why the get / set / direction_output functions are dummys
+-No functional changes
+
+Changes in v7:
+-Some minor cleanups from Andy:
+ -Move asm/ includes below linux/ includes
+ -s/APCI/ACPI/
+ -Use bitmap_clear on chip->irq_valid_mask
+-Add Linus Walleij's Reviewed-by
+---
+ drivers/platform/x86/Kconfig               |  19 +++
+ drivers/platform/x86/Makefile              |   1 +
+ drivers/platform/x86/intel_int0002_vgpio.c | 219 +++++++++++++++++++++++++++++
+ 3 files changed, 239 insertions(+)
+ create mode 100644 drivers/platform/x86/intel_int0002_vgpio.c
+
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 8489020ecf44..a3ccc3c795a5 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -794,6 +794,25 @@ config INTEL_CHT_INT33FE
+ 	  This driver instantiates i2c-clients for these, so that standard
+ 	  i2c drivers for these chips can bind to the them.
+ 
++config INTEL_INT0002_VGPIO
++	tristate "Intel ACPI INT0002 Virtual GPIO driver"
++	depends on GPIOLIB && ACPI
++	select GPIOLIB_IRQCHIP
++	---help---
++	  Some peripherals on Bay Trail and Cherry Trail platforms signal a
++	  Power Management Event (PME) to the Power Management Controller (PMC)
++	  to wakeup the system. When this happens software needs to explicitly
++	  clear the PME bus 0 status bit in the GPE0a_STS register to avoid an
++	  IRQ storm on IRQ 9.
++
++	  This is modelled in ACPI through the INT0002 ACPI device, which is
++	  called a "Virtual GPIO controller" in ACPI because it defines the
++	  event handler to call when the PME triggers through _AEI and _L02
++	  methods as would be done for a real GPIO interrupt in ACPI.
++
++	  To compile this driver as a module, choose M here: the module will
++	  be called intel_int0002_vgpio.
++
+ config INTEL_HID_EVENT
+ 	tristate "INTEL HID Event"
+ 	depends on ACPI
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index 182a3ed6605a..ab22ce77fb66 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -46,6 +46,7 @@ obj-$(CONFIG_TOSHIBA_BT_RFKILL)	+= toshiba_bluetooth.o
+ obj-$(CONFIG_TOSHIBA_HAPS)	+= toshiba_haps.o
+ obj-$(CONFIG_TOSHIBA_WMI)	+= toshiba-wmi.o
+ obj-$(CONFIG_INTEL_CHT_INT33FE)	+= intel_cht_int33fe.o
++obj-$(CONFIG_INTEL_INT0002_VGPIO) += intel_int0002_vgpio.o
+ obj-$(CONFIG_INTEL_HID_EVENT)	+= intel-hid.o
+ obj-$(CONFIG_INTEL_VBTN)	+= intel-vbtn.o
+ obj-$(CONFIG_INTEL_SCU_IPC)	+= intel_scu_ipc.o
+diff --git a/drivers/platform/x86/intel_int0002_vgpio.c b/drivers/platform/x86/intel_int0002_vgpio.c
+new file mode 100644
+index 000000000000..92dc230ef5b2
+--- /dev/null
++++ b/drivers/platform/x86/intel_int0002_vgpio.c
+@@ -0,0 +1,219 @@
++/*
++ * Intel INT0002 "Virtual GPIO" driver
++ *
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Loosely based on android x86 kernel code which is:
++ *
++ * Copyright (c) 2014, Intel Corporation.
++ *
++ * Author: Dyut Kumar Sil <dyut.k.sil@intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * Some peripherals on Bay Trail and Cherry Trail platforms signal a Power
++ * Management Event (PME) to the Power Management Controller (PMC) to wakeup
++ * the system. When this happens software needs to clear the PME bus 0 status
++ * bit in the GPE0a_STS register to avoid an IRQ storm on IRQ 9.
++ *
++ * This is modelled in ACPI through the INT0002 ACPI device, which is
++ * called a "Virtual GPIO controller" in ACPI because it defines the event
++ * handler to call when the PME triggers through _AEI and _L02 / _E02
++ * methods as would be done for a real GPIO interrupt in ACPI. Note this
++ * is a hack to define an AML event handler for the PME while using existing
++ * ACPI mechanisms, this is not a real GPIO at all.
++ *
++ * This driver will bind to the INT0002 device, and register as a GPIO
++ * controller, letting gpiolib-acpi.c call the _L02 handler as it would
++ * for a real GPIO controller.
++ */
++
++#include <linux/acpi.h>
++#include <linux/bitmap.h>
++#include <linux/gpio/driver.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/suspend.h>
++
++#include <asm/cpu_device_id.h>
++#include <asm/intel-family.h>
++
++#define DRV_NAME			"INT0002 Virtual GPIO"
++
++/* For some reason the virtual GPIO pin tied to the GPE is numbered pin 2 */
++#define GPE0A_PME_B0_VIRT_GPIO_PIN	2
++
++#define GPE0A_PME_B0_STS_BIT		BIT(13)
++#define GPE0A_PME_B0_EN_BIT		BIT(13)
++#define GPE0A_STS_PORT			0x420
++#define GPE0A_EN_PORT			0x428
++
++#define ICPU(model)	{ X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
++
++static const struct x86_cpu_id int0002_cpu_ids[] = {
++/*
++ * Limit ourselves to Cherry Trail for now, until testing shows we
++ * need to handle the INT0002 device on Baytrail too.
++ *	ICPU(INTEL_FAM6_ATOM_SILVERMONT1),	 * Valleyview, Bay Trail *
++ */
++	ICPU(INTEL_FAM6_ATOM_AIRMONT),		/* Braswell, Cherry Trail */
++	{}
++};
++
++/*
++ * As this is not a real GPIO at all, but just a hack to model an event in
++ * ACPI the get / set functions are dummy functions.
++ */
++
++static int int0002_gpio_get(struct gpio_chip *chip, unsigned int offset)
++{
++	return 0;
++}
++
++static void int0002_gpio_set(struct gpio_chip *chip, unsigned int offset,
++			     int value)
++{
++}
++
++static int int0002_gpio_direction_output(struct gpio_chip *chip,
++					 unsigned int offset, int value)
++{
++	return 0;
++}
++
++static void int0002_irq_ack(struct irq_data *data)
++{
++	outl(GPE0A_PME_B0_STS_BIT, GPE0A_STS_PORT);
++}
++
++static void int0002_irq_unmask(struct irq_data *data)
++{
++	u32 gpe_en_reg;
++
++	gpe_en_reg = inl(GPE0A_EN_PORT);
++	gpe_en_reg |= GPE0A_PME_B0_EN_BIT;
++	outl(gpe_en_reg, GPE0A_EN_PORT);
++}
++
++static void int0002_irq_mask(struct irq_data *data)
++{
++	u32 gpe_en_reg;
++
++	gpe_en_reg = inl(GPE0A_EN_PORT);
++	gpe_en_reg &= ~GPE0A_PME_B0_EN_BIT;
++	outl(gpe_en_reg, GPE0A_EN_PORT);
++}
++
++static irqreturn_t int0002_irq(int irq, void *data)
++{
++	struct gpio_chip *chip = data;
++	u32 gpe_sts_reg;
++
++	gpe_sts_reg = inl(GPE0A_STS_PORT);
++	if (!(gpe_sts_reg & GPE0A_PME_B0_STS_BIT))
++		return IRQ_NONE;
++
++	generic_handle_irq(irq_find_mapping(chip->irqdomain,
++					    GPE0A_PME_B0_VIRT_GPIO_PIN));
++
++	pm_system_wakeup();
++
++	return IRQ_HANDLED;
++}
++
++static struct irq_chip int0002_irqchip = {
++	.name			= DRV_NAME,
++	.irq_ack		= int0002_irq_ack,
++	.irq_mask		= int0002_irq_mask,
++	.irq_unmask		= int0002_irq_unmask,
++};
++
++static int int0002_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct x86_cpu_id *cpu_id;
++	struct gpio_chip *chip;
++	int irq, ret;
++
++	/* Menlow has a different INT0002 device? <sigh> */
++	cpu_id = x86_match_cpu(int0002_cpu_ids);
++	if (!cpu_id)
++		return -ENODEV;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(dev, "Error getting IRQ: %d\n", irq);
++		return irq;
++	}
++
++	chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
++	if (!chip)
++		return -ENOMEM;
++
++	chip->label = DRV_NAME;
++	chip->parent = dev;
++	chip->owner = THIS_MODULE;
++	chip->get = int0002_gpio_get;
++	chip->set = int0002_gpio_set;
++	chip->direction_input = int0002_gpio_get;
++	chip->direction_output = int0002_gpio_direction_output;
++	chip->base = -1;
++	chip->ngpio = GPE0A_PME_B0_VIRT_GPIO_PIN + 1;
++	chip->irq_need_valid_mask = true;
++
++	ret = devm_gpiochip_add_data(&pdev->dev, chip, NULL);
++	if (ret) {
++		dev_err(dev, "Error adding gpio chip: %d\n", ret);
++		return ret;
++	}
++
++	bitmap_clear(chip->irq_valid_mask, 0, GPE0A_PME_B0_VIRT_GPIO_PIN);
++
++	/*
++	 * We manually request the irq here instead of passing a flow-handler
++	 * to gpiochip_set_chained_irqchip, because the irq is shared.
++	 */
++	ret = devm_request_irq(dev, irq, int0002_irq,
++			       IRQF_SHARED | IRQF_NO_THREAD, "INT0002", chip);
++	if (ret) {
++		dev_err(dev, "Error requesting IRQ %d: %d\n", irq, ret);
++		return ret;
++	}
++
++	ret = gpiochip_irqchip_add(chip, &int0002_irqchip, 0, handle_edge_irq,
++				   IRQ_TYPE_NONE);
++	if (ret) {
++		dev_err(dev, "Error adding irqchip: %d\n", ret);
++		return ret;
++	}
++
++	gpiochip_set_chained_irqchip(chip, &int0002_irqchip, irq, NULL);
++
++	return 0;
++}
++
++static const struct acpi_device_id int0002_acpi_ids[] = {
++	{ "INT0002", 0 },
++	{ },
++};
++MODULE_DEVICE_TABLE(acpi, int0002_acpi_ids);
++
++static struct platform_driver int0002_driver = {
++	.driver = {
++		.name			= DRV_NAME,
++		.acpi_match_table	= int0002_acpi_ids,
++	},
++	.probe	= int0002_probe,
++};
++
++module_platform_driver(int0002_driver);
++
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_DESCRIPTION("Intel INT0002 Virtual GPIO driver");
++MODULE_LICENSE("GPL");
+-- 
+2.13.0
+

0001-power-supply-max17042_battery-Add-support-for-ACPI-e.patch

@@ -0,0 +1,78 @@
+From 075bb90dbb4d894938c5859e3850987238db9cd8 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 11 Aug 2017 22:30:55 +0200
+Subject: [PATCH 1/2] power: supply: max17042_battery: Add support for ACPI
+ enumeration
+
+Some x86 devices enumerate a max17047 fuel-gauge through a MAX17047
+ACPI firmware-node, add support for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/max17042_battery.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index aecaaa2b0586..b2ddb7eb69c6 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -22,6 +22,7 @@
+  * This driver is based on max17040_battery.c
+  */
+ 
++#include <linux/acpi.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
+@@ -982,6 +983,8 @@ static int max17042_probe(struct i2c_client *client,
+ 	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+ 	const struct power_supply_desc *max17042_desc = &max17042_psy_desc;
+ 	struct power_supply_config psy_cfg = {};
++	const struct acpi_device_id *acpi_id;
++	struct device *dev = &client->dev;
+ 	struct max17042_chip *chip;
+ 	int ret;
+ 	int i;
+@@ -995,7 +998,15 @@ static int max17042_probe(struct i2c_client *client,
+ 		return -ENOMEM;
+ 
+ 	chip->client = client;
+-	chip->chip_type = id->driver_data;
++	if (id) {
++		chip->chip_type = id->driver_data;
++	} else {
++		acpi_id = acpi_match_device(dev->driver->acpi_match_table, dev);
++		if (!acpi_id)
++			return -ENODEV;
++
++		chip->chip_type = acpi_id->driver_data;
++	}
+ 	chip->regmap = devm_regmap_init_i2c(client, &max17042_regmap_config);
+ 	if (IS_ERR(chip->regmap)) {
+ 		dev_err(&client->dev, "Failed to initialize regmap\n");
+@@ -1104,6 +1115,14 @@ static int max17042_resume(struct device *dev)
+ static SIMPLE_DEV_PM_OPS(max17042_pm_ops, max17042_suspend,
+ 			max17042_resume);
+ 
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id max17042_acpi_match[] = {
++	{ "MAX17047", MAXIM_DEVICE_TYPE_MAX17047 },
++	{ }
++};
++MODULE_DEVICE_TABLE(acpi, max17042_acpi_match);
++#endif
++
+ #ifdef CONFIG_OF
+ static const struct of_device_id max17042_dt_match[] = {
+ 	{ .compatible = "maxim,max17042" },
+@@ -1125,6 +1144,7 @@ MODULE_DEVICE_TABLE(i2c, max17042_id);
+ static struct i2c_driver max17042_i2c_driver = {
+ 	.driver	= {
+ 		.name	= "max17042",
++		.acpi_match_table = ACPI_PTR(max17042_acpi_match),
+ 		.of_match_table = of_match_ptr(max17042_dt_match),
+ 		.pm	= &max17042_pm_ops,
+ 	},
+-- 
+2.13.4
+

0001-usb-usbtest-fix-NULL-pointer-dereference.patch

@@ -0,0 +1,41 @@
+From 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 29 Sep 2017 10:54:24 -0400
+Subject: [PATCH] usb: usbtest: fix NULL pointer dereference
+
+If the usbtest driver encounters a device with an IN bulk endpoint but
+no OUT bulk endpoint, it will try to dereference a NULL pointer
+(out->desc.bEndpointAddress).  The problem can be solved by adding a
+missing test.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+---
+ drivers/usb/misc/usbtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 113e38bfe0ef..b3fc602b2e24 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
+ 			return tmp;
+ 	}
+
+-	if (in) {
++	if (in)
+ 		dev->in_pipe = usb_rcvbulkpipe(udev,
+ 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
++	if (out)
+ 		dev->out_pipe = usb_sndbulkpipe(udev,
+ 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+-	}
++
+ 	if (iso_in) {
+ 		dev->iso_in = &iso_in->desc;
+ 		dev->in_iso_pipe = usb_rcvisocpipe(udev,
+-- 
+2.13.6
+

0002-Input-soc_button_array-Suppress-power-button-presses.patch

@@ -0,0 +1,62 @@
+From d561f0543506bc12e7b3355efddb0bfd7ca83c74 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 22 Jul 2017 13:17:36 +0200
+Subject: [PATCH 2/2] Input: soc_button_array - Suppress power button presses
+ during suspend
+
+If the power-button is pressed to wakeup the laptop/tablet from suspend
+and we report a KEY_POWER event to userspace when woken up this will cause
+userspace to immediately suspend the system again which is undesirable.
+
+This commit sets the new no_wakeup_events flag in the gpio_keys_button
+struct for the power-button suppressing the undesirable KEY_POWER input
+events on wake-up.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-New patch in v2 of this patch-set
+---
+ drivers/input/misc/soc_button_array.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
+index f600f3a7a3c6..27b99831cb97 100644
+--- a/drivers/input/misc/soc_button_array.c
++++ b/drivers/input/misc/soc_button_array.c
+@@ -27,6 +27,7 @@ struct soc_button_info {
+ 	unsigned int event_code;
+ 	bool autorepeat;
+ 	bool wakeup;
++	bool no_wakeup_events;
+ };
+ 
+ /*
+@@ -100,6 +101,7 @@ soc_button_device_create(struct platform_device *pdev,
+ 		gpio_keys[n_buttons].active_low = 1;
+ 		gpio_keys[n_buttons].desc = info->name;
+ 		gpio_keys[n_buttons].wakeup = info->wakeup;
++		gpio_keys[n_buttons].no_wakeup_events = info->no_wakeup_events;
+ 		/* These devices often use cheap buttons, use 50 ms debounce */
+ 		gpio_keys[n_buttons].debounce_interval = 50;
+ 		n_buttons++;
+@@ -185,6 +187,7 @@ static int soc_button_parse_btn_desc(struct device *dev,
+ 		info->name = "power";
+ 		info->event_code = KEY_POWER;
+ 		info->wakeup = true;
++		info->no_wakeup_events = true;
+ 	} else if (upage == 0x07 && usage == 0xe3) {
+ 		info->name = "home";
+ 		info->event_code = KEY_LEFTMETA;
+@@ -369,7 +372,7 @@ static int soc_button_probe(struct platform_device *pdev)
+  * Platforms"
+  */
+ static struct soc_button_info soc_button_PNP0C40[] = {
+-	{ "power", 0, EV_KEY, KEY_POWER, false, true },
++	{ "power", 0, EV_KEY, KEY_POWER, false, true, true },
+ 	{ "home", 1, EV_KEY, KEY_LEFTMETA, false, true },
+ 	{ "volume_up", 2, EV_KEY, KEY_VOLUMEUP, true, false },
+ 	{ "volume_down", 3, EV_KEY, KEY_VOLUMEDOWN, true, false },
+-- 
+2.13.4
+

0002-mfd-Add-Cherry-Trail-Whiskey-Cove-PMIC-driver.patch

@@ -0,0 +1,355 @@
+From c0f9254fdd0703ade018b2ff3a8cca433f781a11 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 26 Feb 2017 21:07:29 +0100
+Subject: [PATCH 02/16] mfd: Add Cherry Trail Whiskey Cove PMIC driver
+
+Add mfd driver for Intel CHT Whiskey Cove PMIC, based on various non
+upstreamed CHT Whiskey Cove PMIC patches.
+
+This is a somewhat minimal version which adds irqchip support and cells
+for: ACPI PMIC opregion support, the i2c-controller driving the external
+charger irc and the pwrsrc/extcon block.
+
+Further cells can be added in the future if/when drivers are upstreamed
+for them.
+
+Cc: Bin Gao <bin.gao@intel.com>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+---
+Changes in v2:
+-Since this uses plain mfd and not the intel_soc_pmic stuff give it
+ its own Kconfig and allow this to be built as a module
+-Add missing #include <acpi/acpi_bus.h>
+
+Changes in v3:
+-Drop #include <acpi/acpi_bus.h> again, not the right fix for the build errors
+-Error out when the upper byte of the register-address passed to the regmap
+ functions is 0 rather then hardcoding an address in that case
+-Various minor style tweaks / cleanups
+-Move defines of regulator register addresses to intel_pmic_chtwc.c,
+ it is the only place where they are used
+-Drop now empty include/linux/mfd/intel_chtwc.h
+-Rename intel_soc_pmic_chtwc.c to intel_cht_wc.c to match Kconfig option name
+-Add irqchip support
+-Add external charger cell
+-Add pwrsrc cell
+
+Changes in v4:
+-Use PLATFORM_DEVID_NONE
+
+Changes in v5:
+-Change Kconfig option from tristate to boolean and add a select for the
+ i2c-bus driver, this is necessary because the chtwc PMIC provides an ACPI
+ OPRegion handler, which must be available before other drivers using it
+ are loaded, which can only be ensured if the mfd, opregion and i2c-bus
+ drivers are built in. This fixes errors like these during boot:
+ mmc0: SDHCI controller on ACPI [80860F14:00] using ADMA
+ ACPI Error: No handler for Region [REGS] (ffff93543b0cc3a8) [UserDefinedRegion] (20170119/evregion-166)
+ ACPI Error: Region UserDefinedRegion (ID=143) has no handler (20170119/exfldio-299)
+ ACPI Error: Method parse/execution failed [\_SB.PCI0.I2C7.PMI5.GET] (Node ffff93543b0cde10), AE_NOT_EXIST (20170119/psparse-543)
+ ACPI Error: Method parse/execution failed [\_SB.PCI0.SHC1._PS0] (Node ffff93543b0b5cd0), AE_NOT_EXIST (20170119/psparse-543)
+ acpi 80860F14:02: Failed to change power state to D0
+-Some minor style and capitalization fixes from review by Lee Jones
+
+Changes in v6:
+-Fix Kconfig depends and selects to fix warning reported by kbuild test robot
+
+Changes in v7:
+-Add explanation why this is a bool and why it selects i2c-designwaree
+ to the help text rather then as comments in the Kconfig
+
+Changes in v8:
+-Remove MODULE macros, etc. now that this driver is a bool in Kconfig
+
+Changes in v9:
+-Some whitespace tweaks
+-Return -EINVAL from probe on invalid irq
+-Use probe_new i2c_driver callback
+---
+ drivers/mfd/Kconfig                |  16 +++
+ drivers/mfd/Makefile               |   1 +
+ drivers/mfd/intel_soc_pmic_chtwc.c | 230 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 247 insertions(+)
+ create mode 100644 drivers/mfd/intel_soc_pmic_chtwc.c
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 3eb5c93595f6..5203a86b8f6c 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -470,6 +470,22 @@ config INTEL_SOC_PMIC_BXTWC
+ 	  thermal, charger and related power management functions
+ 	  on these systems.
+ 
++config INTEL_SOC_PMIC_CHTWC
++	bool "Support for Intel Cherry Trail Whiskey Cove PMIC"
++	depends on ACPI && HAS_IOMEM && I2C=y && COMMON_CLK
++	depends on X86 || COMPILE_TEST
++	select MFD_CORE
++	select REGMAP_I2C
++	select REGMAP_IRQ
++	select I2C_DESIGNWARE_PLATFORM
++	help
++	  Select this option to enable support for the Intel Cherry Trail
++	  Whiskey Cove PMIC found on some Intel Cherry Trail systems.
++
++	  This option is a bool as it provides an ACPI OpRegion which must be
++	  available before any devices using it are probed. This option also
++	  causes the designware-i2c driver to be builtin for the same reason.
++
+ config MFD_INTEL_LPSS
+ 	tristate
+ 	select COMMON_CLK
+diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
+index c16bf1ea0ea9..6f6aed8cfccc 100644
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -214,6 +214,7 @@ obj-$(CONFIG_MFD_SKY81452)	+= sky81452.o
+ intel-soc-pmic-objs		:= intel_soc_pmic_core.o intel_soc_pmic_crc.o
+ obj-$(CONFIG_INTEL_SOC_PMIC)	+= intel-soc-pmic.o
+ obj-$(CONFIG_INTEL_SOC_PMIC_BXTWC)	+= intel_soc_pmic_bxtwc.o
++obj-$(CONFIG_INTEL_SOC_PMIC_CHTWC)	+= intel_soc_pmic_chtwc.o
+ obj-$(CONFIG_MFD_MT6397)	+= mt6397-core.o
+ 
+ obj-$(CONFIG_MFD_ALTERA_A10SR)	+= altera-a10sr.o
+diff --git a/drivers/mfd/intel_soc_pmic_chtwc.c b/drivers/mfd/intel_soc_pmic_chtwc.c
+new file mode 100644
+index 000000000000..b35da01d5bcf
+--- /dev/null
++++ b/drivers/mfd/intel_soc_pmic_chtwc.c
+@@ -0,0 +1,230 @@
++/*
++ * MFD core driver for Intel Cherrytrail Whiskey Cove PMIC
++ *
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Based on various non upstream patches to support the CHT Whiskey Cove PMIC:
++ * Copyright (C) 2013-2015 Intel Corporation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/acpi.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/kernel.h>
++#include <linux/mfd/core.h>
++#include <linux/mfd/intel_soc_pmic.h>
++#include <linux/regmap.h>
++
++/* PMIC device registers */
++#define REG_OFFSET_MASK		GENMASK(7, 0)
++#define REG_ADDR_MASK		GENMASK(15, 8)
++#define REG_ADDR_SHIFT		8
++
++#define CHT_WC_IRQLVL1		0x6e02
++#define CHT_WC_IRQLVL1_MASK	0x6e0e
++
++/* Whiskey Cove PMIC share same ACPI ID between different platforms */
++#define CHT_WC_HRV		3
++
++/* Level 1 IRQs (level 2 IRQs are handled in the child device drivers) */
++enum {
++	CHT_WC_PWRSRC_IRQ = 0,
++	CHT_WC_THRM_IRQ,
++	CHT_WC_BCU_IRQ,
++	CHT_WC_ADC_IRQ,
++	CHT_WC_EXT_CHGR_IRQ,
++	CHT_WC_GPIO_IRQ,
++	/* There is no irq 6 */
++	CHT_WC_CRIT_IRQ = 7,
++};
++
++static struct resource cht_wc_pwrsrc_resources[] = {
++	DEFINE_RES_IRQ(CHT_WC_PWRSRC_IRQ),
++};
++
++static struct resource cht_wc_ext_charger_resources[] = {
++	DEFINE_RES_IRQ(CHT_WC_EXT_CHGR_IRQ),
++};
++
++static struct mfd_cell cht_wc_dev[] = {
++	{
++		.name = "cht_wcove_pwrsrc",
++		.num_resources = ARRAY_SIZE(cht_wc_pwrsrc_resources),
++		.resources = cht_wc_pwrsrc_resources,
++	}, {
++		.name = "cht_wcove_ext_chgr",
++		.num_resources = ARRAY_SIZE(cht_wc_ext_charger_resources),
++		.resources = cht_wc_ext_charger_resources,
++	},
++	{	.name = "cht_wcove_region", },
++};
++
++/*
++ * The CHT Whiskey Cove covers multiple I2C addresses, with a 1 Byte
++ * register address space per I2C address, so we use 16 bit register
++ * addresses where the high 8 bits contain the I2C client address.
++ */
++static int cht_wc_byte_reg_read(void *context, unsigned int reg,
++				unsigned int *val)
++{
++	struct i2c_client *client = context;
++	int ret, orig_addr = client->addr;
++
++	if (!(reg & REG_ADDR_MASK)) {
++		dev_err(&client->dev, "Error I2C address not specified\n");
++		return -EINVAL;
++	}
++
++	client->addr = (reg & REG_ADDR_MASK) >> REG_ADDR_SHIFT;
++	ret = i2c_smbus_read_byte_data(client, reg & REG_OFFSET_MASK);
++	client->addr = orig_addr;
++
++	if (ret < 0)
++		return ret;
++
++	*val = ret;
++	return 0;
++}
++
++static int cht_wc_byte_reg_write(void *context, unsigned int reg,
++				 unsigned int val)
++{
++	struct i2c_client *client = context;
++	int ret, orig_addr = client->addr;
++
++	if (!(reg & REG_ADDR_MASK)) {
++		dev_err(&client->dev, "Error I2C address not specified\n");
++		return -EINVAL;
++	}
++
++	client->addr = (reg & REG_ADDR_MASK) >> REG_ADDR_SHIFT;
++	ret = i2c_smbus_write_byte_data(client, reg & REG_OFFSET_MASK, val);
++	client->addr = orig_addr;
++
++	return ret;
++}
++
++static const struct regmap_config cht_wc_regmap_cfg = {
++	.reg_bits = 16,
++	.val_bits = 8,
++	.reg_write = cht_wc_byte_reg_write,
++	.reg_read = cht_wc_byte_reg_read,
++};
++
++static const struct regmap_irq cht_wc_regmap_irqs[] = {
++	REGMAP_IRQ_REG(CHT_WC_PWRSRC_IRQ, 0, BIT(CHT_WC_PWRSRC_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_THRM_IRQ, 0, BIT(CHT_WC_THRM_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_BCU_IRQ, 0, BIT(CHT_WC_BCU_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_ADC_IRQ, 0, BIT(CHT_WC_ADC_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_EXT_CHGR_IRQ, 0, BIT(CHT_WC_EXT_CHGR_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_GPIO_IRQ, 0, BIT(CHT_WC_GPIO_IRQ)),
++	REGMAP_IRQ_REG(CHT_WC_CRIT_IRQ, 0, BIT(CHT_WC_CRIT_IRQ)),
++};
++
++static const struct regmap_irq_chip cht_wc_regmap_irq_chip = {
++	.name = "cht_wc_irq_chip",
++	.status_base = CHT_WC_IRQLVL1,
++	.mask_base = CHT_WC_IRQLVL1_MASK,
++	.irqs = cht_wc_regmap_irqs,
++	.num_irqs = ARRAY_SIZE(cht_wc_regmap_irqs),
++	.num_regs = 1,
++};
++
++static int cht_wc_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct intel_soc_pmic *pmic;
++	acpi_status status;
++	unsigned long long hrv;
++	int ret;
++
++	status = acpi_evaluate_integer(ACPI_HANDLE(dev), "_HRV", NULL, &hrv);
++	if (ACPI_FAILURE(status)) {
++		dev_err(dev, "Failed to get PMIC hardware revision\n");
++		return -ENODEV;
++	}
++	if (hrv != CHT_WC_HRV) {
++		dev_err(dev, "Invalid PMIC hardware revision: %llu\n", hrv);
++		return -ENODEV;
++	}
++	if (client->irq < 0) {
++		dev_err(dev, "Invalid IRQ\n");
++		return -EINVAL;
++	}
++
++	pmic = devm_kzalloc(dev, sizeof(*pmic), GFP_KERNEL);
++	if (!pmic)
++		return -ENOMEM;
++
++	pmic->irq = client->irq;
++	pmic->dev = dev;
++	i2c_set_clientdata(client, pmic);
++
++	pmic->regmap = devm_regmap_init(dev, NULL, client, &cht_wc_regmap_cfg);
++	if (IS_ERR(pmic->regmap))
++		return PTR_ERR(pmic->regmap);
++
++	ret = devm_regmap_add_irq_chip(dev, pmic->regmap, pmic->irq,
++				       IRQF_ONESHOT | IRQF_SHARED, 0,
++				       &cht_wc_regmap_irq_chip,
++				       &pmic->irq_chip_data);
++	if (ret)
++		return ret;
++
++	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
++				cht_wc_dev, ARRAY_SIZE(cht_wc_dev), NULL, 0,
++				regmap_irq_get_domain(pmic->irq_chip_data));
++}
++
++static void cht_wc_shutdown(struct i2c_client *client)
++{
++	struct intel_soc_pmic *pmic = i2c_get_clientdata(client);
++
++	disable_irq(pmic->irq);
++}
++
++static int __maybe_unused cht_wc_suspend(struct device *dev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(dev);
++
++	disable_irq(pmic->irq);
++
++	return 0;
++}
++
++static int __maybe_unused cht_wc_resume(struct device *dev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(dev);
++
++	enable_irq(pmic->irq);
++
++	return 0;
++}
++static SIMPLE_DEV_PM_OPS(cht_wc_pm_ops, cht_wc_suspend, cht_wc_resume);
++
++static const struct i2c_device_id cht_wc_i2c_id[] = {
++	{ }
++};
++
++static const struct acpi_device_id cht_wc_acpi_ids[] = {
++	{ "INT34D3", },
++	{ }
++};
++
++static struct i2c_driver cht_wc_driver = {
++	.driver	= {
++		.name	= "CHT Whiskey Cove PMIC",
++		.pm     = &cht_wc_pm_ops,
++		.acpi_match_table = cht_wc_acpi_ids,
++	},
++	.probe_new = cht_wc_probe,
++	.shutdown = cht_wc_shutdown,
++	.id_table = cht_wc_i2c_id,
++};
++builtin_i2c_driver(cht_wc_driver);
+-- 
+2.13.0
+

0002-power-supply-max17042_battery-Fix-ACPI-interrupt-iss.patch

@@ -0,0 +1,80 @@
+From 27b9d46d25c873b351757c44ce523bf0ede1d08e Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 14 Aug 2017 11:02:59 +0200
+Subject: [PATCH 2/2] power: supply: max17042_battery: Fix ACPI interrupt
+ issues
+
+On some x86/ACPI boards the DSDT defines an ACPI event handler for
+the max17047 IRQ, this causes several problems:
+
+1) We need to share the IRQ to avoid an error getting it
+
+2) Even of we are willing to share, we may fail to share because some
+   DSDTs claim it exclusivly
+
+3) If we are unable to share the IRQ, or the IRQ is only listed as an
+   ACPI event source and not in the max1704 firmware node, then the
+   charge threshold IRQ (which is used to give an IRQ every 1 percent
+   charge change) becomes a problem, the ACPI event handler will not
+   update this to the next 1 percent threshold, so the IRQ keeps firing
+   and we get an IRQ storm pegging 1 CPU core.
+
+   This happens despite the max17042 driver not setting the charge
+   threshold because Windows uses it and leaves it set on reboot.
+
+   So if we are unable to get the IRQ we need to reprogram the
+   charge threshold to its disabled setting.
+
+This commit fixes al of the above, while at it it also makes the error
+msg when being unable to get the IRQ consistent with other messages.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/max17042_battery.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index b2ddb7eb69c6..18a44e4ed6ff 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -1050,11 +1050,18 @@ static int max17042_probe(struct i2c_client *client,
+ 	}
+ 
+ 	if (client->irq) {
++		unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT;
++
++		/*
++		 * On ACPI systems the IRQ may be handled by ACPI-event code,
++		 * so we need to share (if the ACPI code is willing to share).
++		 */
++		if (acpi_id)
++			flags |= IRQF_SHARED | IRQF_PROBE_SHARED;
++
+ 		ret = devm_request_threaded_irq(&client->dev, client->irq,
+ 						NULL,
+-						max17042_thread_handler,
+-						IRQF_TRIGGER_FALLING |
+-						IRQF_ONESHOT,
++						max17042_thread_handler, flags,
+ 						chip->battery->desc->name,
+ 						chip);
+ 		if (!ret) {
+@@ -1064,10 +1071,13 @@ static int max17042_probe(struct i2c_client *client,
+ 			max17042_set_soc_threshold(chip, 1);
+ 		} else {
+ 			client->irq = 0;
+-			dev_err(&client->dev, "%s(): cannot get IRQ\n",
+-				__func__);
++			if (ret != -EBUSY)
++				dev_err(&client->dev, "Failed to get IRQ\n");
+ 		}
+ 	}
++	/* Not able to update the charge threshold when exceeded? -> disable */
++	if (!client->irq)
++		regmap_write(chip->regmap, MAX17042_SALRT_Th, 0xff00);
+ 
+ 	regmap_read(chip->regmap, MAX17042_STATUS, &val);
+ 	if (val & STATUS_POR_BIT) {
+-- 
+2.13.4
+

0003-power-supply-core-Add-support-for-supplied-from-devi.patch

@@ -0,0 +1,57 @@
+From 69dd0606a0d8680fe0a5e9b959f6662e582e1674 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 2 May 2017 13:43:34 +0200
+Subject: [PATCH 03/16] power: supply: core: Add support for supplied-from
+ device-property
+
+On devicetree using platforms the devicetree can provide info on which
+power-supplies supply another power-supply through phandles.
+
+This commit adds support for providing this info on non devicetree
+platforms through the platform code setting a supplied-from
+device-property on the power-supplies parent device.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/power/supply/power_supply_core.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 7ec7c7c202bd..0c09144193a6 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -274,8 +274,30 @@ static int power_supply_check_supplies(struct power_supply *psy)
+ 	return power_supply_populate_supplied_from(psy);
+ }
+ #else
+-static inline int power_supply_check_supplies(struct power_supply *psy)
++static int power_supply_check_supplies(struct power_supply *psy)
+ {
++	int nval, ret;
++
++	if (!psy->dev.parent)
++		return 0;
++
++	nval = device_property_read_string_array(psy->dev.parent,
++						 "supplied-from", NULL, 0);
++	if (nval <= 0)
++		return 0;
++
++	psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
++						sizeof(char *), GFP_KERNEL);
++	if (!psy->supplied_from)
++		return -ENOMEM;
++
++	ret = device_property_read_string_array(psy->dev.parent,
++		"supplied-from", (const char **)psy->supplied_from, nval);
++	if (ret < 0)
++		return ret;
++
++	psy->num_supplies = nval;
++
+ 	return 0;
+ }
+ #endif
+-- 
+2.13.0
+

0004-platform-x86-intel_cht_int33fe-Set-supplied-from-pro.patch

@@ -0,0 +1,48 @@
+From 99c44df299d96db6a170ccce9b8108fc2e7f8bae Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 2 May 2017 13:40:44 +0200
+Subject: [PATCH 04/16] platform/x86: intel_cht_int33fe: Set supplied-from
+ property on max17047 dev
+
+Devices with the intel_cht_int33fe ACPI device use a max17047 fuel-gauge
+combined with a bq24272i charger, in order for the fuel-gauge driver to
+correctly display charging / discharging status it needs to know which
+charger is supplying the battery.
+
+This commit sets the supplied-from device property to the name of the
+bq24272i charger for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/intel_cht_int33fe.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/intel_cht_int33fe.c b/drivers/platform/x86/intel_cht_int33fe.c
+index 6a1b2ca5b6fe..da706e2c4232 100644
+--- a/drivers/platform/x86/intel_cht_int33fe.c
++++ b/drivers/platform/x86/intel_cht_int33fe.c
+@@ -34,6 +34,13 @@ struct cht_int33fe_data {
+ 	struct i2c_client *pi3usb30532;
+ };
+ 
++static const char * const max17047_suppliers[] = { "bq24190-charger" };
++
++static const struct property_entry max17047_props[] = {
++	PROPERTY_ENTRY_STRING_ARRAY("supplied-from", max17047_suppliers),
++	{ }
++};
++
+ static int cht_int33fe_probe(struct i2c_client *client)
+ {
+ 	struct device *dev = &client->dev;
+@@ -70,6 +77,7 @@ static int cht_int33fe_probe(struct i2c_client *client)
+ 
+ 	memset(&board_info, 0, sizeof(board_info));
+ 	strlcpy(board_info.type, "max17047", I2C_NAME_SIZE);
++	board_info.properties = max17047_props;
+ 
+ 	data->max17047 = i2c_acpi_new_device(dev, 1, &board_info);
+ 	if (!data->max17047)
+-- 
+2.13.0
+

0005-ACPI-PMIC-xpower-Add-support-for-the-GPI1-regulator-.patch

@@ -0,0 +1,80 @@
+From cc2b0e2c164d02ab42efa736f91f53baf8d8bc36 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 20 Apr 2017 22:41:20 +0200
+Subject: [PATCH 05/16] ACPI / PMIC: xpower: Add support for the GPI1 regulator
+ to the OpRegion handler
+
+Some Bay Trail devices use a GPI1 regulator field (address 0x4c) in
+their 0x8d power OpRegion, add support for this.
+
+This fixes AE_BAD_PARAMETER errors getting thrown on these devices and
+fixes these errors causing these devices to not suspend.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+---
+Changes in v2:
+-Simplify reg == 0x92 handling (suggested by Andy Shevchenko)
+-Add special handling for reg == 0x92 to intel_xpower_pmic_get_power() too
+Changes in v3:
+-Use defines for GPI1 reg and bits, rather then hardcoded hex values
+---
+ drivers/acpi/pmic/intel_pmic_xpower.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c
+index 1a76c784cd4c..3b7d5be5b7ed 100644
+--- a/drivers/acpi/pmic/intel_pmic_xpower.c
++++ b/drivers/acpi/pmic/intel_pmic_xpower.c
+@@ -21,6 +21,11 @@
+ #include "intel_pmic.h"
+ 
+ #define XPOWER_GPADC_LOW	0x5b
++#define XPOWER_GPI1_CTRL	0x92
++
++#define GPI1_LDO_MASK		GENMASK(2, 0)
++#define GPI1_LDO_ON		(3 << 0)
++#define GPI1_LDO_OFF		(4 << 0)
+ 
+ static struct pmic_table power_table[] = {
+ 	{
+@@ -118,6 +123,10 @@ static struct pmic_table power_table[] = {
+ 		.reg = 0x10,
+ 		.bit = 0x00
+ 	}, /* BUC6 */
++	{
++		.address = 0x4c,
++		.reg = 0x92,
++	}, /* GPI1 */
+ };
+ 
+ /* TMP0 - TMP5 are the same, all from GPADC */
+@@ -156,7 +165,12 @@ static int intel_xpower_pmic_get_power(struct regmap *regmap, int reg,
+ 	if (regmap_read(regmap, reg, &data))
+ 		return -EIO;
+ 
+-	*value = (data & BIT(bit)) ? 1 : 0;
++	/* GPIO1 LDO regulator needs special handling */
++	if (reg == XPOWER_GPI1_CTRL)
++		*value = ((data & GPI1_LDO_MASK) == GPI1_LDO_ON);
++	else
++		*value = (data & BIT(bit)) ? 1 : 0;
++
+ 	return 0;
+ }
+ 
+@@ -165,6 +179,11 @@ static int intel_xpower_pmic_update_power(struct regmap *regmap, int reg,
+ {
+ 	int data;
+ 
++	/* GPIO1 LDO regulator needs special handling */
++	if (reg == XPOWER_GPI1_CTRL)
++		return regmap_update_bits(regmap, reg, GPI1_LDO_MASK,
++					  on ? GPI1_LDO_ON : GPI1_LDO_OFF);
++
+ 	if (regmap_read(regmap, reg, &data))
+ 		return -EIO;
+ 
+-- 
+2.13.0
+

0006-Input-axp20x-pek-Add-wakeup-support.patch

@@ -0,0 +1,67 @@
+From fbac4c05ec1d7c2d949f50baf1e934cbfbb6a494 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 17 Apr 2017 22:06:25 +0200
+Subject: [PATCH 06/16] Input: axp20x-pek - Add wakeup support
+
+At least on devices with the AXP288 PMIC the device is expected to
+wakeup from suspend when the power-button gets pressed, add support
+for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/misc/axp20x-pek.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
+index 400869e61a06..5f16fceaae83 100644
+--- a/drivers/input/misc/axp20x-pek.c
++++ b/drivers/input/misc/axp20x-pek.c
+@@ -253,6 +253,9 @@ static int axp20x_pek_probe_input_device(struct axp20x_pek *axp20x_pek,
+ 		return error;
+ 	}
+ 
++	if (axp20x_pek->axp20x->variant == AXP288_ID)
++		enable_irq_wake(axp20x_pek->irq_dbr);
++
+ 	return 0;
+ }
+ 
+@@ -331,10 +334,35 @@ static int axp20x_pek_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static int __maybe_unused axp20x_pek_resume_noirq(struct device *dev)
++{
++	struct axp20x_pek *axp20x_pek = dev_get_drvdata(dev);
++
++	if (axp20x_pek->axp20x->variant != AXP288_ID)
++		return 0;
++
++	/*
++	 * Clear interrupts from button presses during suspend, to avoid
++	 * a wakeup power-button press getting reported to userspace.
++	 */
++	regmap_write(axp20x_pek->axp20x->regmap,
++		     AXP20X_IRQ1_STATE + AXP288_IRQ_POKN / 8,
++		     BIT(AXP288_IRQ_POKN % 8));
++
++	return 0;
++}
++
++const struct dev_pm_ops axp20x_pek_pm_ops = {
++#ifdef CONFIG_PM_SLEEP
++	.resume_noirq = axp20x_pek_resume_noirq,
++#endif
++};
++
+ static struct platform_driver axp20x_pek_driver = {
+ 	.probe		= axp20x_pek_probe,
+ 	.driver		= {
+ 		.name		= "axp20x-pek",
++		.pm		= &axp20x_pek_pm_ops,
+ 	},
+ };
+ module_platform_driver(axp20x_pek_driver);
+-- 
+2.13.0
+

0007-platform-x86-silead_dmi-Add-touchscreen-info-for-GP-.patch

@@ -0,0 +1,56 @@
+From d95c127c48ef784214671359a41ac505ac30098a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 7 May 2017 12:32:11 +0200
+Subject: [PATCH 07/16] platform/x86: silead_dmi: Add touchscreen info for
+ GP-electronic T701
+
+Add touchscreen info for the GP-electronic T701 tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index a3a57d93cf06..db3a877d2160 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -80,6 +80,19 @@ static const struct silead_ts_dmi_data surftab_wintron70_st70416_6_data = {
+ 	.properties	= surftab_wintron70_st70416_6_props,
+ };
+ 
++static const struct property_entry gp_electronic_t701_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 960),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 640),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl1680-gp-electronic-t701.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data gp_electronic_t701_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= gp_electronic_t701_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -117,6 +130,15 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_VERSION, "TREK.G.WI71C.JGBMRBA04"),
+ 		},
+ 	},
++	{
++		/* GP-electronic T701 */
++		.driver_data = (void *)&gp_electronic_t701_data,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "T701"),
++			DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0008-platform-x86-silead_dmi-Add-touchscreen-info-for-PoV.patch

@@ -0,0 +1,59 @@
+From 55b347c61b2850d1e11e159ab02dc71f13b06481 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 11 Jun 2017 17:42:31 +0200
+Subject: [PATCH 08/16] platform/x86: silead_dmi: Add touchscreen info for PoV
+ mobii wintab p800w
+
+Add touchscreen info for the Point of View mobii wintab p800w tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index db3a877d2160..46c5e1ebfb53 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -93,6 +93,20 @@ static const struct silead_ts_dmi_data gp_electronic_t701_data = {
+ 	.properties	= gp_electronic_t701_props,
+ };
+ 
++static const struct property_entry pov_mobii_wintab_p800w_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 1800),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 1150),
++	PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl3692-pov-mobii-wintab-p800w.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data pov_mobii_wintab_p800w_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= pov_mobii_wintab_p800w_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -139,6 +153,17 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
+ 		},
+ 	},
++	{
++		/* Point of View mobii wintab p800w */
++		.driver_data = (void *)&pov_mobii_wintab_p800w_data,
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++			DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++			DMI_MATCH(DMI_BIOS_VERSION, "3BAIR1013"),
++			/* Above matches are too generic, add bios-date match */
++			DMI_MATCH(DMI_BIOS_DATE, "08/22/2014"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0009-platform-x86-silead_dmi-Add-touchscreen-info-for-Pip.patch

@@ -0,0 +1,57 @@
+From b239a7a0c2a1435aa5cbab3f233e0c37e82943dd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 13 Jun 2017 18:17:07 +0200
+Subject: [PATCH 09/16] platform/x86: silead_dmi: Add touchscreen info for Pipo
+ W2S tablet
+
+Add touchscreen info for Pipo W2S tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/platform/x86/silead_dmi.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/platform/x86/silead_dmi.c b/drivers/platform/x86/silead_dmi.c
+index 46c5e1ebfb53..25cbea307a5e 100644
+--- a/drivers/platform/x86/silead_dmi.c
++++ b/drivers/platform/x86/silead_dmi.c
+@@ -107,6 +107,21 @@ static const struct silead_ts_dmi_data pov_mobii_wintab_p800w_data = {
+ 	.properties	= pov_mobii_wintab_p800w_props,
+ };
+ 
++static const struct property_entry pipo_w2s_props[] = {
++	PROPERTY_ENTRY_U32("touchscreen-size-x", 1660),
++	PROPERTY_ENTRY_U32("touchscreen-size-y", 880),
++	PROPERTY_ENTRY_BOOL("touchscreen-inverted-x"),
++	PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++	PROPERTY_ENTRY_STRING("firmware-name",
++			      "gsl1680-pipo-w2s.fw"),
++	{ }
++};
++
++static const struct silead_ts_dmi_data pipo_w2s_data = {
++	.acpi_name	= "MSSL1680:00",
++	.properties	= pipo_w2s_props,
++};
++
+ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 	{
+ 		/* CUBE iwork8 Air */
+@@ -164,6 +179,14 @@ static const struct dmi_system_id silead_ts_dmi_table[] = {
+ 			DMI_MATCH(DMI_BIOS_DATE, "08/22/2014"),
+ 		},
+ 	},
++	{
++		/* Pipo W2S */
++		.driver_data = (void *)&pipo_w2s_data,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "PIPO"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "W2S"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.13.0
+

0010-Input-silead-Add-support-for-capactive-home-button-f.patch

@@ -0,0 +1,114 @@
+From 33fc16fd8aa3684e19b1d1f0a712593e2e570ab1 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 11 Jun 2017 21:24:50 +0200
+Subject: [PATCH 10/16] Input: silead: Add support for capactive home button
+ found on some x86 tablets
+
+On some x86 tablets with a silead touchscreen the windows logo on the
+front is a capacitive home button. Touching this button results in a touch
+with bits 12-15 of the Y coordinates set, while normally only the lower 12
+are used.
+
+Detect this and report a KEY_LEFTMETA press when this happens. Note for
+now we only respond to the Y coordinate bits 12-15 containing 0x01, on some
+tablets *without* a capacative button I've noticed these bits containing
+0x04 when crossing the edges of the screen.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/touchscreen/silead.c | 45 ++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index 0dbcf105f7db..c0ba40c09699 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -56,7 +56,7 @@
+ #define SILEAD_POINT_Y_MSB_OFF	0x01
+ #define SILEAD_POINT_X_OFF	0x02
+ #define SILEAD_POINT_X_MSB_OFF	0x03
+-#define SILEAD_TOUCH_ID_MASK	0xF0
++#define SILEAD_EXTRA_DATA_MASK	0xF0
+ 
+ #define SILEAD_CMD_SLEEP_MIN	10000
+ #define SILEAD_CMD_SLEEP_MAX	20000
+@@ -109,6 +109,8 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data)
+ 			    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED |
+ 			    INPUT_MT_TRACK);
+ 
++	input_set_capability(data->input, EV_KEY, KEY_LEFTMETA);
++
+ 	data->input->name = SILEAD_TS_NAME;
+ 	data->input->phys = "input/ts";
+ 	data->input->id.bustype = BUS_I2C;
+@@ -139,7 +141,8 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 	struct input_dev *input = data->input;
+ 	struct device *dev = &client->dev;
+ 	u8 *bufp, buf[SILEAD_TS_DATA_LEN];
+-	int touch_nr, error, i;
++	int touch_nr, softbutton, error, i;
++	bool softbutton_pressed = false;
+ 
+ 	error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_DATA,
+ 					      SILEAD_TS_DATA_LEN, buf);
+@@ -148,21 +151,40 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 		return;
+ 	}
+ 
+-	touch_nr = buf[0];
+-	if (touch_nr > data->max_fingers) {
++	if (buf[0] > data->max_fingers) {
+ 		dev_warn(dev, "More touches reported then supported %d > %d\n",
+-			 touch_nr, data->max_fingers);
+-		touch_nr = data->max_fingers;
++			 buf[0], data->max_fingers);
++		buf[0] = data->max_fingers;
+ 	}
+ 
++	touch_nr = 0;
+ 	bufp = buf + SILEAD_POINT_DATA_LEN;
+-	for (i = 0; i < touch_nr; i++, bufp += SILEAD_POINT_DATA_LEN) {
+-		/* Bits 4-7 are the touch id */
+-		data->id[i] = (bufp[SILEAD_POINT_X_MSB_OFF] &
+-			       SILEAD_TOUCH_ID_MASK) >> 4;
+-		touchscreen_set_mt_pos(&data->pos[i], &data->prop,
++	for (i = 0; i < buf[0]; i++, bufp += SILEAD_POINT_DATA_LEN) {
++		softbutton = (bufp[SILEAD_POINT_Y_MSB_OFF] &
++			      SILEAD_EXTRA_DATA_MASK) >> 4;
++
++		if (softbutton) {
++			/*
++			 * For now only respond to softbutton == 0x01, some
++			 * tablets *without* a capacative button send 0x04
++			 * when crossing the edges of the screen.
++			 */
++			if (softbutton == 0x01)
++				softbutton_pressed = true;
++
++			continue;
++		}
++
++		/*
++		 * Bits 4-7 are the touch id, note not all models have
++		 * hardware touch ids so atm we don't use these.
++		 */
++		data->id[touch_nr] = (bufp[SILEAD_POINT_X_MSB_OFF] &
++				      SILEAD_EXTRA_DATA_MASK) >> 4;
++		touchscreen_set_mt_pos(&data->pos[touch_nr], &data->prop,
+ 			get_unaligned_le16(&bufp[SILEAD_POINT_X_OFF]) & 0xfff,
+ 			get_unaligned_le16(&bufp[SILEAD_POINT_Y_OFF]) & 0xfff);
++		touch_nr++;
+ 	}
+ 
+ 	input_mt_assign_slots(input, data->slots, data->pos, touch_nr, 0);
+@@ -178,6 +200,7 @@ static void silead_ts_read_data(struct i2c_client *client)
+ 	}
+ 
+ 	input_mt_sync_frame(input);
++	input_report_key(input, KEY_LEFTMETA, softbutton_pressed);
+ 	input_sync(input);
+ }
+ 
+-- 
+2.13.0
+

0011-Input-goodix-Add-support-for-capacitive-home-button.patch

@@ -0,0 +1,53 @@
+From 2a99775c336303d2efc43eab4f24b34722a28faa Mon Sep 17 00:00:00 2001
+From: "Sergei A. Trusov" <sergei.a.trusov@ya.ru>
+Date: Tue, 20 Jun 2017 18:08:35 +0200
+Subject: [PATCH 11/16] Input: goodix: Add support for capacitive home button
+
+On some x86 tablets with a Goodix touchscreen, the Windows logo on the
+front is a capacitive home button. Touching this button results in a touch
+with bit 4 of the first byte set, while only the lower 4 bits (0-3) are
+used to indicate the number of touches.
+
+Report a KEY_LEFTMETA press when this happens.
+
+Note that the hardware might support more than one button, in which
+case the "id" byte of coor_data would identify the button in question.
+This is not implemented as we don't have access to hardware with
+multiple buttons.
+
+Signed-off-by: Sergei A. Trusov <sergei.a.trusov@ya.ru>
+Acked-by: Bastien Nocera <hadess@hadess.net>
+---
+ drivers/input/touchscreen/goodix.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index 240b16f3ee97..903137d9cf7d 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -267,6 +267,12 @@ static void goodix_process_events(struct goodix_ts_data *ts)
+ 	if (touch_num < 0)
+ 		return;
+ 
++	/*
++	 * Bit 4 of the first byte reports the status of the capacitive
++	 * Windows/Home button.
++	 */
++	input_report_key(ts->input_dev, KEY_LEFTMETA, !!(point_data[0] & BIT(4)));
++
+ 	for (i = 0; i < touch_num; i++)
+ 		goodix_ts_report_touch(ts,
+ 				&point_data[1 + GOODIX_CONTACT_SIZE * i]);
+@@ -612,6 +618,9 @@ static int goodix_request_input_dev(struct goodix_ts_data *ts)
+ 	ts->input_dev->id.product = ts->id;
+ 	ts->input_dev->id.version = ts->version;
+ 
++	/* Capacitive Windows/Home button on some devices */
++	input_set_capability(ts->input_dev, EV_KEY, KEY_LEFTMETA);
++
+ 	error = input_register_device(ts->input_dev);
+ 	if (error) {
+ 		dev_err(&ts->client->dev,
+-- 
+2.13.0
+

0012-Input-gpio_keys-Do-not-report-wake-button-presses-as.patch

@@ -0,0 +1,150 @@
+From 02b823a4d28ffb5fde5192799abd934d9de95630 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 6 Jan 2017 20:08:11 +0100
+Subject: [PATCH 12/16] Input: gpio_keys - Do not report wake button presses as
+ evdev events
+
+If a button is a wake button, it may still be bouncing from the press
+to wakeup the device by the time the gpio interrupts get enabled again
+and / or the gpio_keys_report_state call from gpio_keys_resume may
+find the button still pressed and report this as a new press.
+
+This is undesirable, esp. since the powerbutton on tablets is typically
+a wakeup source and uses the gpio_keys driver on some tablets, leading
+to userspace immediately re-suspending the tablet after the powerbutton
+is pressed, due to it seeing a powerbutton press.
+
+This commit ignores wakeup button presses for the first 1 second after
+resume (and while resumed, as the workqueue may run before the resume
+function runs), avoiding this problem.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Note: maybe we should make WAKE_DEBOUNCE part of gpio_keys_button and
+only do this when drivers / platform-data set this to a non-zero value ?
+---
+ drivers/input/keyboard/gpio_keys.c | 49 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
+index da3d362f21b1..e1488b534e7d 100644
+--- a/drivers/input/keyboard/gpio_keys.c
++++ b/drivers/input/keyboard/gpio_keys.c
+@@ -31,6 +31,8 @@
+ #include <linux/of_irq.h>
+ #include <linux/spinlock.h>
+ 
++#define WAKE_DEBOUNCE msecs_to_jiffies(1000)
++
+ struct gpio_button_data {
+ 	const struct gpio_keys_button *button;
+ 	struct input_dev *input;
+@@ -44,10 +46,14 @@ struct gpio_button_data {
+ 	struct delayed_work work;
+ 	unsigned int software_debounce;	/* in msecs, for GPIO-driven buttons */
+ 
++	unsigned long resume_time;	/* in jiffies, for wakeup buttons */
++
+ 	unsigned int irq;
+ 	spinlock_t lock;
+ 	bool disabled;
+ 	bool key_pressed;
++	bool suspended;
++	bool resume_time_valid;
+ };
+ 
+ struct gpio_keys_drvdata {
+@@ -356,6 +362,27 @@ static struct attribute_group gpio_keys_attr_group = {
+ 	.attrs = gpio_keys_attrs,
+ };
+ 
++static bool gpio_keys_ignore_wakeup_button_press(struct gpio_button_data *bdata)
++{
++	unsigned long flags;
++	bool ret = false;
++
++	if (!bdata->button->wakeup)
++		return ret;
++
++	spin_lock_irqsave(&bdata->lock, flags);
++
++	if (bdata->suspended)
++		ret = true; /* Our resume method did not run yet */
++	else if (bdata->resume_time_valid &&
++		 time_before(jiffies, bdata->resume_time + WAKE_DEBOUNCE))
++		ret = true; /* Assume this is a wakeup press and ignore */
++
++	spin_unlock_irqrestore(&bdata->lock, flags);
++
++	return ret;
++}
++
+ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ {
+ 	const struct gpio_keys_button *button = bdata->button;
+@@ -370,6 +397,9 @@ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
+ 		return;
+ 	}
+ 
++	if (state && gpio_keys_ignore_wakeup_button_press(bdata))
++		return;
++
+ 	if (type == EV_ABS) {
+ 		if (state)
+ 			input_event(input, type, button->code, button->value);
+@@ -429,6 +459,9 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
+ 
+ 	BUG_ON(irq != bdata->irq);
+ 
++	if (gpio_keys_ignore_wakeup_button_press(bdata))
++		return IRQ_HANDLED;
++
+ 	spin_lock_irqsave(&bdata->lock, flags);
+ 
+ 	if (!bdata->key_pressed) {
+@@ -848,13 +881,18 @@ static int __maybe_unused gpio_keys_suspend(struct device *dev)
+ {
+ 	struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev);
+ 	struct input_dev *input = ddata->input;
++	unsigned long flags;
+ 	int i;
+ 
+ 	if (device_may_wakeup(dev)) {
+ 		for (i = 0; i < ddata->pdata->nbuttons; i++) {
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+-			if (bdata->button->wakeup)
++			if (bdata->button->wakeup) {
++				spin_lock_irqsave(&bdata->lock, flags);
++				bdata->suspended = true;
++				spin_unlock_irqrestore(&bdata->lock, flags);
+ 				enable_irq_wake(bdata->irq);
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+@@ -870,14 +908,21 @@ static int __maybe_unused gpio_keys_resume(struct device *dev)
+ {
+ 	struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev);
+ 	struct input_dev *input = ddata->input;
++	unsigned long flags;
+ 	int error = 0;
+ 	int i;
+ 
+ 	if (device_may_wakeup(dev)) {
+ 		for (i = 0; i < ddata->pdata->nbuttons; i++) {
+ 			struct gpio_button_data *bdata = &ddata->data[i];
+-			if (bdata->button->wakeup)
++			if (bdata->button->wakeup) {
+ 				disable_irq_wake(bdata->irq);
++				spin_lock_irqsave(&bdata->lock, flags);
++				bdata->resume_time = jiffies;
++				bdata->resume_time_valid = true;
++				bdata->suspended = false;
++				spin_unlock_irqrestore(&bdata->lock, flags);
++			}
+ 		}
+ 	} else {
+ 		mutex_lock(&input->mutex);
+-- 
+2.13.0
+

0013-iio-accel-bmc150-Add-support-for-BOSC0200-ACPI-devic.patch

@@ -0,0 +1,32 @@
+From bf3e9581e10a19b2ce77a45fe001116d269b4c7f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 18 Jun 2017 12:47:38 +0200
+Subject: [PATCH 13/16] iio: accel: bmc150: Add support for BOSC0200 ACPI
+ device id
+
+Add support for the BOSC0200 ACPI device id used on some x86 tablets.
+note driver_data is not set to a specific model, driver_data is not
+used anyways (instead detection is done on the chip_id reg) and the
+2 tablets with a BOSC0200 ACPI device id I've have 2 different chips,
+one has a BMA250E, the other a BMA222E.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/iio/accel/bmc150-accel-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/accel/bmc150-accel-i2c.c b/drivers/iio/accel/bmc150-accel-i2c.c
+index 8ca8041267ef..f85014fbaa12 100644
+--- a/drivers/iio/accel/bmc150-accel-i2c.c
++++ b/drivers/iio/accel/bmc150-accel-i2c.c
+@@ -64,6 +64,7 @@ static const struct acpi_device_id bmc150_accel_acpi_match[] = {
+ 	{"BMA250E",	bma250e},
+ 	{"BMA222E",	bma222e},
+ 	{"BMA0280",	bma280},
++	{"BOSC0200"},
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(acpi, bmc150_accel_acpi_match);
+-- 
+2.13.0
+

0014-mmc-sdhci-acpi-Workaround-conflict-with-PCI-wifi-on-.patch

@@ -0,0 +1,143 @@
+From 51eb7454942c68c84b82782e47637de3ba37f113 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 21 Jun 2017 15:08:39 +0300
+Subject: [PATCH 14/16] mmc: sdhci-acpi: Workaround conflict with PCI wifi on
+ GPD Win handheld
+
+GPDwin uses PCI wifi which conflicts with SDIO's use of
+acpi_device_fix_up_power() on child device nodes. Specifically
+acpi_device_fix_up_power() causes the wifi module to get turned off.
+Identifying GPDwin is problematic, but since SDIO is only used for wifi,
+the presence of the PCI wifi card in the expected slot with an ACPI
+companion node, is used to indicate that acpi_device_fix_up_power() should
+be avoided.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Cc: stable@vger.kernel.org
+---
+ drivers/mmc/host/sdhci-acpi.c | 70 +++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 64 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index c6a9a1bfaa22..b3fb155f50e4 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -45,6 +45,7 @@
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+ #include <asm/iosf_mbi.h>
++#include <linux/pci.h>
+ #endif
+ 
+ #include "sdhci.h"
+@@ -134,6 +135,16 @@ static bool sdhci_acpi_byt(void)
+ 	return x86_match_cpu(byt);
+ }
+ 
++static bool sdhci_acpi_cht(void)
++{
++	static const struct x86_cpu_id cht[] = {
++		{ X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
++		{}
++	};
++
++	return x86_match_cpu(cht);
++}
++
+ #define BYT_IOSF_SCCEP			0x63
+ #define BYT_IOSF_OCP_NETCTRL0		0x1078
+ #define BYT_IOSF_OCP_TIMEOUT_BASE	GENMASK(10, 8)
+@@ -178,6 +189,45 @@ static bool sdhci_acpi_byt_defer(struct device *dev)
+ 	return false;
+ }
+ 
++static bool sdhci_acpi_cht_pci_wifi(unsigned int vendor, unsigned int device,
++				    unsigned int slot, unsigned int parent_slot)
++{
++	struct pci_dev *dev, *parent, *from = NULL;
++
++	while (1) {
++		dev = pci_get_device(vendor, device, from);
++		pci_dev_put(from);
++		if (!dev)
++			break;
++		parent = pci_upstream_bridge(dev);
++		if (ACPI_COMPANION(&dev->dev) && PCI_SLOT(dev->devfn) == slot &&
++		    parent && PCI_SLOT(parent->devfn) == parent_slot &&
++		    !pci_upstream_bridge(parent)) {
++			pci_dev_put(dev);
++			return true;
++		}
++		from = dev;
++	}
++
++	return false;
++}
++
++/*
++ * GPDwin uses PCI wifi which conflicts with SDIO's use of
++ * acpi_device_fix_up_power() on child device nodes. Identifying GPDwin is
++ * problematic, but since SDIO is only used for wifi, the presence of the PCI
++ * wifi card in the expected slot with an ACPI companion node, is used to
++ * indicate that acpi_device_fix_up_power() should be avoided.
++ */
++static inline bool sdhci_acpi_no_fixup_child_power(const char *hid,
++						   const char *uid)
++{
++	return sdhci_acpi_cht() &&
++	       !strcmp(hid, "80860F14") &&
++	       !strcmp(uid, "2") &&
++	       sdhci_acpi_cht_pci_wifi(0x14e4, 0x43ec, 0, 28);
++}
++
+ #else
+ 
+ static inline void sdhci_acpi_byt_setting(struct device *dev)
+@@ -189,6 +239,12 @@ static inline bool sdhci_acpi_byt_defer(struct device *dev)
+ 	return false;
+ }
+ 
++static inline bool sdhci_acpi_no_fixup_child_power(const char *hid,
++						   const char *uid)
++{
++	return false;
++}
++
+ #endif
+ 
+ static int bxt_get_cd(struct mmc_host *mmc)
+@@ -390,11 +446,16 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	if (acpi_bus_get_device(handle, &device))
+ 		return -ENODEV;
+ 
++	hid = acpi_device_hid(device);
++	uid = device->pnp.unique_id;
++
+ 	/* Power on the SDHCI controller and its children */
+ 	acpi_device_fix_up_power(device);
+-	list_for_each_entry(child, &device->children, node)
+-		if (child->status.present && child->status.enabled)
+-			acpi_device_fix_up_power(child);
++	if (!sdhci_acpi_no_fixup_child_power(hid, uid)) {
++		list_for_each_entry(child, &device->children, node)
++			if (child->status.present && child->status.enabled)
++				acpi_device_fix_up_power(child);
++	}
+ 
+ 	if (acpi_bus_get_status(device) || !device->status.present)
+ 		return -ENODEV;
+@@ -402,9 +463,6 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	if (sdhci_acpi_byt_defer(dev))
+ 		return -EPROBE_DEFER;
+ 
+-	hid = acpi_device_hid(device);
+-	uid = device->pnp.unique_id;
+-
+ 	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!iomem)
+ 		return -ENOMEM;
+-- 
+2.13.0
+

0015-i2c-cht-wc-Add-Intel-Cherry-Trail-Whiskey-Cove-SMBUS.patch

@@ -0,0 +1,410 @@
+From bd0d7169342e47919f68e75d659968f02b62f84b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 3 Mar 2017 23:48:50 +0100
+Subject: [PATCH 15/16] i2c-cht-wc: Add Intel Cherry Trail Whiskey Cove SMBUS
+ controller driver
+
+The Intel Cherry Trail Whiskey Cove PMIC does not contain a builtin
+battery charger, instead boards with this PMIC use an external TI
+bq24292i charger IC, which is connected to a SMBUS controller built into
+the PMIC.
+
+This commit adds an i2c-bus driver for the PMIC's builtin SMBUS
+controller. The probe function for this i2c-bus will also register an
+i2c-client for the TI bq24292i charger after the i2c-bus has been
+registered.
+
+Note that several device-properties are set on the client-device to
+tell the bq24190 power-supply driver to integrate the Whiskey Cove PMIC
+and e.g. use the PMIC's BC1.2 detection (through extcon) to determine
+the maximum input current.
+
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+Changes in v2:
+-Various style (mostly captialization and variable name) fixes
+-Use device-properties instead of platform_data for the i2c_board_info
+---
+ drivers/i2c/busses/Kconfig      |   8 +
+ drivers/i2c/busses/Makefile     |   1 +
+ drivers/i2c/busses/i2c-cht-wc.c | 336 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 345 insertions(+)
+ create mode 100644 drivers/i2c/busses/i2c-cht-wc.c
+
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 144cbadc7c72..18c96178b177 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -187,6 +187,14 @@ config I2C_PIIX4
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called i2c-piix4.
+ 
++config I2C_CHT_WC
++	tristate "Intel Cherry Trail Whiskey Cove PMIC smbus controller"
++	depends on INTEL_SOC_PMIC_CHTWC
++	help
++	  If you say yes to this option, support will be included for the
++	  SMBus controller found in the Intel Cherry Trail Whiskey Cove PMIC
++	  found on some Intel Cherry Trail systems.
++
+ config I2C_NFORCE2
+ 	tristate "Nvidia nForce2, nForce3 and nForce4"
+ 	depends on PCI
+diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
+index 30b60855fbcd..f6443fa44f61 100644
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_I2C_ALI15X3)	+= i2c-ali15x3.o
+ obj-$(CONFIG_I2C_AMD756)	+= i2c-amd756.o
+ obj-$(CONFIG_I2C_AMD756_S4882)	+= i2c-amd756-s4882.o
+ obj-$(CONFIG_I2C_AMD8111)	+= i2c-amd8111.o
++obj-$(CONFIG_I2C_CHT_WC)	+= i2c-cht-wc.o
+ obj-$(CONFIG_I2C_I801)		+= i2c-i801.o
+ obj-$(CONFIG_I2C_ISCH)		+= i2c-isch.o
+ obj-$(CONFIG_I2C_ISMT)		+= i2c-ismt.o
+diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
+new file mode 100644
+index 000000000000..ccf0785bcb75
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-cht-wc.c
+@@ -0,0 +1,336 @@
++/*
++ * Intel CHT Whiskey Cove PMIC I2C Master driver
++ * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Based on various non upstream patches to support the CHT Whiskey Cove PMIC:
++ * Copyright (C) 2011 - 2014 Intel Corporation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version
++ * 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/completion.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdomain.h>
++#include <linux/mfd/intel_soc_pmic.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++#define CHT_WC_I2C_CTRL			0x5e24
++#define CHT_WC_I2C_CTRL_WR		BIT(0)
++#define CHT_WC_I2C_CTRL_RD		BIT(1)
++#define CHT_WC_I2C_CLIENT_ADDR		0x5e25
++#define CHT_WC_I2C_REG_OFFSET		0x5e26
++#define CHT_WC_I2C_WRDATA		0x5e27
++#define CHT_WC_I2C_RDDATA		0x5e28
++
++#define CHT_WC_EXTCHGRIRQ		0x6e0a
++#define CHT_WC_EXTCHGRIRQ_CLIENT_IRQ	BIT(0)
++#define CHT_WC_EXTCHGRIRQ_WRITE_IRQ	BIT(1)
++#define CHT_WC_EXTCHGRIRQ_READ_IRQ	BIT(2)
++#define CHT_WC_EXTCHGRIRQ_NACK_IRQ	BIT(3)
++#define CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK	((u8)GENMASK(3, 1))
++#define CHT_WC_EXTCHGRIRQ_MSK		0x6e17
++
++struct cht_wc_i2c_adap {
++	struct i2c_adapter adapter;
++	wait_queue_head_t wait;
++	struct irq_chip irqchip;
++	struct mutex irqchip_lock;
++	struct regmap *regmap;
++	struct irq_domain *irq_domain;
++	struct i2c_client *client;
++	int client_irq;
++	u8 irq_mask;
++	u8 old_irq_mask;
++	bool nack;
++	bool done;
++};
++
++static irqreturn_t cht_wc_i2c_adap_thread_handler(int id, void *data)
++{
++	struct cht_wc_i2c_adap *adap = data;
++	int ret, reg;
++
++	/* Read IRQs */
++	ret = regmap_read(adap->regmap, CHT_WC_EXTCHGRIRQ, &reg);
++	if (ret) {
++		dev_err(&adap->adapter.dev, "Error reading extchgrirq reg\n");
++		return IRQ_NONE;
++	}
++
++	reg &= ~adap->irq_mask;
++
++	/*
++	 * Immediately ack IRQs, so that if new IRQs arrives while we're
++	 * handling the previous ones our irq will re-trigger when we're done.
++	 */
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ, reg);
++	if (ret)
++		dev_err(&adap->adapter.dev, "Error writing extchgrirq reg\n");
++
++	/*
++	 * Do NOT use handle_nested_irq here, the client irq handler will
++	 * likely want to do i2c transfers and the i2c controller uses this
++	 * interrupt handler as well, so running the client irq handler from
++	 * this thread will cause things to lock up.
++	 */
++	if (reg & CHT_WC_EXTCHGRIRQ_CLIENT_IRQ) {
++		/*
++		 * generic_handle_irq expects local IRQs to be disabled
++		 * as normally it is called from interrupt context.
++		 */
++		local_irq_disable();
++		generic_handle_irq(adap->client_irq);
++		local_irq_enable();
++	}
++
++	if (reg & CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK) {
++		adap->nack = !!(reg & CHT_WC_EXTCHGRIRQ_NACK_IRQ);
++		adap->done = true;
++		wake_up(&adap->wait);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static u32 cht_wc_i2c_adap_master_func(struct i2c_adapter *adap)
++{
++	/* This i2c adapter only supports SMBUS byte transfers */
++	return I2C_FUNC_SMBUS_BYTE_DATA;
++}
++
++static int cht_wc_i2c_adap_smbus_xfer(struct i2c_adapter *_adap, u16 addr,
++				      unsigned short flags, char read_write,
++				      u8 command, int size,
++				      union i2c_smbus_data *data)
++{
++	struct cht_wc_i2c_adap *adap = i2c_get_adapdata(_adap);
++	int ret, reg;
++
++	adap->nack = false;
++	adap->done = false;
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_CLIENT_ADDR, addr);
++	if (ret)
++		return ret;
++
++	if (read_write == I2C_SMBUS_WRITE) {
++		ret = regmap_write(adap->regmap, CHT_WC_I2C_WRDATA, data->byte);
++		if (ret)
++			return ret;
++	}
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_REG_OFFSET, command);
++	if (ret)
++		return ret;
++
++	ret = regmap_write(adap->regmap, CHT_WC_I2C_CTRL,
++			   (read_write == I2C_SMBUS_WRITE) ?
++			   CHT_WC_I2C_CTRL_WR : CHT_WC_I2C_CTRL_RD);
++	if (ret)
++		return ret;
++
++	/* 3 second timeout, during cable plug the PMIC responds quite slow */
++	ret = wait_event_timeout(adap->wait, adap->done, 3 * HZ);
++	if (ret == 0)
++		return -ETIMEDOUT;
++	if (adap->nack)
++		return -EIO;
++
++	if (read_write == I2C_SMBUS_READ) {
++		ret = regmap_read(adap->regmap, CHT_WC_I2C_RDDATA, &reg);
++		if (ret)
++			return ret;
++
++		data->byte = reg;
++	}
++
++	return 0;
++}
++
++static const struct i2c_algorithm cht_wc_i2c_adap_algo = {
++	.functionality = cht_wc_i2c_adap_master_func,
++	.smbus_xfer = cht_wc_i2c_adap_smbus_xfer,
++};
++
++/**** irqchip for the client connected to the extchgr i2c adapter ****/
++static void cht_wc_i2c_irq_lock(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	mutex_lock(&adap->irqchip_lock);
++}
++
++static void cht_wc_i2c_irq_sync_unlock(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++	int ret;
++
++	if (adap->irq_mask != adap->old_irq_mask) {
++		ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ_MSK,
++				   adap->irq_mask);
++		if (ret == 0)
++			adap->old_irq_mask = adap->irq_mask;
++		else
++			dev_err(&adap->adapter.dev, "Error writing EXTCHGRIRQ_MSK\n");
++	}
++
++	mutex_unlock(&adap->irqchip_lock);
++}
++
++static void cht_wc_i2c_irq_enable(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	adap->irq_mask &= ~CHT_WC_EXTCHGRIRQ_CLIENT_IRQ;
++}
++
++static void cht_wc_i2c_irq_disable(struct irq_data *data)
++{
++	struct cht_wc_i2c_adap *adap = irq_data_get_irq_chip_data(data);
++
++	adap->irq_mask |= CHT_WC_EXTCHGRIRQ_CLIENT_IRQ;
++}
++
++static const struct irq_chip cht_wc_i2c_irq_chip = {
++	.irq_bus_lock		= cht_wc_i2c_irq_lock,
++	.irq_bus_sync_unlock	= cht_wc_i2c_irq_sync_unlock,
++	.irq_disable		= cht_wc_i2c_irq_disable,
++	.irq_enable		= cht_wc_i2c_irq_enable,
++	.name			= "cht_wc_ext_chrg_irq_chip",
++};
++
++static const struct property_entry bq24190_props[] = {
++	PROPERTY_ENTRY_STRING("extcon-name", "cht_wcove_pwrsrc"),
++	PROPERTY_ENTRY_BOOL("omit-battery-class"),
++	PROPERTY_ENTRY_BOOL("disable-reset"),
++	{ }
++};
++
++static int cht_wc_i2c_adap_i2c_probe(struct platform_device *pdev)
++{
++	struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent);
++	struct cht_wc_i2c_adap *adap;
++	struct i2c_board_info board_info = {
++		.type = "bq24190",
++		.addr = 0x6b,
++		.properties = bq24190_props,
++	};
++	int ret, irq;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(&pdev->dev, "Error missing irq resource\n");
++		return -EINVAL;
++	}
++
++	adap = devm_kzalloc(&pdev->dev, sizeof(*adap), GFP_KERNEL);
++	if (!adap)
++		return -ENOMEM;
++
++	init_waitqueue_head(&adap->wait);
++	mutex_init(&adap->irqchip_lock);
++	adap->irqchip = cht_wc_i2c_irq_chip;
++	adap->regmap = pmic->regmap;
++	adap->adapter.owner = THIS_MODULE;
++	adap->adapter.class = I2C_CLASS_HWMON;
++	adap->adapter.algo = &cht_wc_i2c_adap_algo;
++	strlcpy(adap->adapter.name, "PMIC I2C Adapter",
++		sizeof(adap->adapter.name));
++	adap->adapter.dev.parent = &pdev->dev;
++
++	/* Clear and activate i2c-adapter interrupts, disable client IRQ */
++	adap->old_irq_mask = adap->irq_mask = ~CHT_WC_EXTCHGRIRQ_ADAP_IRQMASK;
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ, ~adap->irq_mask);
++	if (ret)
++		return ret;
++
++	ret = regmap_write(adap->regmap, CHT_WC_EXTCHGRIRQ_MSK, adap->irq_mask);
++	if (ret)
++		return ret;
++
++	/* Alloc and register client IRQ */
++	adap->irq_domain = irq_domain_add_linear(pdev->dev.of_node, 1,
++						 &irq_domain_simple_ops, NULL);
++	if (!adap->irq_domain)
++		return -ENOMEM;
++
++	adap->client_irq = irq_create_mapping(adap->irq_domain, 0);
++	if (!adap->client_irq) {
++		ret = -ENOMEM;
++		goto remove_irq_domain;
++	}
++
++	irq_set_chip_data(adap->client_irq, adap);
++	irq_set_chip_and_handler(adap->client_irq, &adap->irqchip,
++				 handle_simple_irq);
++
++	ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
++					cht_wc_i2c_adap_thread_handler,
++					IRQF_ONESHOT, "PMIC I2C Adapter", adap);
++	if (ret)
++		goto remove_irq_domain;
++
++	i2c_set_adapdata(&adap->adapter, adap);
++	ret = i2c_add_adapter(&adap->adapter);
++	if (ret)
++		goto remove_irq_domain;
++
++	board_info.irq = adap->client_irq;
++	adap->client = i2c_new_device(&adap->adapter, &board_info);
++	if (!adap->client) {
++		ret = -ENOMEM;
++		goto del_adapter;
++	}
++
++	platform_set_drvdata(pdev, adap);
++	return 0;
++
++del_adapter:
++	i2c_del_adapter(&adap->adapter);
++remove_irq_domain:
++	irq_domain_remove(adap->irq_domain);
++	return ret;
++}
++
++static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev)
++{
++	struct cht_wc_i2c_adap *adap = platform_get_drvdata(pdev);
++
++	i2c_unregister_device(adap->client);
++	i2c_del_adapter(&adap->adapter);
++	irq_domain_remove(adap->irq_domain);
++
++	return 0;
++}
++
++static struct platform_device_id cht_wc_i2c_adap_id_table[] = {
++	{ .name = "cht_wcove_ext_chgr" },
++	{},
++};
++MODULE_DEVICE_TABLE(platform, cht_wc_i2c_adap_id_table);
++
++struct platform_driver cht_wc_i2c_adap_driver = {
++	.probe = cht_wc_i2c_adap_i2c_probe,
++	.remove = cht_wc_i2c_adap_i2c_remove,
++	.driver = {
++		.name = "cht_wcove_ext_chgr",
++	},
++	.id_table = cht_wc_i2c_adap_id_table,
++};
++module_platform_driver(cht_wc_i2c_adap_driver);
++
++MODULE_DESCRIPTION("Intel CHT Whiskey Cove PMIC I2C Master driver");
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.13.0
+

0016-Input-silead-Do-not-try-to-directly-access-the-GPIO-.patch

@@ -0,0 +1,54 @@
+From fd4fb1f6633b21042ff084868323e15e708fe1cd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 1 Jan 2017 22:11:20 +0100
+Subject: [PATCH 16/16] Input: silead: Do not try to directly access the GPIO
+ when using ACPI pm
+
+On some x86 tablets we cannot directly access the GPIOs as they are
+claimed by the ACPI tables, so check it the i2c client is not being
+power-managed by ACPI before trying to get the power pin GPIO.
+
+Note this is a workaround patch to fix this until Andy' gpiolib-ACPI
+patches which make gpiolib more strict land, once those are landed this
+patch is no longer needed.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/touchscreen/silead.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index c0ba40c09699..30fba3cbe277 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -517,12 +518,21 @@ static int silead_ts_probe(struct i2c_client *client,
+ 	if (error)
+ 		return error;
+ 
+-	/* Power GPIO pin */
+-	data->gpio_power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+-	if (IS_ERR(data->gpio_power)) {
+-		if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
+-			dev_err(dev, "Shutdown GPIO request failed\n");
+-		return PTR_ERR(data->gpio_power);
++	/*
++	 * If device power is not managed by ACPI, get the power_gpio
++	 * and manage it ourselves.
++	 */
++#ifdef CONFIG_ACPI
++	if (!acpi_bus_power_manageable(ACPI_HANDLE(dev)))
++#endif
++	{
++		data->gpio_power = devm_gpiod_get_optional(dev, "power",
++							   GPIOD_OUT_LOW);
++		if (IS_ERR(data->gpio_power)) {
++			if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
++				dev_err(dev, "Power GPIO request failed\n");
++			return PTR_ERR(data->gpio_power);
++		}
+ 	}
+ 
+ 	error = silead_ts_setup(client);
+-- 
+2.13.0
+

1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch

@@ -0,0 +1,296 @@
+From patchwork Mon Nov  6 12:31:12 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] kvm: vmx: Reinstate support for CPUs without virtual NMI
+From: Paolo Bonzini <pbonzini@redhat.com>
+X-Patchwork-Id: 10043403
+Message-Id: <1509971473-74491-2-git-send-email-pbonzini@redhat.com>
+To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
+Cc: rkrcmar@redhat.com, stable@vger.kernel.org
+Date: Mon,  6 Nov 2017 13:31:12 +0100
+
+This is more or less a revert of commit 2c82878b0cb3 ("KVM: VMX: require
+virtual NMI support", 2017-03-27); it turns out that Core 2 Duo machines
+only had virtual NMIs in some SKUs.
+
+The revert is not trivial because in the meanwhile there have been several
+fixes to nested NMI injection.  Therefore, the entire vNMI state is moved
+to struct loaded_vmcs.
+
+Another change compared to before the patch is a simplification here:
+
+       if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked &&
+           !(is_guest_mode(vcpu) && nested_cpu_has_virtual_nmis(
+                                       get_vmcs12(vcpu))))) {
+
+The final condition here is always true (because nested_cpu_has_virtual_nmis
+is always false) and is removed.
+
+Fixes: 2c82878b0cb38fd516fd612c67852a6bbf282003
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1490803
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ arch/x86/kvm/vmx.c | 150 +++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 106 insertions(+), 44 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e6c8ffa84968..d6b3b12ae1e2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -202,6 +202,10 @@ struct loaded_vmcs {
+ 	bool nmi_known_unmasked;
+ 	unsigned long vmcs_host_cr3;	/* May not match real cr3 */
+ 	unsigned long vmcs_host_cr4;	/* May not match real cr4 */
++	/* Support for vnmi-less CPUs */
++	int soft_vnmi_blocked;
++	ktime_t entry_time;
++	s64 vnmi_blocked_time;
+ 	struct list_head loaded_vmcss_on_cpu_link;
+ };
+ 
+@@ -1291,6 +1295,11 @@ static inline bool cpu_has_vmx_invpcid(void)
+ 		SECONDARY_EXEC_ENABLE_INVPCID;
+ }
+ 
++static inline bool cpu_has_virtual_nmis(void)
++{
++	return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
+ static inline bool cpu_has_vmx_wbinvd_exit(void)
+ {
+ 	return vmcs_config.cpu_based_2nd_exec_ctrl &
+@@ -1348,11 +1357,6 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+ 		(vmcs12->secondary_vm_exec_control & bit);
+ }
+ 
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+-	return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+ static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+ {
+ 	return vmcs12->pin_based_vm_exec_control &
+@@ -3712,9 +3716,9 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 				&_vmexit_control) < 0)
+ 		return -EIO;
+ 
+-	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING |
+-		PIN_BASED_VIRTUAL_NMIS;
+-	opt = PIN_BASED_POSTED_INTR | PIN_BASED_VMX_PREEMPTION_TIMER;
++	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++	opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++		 PIN_BASED_VMX_PREEMPTION_TIMER;
+ 	if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+ 				&_pin_based_exec_control) < 0)
+ 		return -EIO;
+@@ -5669,7 +5673,8 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ 
+ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ {
+-	if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++	if (!cpu_has_virtual_nmis() ||
++	    vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+ 		enable_irq_window(vcpu);
+ 		return;
+ 	}
+@@ -5709,6 +5714,19 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
++	if (!cpu_has_virtual_nmis()) {
++		/*
++		 * Tracking the NMI-blocked state in software is built upon
++		 * finding the next open IRQ window. This, in turn, depends on
++		 * well-behaving guests: They have to keep IRQs disabled at
++		 * least as long as the NMI handler runs. Otherwise we may
++		 * cause NMI nesting, maybe breaking the guest. But as this is
++		 * highly unlikely, we can live with the residual risk.
++		 */
++		vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++		vmx->loaded_vmcs->vnmi_blocked_time = 0;
++	}
++
+ 	++vcpu->stat.nmi_injections;
+ 	vmx->loaded_vmcs->nmi_known_unmasked = false;
+ 
+@@ -5727,6 +5745,8 @@ static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	bool masked;
+ 
++	if (!cpu_has_virtual_nmis())
++		return vmx->loaded_vmcs->soft_vnmi_blocked;
+ 	if (vmx->loaded_vmcs->nmi_known_unmasked)
+ 		return false;
+ 	masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+@@ -5738,13 +5758,20 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+-	vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+-	if (masked)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+-				GUEST_INTR_STATE_NMI);
++	if (!cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++			vmx->loaded_vmcs->vnmi_blocked_time = 0;
++		}
++	} else {
++		vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++		if (masked)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++					GUEST_INTR_STATE_NMI);
++	}
+ }
+ 
+ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+@@ -5752,6 +5779,10 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+ 	if (to_vmx(vcpu)->nested.nested_run_pending)
+ 		return 0;
+ 
++	if (!cpu_has_virtual_nmis() &&
++	    to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++		return 0;
++
+ 	return	!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ 		  (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+ 		   | GUEST_INTR_STATE_NMI));
+@@ -6479,6 +6510,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
+ 	 * AAK134, BY25.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+ 
+@@ -6965,7 +6997,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
+ 	}
+ 
+ 	/* Create a new VMCS */
+-	item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
++	item = kzalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
+ 	if (!item)
+ 		return NULL;
+ 	item->vmcs02.vmcs = alloc_vmcs();
+@@ -7982,6 +8014,7 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)
+ 	 * "blocked by NMI" bit has to be set before next VM entry.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ 				GUEST_INTR_STATE_NMI);
+@@ -8826,6 +8859,25 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ 		return 0;
+ 	}
+ 
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked)) {
++		if (vmx_interrupt_allowed(vcpu)) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		} else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++			   vcpu->arch.nmi_pending) {
++			/*
++			 * This CPU don't support us in finding the end of an
++			 * NMI-blocked window if the guest runs with IRQs
++			 * disabled. So we pull the trigger after 1 s of
++			 * futile waiting, but inform the user about this.
++			 */
++			printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++			       "state on VCPU %d after 1 s timeout\n",
++			       __func__, vcpu->vcpu_id);
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		}
++	}
++
+ 	if (exit_reason < kvm_vmx_max_exit_handlers
+ 	    && kvm_vmx_exit_handlers[exit_reason])
+ 		return kvm_vmx_exit_handlers[exit_reason](vcpu);
+@@ -9108,33 +9160,38 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+ 
+ 	idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ 
+-	if (vmx->loaded_vmcs->nmi_known_unmasked)
+-		return;
+-	/*
+-	 * Can't use vmx->exit_intr_info since we're not sure what
+-	 * the exit reason is.
+-	 */
+-	exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-	unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+-	vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+-	/*
+-	 * SDM 3: 27.7.1.2 (September 2008)
+-	 * Re-set bit "block by NMI" before VM entry if vmexit caused by
+-	 * a guest IRET fault.
+-	 * SDM 3: 23.2.2 (September 2008)
+-	 * Bit 12 is undefined in any of the following cases:
+-	 *  If the VM exit sets the valid bit in the IDT-vectoring
+-	 *   information field.
+-	 *  If the VM exit is due to a double fault.
+-	 */
+-	if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+-	    vector != DF_VECTOR && !idtv_info_valid)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmx->loaded_vmcs->nmi_known_unmasked =
+-			!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+-			  & GUEST_INTR_STATE_NMI);
++	if (cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->nmi_known_unmasked)
++			return;
++		/*
++		 * Can't use vmx->exit_intr_info since we're not sure what
++		 * the exit reason is.
++		 */
++		exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++		unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++		vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++		/*
++		 * SDM 3: 27.7.1.2 (September 2008)
++		 * Re-set bit "block by NMI" before VM entry if vmexit caused by
++		 * a guest IRET fault.
++		 * SDM 3: 23.2.2 (September 2008)
++		 * Bit 12 is undefined in any of the following cases:
++		 *  If the VM exit sets the valid bit in the IDT-vectoring
++		 *   information field.
++		 *  If the VM exit is due to a double fault.
++		 */
++		if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++		    vector != DF_VECTOR && !idtv_info_valid)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmx->loaded_vmcs->nmi_known_unmasked =
++				!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++				  & GUEST_INTR_STATE_NMI);
++	} else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->vnmi_blocked_time +=
++			ktime_to_ns(ktime_sub(ktime_get(),
++					      vmx->loaded_vmcs->entry_time));
+ }
+ 
+ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+@@ -9251,6 +9308,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	unsigned long debugctlmsr, cr3, cr4;
+ 
++	/* Record the guest's net vcpu time for enforced NMI injections. */
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->entry_time = ktime_get();
++
+ 	/* Don't enter VMX if guest state is invalid, let the exit handler
+ 	   start emulation until we arrive back to a valid state */
+ 	if (vmx->emulation_required)

1-3-net-set-tb--fast_sk_family.patch

@@ -0,0 +1,50 @@
+From patchwork Mon Sep 18 16:28:55 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/3] net: set tb->fast_sk_family
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815031
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-2-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:55 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+We need to set the tb->fast_sk_family properly so we can use the proper
+comparison function for all subsequent reuseport bind requests.
+
+Cc: stable@vger.kernel.org
+Fixes: 637bc8bbe6c0 ("inet: reset tb->fastreuseport when adding a reuseport sk")
+Reported-and-tested-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index b9c64b40a83a..f87f4805e244 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -328,6 +328,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 			tb->fastuid = uid;
+ 			tb->fast_rcv_saddr = sk->sk_rcv_saddr;
+ 			tb->fast_ipv6_only = ipv6_only_sock(sk);
++			tb->fast_sk_family = sk->sk_family;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 			tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ #endif
+@@ -354,6 +355,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 				tb->fastuid = uid;
+ 				tb->fast_rcv_saddr = sk->sk_rcv_saddr;
+ 				tb->fast_ipv6_only = ipv6_only_sock(sk);
++				tb->fast_sk_family = sk->sk_family;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 				tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ #endif

2-3-net-use-inet6_rcv_saddr-to-compare-sockets.patch

@@ -0,0 +1,44 @@
+From patchwork Mon Sep 18 16:28:56 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [2/3] net: use inet6_rcv_saddr to compare sockets
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815028
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-3-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:56 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+In ipv6_rcv_saddr_equal() we need to use inet6_rcv_saddr(sk) for the
+ipv6 compare with the fast socket information to make sure we're doing
+the proper comparisons.
+
+Cc: stable@vger.kernel.org
+Fixes: 637bc8bbe6c0 ("inet: reset tb->fastreuseport when adding a reuseport sk")
+Reported-and-tested-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index f87f4805e244..a1bf30438bc5 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -266,7 +266,7 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	if (tb->fast_sk_family == AF_INET6)
+ 		return ipv6_rcv_saddr_equal(&tb->fast_v6_rcv_saddr,
+-					    &sk->sk_v6_rcv_saddr,
++					    inet6_rcv_saddr(sk),
+ 					    tb->fast_rcv_saddr,
+ 					    sk->sk_rcv_saddr,
+ 					    tb->fast_ipv6_only,

3-3-inet-fix-improper-empty-comparison.patch

@@ -0,0 +1,53 @@
+From patchwork Mon Sep 18 16:28:57 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [3/3] inet: fix improper empty comparison
+X-Patchwork-Submitter: Josef Bacik <josef@toxicpanda.com>
+X-Patchwork-Id: 815029
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1505752137-15522-4-git-send-email-jbacik@fb.com>
+To: davem@davemloft.net, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, crobinso@redhat.com,
+ labbott@redhat.com, kernel-team@fb.com
+Cc: Josef Bacik <jbacik@fb.com>, stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 12:28:57 -0400
+From: josef@toxicpanda.com
+List-Id: <netdev.vger.kernel.org>
+
+From: Josef Bacik <jbacik@fb.com>
+
+When doing my reuseport rework I screwed up and changed a
+
+if (hlist_empty(&tb->owners))
+
+to
+
+if (!hlist_empty(&tb->owners))
+
+This is obviously bad as all of the reuseport/reuse logic was reversed,
+which caused weird problems like allowing an ipv4 bind conflict if we
+opened an ipv4 only socket on a port followed by an ipv6 only socket on
+the same port.
+
+Cc: stable@vger.kernel.org
+Fixes: b9470c27607b ("inet: kill smallest_size and smallest_port")
+Reported-by: Cole Robinson <crobinso@redhat.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index a1bf30438bc5..c039c937ba90 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -321,7 +321,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 			goto fail_unlock;
+ 	}
+ success:
+-	if (!hlist_empty(&tb->owners)) {
++	if (hlist_empty(&tb->owners)) {
+ 		tb->fastreuse = reuse;
+ 		if (sk->sk_reuseport) {
+ 			tb->fastreuseport = FASTREUSEPORT_ANY;

ARM-tegra-usb-no-reset.patch

@@ -0,0 +1,28 @@
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Thu, 3 May 2012 20:27:11 +0100
+Subject: [PATCH] ARM: tegra: usb no reset
+
+Patch for disconnect issues with storage attached to a
+ tegra-ehci controller
+---
+ drivers/usb/core/hub.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 43cb2f2e3b43..7f838ec11c81 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4996,6 +4996,13 @@ static void hub_event(struct work_struct *work)
+ 			(u16) hub->change_bits[0],
+ 			(u16) hub->event_bits[0]);
+ 
++	/* Don't disconnect USB-SATA on TrimSlice */
++	if (strcmp(dev_name(hdev->bus->controller), "tegra-ehci.0") == 0) {
++		if ((hdev->state == 7) && (hub->change_bits[0] == 0) &&
++				(hub->event_bits[0] == 0x2))
++			hub->event_bits[0] = 0;
++	}
++
+ 	/* Lock the device, then check to see if we were
+ 	 * disconnected while waiting for the lock to succeed. */
+ 	usb_lock_device(hdev);

Add-EFI-signature-data-types.patch

@@ -0,0 +1,60 @@
+From 0451d4e795929a69a0fda6d960aa4b077c5bd179 Mon Sep 17 00:00:00 2001
+From: Dave Howells <dhowells@redhat.com>
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 1/4] efi: Add EFI signature data types
+
+Add the data types that are used for containing hashes, keys and
+certificates for cryptographic verification along with their corresponding
+type GUIDs.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ include/linux/efi.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index ec36f42..3259ad6 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -614,6 +614,10 @@ void efi_native_runtime_setup(void);
+ #define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596,  0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
+ #define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300,  0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
+
++#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
++#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
++#define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed)
++
+ /*
+  * This GUID is used to pass to the kernel proper the struct screen_info
+  * structure that was populated by the stub based on the GOP protocol instance
+@@ -873,6 +877,27 @@ typedef struct {
+ 	efi_memory_desc_t entry[0];
+ } efi_memory_attributes_table_t;
+
++typedef struct  {
++	efi_guid_t signature_owner;
++	u8 signature_data[];
++} efi_signature_data_t;
++
++typedef struct {
++	efi_guid_t signature_type;
++	u32 signature_list_size;
++	u32 signature_header_size;
++	u32 signature_size;
++	u8 signature_header[];
++	/* efi_signature_data_t signatures[][] */
++} efi_signature_list_t;
++
++typedef u8 efi_sha256_hash_t[32];
++
++typedef struct {
++	efi_sha256_hash_t to_be_signed_hash;
++	efi_time_t time_of_revocation;
++} efi_cert_x509_sha256_t;
++
+ /*
+  * All runtime access to EFI goes through this structure:
+  */
+-- 
+2.9.3
+

Add-an-EFI-signature-blob-parser-and-key-loader.patch

@@ -0,0 +1,197 @@
+From e4c62c12635a371e43bd17e8d33a936668264491 Mon Sep 17 00:00:00 2001
+From: Dave Howells <dhowells@redhat.com>
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 2/4] efi: Add an EFI signature blob parser
+
+Add a function to parse an EFI signature blob looking for elements of
+interest.  A list is made up of a series of sublists, where all the
+elements in a sublist are of the same type, but sublists can be of
+different types.
+
+For each sublist encountered, the function pointed to by the
+get_handler_for_guid argument is called with the type specifier GUID and
+returns either a pointer to a function to handle elements of that type or
+NULL if the type is not of interest.
+
+If the sublist is of interest, each element is passed to the handler
+function in turn.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ certs/Kconfig       |   8 ++++
+ certs/Makefile      |   1 +
+ certs/efi_parser.c  | 112 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/efi.h |   9 +++++
+ 4 files changed, 130 insertions(+)
+ create mode 100644 certs/efi_parser.c
+
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 6ce51ed..630ae09 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -82,4 +82,12 @@ config SYSTEM_BLACKLIST_HASH_LIST
+ 	  wrapper to incorporate the list into the kernel.  Each <hash> should
+ 	  be a string of hex digits.
+
++config EFI_SIGNATURE_LIST_PARSER
++	bool "EFI signature list parser"
++	depends on EFI
++	select X509_CERTIFICATE_PARSER
++	help
++	  This option provides support for parsing EFI signature lists for
++	  X.509 certificates and turning them into keys.
++
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 4119bb3..738151a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
+ else
+ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
++obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
+
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+
+diff --git a/certs/efi_parser.c b/certs/efi_parser.c
+new file mode 100644
+index 0000000..4e396f9
+--- /dev/null
++++ b/certs/efi_parser.c
+@@ -0,0 +1,112 @@
++/* EFI signature/key/certificate list parser
++ *
++ * Copyright (C) 2012, 2016 Red Hat, Inc. All Rights Reserved.
++ * Written by David Howells (dhowells@redhat.com)
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public Licence
++ * as published by the Free Software Foundation; either version
++ * 2 of the Licence, or (at your option) any later version.
++ */
++
++#define pr_fmt(fmt) "EFI: "fmt
++#include <linux/module.h>
++#include <linux/printk.h>
++#include <linux/err.h>
++#include <linux/efi.h>
++
++/**
++ * parse_efi_signature_list - Parse an EFI signature list for certificates
++ * @source: The source of the key
++ * @data: The data blob to parse
++ * @size: The size of the data blob
++ * @get_handler_for_guid: Get the handler func for the sig type (or NULL)
++ *
++ * Parse an EFI signature list looking for elements of interest.  A list is
++ * made up of a series of sublists, where all the elements in a sublist are of
++ * the same type, but sublists can be of different types.
++ *
++ * For each sublist encountered, the @get_handler_for_guid function is called
++ * with the type specifier GUID and returns either a pointer to a function to
++ * handle elements of that type or NULL if the type is not of interest.
++ *
++ * If the sublist is of interest, each element is passed to the handler
++ * function in turn.
++ *
++ * Error EBADMSG is returned if the list doesn't parse correctly and 0 is
++ * returned if the list was parsed correctly.  No error can be returned from
++ * the @get_handler_for_guid function or the element handler function it
++ * returns.
++ */
++int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *))
++{
++	efi_element_handler_t handler;
++	unsigned offs = 0;
++
++	pr_devel("-->%s(,%zu)\n", __func__, size);
++
++	while (size > 0) {
++		const efi_signature_data_t *elem;
++		efi_signature_list_t list;
++		size_t lsize, esize, hsize, elsize;
++
++		if (size < sizeof(list))
++			return -EBADMSG;
++
++		memcpy(&list, data, sizeof(list));
++		pr_devel("LIST[%04x] guid=%pUl ls=%x hs=%x ss=%x\n",
++			 offs,
++			 list.signature_type.b, list.signature_list_size,
++			 list.signature_header_size, list.signature_size);
++
++		lsize = list.signature_list_size;
++		hsize = list.signature_header_size;
++		esize = list.signature_size;
++		elsize = lsize - sizeof(list) - hsize;
++
++		if (lsize > size) {
++			pr_devel("<--%s() = -EBADMSG [overrun @%x]\n",
++				 __func__, offs);
++			return -EBADMSG;
++		}
++
++		if (lsize < sizeof(list) ||
++		    lsize - sizeof(list) < hsize ||
++		    esize < sizeof(*elem) ||
++		    elsize < esize ||
++		    elsize % esize != 0) {
++			pr_devel("- bad size combo @%x\n", offs);
++			return -EBADMSG;
++		}
++
++		handler = get_handler_for_guid(&list.signature_type);
++		if (!handler) {
++			data += lsize;
++			size -= lsize;
++			offs += lsize;
++			continue;
++		}
++
++		data += sizeof(list) + hsize;
++		size -= sizeof(list) + hsize;
++		offs += sizeof(list) + hsize;
++
++		for (; elsize > 0; elsize -= esize) {
++			elem = data;
++
++			pr_devel("ELEM[%04x]\n", offs);
++			handler(source,
++				&elem->signature_data,
++				esize - sizeof(*elem));
++
++			data += esize;
++			size -= esize;
++			offs += esize;
++		}
++	}
++
++	return 0;
++}
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 3259ad6..08024c6 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -1055,6 +1055,15 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
+ char * __init efi_md_typeattr_format(char *buf, size_t size,
+ 				     const efi_memory_desc_t *md);
+
++
++typedef void (*efi_element_handler_t)(const char *source,
++				      const void *element_data,
++				      size_t element_size);
++extern int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *));
++
+ /**
+  * efi_range_is_wc - check the WC bit on an address range
+  * @start: starting kvirt address
+-- 
+2.9.3
+

CVE-2017-16538.patch

@@ -0,0 +1,166 @@
+From patchwork Tue Sep 26 21:10:20 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm
+ start.
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44566
+Message-Id: <20170926211021.11036-1-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:20 +0100
+
+Warm start has no check as whether a genuine device has
+connected and proceeds to next execution path.
+
+Check device should read 0x47 at offset of 2 on USB descriptor read
+and it is the amount requested of 6 bytes.
+
+Fix for
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access as
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 5e320fa4a795..992f2011a6ba 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -494,18 +494,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
+ 
+ static int lme2510_return_status(struct dvb_usb_device *d)
+ {
+-	int ret = 0;
++	int ret;
+ 	u8 *data;
+ 
+-	data = kzalloc(10, GFP_KERNEL);
++	data = kzalloc(6, GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
+-	ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
+-			0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
+-	info("Firmware Status: %x (%x)", ret , data[2]);
++	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
++			      0x06, 0x80, 0x0302, 0x00,
++			      data, 0x6, 200);
++	if (ret != 6)
++		ret = -EINVAL;
++	else
++		ret = data[2];
++
++	info("Firmware Status: %6ph", data);
+ 
+-	ret = (ret < 0) ? -ENODEV : data[2];
+ 	kfree(data);
+ 	return ret;
+ }
+@@ -1189,6 +1194,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d)
+ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ {
+ 	struct lme2510_state *st = d->priv;
++	int status;
+ 
+ 	usb_reset_configuration(d->udev);
+ 
+@@ -1197,12 +1203,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ 
+ 	st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
+ 
+-	if (lme2510_return_status(d) == 0x44) {
++	status = lme2510_return_status(d);
++	if (status == 0x44) {
+ 		*name = lme_firmware_switch(d, 0);
+ 		return COLD;
+ 	}
+ 
+-	return 0;
++	if (status != 0x47)
++		return -EINVAL;
++
++	return WARM;
+ }
+ 
+ static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
+From patchwork Tue Sep 26 21:10:21 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to
+ dm04_lme2510_tuner
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44567
+Message-Id: <20170926211021.11036-2-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:21 +0100
+
+When the tuner was split from m88rs2000 the attach function is in wrong
+place.
+
+Move to dm04_lme2510_tuner to trap errors on failure and removing
+a call to lme_coldreset.
+
+Prevents driver starting up without any tuner connected.
+
+Fixes to trap for ts2020 fail.
+LME2510(C): FE Found M88RS2000
+ts2020: probe of 0-0060 failed with error -11
+...
+LME2510(C): TUN Found RS2000 tuner
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] PREEMPT SMP KASAN
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 992f2011a6ba..be26c029546b 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -1076,8 +1076,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap)
+ 
+ 		if (adap->fe[0]) {
+ 			info("FE Found M88RS2000");
+-			dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,
+-					&d->i2c_adap);
+ 			st->i2c_tuner_gate_w = 5;
+ 			st->i2c_tuner_gate_r = 5;
+ 			st->i2c_tuner_addr = 0x60;
+@@ -1143,17 +1141,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap)
+ 			ret = st->tuner_config;
+ 		break;
+ 	case TUNER_RS2000:
+-		ret = st->tuner_config;
++		if (dvb_attach(ts2020_attach, adap->fe[0],
++			       &ts2020_config, &d->i2c_adap))
++			ret = st->tuner_config;
+ 		break;
+ 	default:
+ 		break;
+ 	}
+ 
+-	if (ret)
++	if (ret) {
+ 		info("TUN Found %s tuner", tun_msg[ret]);
+-	else {
+-		info("TUN No tuner found --- resetting device");
+-		lme_coldreset(d);
++	} else {
++		info("TUN No tuner found");
+ 		return -ENODEV;
+ 	}
+ 

CVE-2017-7477.patch

@@ -0,0 +1,73 @@
+From 4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Fri, 21 Apr 2017 23:14:48 +0200
+Subject: macsec: avoid heap overflow in skb_to_sgvec
+
+While this may appear as a humdrum one line change, it's actually quite
+important. An sk_buff stores data in three places:
+
+1. A linear chunk of allocated memory in skb->data. This is the easiest
+   one to work with, but it precludes using scatterdata since the memory
+   must be linear.
+2. The array skb_shinfo(skb)->frags, which is of maximum length
+   MAX_SKB_FRAGS. This is nice for scattergather, since these fragments
+   can point to different pages.
+3. skb_shinfo(skb)->frag_list, which is a pointer to another sk_buff,
+   which in turn can have data in either (1) or (2).
+
+The first two are rather easy to deal with, since they're of a fixed
+maximum length, while the third one is not, since there can be
+potentially limitless chains of fragments. Fortunately dealing with
+frag_list is opt-in for drivers, so drivers don't actually have to deal
+with this mess. For whatever reason, macsec decided it wanted pain, and
+so it explicitly specified NETIF_F_FRAGLIST.
+
+Because dealing with (1), (2), and (3) is insane, most users of sk_buff
+doing any sort of crypto or paging operation calls a convenient function
+called skb_to_sgvec (which happens to be recursive if (3) is in use!).
+This takes a sk_buff as input, and writes into its output pointer an
+array of scattergather list items. Sometimes people like to declare a
+fixed size scattergather list on the stack; othertimes people like to
+allocate a fixed size scattergather list on the heap. However, if you're
+doing it in a fixed-size fashion, you really shouldn't be using
+NETIF_F_FRAGLIST too (unless you're also ensuring the sk_buff and its
+frag_list children arent't shared and then you check the number of
+fragments in total required.)
+
+Macsec specifically does this:
+
+        size += sizeof(struct scatterlist) * (MAX_SKB_FRAGS + 1);
+        tmp = kmalloc(size, GFP_ATOMIC);
+        *sg = (struct scatterlist *)(tmp + sg_offset);
+	...
+        sg_init_table(sg, MAX_SKB_FRAGS + 1);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+Specifying MAX_SKB_FRAGS + 1 is the right answer usually, but not if you're
+using NETIF_F_FRAGLIST, in which case the call to skb_to_sgvec will
+overflow the heap, and disaster ensues.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: stable@vger.kernel.org
+Cc: security@kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/macsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index ff0a5ed..dbab05a 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2716,7 +2716,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
+ }
+ 
+ #define MACSEC_FEATURES \
+-	(NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
++	(NETIF_F_SG | NETIF_F_HIGHDMA)
+ static struct lock_class_key macsec_netdev_addr_lock_key;
+ 
+ static int macsec_dev_init(struct net_device *dev)
+-- 
+cgit v1.1
+

Fix-for-module-sig-verification.patch

@@ -0,0 +1,24 @@
+From ea6e7d9d0fe3e448aef19b3943d4897ae0bef128 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Thu, 3 Aug 2017 13:46:51 -0500
+Subject: [PATCH] Fix for module sig verification
+
+---
+ kernel/module_signing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/module_signing.c b/kernel/module_signing.c
+index 937c844..d3d6f95 100644
+--- a/kernel/module_signing.c
++++ b/kernel/module_signing.c
+@@ -81,6 +81,6 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
+ 	}
+
+ 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+-				      NULL, VERIFYING_MODULE_SIGNATURE,
++				      (void *)1UL, VERIFYING_MODULE_SIGNATURE,
+ 				      NULL, NULL);
+ }
+-- 
+2.13.3
+

Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch

@@ -0,0 +1,51 @@
+From patchwork Thu Sep 28 20:07:19 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: Input: synaptics - Disable kernel tracking on SMBus devices
+From: Andrew Duggan <aduggan@synaptics.com>
+X-Patchwork-Id: 9976729
+Message-Id: <1506629239-5940-1-git-send-email-aduggan@synaptics.com>
+To: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: Andrew Duggan <aduggan@synaptics.com>,
+ Dmitry Torokhov <dmitry.torokhov@gmail.com>,
+ Benjamin Tissoires <benjamin.tissoires@redhat.com>,
+ =?UTF-8?q?Kamil=20P=C3=A1ral?= <kparal@redhat.com>
+Date: Thu, 28 Sep 2017 13:07:19 -0700
+
+In certain situations kernel tracking seems to be getting confused
+and incorrectly reporting the slot of a contact. On example is when
+the user does a three finger click or tap and then places two fingers
+on the touchpad in the same area. The kernel tracking code seems to
+continue to think that there are three contacts on the touchpad and
+incorrectly alternates the slot of one of the contacts. The result that
+is the input subsystem reports a stream of button press and release
+events as the reported slot changes.
+
+Kernel tracking was originally enabled to prevent cursor jumps, but it
+is unclear how much of an issue kernel jumps actually are. This patch
+simply disabled kernel tracking for now.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1482640
+
+Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
+Tested-by: Kamil Páral <kparal@redhat.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+---
+ drivers/input/mouse/synaptics.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 5af0b7d..ee5466a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1709,8 +1709,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
+ 		.sensor_pdata = {
+ 			.sensor_type = rmi_sensor_touchpad,
+ 			.axis_align.flip_y = true,
+-			/* to prevent cursors jumps: */
+-			.kernel_tracking = true,
++			.kernel_tracking = false,
+ 			.topbuttonpad = topbuttonpad,
+ 		},
+ 		.f30_data = {

Input-synaptics-pin-3-touches-when-the-firmware-repo.patch

@@ -0,0 +1,47 @@
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Thu, 16 Apr 2015 13:01:46 -0400
+Subject: [PATCH] Input - synaptics: pin 3 touches when the firmware reports 3
+ fingers
+
+Synaptics PS/2 touchpad can send only 2 touches in a report. They can
+detect 4 or 5 and this information is valuable.
+
+In commit 63c4fda (Input: synaptics - allocate 3 slots to keep stability
+in image sensors), we allocate 3 slots, but we still continue to report
+the 2 available fingers. That means that the client sees 2 used slots while
+there is a total of 3 fingers advertised by BTN_TOOL_TRIPLETAP.
+
+For old kernels this is not a problem because max_slots was 2 and libinput/
+xorg-synaptics knew how to deal with that. Now that max_slot is 3, the
+clients ignore BTN_TOOL_TRIPLETAP and count the actual used slots (so 2).
+It then gets confused when receiving the BTN_TOOL_TRIPLETAP and DOUBLETAP
+information, and goes wild.
+
+We can pin the 3 slots until we get a total number of fingers below 2.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1212230
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+---
+ drivers/input/mouse/synaptics.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 3a32caf06bf1..58102970f94f 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -940,6 +940,14 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
+ 		input_report_abs(dev, ABS_MT_PRESSURE, hw[i]->z);
+ 	}
+ 
++	/* keep (slot count <= num_fingers) by pinning all slots */
++	if (num_fingers >= 3) {
++		for (i = 0; i < 3; i++) {
++			input_mt_slot(dev, i);
++			input_mt_report_slot_state(dev, MT_TOOL_FINGER, true);
++		}
++	}
++
+ 	input_mt_drop_unused(dev);
+ 
+ 	/* Don't use active slot count to generate BTN_TOOL events. */

KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch

@@ -0,0 +1,95 @@
+From fb2ac204a70da565de9ef9a9d6d69a40c2d59727 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 5 May 2017 08:21:56 +0100
+Subject: [PATCH] KEYS: Allow unrestricted boot-time addition of keys to
+ secondary keyring
+
+Allow keys to be added to the system secondary certificates keyring during
+kernel initialisation in an unrestricted fashion.  Such keys are implicitly
+trusted and don't have their trust chains checked on link.
+
+This allows keys in the UEFI database to be added in secure boot mode for
+the purposes of module signing.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ certs/internal.h       | 18 ++++++++++++++++++
+ certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 51 insertions(+)
+ create mode 100644 certs/internal.h
+
+diff --git a/certs/internal.h b/certs/internal.h
+new file mode 100644
+index 0000000..5dcbefb
+--- /dev/null
++++ b/certs/internal.h
+@@ -0,0 +1,18 @@
++/* Internal definitions
++ *
++ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
++ * Written by David Howells (dhowells@redhat.com)
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public Licence
++ * as published by the Free Software Foundation; either version
++ * 2 of the Licence, or (at your option) any later version.
++ */
++
++/*
++ * system_keyring.c
++ */
++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
++extern void __init add_trusted_secondary_key(const char *source,
++					     const void *data, size_t len);
++#endif
+diff --git a/certs/system_keyring.c b/certs/system_keyring.c
+index 6251d1b..5ac8ba6 100644
+--- a/certs/system_keyring.c
++++ b/certs/system_keyring.c
+@@ -18,6 +18,7 @@
+ #include <keys/asymmetric-type.h>
+ #include <keys/system_keyring.h>
+ #include <crypto/pkcs7.h>
++#include "internal.h"
+
+ static struct key *builtin_trusted_keys;
+ #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+@@ -265,3 +266,35 @@ int verify_pkcs7_signature(const void *data, size_t len,
+ EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+
+ #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
++
++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
++/**
++ * add_trusted_secondary_key - Add to secondary keyring with no validation
++ * @source: Source of key
++ * @data: The blob holding the key
++ * @len: The length of the data blob
++ *
++ * Add a key to the secondary keyring without checking its trust chain.  This
++ * is available only during kernel initialisation.
++ */
++void __init add_trusted_secondary_key(const char *source,
++				      const void *data, size_t len)
++{
++	key_ref_t key;
++
++	key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1),
++				   "asymmetric",
++				   NULL, data, len,
++				   (KEY_POS_ALL & ~KEY_POS_SETATTR) |
++				   KEY_USR_VIEW,
++				   KEY_ALLOC_NOT_IN_QUOTA |
++				   KEY_ALLOC_BYPASS_RESTRICTION);
++
++	if (IS_ERR(key))
++		pr_err("Problem loading %s X.509 certificate (%ld)\n",
++		       source, PTR_ERR(key));
++	else
++		pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n",
++			  source, key_ref_to_ptr(key)->description);
++}
++#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */
+-- 
+2.9.3
+

Kbuild-Add-an-option-to-enable-GCC-VTA.patch

@@ -0,0 +1,89 @@
+From: Josh Stone <jistone@redhat.com>
+Date: Fri, 21 Nov 2014 10:40:00 -0800
+Subject: [PATCH] Kbuild: Add an option to enable GCC VTA
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Due to recent codegen issues, gcc -fvar-tracking-assignments was
+unconditionally disabled in commit 2062afb4f804a ("Fix gcc-4.9.0
+miscompilation of load_balance() in scheduler").  However, this reduces
+the debuginfo coverage for variable locations, especially in inline
+functions.  VTA is certainly not perfect either in those cases, but it
+is much better than without.  With compiler versions that have fixed the
+codegen bugs, we would prefer to have the better details for SystemTap,
+and surely other debuginfo consumers like perf will benefit as well.
+
+This patch simply makes CONFIG_DEBUG_INFO_VTA an option.  I considered
+Frank and Linus's discussion of a cc-option-like -fcompare-debug test,
+but I'm convinced that a narrow test of an arch-specific codegen issue
+is not really useful.  GCC has their own regression tests for this, so
+I'd suggest GCC_COMPARE_DEBUG=-fvar-tracking-assignments-toggle is more
+useful for kernel developers to test confidence.
+
+In fact, I ran into a couple more issues when testing for this patch[1],
+although neither of those had any codegen impact.
+ [1] https://bugzilla.redhat.com/show_bug.cgi?id=1140872
+
+With gcc-4.9.2-1.fc22, I can now build v3.18-rc5 with Fedora's i686 and
+x86_64 configs, and this is completely clean with GCC_COMPARE_DEBUG.
+
+Cc: Frank Ch. Eigler <fche@redhat.com>
+Cc: Jakub Jelinek <jakub@redhat.com>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Markus Trippelsdorf <markus@trippelsdorf.de>
+Cc: Michel Dänzer <michel@daenzer.net>
+Signed-off-by: Josh Stone <jistone@redhat.com>
+---
+ Makefile          |  4 ++++
+ lib/Kconfig.debug | 18 +++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 257ef5892ab7..3cc6f4477e78 100644
+--- a/Makefile
++++ b/Makefile
+@@ -701,7 +701,11 @@ KBUILD_CFLAGS	+= -fomit-frame-pointer
+ endif
+ endif
+ 
++ifdef CONFIG_DEBUG_INFO_VTA
++KBUILD_CFLAGS   += $(call cc-option, -fvar-tracking-assignments)
++else
+ KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
++endif
+ 
+ ifdef CONFIG_DEBUG_INFO
+ ifdef CONFIG_DEBUG_INFO_SPLIT
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index e2894b23efb6..d98afe18f704 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -165,7 +165,23 @@ config DEBUG_INFO_DWARF4
+ 	  Generate dwarf4 debug info. This requires recent versions
+ 	  of gcc and gdb. It makes the debug information larger.
+ 	  But it significantly improves the success of resolving
+-	  variables in gdb on optimized code.
++	  variables in gdb on optimized code.  The gcc docs also
++	  recommend enabling -fvar-tracking-assignments for maximum
++	  benefit. (see DEBUG_INFO_VTA)
++
++config DEBUG_INFO_VTA
++	bool "Enable var-tracking-assignments for debuginfo"
++	depends on DEBUG_INFO
++	help
++	  Enable gcc -fvar-tracking-assignments for improved debug
++	  information on variable locations in optimized code.  Per
++	  gcc, DEBUG_INFO_DWARF4 is recommended for best use of VTA.
++
++	  VTA has been implicated in codegen bugs (gcc PR61801,
++	  PR61904), so this may deserve some caution.  One can set
++	  GCC_COMPARE_DEBUG=-fvar-tracking-assignments-toggle in the
++	  environment to automatically compile everything both ways,
++	  generating an error if anything differs.
+ 
+ config GDB_SCRIPTS
+ 	bool "Provide GDB scripts for kernel debugging"

MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch

@@ -0,0 +1,246 @@
+From 90dc66270b02981b19a085c6a9184e3452b7b3e8 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@fedoraproject.org>
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 3/4] MODSIGN: Import certificates from UEFI Secure Boot
+
+Secure Boot stores a list of allowed certificates in the 'db' variable.
+This imports those certificates into the system trusted keyring.  This
+allows for a third party signing certificate to be used in conjunction
+with signed modules.  By importing the public certificate into the 'db'
+variable, a user can allow a module signed with that certificate to
+load.  The shim UEFI bootloader has a similar certificate list stored
+in the 'MokListRT' variable.  We import those as well.
+
+Secure Boot also maintains a list of disallowed certificates in the 'dbx'
+variable.  We load those certificates into the newly introduced system
+blacklist keyring and forbid any module signed with those from loading and
+forbid the use within the kernel of any key with a matching hash.
+
+This facility is enabled by setting CONFIG_LOAD_UEFI_KEYS.
+
+Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ certs/Kconfig     |  16 ++++++
+ certs/Makefile    |   4 ++
+ certs/load_uefi.c | 168 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 188 insertions(+)
+ create mode 100644 certs/load_uefi.c
+
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 630ae09..edf9f75 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -90,4 +90,20 @@ config EFI_SIGNATURE_LIST_PARSER
+ 	  This option provides support for parsing EFI signature lists for
+ 	  X.509 certificates and turning them into keys.
+
++config LOAD_UEFI_KEYS
++	bool "Load certs and blacklist from UEFI db for module checking"
++	depends on SYSTEM_BLACKLIST_KEYRING
++	depends on SECONDARY_TRUSTED_KEYRING
++	depends on EFI
++	depends on EFI_SIGNATURE_LIST_PARSER
++	help
++	  If the kernel is booted in secure boot mode, this option will cause
++	  the kernel to load the certificates from the UEFI db and MokListRT
++	  into the secondary trusted keyring.  It will also load any X.509
++	  SHA256 hashes in the dbx list into the blacklist.
++
++	  The effect of this is that, if the kernel is booted in secure boot
++	  mode, modules signed with UEFI-stored keys will be permitted to be
++	  loaded and keys that match the blacklist will be rejected.
++
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 738151a..a5e057a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -11,6 +11,10 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
+ obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
+
++obj-$(CONFIG_LOAD_UEFI_KEYS) += load_uefi.o
++$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar
++
++
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+
+ $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
+new file mode 100644
+index 0000000..b44e464
+--- /dev/null
++++ b/certs/load_uefi.c
+@@ -0,0 +1,168 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/cred.h>
++#include <linux/err.h>
++#include <linux/efi.h>
++#include <linux/slab.h>
++#include <keys/asymmetric-type.h>
++#include <keys/system_keyring.h>
++#include "internal.h"
++
++static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID;
++static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GUID;
++static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
++
++/*
++ * Get a certificate list blob from the named EFI variable.
++ */
++static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
++				  unsigned long *size)
++{
++	efi_status_t status;
++	unsigned long lsize = 4;
++	unsigned long tmpdb[4];
++	void *db;
++
++	status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
++	if (status != EFI_BUFFER_TOO_SMALL) {
++		pr_err("Couldn't get size: 0x%lx\n", status);
++		return NULL;
++	}
++
++	db = kmalloc(lsize, GFP_KERNEL);
++	if (!db) {
++		pr_err("Couldn't allocate memory for uefi cert list\n");
++		return NULL;
++	}
++
++	status = efi.get_variable(name, guid, NULL, &lsize, db);
++	if (status != EFI_SUCCESS) {
++		kfree(db);
++		pr_err("Error reading db var: 0x%lx\n", status);
++		return NULL;
++	}
++
++	*size = lsize;
++	return db;
++}
++
++/*
++ * Blacklist an X509 TBS hash.
++ */
++static __init void uefi_blacklist_x509_tbs(const char *source,
++					   const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "tbs:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Blacklist the hash of an executable.
++ */
++static __init void uefi_blacklist_binary(const char *source,
++					 const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "bin:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI db and MokListRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
++		return add_trusted_secondary_key;
++	return 0;
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI dbx and MokListXRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0)
++		return uefi_blacklist_x509_tbs;
++	if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0)
++		return uefi_blacklist_binary;
++	return 0;
++}
++
++/*
++ * Load the certs contained in the UEFI databases
++ */
++static int __init load_uefi_certs(void)
++{
++	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
++	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
++	void *db = NULL, *dbx = NULL, *mok = NULL;
++	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
++	int rc = 0;
++
++	if (!efi.get_variable)
++		return false;
++
++	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
++	 * an error if we can't get them.
++	 */
++	db = get_cert_list(L"db", &secure_var, &dbsize);
++	if (!db) {
++		pr_err("MODSIGN: Couldn't get UEFI db list\n");
++	} else {
++		rc = parse_efi_signature_list("UEFI:db",
++					      db, dbsize, get_handler_for_db);
++		if (rc)
++			pr_err("Couldn't parse db signatures: %d\n", rc);
++		kfree(db);
++	}
++
++	mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
++	if (!mok) {
++		pr_info("MODSIGN: Couldn't get UEFI MokListRT\n");
++	} else {
++		rc = parse_efi_signature_list("UEFI:MokListRT",
++					      mok, moksize, get_handler_for_db);
++		if (rc)
++			pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
++		kfree(mok);
++	}
++
++	dbx = get_cert_list(L"dbx", &secure_var, &dbxsize);
++	if (!dbx) {
++		pr_info("MODSIGN: Couldn't get UEFI dbx list\n");
++	} else {
++		rc = parse_efi_signature_list("UEFI:dbx",
++					      dbx, dbxsize,
++					      get_handler_for_dbx);
++		if (rc)
++			pr_err("Couldn't parse dbx signatures: %d\n", rc);
++		kfree(dbx);
++	}
++
++	return rc;
++}
++late_initcall(load_uefi_certs);
+-- 
+2.9.3
+

MODSIGN-Support-not-importing-certs-from-db.patch

@@ -0,0 +1,88 @@
+From 9f1958a0cc911e1f79b2733ee5029dbd819ff328 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@fedoraproject.org>
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 4/4] MODSIGN: Allow the "db" UEFI variable to be suppressed
+
+If a user tells shim to not use the certs/hashes in the UEFI db variable
+for verification purposes, shim will set a UEFI variable called
+MokIgnoreDB.  Have the uefi import code look for this and ignore the db
+variable if it is found.
+
+Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+---
+ certs/load_uefi.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
+
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
+index b44e464..3d88459 100644
+--- a/certs/load_uefi.c
++++ b/certs/load_uefi.c
+@@ -13,6 +13,26 @@ static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GU
+ static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
+
+ /*
++ * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
++ * it does.
++ *
++ * This UEFI variable is set by the shim if a user tells the shim to not use
++ * the certs/hashes in the UEFI db variable for verification purposes.  If it
++ * is set, we should ignore the db variable also and the true return indicates
++ * this.
++ */
++static __init bool uefi_check_ignore_db(void)
++{
++	efi_status_t status;
++	unsigned int db = 0;
++	unsigned long size = sizeof(db);
++	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
++
++	status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
++	return status == EFI_SUCCESS;
++}
++
++/*
+  * Get a certificate list blob from the named EFI variable.
+  */
+ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+@@ -113,7 +133,9 @@ static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_ty
+ }
+
+ /*
+- * Load the certs contained in the UEFI databases
++ * Load the certs contained in the UEFI databases into the secondary trusted
++ * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
++ * keyring.
+  */
+ static int __init load_uefi_certs(void)
+ {
+@@ -129,15 +151,17 @@ static int __init load_uefi_certs(void)
+ 	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
+ 	 * an error if we can't get them.
+ 	 */
+-	db = get_cert_list(L"db", &secure_var, &dbsize);
+-	if (!db) {
+-		pr_err("MODSIGN: Couldn't get UEFI db list\n");
+-	} else {
+-		rc = parse_efi_signature_list("UEFI:db",
+-					      db, dbsize, get_handler_for_db);
+-		if (rc)
+-			pr_err("Couldn't parse db signatures: %d\n", rc);
+-		kfree(db);
++	if (!uefi_check_ignore_db()) {
++		db = get_cert_list(L"db", &secure_var, &dbsize);
++		if (!db) {
++			pr_err("MODSIGN: Couldn't get UEFI db list\n");
++		} else {
++			rc = parse_efi_signature_list("UEFI:db",
++						      db, dbsize, get_handler_for_db);
++			if (rc)
++				pr_err("Couldn't parse db signatures: %d\n", rc);
++			kfree(db);
++		}
+ 	}
+
+ 	mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
+-- 
+2.9.3
+

Makefile

@@ -0,0 +1,50 @@
+# Makefile for source rpm: kernel
+SPECFILE := kernel.spec
+
+# we only check the .sign signatures
+UPSTREAM_CHECKS = sign
+
+.PHONY: help
+help:
+%:
+	@echo "Try fedpkg $@ or something like that"
+	@exit 1
+
+prep: config-files
+	fedpkg -v prep
+
+noarch:
+	fedpkg -v local --arch=noarch
+
+# 'make local' also needs to build the noarch firmware package
+local:
+	fedpkg -v local
+
+extremedebug:
+	@perl -pi -e 's/# CONFIG_DEBUG_PAGEALLOC is not set/CONFIG_DEBUG_PAGEALLOC=y/' config-nodebug
+
+config-files:
+	@./build_configs.sh
+
+debug:
+	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
+	@rpmdev-bumpspec -c "Reenable debugging options." kernel.spec
+
+release:
+	@perl -pi -e 's/^%define debugbuildsenabled 0/%define debugbuildsenabled 1/' kernel.spec
+	@rpmdev-bumpspec -c "Disable debugging options." kernel.spec
+
+nodebuginfo:
+	@perl -pi -e 's/^%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 1\}/%define with_debuginfo %\{\?_without_debuginfo: 0\} %\{\?\!_without_debuginfo: 0\}/' kernel.spec
+
+nodebug: release
+	@perl -pi -e 's/^%define debugbuildsenabled 1/%define debugbuildsenabled 0/' kernel.spec
+
+ifeq ($(MAKECMDGOALS),me a sandwich)
+.PHONY: me a sandwich
+me a:
+	@:
+
+sandwich:
+	@[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay.
+endif

Makefile.rhelver

@@ -1,45 +0,0 @@
-RHEL_MAJOR = 8
-RHEL_MINOR = 99
-
-#
-# RHEL_RELEASE
-# -------------
-#
-# Represents build number in 'release' part of RPM's name-version-release.
-#   name is <package_name>, e.g. kernel
-#   version is upstream kernel version this kernel is based on, e.g. 4.18.0
-#   release is <RHEL_RELEASE>.<dist_tag>[<buildid>], e.g. 100.el8
-#
-# Use this spot to avoid future merge conflicts.
-# Do not trim this comment.
-RHEL_RELEASE = 122
-
-#
-# Early y+1 numbering
-# --------------------
-#
-# In early y+1 process, RHEL_RELEASE consists of 2 numbers: x.y
-# First is RHEL_RELEASE inherited/merged from y as-is, second number
-# is incremented with each build starting from 1. After merge from y,
-# it resets back to 1. This way y+1 nvr reflects status of last merge.
-#
-# Example:
-#
-# rhel8.0                        rhel-8.1
-#   kernel-4.18.0-58.el8   -->     kernel-4.18.0-58.1.el8
-#                                  kernel-4.18.0-58.2.el8
-#   kernel-4.18.0-59.el8           kernel-4.18.0-59.1.el8
-#   kernel-4.18.0-60.el8
-#   kernel-4.18.0-61.el8   -->     kernel-4.18.0-61.1.el8
-#
-#
-# Use this spot to avoid future merge conflicts.
-# Do not trim this comment.
-EARLY_YSTREAM ?= no
-EARLY_YBUILD:=
-EARLY_YRELEASE:=
-ifneq ("$(ZSTREAM)", "yes")
-  ifeq ("$(EARLY_YSTREAM)","yes")
-    RHEL_RELEASE:=$(RHEL_RELEASE).$(EARLY_YRELEASE)
-  endif
-endif

PatchList.txt

@@ -0,0 +1,76 @@
+# This file contains patches that we intend to carry for longer than
+# "Should show up in a stable release soonish"
+# Some of these may eventually drop out
+
+kbuild-AFTER_LINK.patch
+
+arm64-avoid-needing-console-to-enable-serial-console.patch
+
+geekbox-v4-device-tree-support.patch
+
+Initial-AllWinner-A64-and-PINE64-support.patch
+
+arm64-pcie-quirks-xgene.patch
+
+usb-phy-tegra-Add-38.4MHz-clock-table-entry.patch
+
+ARM-tegra-usb-no-reset.patch
+
+bcm283x-upstream-fixes.patch
+
+lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
+
+input-kill-stupid-messages.patch
+
+die-floppy-die.patch
+
+no-pcspkr-modalias.patch
+
+silence-fbcon-logo.patch
+
+Kbuild-Add-an-option-to-enable-GCC-VTA.patch
+
+crash-driver.patch
+
+#Secure boot patches
+Add-secure_modules-call.patch
+PCI-Lock-down-BAR-access-when-module-security-is-ena.patch
+x86-Lock-down-IO-port-access-when-module-security-is.patch
+ACPI-Limit-access-to-custom_method.patch
+asus-wmi-Restrict-debugfs-interface-when-module-load.patch
+Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch
+acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch
+kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch
+x86-Restrict-MSR-access-when-module-loading-is-restr.patch
+Add-option-to-automatically-enforce-module-signature.patch
+efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch
+efi-Add-EFI_SECURE_BOOT-bit.patch
+hibernate-Disable-in-a-signed-modules-environment.patch
+Add-EFI-signature-data-types.patch
+Add-an-EFI-signature-blob-parser-and-key-loader.patch
+KEYS-Add-a-system-blacklist-keyring.patch
+MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
+MODSIGN-Support-not-importing-certs-from-db.patch
+Add-sysrq-option-to-disable-secure-boot-mode.patch
+kexec-uefi-copy-secure_boot-flag-in-boot-params.patch
+
+drm-i915-hush-check-crtc-state.patch
+
+disable-i8042-check-on-apple-mac.patch
+
+lis3-improve-handling-of-null-rate.patch
+
+scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
+
+criu-no-expert.patch
+
+ath9k-rx-dma-stop-check.patch
+
+xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
+
+Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
+
+firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
+
+drm-i915-turn-off-wc-mmaps.patch
+

Patchlist.changelog

@@ -1,228 +0,0 @@
-https://gitlab.com/cki-project/kernel-ark/-/commit/8773e8c6039ff74d1426cc80de30de759cd0c2a2
- 8773e8c6039ff74d1426cc80de30de759cd0c2a2 irq: export irq_check_status_bit
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/e187313e5f0086538fefe0925ef84480f99616d8
- e187313e5f0086538fefe0925ef84480f99616d8 gcc-plugins: fix gcc 11 indigestion with plugins...
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/0c84b348e33ab9d7df5c3c5acc7fbc07fd96fafc
- 0c84b348e33ab9d7df5c3c5acc7fbc07fd96fafc Fix up bad merge with efi: generalize efi_get_secureboot
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/364788093bdf437c33753d327136c363be8f756c
- 364788093bdf437c33753d327136c363be8f756c Fix up a merge issue with rxe.c
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/a4d554ce883e24df77cce42bc2deec527028c213
- a4d554ce883e24df77cce42bc2deec527028c213 Filter out LTO build options from the perl ccopts
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/17b0f7f1d49df30661b517d668715ff5ee1bab09
- 17b0f7f1d49df30661b517d668715ff5ee1bab09 Fixes "acpi: prefer booting with ACPI over DTS" to be RHEL only
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/e7c009cd91ababdbb5f726ef592c7800f0682d3a
- e7c009cd91ababdbb5f726ef592c7800f0682d3a arch/x86: Remove vendor specific CPU ID checks
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7120b2a26fc4c7954fd0395973dc6739c110e091
- 7120b2a26fc4c7954fd0395973dc6739c110e091 redhat: Replace hardware.redhat.com link in Unsupported message
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7a28e2fde653a161913abb8eee943cdacb5ff2ae
- 7a28e2fde653a161913abb8eee943cdacb5ff2ae x86: Fix compile issues with rh_check_supported()
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/45f64c1a24e73af7987cffec3ea941e29364f87f
- 45f64c1a24e73af7987cffec3ea941e29364f87f e1000e: bump up timeout to wait when ME un-configure ULP mode
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/6c14763b1ce98698949ff45135c15e333aa6416d
- 6c14763b1ce98698949ff45135c15e333aa6416d drm/sun4i: sun6i_mipi_dsi: fix horizontal timing calculation
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/67a19b16012b12cffba0b515c6503e5f8cdbb798
- 67a19b16012b12cffba0b515c6503e5f8cdbb798 drm: panel: add Xingbangda XBD599 panel
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/d220dbf98cef820367b5a2a2eeaacebee958bdd4
- d220dbf98cef820367b5a2a2eeaacebee958bdd4 dt-bindings: panel: add binding for Xingbangda XBD599 panel
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/80660062260dec4bdca9540922577542c16145e8
- 80660062260dec4bdca9540922577542c16145e8 ARM: fix __get_user_check() in case uaccess_* calls are not inlined
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/24d8743613b2a6a585fc68cfe95078d9a3d5b389
- 24d8743613b2a6a585fc68cfe95078d9a3d5b389 mm/kmemleak: skip late_init if not skip disable
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/b697ff5e26974fee8fcd31a1e221e9dd41515efc
- b697ff5e26974fee8fcd31a1e221e9dd41515efc KEYS: Make use of platform keyring for module signature verify
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/081d2185e22479b449586c4e9843602ca0d49806
- 081d2185e22479b449586c4e9843602ca0d49806 Drop that for now
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/5ef51389cf6673a0e9e004909c7be1dc785050b2
- 5ef51389cf6673a0e9e004909c7be1dc785050b2 Input: rmi4 - remove the need for artificial IRQ in case of HID
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/c1788012ebf8de46e9dc80d18051ed0c77c811b6
- c1788012ebf8de46e9dc80d18051ed0c77c811b6 ARM: tegra: usb no reset
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/577365feaa909db4c0949eabfcda7e4a972b8e54
- 577365feaa909db4c0949eabfcda7e4a972b8e54 arm: make CONFIG_HIGHPTE optional without CONFIG_EXPERT
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/331be9c5a436057ee852075c102d9d90a9046a30
- 331be9c5a436057ee852075c102d9d90a9046a30 redhat: rh_kabi: deduplication friendly structs
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/34d79fbfb327f732ebf3ece4db21a14f81fedf03
- 34d79fbfb327f732ebf3ece4db21a14f81fedf03 redhat: rh_kabi add a comment with warning about RH_KABI_EXCLUDE usage
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/93a4b5f12d5a1c2d62cf1d7c440b31d9847eab07
- 93a4b5f12d5a1c2d62cf1d7c440b31d9847eab07 redhat: rh_kabi: introduce RH_KABI_EXTEND_WITH_SIZE
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/8e5c06356457f5351289e9f687b991189d163dae
- 8e5c06356457f5351289e9f687b991189d163dae redhat: rh_kabi: Indirect EXTEND macros so nesting of other macros will resolve.
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/212cbccda77cc81fcb60123907eabdac8ad5adb7
- 212cbccda77cc81fcb60123907eabdac8ad5adb7 redhat: rh_kabi: Fix RH_KABI_SET_SIZE to use dereference operator
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/6f7744b412e1fb86a67d8761e64df69cf891b4ad
- 6f7744b412e1fb86a67d8761e64df69cf891b4ad redhat: rh_kabi: Add macros to size and extend structs
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/049623d33998be30d79692c69b34acb502c496e3
- 049623d33998be30d79692c69b34acb502c496e3 Removing Obsolete hba pci-ids from rhel8
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/43ef1d631ecfe84084db3572c9ed1bedbdceb0f8
- 43ef1d631ecfe84084db3572c9ed1bedbdceb0f8 mptsas: pci-id table changes
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/e5726695109dd1a73da92487b75de6a51d54c015
- e5726695109dd1a73da92487b75de6a51d54c015 mptsas: Taint kernel if mptsas is loaded
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/ee4dcd6f04ca76ad35ab0f38c436ab2f7de53f16
- ee4dcd6f04ca76ad35ab0f38c436ab2f7de53f16 mptspi: pci-id table changes
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/bd305f716d8b64be1926bc7aebe02468ac6bf599
- bd305f716d8b64be1926bc7aebe02468ac6bf599 qla2xxx: Remove PCI IDs of deprecated adapter
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/803ff9a2c660c094e14d246ef05019bf6008d503
- 803ff9a2c660c094e14d246ef05019bf6008d503 be2iscsi: remove unsupported device IDs
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2cb24399321f555f18b0804d3fe02cf53949fba1
- 2cb24399321f555f18b0804d3fe02cf53949fba1 mptspi: Taint kernel if mptspi is loaded
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/ad1740551ff4af49f1ef10a130783d9369e955a0
- ad1740551ff4af49f1ef10a130783d9369e955a0 hpsa: remove old cciss-based smartarray pci ids
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/4197ba3e766656eea9175c11ed05903620d98a28
- 4197ba3e766656eea9175c11ed05903620d98a28 qla4xxx: Remove deprecated PCI IDs from RHEL 8
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7e285aec22ab1213639afda877902db363473cb0
- 7e285aec22ab1213639afda877902db363473cb0 aacraid: Remove depreciated device and vendor PCI id's
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/846109a16be92155e69731c36dde48761d375153
- 846109a16be92155e69731c36dde48761d375153 megaraid_sas: remove deprecated pci-ids
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/6fd2019d01cee7ff36dc047d3ecdb504b968f222
- 6fd2019d01cee7ff36dc047d3ecdb504b968f222 mpt*: remove certain deprecated pci-ids
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/dddcd5c1129b275ff160324036a662739db51fc3
- dddcd5c1129b275ff160324036a662739db51fc3 kernel: add SUPPORT_REMOVED kernel taint
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/08d77161dba915d1ed0d9fede658085440ab4474
- 08d77161dba915d1ed0d9fede658085440ab4474 Rename RH_DISABLE_DEPRECATED to RHEL_DIFFERENCES
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/e2dc2ca6a25a445bf22ceb6a8e38e02706605341
- e2dc2ca6a25a445bf22ceb6a8e38e02706605341 Add option of 13 for FORCE_MAX_ZONEORDER
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2384646bf71d8c282cf49bb20321fdf802c61cce
- 2384646bf71d8c282cf49bb20321fdf802c61cce s390: Lock down the kernel when the IPL secure flag is set
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/5850c93175b9d2e1081873f4bbe08dead202cb08
- 5850c93175b9d2e1081873f4bbe08dead202cb08 efi: Lock down the kernel if booted in secure boot mode
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/53250b991f841be025fa4d264850dadc0fae2861
- 53250b991f841be025fa4d264850dadc0fae2861 efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/72223fd1241cc5c70b96a491db14d54c83beadd8
- 72223fd1241cc5c70b96a491db14d54c83beadd8 security: lockdown: expose a hook to lock the kernel down
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7ba28f03674fa9346610c3fea7fc93bc58f06d2a
- 7ba28f03674fa9346610c3fea7fc93bc58f06d2a Make get_cert_list() use efi_status_to_str() to print error messages.
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2ae9082db0b54d831a9b3782c049d9917e37d89f
- 2ae9082db0b54d831a9b3782c049d9917e37d89f Add efi_status_to_str() and rework efi_status_to_err().
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/cee1461ada1b7e4b92cd154e7ec241119afcd644
- cee1461ada1b7e4b92cd154e7ec241119afcd644 Add support for deprecating processors
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2420149f8f5fa9dd1e2dc793765b498022922a81
- 2420149f8f5fa9dd1e2dc793765b498022922a81 arm: aarch64: Drop the EXPERT setting from ARM64_FORCE_52BIT
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/1d69b30b98b60aff639351f5788d20a3b17f6e27
- 1d69b30b98b60aff639351f5788d20a3b17f6e27 iommu/arm-smmu: workaround DMA mode issues
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/6b2e73e508e7a117b1db91596097c00e5570f64a
- 6b2e73e508e7a117b1db91596097c00e5570f64a rh_kabi: introduce RH_KABI_EXCLUDE
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/ecb9206bce179eb600c52642a6753012a69ce4a2
- ecb9206bce179eb600c52642a6753012a69ce4a2 ipmi: do not configure ipmi for HPE m400
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/473be59fe72afa9969cf8d10609ef3f14f594631
- 473be59fe72afa9969cf8d10609ef3f14f594631 IB/rxe: Mark Soft-RoCE Transport driver as tech-preview
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/b94117795261f9c074a7addca2252238871b5081
- b94117795261f9c074a7addca2252238871b5081 scsi: smartpqi: add inspur advantech ids
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/cae871558c333880c1687cab6f2a71accf40d105
- cae871558c333880c1687cab6f2a71accf40d105 ice: mark driver as tech-preview
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7d9cb007404211ea6638bde4a28dd0fbe8d95de0
- 7d9cb007404211ea6638bde4a28dd0fbe8d95de0 kABI: Add generic kABI macros to use for kABI workarounds
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/bd353e9aae8877dd490e6c92b67849e0dcfbab25
- bd353e9aae8877dd490e6c92b67849e0dcfbab25 add pci_hw_vendor_status()
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/41a259999969bbdfe9f556ce71f2c3c07d7454f4
- 41a259999969bbdfe9f556ce71f2c3c07d7454f4 ahci: thunderx2: Fix for errata that affects stop engine
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2a107343529ce648c11bff62e9f72bbeec738f3f
- 2a107343529ce648c11bff62e9f72bbeec738f3f Vulcan: AHCI PCI bar fix for Broadcom Vulcan early silicon
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/03e48a48f400a51a182a1254cf22ff0c08706d76
- 03e48a48f400a51a182a1254cf22ff0c08706d76 bpf: Add tech preview taint for syscall
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/607f0e89af7ef5682f79f2eea0a99638a1bc0c4f
- 607f0e89af7ef5682f79f2eea0a99638a1bc0c4f bpf: set unprivileged_bpf_disabled to 1 by default, add a boot parameter
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/31da227877eb734ddb484bc519aae85ce200802e
- 31da227877eb734ddb484bc519aae85ce200802e add Red Hat-specific taint flags
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/7a2e2c83be0230667756cccb5bc3687419dfbb8b
- 7a2e2c83be0230667756cccb5bc3687419dfbb8b kdump: fix a grammar issue in a kernel message
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/d345d54d33e7d496c9d845e4723550dd37cb3f88
- d345d54d33e7d496c9d845e4723550dd37cb3f88 tags.sh: Ignore redhat/rpm
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/5c67dc1eb0783a5c4ca4eb5c545ff6fe05facff0
- 5c67dc1eb0783a5c4ca4eb5c545ff6fe05facff0 put RHEL info into generated headers
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/ce12884c009ec3bed11100c9d19f6d97628cf8ae
- ce12884c009ec3bed11100c9d19f6d97628cf8ae kdump: add support for crashkernel=auto
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/18fb1389afccdc5535977a10669b49a37829b55a
- 18fb1389afccdc5535977a10669b49a37829b55a kdump: round up the total memory size to 128M for crashkernel reservation
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/5fb9821441cc0b77101ad9c0dfaa747957a4cce4
- 5fb9821441cc0b77101ad9c0dfaa747957a4cce4 acpi: prefer booting with ACPI over DTS
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/0cf21a40db6fca5d89cf3d65808117c8c14e524e
- 0cf21a40db6fca5d89cf3d65808117c8c14e524e aarch64: acpi scan: Fix regression related to X-Gene UARTs
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/de13e14cc2388478d9a2c68c5d90affd92098f11
- de13e14cc2388478d9a2c68c5d90affd92098f11 ACPI / irq: Workaround firmware issue on X-Gene based m400
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/71c098f4afa38a15a95495c14f71fb087ab27308
- 71c098f4afa38a15a95495c14f71fb087ab27308 modules: add rhelversion MODULE_INFO tag
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/3247f9c838f4aa91aa5d08c152b385d61554d4b5
- 3247f9c838f4aa91aa5d08c152b385d61554d4b5 ACPI: APEI: arm64: Ignore broken HPE moonshot APEI support
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/e80982feaa68226ff60d2f83dace2016c35270d3
- e80982feaa68226ff60d2f83dace2016c35270d3 Add Red Hat tainting
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/2987f9a606df106f5bdfa4113eb55356a21085a6
- 2987f9a606df106f5bdfa4113eb55356a21085a6 Introduce CONFIG_RH_DISABLE_DEPRECATED
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/a99885a5e77af594dfdce586cc83e5911d8401ce
- a99885a5e77af594dfdce586cc83e5911d8401ce Pull the RHEL version defines out of the Makefile
-
-https://gitlab.com/cki-project/kernel-ark/-/commit/cd3a5d30570279538623ea8a1255db0ee4b728f7
- cd3a5d30570279538623ea8a1255db0ee4b728f7 [initial commit] Add Red Hat variables in the top level makefile
-

README.rst

@@ -1,25 +0,0 @@
-===================
-The Kernel dist-git
-===================
-
-The kernel is maintained in a `source tree`_ rather than directly in dist-git.
-The specfile is maintained as a `template`_ in the source tree along with a set
-of build scripts to generate configurations, (S)RPMs, and to populate the
-dist-git repository.
-
-The `documentation`_ for the source tree covers how to contribute and maintain
-the tree.
-
-If you're looking for the downstream patch set it's available in the source
-tree with "git log master..ark-patches" or
-`online`_.
-
-Each release in dist-git is tagged in the source repository so you can easily
-check out the source tree for a build. The tags are in the format
-name-version-release, but note release doesn't contain the dist tag since the
-source can be built in different build roots (Fedora, CentOS, etc.)
-
-.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
-.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
-.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
-.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches

README.txt

@@ -0,0 +1,82 @@
+
+		Kernel package tips & tricks.
+		~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The kernel is one of the more complicated packages in the distro, and
+for the newcomer, some of the voodoo in the spec file can be somewhat scary.
+This file attempts to document some of the magic.
+
+
+Speeding up make prep
+---------------------
+The kernel is nearly 500MB of source code, and as such, 'make prep'
+takes a while. The spec file employs some trickery so that repeated
+invocations of make prep don't take as long.  Ordinarily the %prep
+phase of a package will delete the tree it is about to untar/patch.
+The kernel %prep keeps around an unpatched version of the tree,
+and makes a symlink tree clone of that clean tree and than applies
+the patches listed in the spec to the symlink tree.
+This makes a huge difference if you're doing multiple make preps a day.
+As an added bonus, doing a diff between the clean tree and the symlink
+tree is slightly faster than it would be doing two proper copies of the tree.
+
+
+build logs.
+-----------
+There's a convenience helper script in scripts/grab-logs.sh
+that will grab the build logs from koji for the kernel version reported
+by make verrel
+
+
+config heirarchy.
+-----------------
+Instead of having to maintain a config file for every arch variant we build on,
+the kernel spec uses a nested system of configs.  At the top level, is
+config-generic. Add options here that should be present in every possible
+config on all architectures.
+
+Beneath this are per-arch overrides. For example config-x86-generic add
+additional x86 specific options, and also _override_ any options that were
+set in config-generic.
+
+The heirarchy looks like this..
+
+                           config-generic
+                                 |
+                         config-x86-generic
+                         |                |
+             config-x86-32-generic   config-x86-64-generic
+
+An option set in a lower level will override the same option set in one
+of the higher levels.
+
+
+There exist two additional overrides, config-debug, and config-nodebug,
+which override -generic, and the per-arch overrides. It is documented
+further below.
+
+
+debug options.
+--------------
+This is a little complicated, as the purpose & meaning of this changes
+depending on where we are in the release cycle.
+If we are building for a current stable release, 'make release' has
+typically been run already, which sets up the following..
+- Two builds occur, a 'kernel' and a 'kernel-debug' flavor.
+- kernel-debug will get various heavyweight debugging options like
+  lockdep etc turned on.
+
+If we are building for rawhide, 'make debug' has been run, which changes
+the status quo to:
+- We only build one kernel 'kernel'
+- The debug options from 'config-debug' are always turned on.
+This is done to increase coverage testing, as not many people actually
+run kernel-debug.
+
+To add new debug options, add an option to _both_ config-debug and config-nodebug,
+and also new stanzas to the Makefile 'debug' and 'release' targets.
+
+Sometimes debug options get added to config-generic, or per-arch overrides
+instead of config-[no]debug. In this instance, the options should have no
+discernable performance impact, otherwise they belong in the debug files.
+

RFC-audit-fix-a-race-condition-with-the-auditd-tracking-code.patch

@@ -0,0 +1,156 @@
+From patchwork Thu Jun 15 15:28:58 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [RFC] audit: fix a race condition with the auditd tracking code
+From: Paul Moore <pmoore@redhat.com>
+X-Patchwork-Id: 9789009
+Message-Id: <149754053819.11365.5047864735077505545.stgit@sifl>
+To: linux-audit@redhat.com
+Cc: Dusty Mabe <dustymabe@redhat.com>
+Date: Thu, 15 Jun 2017 11:28:58 -0400
+
+From: Paul Moore <paul@paul-moore.com>
+
+Originally reported by Adam and Dusty, it appears we have a small
+race window in kauditd_thread(), as documented in the Fedora BZ:
+
+ * https://bugzilla.redhat.com/show_bug.cgi?id=1459326#c35
+
+ "This issue is partly due to the read-copy nature of RCU, and
+  partly due to how we sync the auditd_connection state across
+  kauditd_thread and the audit control channel.  The kauditd_thread
+  thread is always running so it can service the record queues and
+  emit the multicast messages, if it happens to be just past the
+  "main_queue" label, but before the "if (sk == NULL || ...)"
+  if-statement which calls auditd_reset() when the new auditd
+  connection is registered it could end up resetting the auditd
+  connection, regardless of if it is valid or not.  This is a rather
+  small window and the variable nature of multi-core scheduling
+  explains why this is proving rather difficult to reproduce."
+
+The fix is to have functions only call auditd_reset() when they
+believe that the kernel/auditd connection is still valid, e.g.
+non-NULL, and to have these callers pass their local copy of the
+auditd_connection pointer to auditd_reset() where it can be compared
+with the current connection state before resetting.  If the caller
+has a stale state tracking pointer then the reset is ignored.
+
+We also make a small change to kauditd_thread() so that if the
+kernel/auditd connection is dead we skip the retry queue and send the
+records straight to the hold queue.  This is necessary as we used to
+rely on auditd_reset() to occasionally purge the retry queue but we
+are going to be calling the reset function much less now and we want
+to make sure the retry queue doesn't grow unbounded.
+
+Reported-by: Adam Williamson <awilliam@redhat.com>
+Reported-by: Dusty Mabe <dustymabe@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+---
+ kernel/audit.c |   36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+
+--
+Linux-audit mailing list
+Linux-audit@redhat.com
+https://www.redhat.com/mailman/listinfo/linux-audit
+
+diff --git a/kernel/audit.c b/kernel/audit.c
+index b2e877100242..e1e2b3abfb93 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -575,12 +575,16 @@ static void kauditd_retry_skb(struct sk_buff *skb)
+ 
+ /**
+  * auditd_reset - Disconnect the auditd connection
++ * @ac: auditd connection state
+  *
+  * Description:
+  * Break the auditd/kauditd connection and move all the queued records into the
+- * hold queue in case auditd reconnects.
++ * hold queue in case auditd reconnects.  It is important to note that the @ac
++ * pointer should never be dereferenced inside this function as it may be NULL
++ * or invalid, you can only compare the memory address!  If @ac is NULL then
++ * the connection will always be reset.
+  */
+-static void auditd_reset(void)
++static void auditd_reset(const struct auditd_connection *ac)
+ {
+ 	unsigned long flags;
+ 	struct sk_buff *skb;
+@@ -590,6 +594,11 @@ static void auditd_reset(void)
+ 	spin_lock_irqsave(&auditd_conn_lock, flags);
+ 	ac_old = rcu_dereference_protected(auditd_conn,
+ 					   lockdep_is_held(&auditd_conn_lock));
++	if (ac && ac != ac_old) {
++		/* someone already registered a new auditd connection */
++		spin_unlock_irqrestore(&auditd_conn_lock, flags);
++		return;
++	}
+ 	rcu_assign_pointer(auditd_conn, NULL);
+ 	spin_unlock_irqrestore(&auditd_conn_lock, flags);
+ 
+@@ -649,8 +658,8 @@ static int auditd_send_unicast_skb(struct sk_buff *skb)
+ 	return rc;
+ 
+ err:
+-	if (rc == -ECONNREFUSED)
+-		auditd_reset();
++	if (ac && rc == -ECONNREFUSED)
++		auditd_reset(ac);
+ 	return rc;
+ }
+ 
+@@ -795,9 +804,9 @@ static int kauditd_thread(void *dummy)
+ 		rc = kauditd_send_queue(sk, portid,
+ 					&audit_hold_queue, UNICAST_RETRIES,
+ 					NULL, kauditd_rehold_skb);
+-		if (rc < 0) {
++		if (ac && rc < 0) {
+ 			sk = NULL;
+-			auditd_reset();
++			auditd_reset(ac);
+ 			goto main_queue;
+ 		}
+ 
+@@ -805,9 +814,9 @@ static int kauditd_thread(void *dummy)
+ 		rc = kauditd_send_queue(sk, portid,
+ 					&audit_retry_queue, UNICAST_RETRIES,
+ 					NULL, kauditd_hold_skb);
+-		if (rc < 0) {
++		if (ac && rc < 0) {
+ 			sk = NULL;
+-			auditd_reset();
++			auditd_reset(ac);
+ 			goto main_queue;
+ 		}
+ 
+@@ -815,12 +824,13 @@ static int kauditd_thread(void *dummy)
+ 		/* process the main queue - do the multicast send and attempt
+ 		 * unicast, dump failed record sends to the retry queue; if
+ 		 * sk == NULL due to previous failures we will just do the
+-		 * multicast send and move the record to the retry queue */
++		 * multicast send and move the record to the hold queue */
+ 		rc = kauditd_send_queue(sk, portid, &audit_queue, 1,
+ 					kauditd_send_multicast_skb,
+-					kauditd_retry_skb);
+-		if (sk == NULL || rc < 0)
+-			auditd_reset();
++					(sk ?
++					 kauditd_retry_skb : kauditd_hold_skb));
++		if (ac && rc < 0)
++			auditd_reset(ac);
+ 		sk = NULL;
+ 
+ 		/* drop our netns reference, no auditd sends past this line */
+@@ -1230,7 +1240,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 								auditd_pid, 1);
+ 
+ 				/* unregister the auditd connection */
+-				auditd_reset();
++				auditd_reset(NULL);
+ 			}
+ 		}
+ 		if (s.mask & AUDIT_STATUS_RATE_LIMIT) {

TODO

@@ -0,0 +1,10 @@
+Config TODOs:
+* review & disable a bunch of the I2C, RTC, DVB, SOUND options.
+
+Spec file TODOs:
+
+* modules-extra: Do a few more things to make it a bit more robust.
+  - Allow for comments in the mod-extra.list file.
+  - Don't fail the build if a module is listed but not built (maybe).
+  - See if it can be tied into Kconfig instead of module names.
+

V4-acpi-acpica-fix-acpi-parse-and-parseext-cache-leaks.patch

@@ -0,0 +1,231 @@
+From patchwork Fri Jun 23 09:36:37 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: [V4] acpi: acpica: fix acpi parse and parseext cache leaks
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9806085
+Message-Id: <1498210597-112293-1-git-send-email-kkamagui@gmail.com>
+To: lv.zheng@intel.com
+Cc: robert.moore@intel.com, rafael.j.wysocki@intel.com,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, Seunghun Han <kkamagui@gmail.com>
+Date: Fri, 23 Jun 2017 18:36:37 +0900
+
+I'm Seunghun Han, and I work for National Security Research Institute of
+South Korea.
+
+I have been doing a research on ACPI and found an ACPI cache leak in ACPI
+early abort cases.
+
+Boot log of ACPI cache leak is as follows:
+[    0.352414] ACPI: Added _OSI(Module Device)
+[    0.353182] ACPI: Added _OSI(Processor Device)
+[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)
+[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)
+[    0.356028] ACPI: Unable to start the ACPI Interpreter
+[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects
+[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #10
+[    0.361273] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.361873] Call Trace:
+[    0.362243]  ? dump_stack+0x5c/0x81
+[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.363296]  ? acpi_os_delete_cache+0xa/0x10
+[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b
+[    0.364000]  ? acpi_terminate+0xa/0x14
+[    0.364000]  ? acpi_init+0x2af/0x34f
+[    0.364000]  ? __class_create+0x4c/0x80
+[    0.364000]  ? video_setup+0x7f/0x7f
+[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.364000]  ? do_one_initcall+0x4e/0x1a0
+[    0.364000]  ? kernel_init_freeable+0x189/0x20a
+[    0.364000]  ? rest_init+0xc0/0xc0
+[    0.364000]  ? kernel_init+0xa/0x100
+[    0.364000]  ? ret_from_fork+0x25/0x30
+
+I analyzed this memory leak in detail. I found that “Acpi-State” cache and
+“Acpi-Parse” cache were merged because the size of cache objects was same
+slab cache size.
+
+I finally found “Acpi-Parse” cache and “Acpi-ParseExt” cache were leaked
+using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
+
+Real ACPI cache leak point is as follows:
+[    0.360101] ACPI: Added _OSI(Module Device)
+[    0.360101] ACPI: Added _OSI(Processor Device)
+[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)
+[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)
+[    0.364016] ACPI: Unable to start the ACPI Interpreter
+[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects
+[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #8
+[    0.371256] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.372000] Call Trace:
+[    0.372000]  ? dump_stack+0x5c/0x81
+[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.372000]  ? acpi_os_delete_cache+0xa/0x10
+[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b
+[    0.372000]  ? acpi_terminate+0xa/0x14
+[    0.372000]  ? acpi_init+0x2af/0x34f
+[    0.372000]  ? __class_create+0x4c/0x80
+[    0.372000]  ? video_setup+0x7f/0x7f
+[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.372000]  ? do_one_initcall+0x4e/0x1a0
+[    0.372000]  ? kernel_init_freeable+0x189/0x20a
+[    0.372000]  ? rest_init+0xc0/0xc0
+[    0.372000]  ? kernel_init+0xa/0x100
+[    0.372000]  ? ret_from_fork+0x25/0x30
+[    0.388039] kmem_cache_destroy Acpi-ParseExt: Slab cache still has objects
+[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W
+4.12.0-rc4-next-20170608+ #8
+[    0.390557] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
+VirtualBox 12/01/2006
+[    0.392000] Call Trace:
+[    0.392000]  ? dump_stack+0x5c/0x81
+[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0
+[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.392000]  ? acpi_os_delete_cache+0xa/0x10
+[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b
+[    0.392000]  ? acpi_terminate+0xa/0x14
+[    0.392000]  ? acpi_init+0x2af/0x34f
+[    0.392000]  ? __class_create+0x4c/0x80
+[    0.392000]  ? video_setup+0x7f/0x7f
+[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27
+[    0.392000]  ? do_one_initcall+0x4e/0x1a0
+[    0.392000]  ? kernel_init_freeable+0x189/0x20a
+[    0.392000]  ? rest_init+0xc0/0xc0
+[    0.392000]  ? kernel_init+0xa/0x100
+[    0.392000]  ? ret_from_fork+0x25/0x30
+
+When early abort is occurred due to invalid ACPI information, Linux kernel
+terminates ACPI by calling acpi_terminate() function. The function calls
+acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_
+cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
+
+But the deletion codes in acpi_ut_delete_caches() function only delete
+slab caches using kmem_cache_destroy() function, therefore the cache
+objects should be flushed before acpi_ut_delete_caches() function.
+
+“Acpi-Parse” cache and “Acpi-ParseExt” cache are used in an AML parse
+function, acpi_ps_parse_loop(). The function should have flush codes to
+handle an error state due to invalid AML codes.
+
+This cache leak has a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+To fix ACPI cache leak for enhancing security, I made a patch which has
+flush codes in acpi_ps_parse_loop() function.
+
+I hope that this patch improves the security of Linux kernel.
+
+Thank you.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+Changes since v3: change control transfer according to reviewer's comments.
+Changes since v2: merge flush code with existing code and change comments.
+Changes since v1: move flush code to acpi_ps_complete_final_op() function.
+
+ drivers/acpi/acpica/psobject.c | 53 +++++++++++++-----------------------------
+ 1 file changed, 16 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c
+index 5bcb618..4539391 100644
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -608,7 +608,8 @@ acpi_status
+ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 			  union acpi_parse_object *op, acpi_status status)
+ {
+-	acpi_status status2;
++	acpi_status return_status = AE_OK;
++	u8 ascending = TRUE;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state);
+ 
+@@ -622,7 +623,8 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 			  op));
+ 	do {
+ 		if (op) {
+-			if (walk_state->ascending_callback != NULL) {
++			if (ascending &&
++			    walk_state->ascending_callback != NULL) {
+ 				walk_state->op = op;
+ 				walk_state->op_info =
+ 				    acpi_ps_get_opcode_info(op->common.
+@@ -644,49 +646,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 				}
+ 
+ 				if (status == AE_CTRL_TERMINATE) {
+-					status = AE_OK;
+-
+-					/* Clean up */
+-					do {
+-						if (op) {
+-							status2 =
+-							    acpi_ps_complete_this_op
+-							    (walk_state, op);
+-							if (ACPI_FAILURE
+-							    (status2)) {
+-								return_ACPI_STATUS
+-								    (status2);
+-							}
+-						}
+-
+-						acpi_ps_pop_scope(&
+-								  (walk_state->
+-								   parser_state),
+-								  &op,
+-								  &walk_state->
+-								  arg_types,
+-								  &walk_state->
+-								  arg_count);
+-
+-					} while (op);
+-
+-					return_ACPI_STATUS(status);
++					ascending = FALSE;
++					return_status = AE_CTRL_TERMINATE;
+ 				}
+ 
+ 				else if (ACPI_FAILURE(status)) {
+ 
+ 					/* First error is most important */
+ 
+-					(void)
+-					    acpi_ps_complete_this_op(walk_state,
+-								     op);
+-					return_ACPI_STATUS(status);
++					ascending = FALSE;
++					return_status = status;
+ 				}
+ 			}
+ 
+-			status2 = acpi_ps_complete_this_op(walk_state, op);
+-			if (ACPI_FAILURE(status2)) {
+-				return_ACPI_STATUS(status2);
++			status = acpi_ps_complete_this_op(walk_state, op);
++			if (ACPI_FAILURE(status)) {
++				ascending = FALSE;
++				if (ACPI_SUCCESS(return_status) ||
++				    return_status == AE_CTRL_TERMINATE) {
++					return_status = status;
++				}
+ 			}
+ 		}
+ 
+@@ -696,5 +675,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ 
+ 	} while (op);
+ 
+-	return_ACPI_STATUS(status);
++	return_ACPI_STATUS(return_status);
+ }

acpi-acpica-fix-acpi-operand-cache-leak-in-dsutils.c.patch

@@ -0,0 +1,107 @@
+From patchwork Thu Aug 24 05:11:35 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: acpi: acpica: fix acpi operand cache leak in dsutils.c
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9919053
+Message-Id: <1503551495-33286-1-git-send-email-kkamagui@gmail.com>
+To: lv.zheng@intel.com
+Cc: robert.moore@intel.com, rafael.j.wysocki@intel.com,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, security@kernel.org,
+ Seunghun Han <kkamagui@gmail.com>
+Date: Thu, 24 Aug 2017 14:11:35 +0900
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination is occurred due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[    0.585957] ACPI: Added _OSI(Module Device)
+>[    0.587218] ACPI: Added _OSI(Processor Device)
+>[    0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[    0.589790] ACPI: Added _OSI(Processor Aggregator Device)
+>[    0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)
+>[    0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)
+>[    0.597858] ACPI: Unable to start the ACPI Interpreter
+>[    0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+>[    0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[    0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[    0.605159] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+>[    0.609177] Call Trace:
+>[    0.610063]  ? dump_stack+0x5c/0x81
+>[    0.611118]  ? kmem_cache_destroy+0x1aa/0x1c0
+>[    0.612632]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.613906]  ? acpi_os_delete_cache+0xa/0x10
+>[    0.617986]  ? acpi_ut_delete_caches+0x3f/0x7b
+>[    0.619293]  ? acpi_terminate+0xa/0x14
+>[    0.620394]  ? acpi_init+0x2af/0x34f
+>[    0.621616]  ? __class_create+0x4c/0x80
+>[    0.623412]  ? video_setup+0x7f/0x7f
+>[    0.624585]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.625861]  ? do_one_initcall+0x4e/0x1a0
+>[    0.627513]  ? kernel_init_freeable+0x19e/0x21f
+>[    0.628972]  ? rest_init+0x80/0x80
+>[    0.630043]  ? kernel_init+0xa/0x100
+>[    0.631084]  ? ret_from_fork+0x25/0x30
+>[    0.633343] vgaarb: loaded
+>[    0.635036] EDAC MC: Ver: 3.0.0
+>[    0.638601] PCI: Probing PCI hardware
+>[    0.639833] PCI host bridge to bus 0000:00
+>[    0.641031] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_
+delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()
+function uses walk_state->operand_index for start position of the top, but
+acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.
+Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+ drivers/acpi/acpica/dsutils.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
+index 0dabd9b..2c8a060 100644
+--- a/drivers/acpi/acpica/dsutils.c
++++ b/drivers/acpi/acpica/dsutils.c
+@@ -705,6 +705,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 	union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS];
+ 	u32 arg_count = 0;
+ 	u32 index = walk_state->num_operands;
++	u32 prev_num_operands = walk_state->num_operands;
++	u32 new_num_operands;
+ 	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg);
+@@ -733,6 +735,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 
+ 	/* Create the interpreter arguments, in reverse order */
+ 
++	new_num_operands = index;
+ 	index--;
+ 	for (i = 0; i < arg_count; i++) {
+ 		arg = arguments[index];
+@@ -757,7 +760,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ 	 * pop everything off of the operand stack and delete those
+ 	 * objects
+ 	 */
+-	acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state);
++	walk_state->num_operands = i;
++	acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state);
++
++	/* Restore operand count */
++	walk_state->num_operands = prev_num_operands;
+ 
+ 	ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index));
+ 	return_ACPI_STATUS(status);

acpi-acpica-fix-acpi-operand-cache-leak-in-nseval.c.patch

@@ -0,0 +1,96 @@
+From patchwork Wed Jul 19 07:07:23 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: acpi: acpica: fix acpi operand cache leak in nseval.c
+From: Seunghun Han <kkamagui@gmail.com>
+X-Patchwork-Id: 9850567
+Message-Id: <1500448043-137615-1-git-send-email-kkamagui@gmail.com>
+To: Lv Zheng <lv.zheng@intel.com>
+Cc: Robert Moore <robert.moore@intel.com>,
+ "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
+ linux-acpi@vger.kernel.org, devel@acpica.org,
+ linux-kernel@vger.kernel.org, security@kernel.org,
+ Seunghun Han <kkamagui@gmail.com>
+Date: Wed, 19 Jul 2017 16:07:23 +0900
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination occurs due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[    0.464168] ACPI: Added _OSI(Module Device)
+>[    0.467022] ACPI: Added _OSI(Processor Device)
+>[    0.469376] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[    0.471647] ACPI: Added _OSI(Processor Aggregator Device)
+>[    0.477997] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
+>[    0.482706] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [OpcodeName unavailable] (20170303/dswexec-461)
+>[    0.487503] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.492136] ACPI Error: Method parse/execution failed [\_SB._INI] (Node ffff88021710a618), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.497683] ACPI: Interpreter enabled
+>[    0.499385] ACPI: (supports S0)
+>[    0.501151] ACPI: Using IOAPIC for interrupt routing
+>[    0.503342] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
+>[    0.506522] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [OpcodeName unavailable] (20170303/dswexec-461)
+>[    0.510463] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.514477] ACPI Error: Method parse/execution failed [\_PIC] (Node ffff88021710ab18), AE_AML_INTERNAL (20170303/psparse-543)
+>[    0.518867] ACPI Exception: AE_AML_INTERNAL, Evaluating _PIC (20170303/bus-991)
+>[    0.522384] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[    0.524597] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[    0.526795] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+>[    0.529668] Call Trace:
+>[    0.530811]  ? dump_stack+0x5c/0x81
+>[    0.532240]  ? kmem_cache_destroy+0x1aa/0x1c0
+>[    0.533905]  ? acpi_os_delete_cache+0xa/0x10
+>[    0.535497]  ? acpi_ut_delete_caches+0x3f/0x7b
+>[    0.537237]  ? acpi_terminate+0xa/0x14
+>[    0.538701]  ? acpi_init+0x2af/0x34f
+>[    0.540008]  ? acpi_sleep_proc_init+0x27/0x27
+>[    0.541593]  ? do_one_initcall+0x4e/0x1a0
+>[    0.543008]  ? kernel_init_freeable+0x19e/0x21f
+>[    0.546202]  ? rest_init+0x80/0x80
+>[    0.547513]  ? kernel_init+0xa/0x100
+>[    0.548817]  ? ret_from_fork+0x25/0x30
+>[    0.550587] vgaarb: loaded
+>[    0.551716] EDAC MC: Ver: 3.0.0
+>[    0.553744] PCI: Probing PCI hardware
+>[    0.555038] PCI host bridge to bus 0000:00
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ns_evaluate() function
+only removes info->return_object in AE_CTRL_RETURN_VALUE case. But, when errors
+occur, the status value is not AE_CTRL_RETURN_VALUE, and info->return_object is
+also not null. Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+---
+ drivers/acpi/acpica/nseval.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
+index d22167c..f13d3cf 100644
+--- a/drivers/acpi/acpica/nseval.c
++++ b/drivers/acpi/acpica/nseval.c
+@@ -308,6 +308,14 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
+ 		/* Map AE_CTRL_RETURN_VALUE to AE_OK, we are done with it */
+ 
+ 		status = AE_OK;
++	} else if (ACPI_FAILURE(status)) {
++
++		/* If return_object exists, delete it */
++
++		if (info->return_object) {
++			acpi_ut_remove_reference(info->return_object);
++			info->return_object = NULL;
++		}
+ 	}
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_NAMES,

allwinner-net-emac.patch

@@ -0,0 +1,746 @@
+From 83e18f0ad4793ea83e03cb8e608bdd2939e76d78 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:34 +0100
+Subject: [PATCH 1/4] Revert "net: stmmac: sun8i: Remove the compatibles"
+
+This reverts commit ad4540cc5aa3dccb8e1e12458d57f8c40fae5a1c.
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 39c2122a4f26..fffd6d5fc907 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -979,6 +979,14 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id sun8i_dwmac_match[] = {
++	{ .compatible = "allwinner,sun8i-h3-emac",
++		.data = &emac_variant_h3 },
++	{ .compatible = "allwinner,sun8i-v3s-emac",
++		.data = &emac_variant_v3s },
++	{ .compatible = "allwinner,sun8i-a83t-emac",
++		.data = &emac_variant_a83t },
++	{ .compatible = "allwinner,sun50i-a64-emac",
++		.data = &emac_variant_a64 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
+-- 
+2.13.5
+
+From fa4788d88903c1e535d034c3dd3fcd386685a02c Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:41 +0100
+Subject: [PATCH 2/4] Revert "arm: dts: sunxi: Revert EMAC changes"
+
+This reverts commit fe45174b72aead678da581bab9e9a37c9b26a070.
+---
+ arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts |  9 ++++++++
+ arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts   | 19 +++++++++++++++++
+ arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts         |  7 ++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-2.dts         |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-one.dts       |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts   |  5 +++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts        |  8 +++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts      | 22 +++++++++++++++++++
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts    | 16 ++++++++++++++
+ arch/arm/boot/dts/sunxi-h3-h5.dtsi                | 26 +++++++++++++++++++++++
+ 10 files changed, 128 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+index b1502df7b509..6713d0f2b3f4 100644
+--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+@@ -56,6 +56,8 @@
+ 
+ 	aliases {
+ 		serial0 = &uart0;
++		/* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
++		ethernet0 = &emac;
+ 		ethernet1 = &xr819;
+ 	};
+ 
+@@ -102,6 +104,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+index a337af1de322..d756ff825116 100644
+--- a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "sinovoip,bpi-m2-plus", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+@@ -114,12 +115,30 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <0>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
+index 8d2cc6e9a03f..78f6c24952dd 100644
+--- a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
+@@ -46,3 +46,10 @@
+ 	model = "FriendlyARM NanoPi NEO";
+ 	compatible = "friendlyarm,nanopi-neo", "allwinner,sun8i-h3";
+ };
++
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
+index 8ff71b1bb45b..17cdeae19c6f 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
+@@ -54,6 +54,7 @@
+ 	aliases {
+ 		serial0 = &uart0;
+ 		/* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
++		ethernet0 = &emac;
+ 		ethernet1 = &rtl8189;
+ 	};
+ 
+@@ -117,6 +118,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+index 5fea430e0eb1..6880268e8b87 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "xunlong,orangepi-one", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -97,6 +98,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+index 8b93f5c781a7..a10281b455f5 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+@@ -53,6 +53,11 @@
+ 	};
+ };
+ 
++&emac {
++	/* LEDs changed to active high on the plus */
++	/delete-property/ allwinner,leds-active-low;
++};
++
+ &mmc1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc1_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
+index 1a044b17d6c6..998b60f8d295 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts
+@@ -52,6 +52,7 @@
+ 	compatible = "xunlong,orangepi-pc", "allwinner,sun8i-h3";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -113,6 +114,13 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
+index 828ae7a526d9..331ed683ac62 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts
+@@ -47,6 +47,10 @@
+ 	model = "Xunlong Orange Pi Plus / Plus 2";
+ 	compatible = "xunlong,orangepi-plus", "allwinner,sun8i-h3";
+ 
++	aliases {
++		ethernet0 = &emac;
++	};
++
+ 	reg_gmac_3v3: gmac-3v3 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "gmac-3v3";
+@@ -74,6 +78,24 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++
++	allwinner,leds-active-low;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <0>;
++	};
++};
++
+ &mmc2 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc2_8bit_pins>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+index 97920b12a944..80026f3caafc 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+@@ -61,3 +61,19 @@
+ 		gpio = <&pio 3 6 GPIO_ACTIVE_HIGH>; /* PD6 */
+ 	};
+ };
++
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
+diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+index 11240a8313c2..d38282b9e5d4 100644
+--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
++++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+@@ -391,6 +391,32 @@
+ 			clocks = <&osc24M>;
+ 		};
+ 
++		emac: ethernet@1c30000 {
++			compatible = "allwinner,sun8i-h3-emac";
++			syscon = <&syscon>;
++			reg = <0x01c30000 0x10000>;
++			interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "macirq";
++			resets = <&ccu RST_BUS_EMAC>;
++			reset-names = "stmmaceth";
++			clocks = <&ccu CLK_BUS_EMAC>;
++			clock-names = "stmmaceth";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				int_mii_phy: ethernet-phy@1 {
++					compatible = "ethernet-phy-ieee802.3-c22";
++					reg = <1>;
++					clocks = <&ccu CLK_BUS_EPHY>;
++					resets = <&ccu RST_BUS_EPHY>;
++				};
++			};
++		};
++
+ 		spi0: spi@01c68000 {
+ 			compatible = "allwinner,sun8i-h3-spi";
+ 			reg = <0x01c68000 0x1000>;
+-- 
+2.13.5
+
+From 4aba5ca95496899165ee7ceef5d9c60a6e7b15dd Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:47 +0100
+Subject: [PATCH 3/4] Revert "arm64: dts: allwinner: Revert EMAC changes"
+
+This reverts commit 87e1f5e8bb4bd584de0a8f3b1e42196dca221d02.
+---
+ .../boot/dts/allwinner/sun50i-a64-bananapi-m64.dts   | 16 ++++++++++++++++
+ .../boot/dts/allwinner/sun50i-a64-pine64-plus.dts    | 15 +++++++++++++++
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts  | 17 +++++++++++++++++
+ .../dts/allwinner/sun50i-a64-sopine-baseboard.dts    | 16 ++++++++++++++++
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi        | 20 ++++++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts     | 17 +++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts    | 17 +++++++++++++++++
+ .../boot/dts/allwinner/sun50i-h5-orangepi-prime.dts  | 17 +++++++++++++++++
+ 8 files changed, 135 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 6872135d7f84..ba2fde2909f9 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+@@ -67,6 +68,14 @@
+ 	};
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
+ &i2c1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&i2c1_pins>;
+@@ -77,6 +86,13 @@
+ 	bias-pull-up;
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index f82ccf332c0f..24f1aac366d6 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -48,3 +48,18 @@
+ 
+ 	/* TODO: Camera, touchscreen, etc. */
+ };
++
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+index 7c533b6d4ba9..827168bc22ed 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "pine64,pine64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 		serial2 = &uart2;
+@@ -78,6 +79,15 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rmii_pins>;
++	phy-mode = "rmii";
++	phy-handle = <&ext_rmii_phy1>;
++	status = "okay";
++
++};
++
+ &i2c1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&i2c1_pins>;
+@@ -88,6 +98,13 @@
+ 	bias-pull-up;
+ };
+ 
++&mdio {
++	ext_rmii_phy1: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+index d891a1a27f6c..216e3a5dafae 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+@@ -53,6 +53,7 @@
+ 		     "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -76,6 +77,21 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rgmii_pins>;
++	phy-mode = "rgmii";
++	phy-handle = <&ext_rgmii_phy>;
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc2 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc2_pins>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 68aadc9b96dc..bd0f33b77f57 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -449,6 +449,26 @@
+ 			#size-cells = <0>;
+ 		};
+ 
++		emac: ethernet@1c30000 {
++			compatible = "allwinner,sun50i-a64-emac";
++			syscon = <&syscon>;
++			reg = <0x01c30000 0x10000>;
++			interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "macirq";
++			resets = <&ccu RST_BUS_EMAC>;
++			reset-names = "stmmaceth";
++			clocks = <&ccu CLK_BUS_EMAC>;
++			clock-names = "stmmaceth";
++			status = "disabled";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++
+ 		gic: interrupt-controller@1c81000 {
+ 			compatible = "arm,gic-400";
+ 			reg = <0x01c81000 0x1000>,
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+index 1c2387bd5df6..968908761194 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+@@ -50,6 +50,7 @@
+ 	compatible = "friendlyarm,nanopi-neo2", "allwinner,sun50i-h5";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -108,6 +109,22 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
++&mdio {
++	ext_rgmii_phy: ethernet-phy@7 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <7>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+index 4f77c8470f6c..a8296feee884 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+@@ -59,6 +59,7 @@
+ 	};
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -136,12 +137,28 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+index 6be06873e5af..d906b302cbcd 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+@@ -54,6 +54,7 @@
+ 	compatible = "xunlong,orangepi-prime", "allwinner,sun50i-h5";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -143,12 +144,28 @@
+ 	status = "okay";
+ };
+ 
++&emac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emac_rgmii_pins>;
++	phy-supply = <&reg_gmac_3v3>;
++	phy-handle = <&ext_rgmii_phy>;
++	phy-mode = "rgmii";
++	status = "okay";
++};
++
+ &ir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&ir_pins_a>;
+ 	status = "okay";
+ };
+ 
++&mdio {
++	ext_rgmii_phy: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
+-- 
+2.13.5
+
+From 11190f020b948ccdf15061b6df8cc2836a2afcb1 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Mon, 4 Sep 2017 13:04:55 +0100
+Subject: [PATCH 4/4] Revert "dt-bindings: net: Revert sun8i dwmac binding"
+
+This reverts commit 8aa33ec2f4812d1ee96f4c02ba013f5b9c514343.
+---
+ .../devicetree/bindings/net/dwmac-sun8i.txt        | 84 ++++++++++++++++++++++
+ 1 file changed, 84 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+
+diff --git a/Documentation/devicetree/bindings/net/dwmac-sun8i.txt b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+new file mode 100644
+index 000000000000..725f3b187886
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+@@ -0,0 +1,84 @@
++* Allwinner sun8i GMAC ethernet controller
++
++This device is a platform glue layer for stmmac.
++Please see stmmac.txt for the other unchanged properties.
++
++Required properties:
++- compatible: should be one of the following string:
++		"allwinner,sun8i-a83t-emac"
++		"allwinner,sun8i-h3-emac"
++		"allwinner,sun8i-v3s-emac"
++		"allwinner,sun50i-a64-emac"
++- reg: address and length of the register for the device.
++- interrupts: interrupt for the device
++- interrupt-names: should be "macirq"
++- clocks: A phandle to the reference clock for this device
++- clock-names: should be "stmmaceth"
++- resets: A phandle to the reset control for this device
++- reset-names: should be "stmmaceth"
++- phy-mode: See ethernet.txt
++- phy-handle: See ethernet.txt
++- #address-cells: shall be 1
++- #size-cells: shall be 0
++- syscon: A phandle to the syscon of the SoC with one of the following
++ compatible string:
++  - allwinner,sun8i-h3-system-controller
++  - allwinner,sun8i-v3s-system-controller
++  - allwinner,sun50i-a64-system-controller
++  - allwinner,sun8i-a83t-system-controller
++
++Optional properties:
++- allwinner,tx-delay-ps: TX clock delay chain value in ps. Range value is 0-700. Default is 0)
++- allwinner,rx-delay-ps: RX clock delay chain value in ps. Range value is 0-3100. Default is 0)
++Both delay properties need to be a multiple of 100. They control the delay for
++external PHY.
++
++Optional properties for the following compatibles:
++  - "allwinner,sun8i-h3-emac",
++  - "allwinner,sun8i-v3s-emac":
++- allwinner,leds-active-low: EPHY LEDs are active low
++
++Required child node of emac:
++- mdio bus node: should be named mdio
++
++Required properties of the mdio node:
++- #address-cells: shall be 1
++- #size-cells: shall be 0
++
++The device node referenced by "phy" or "phy-handle" should be a child node
++of the mdio node. See phy.txt for the generic PHY bindings.
++
++Required properties of the phy node with the following compatibles:
++  - "allwinner,sun8i-h3-emac",
++  - "allwinner,sun8i-v3s-emac":
++- clocks: a phandle to the reference clock for the EPHY
++- resets: a phandle to the reset control for the EPHY
++
++Example:
++
++emac: ethernet@1c0b000 {
++	compatible = "allwinner,sun8i-h3-emac";
++	syscon = <&syscon>;
++	reg = <0x01c0b000 0x104>;
++	interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>;
++	interrupt-names = "macirq";
++	resets = <&ccu RST_BUS_EMAC>;
++	reset-names = "stmmaceth";
++	clocks = <&ccu CLK_BUS_EMAC>;
++	clock-names = "stmmaceth";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	phy-handle = <&int_mii_phy>;
++	phy-mode = "mii";
++	allwinner,leds-active-low;
++	mdio: mdio {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		int_mii_phy: ethernet-phy@1 {
++			reg = <1>;
++			clocks = <&ccu CLK_BUS_EPHY>;
++			resets = <&ccu RST_BUS_EPHY>;
++		};
++	};
++};
+-- 
+2.13.5
+

arm-dts-boneblack-wireless-add-WL1835-Bluetooth-device-node.patch

@@ -0,0 +1,40 @@
+From patchwork Mon May 22 14:51:38 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: arm: dts: boneblack-wireless: add WL1835 Bluetooth device node
+From: Ricardo Salveti <ricardo.salveti@linaro.org>
+X-Patchwork-Id: 9740719
+Message-Id: <1495464701-12046-1-git-send-email-ricardo.salveti@linaro.org>
+To: linux-omap@vger.kernel.org
+Cc: Mark Rutland <mark.rutland@arm.com>,
+ Ricardo Salveti <ricardo.salveti@linaro.org>, devicetree@vger.kernel.org, 
+ Tony Lindgren <tony@atomide.com>, Russell King <linux@armlinux.org.uk>,
+ linux-kernel@vger.kernel.org, Rob Herring <robh+dt@kernel.org>,
+ =?UTF-8?q?Beno=C3=AEt=20Cousson?= <bcousson@baylibre.com>,
+ robertcnelson@gmail.com, linux-arm-kernel@lists.infradead.org
+Date: Mon, 22 May 2017 11:51:38 -0300
+
+This adds the serial slave device for the WL1835 Bluetooth interface.
+
+Signed-off-by: Ricardo Salveti <ricardo.salveti@linaro.org>
+---
+ arch/arm/boot/dts/am335x-boneblack-wireless.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-wireless.dts b/arch/arm/boot/dts/am335x-boneblack-wireless.dts
+index 105bd10..83f49f6 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-wireless.dts
++++ b/arch/arm/boot/dts/am335x-boneblack-wireless.dts
+@@ -97,6 +97,11 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart3_pins &bt_pins>;
+ 	status = "okay";
++
++	bluetooth {
++		compatible = "ti,wl1835-st";
++		enable-gpios = <&gpio0 28 GPIO_ACTIVE_HIGH>;
++	};
+ };
+ 
+ &gpio3 {

arm-imx6-hummingboard2.patch

@@ -0,0 +1,902 @@
+From e9e601215d294d473a593641b1ecfd1fa4586a90 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Thu, 6 Apr 2017 13:52:54 +0100
+Subject: [PATCH 1/4] [RFC,v2,1/4] ARM: dts: imx6qdl: add HummingBoard2 boards
+
+From: Jon Nettleton <jon@solid-run.com>
+
+This adds support for the Hummingboard Gate and Edge devices from
+SolidRun.
+
+Signed-off-by: Jon Nettleton <jon@solid-run.com>
+Signed-off-by: Rabeeh Khoury <rabeeh@solid-run.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+---
+ arch/arm/boot/dts/Makefile                   |   2 +
+ arch/arm/boot/dts/imx6dl-hummingboard2.dts   |  52 +++
+ arch/arm/boot/dts/imx6q-hummingboard2.dts    |  60 +++
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 543 +++++++++++++++++++++++++++
+ 4 files changed, 657 insertions(+)
+ create mode 100644 arch/arm/boot/dts/imx6dl-hummingboard2.dts
+ create mode 100644 arch/arm/boot/dts/imx6q-hummingboard2.dts
+ create mode 100644 arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index 011808490fed..ccdff6650541 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -353,6 +353,7 @@ dtb-$(CONFIG_SOC_IMX6Q) += \
+ 	imx6dl-gw5903.dtb \
+ 	imx6dl-gw5904.dtb \
+ 	imx6dl-hummingboard.dtb \
++	imx6dl-hummingboard2.dtb \
+ 	imx6dl-icore.dtb \
+ 	imx6dl-icore-rqs.dtb \
+ 	imx6dl-nit6xlite.dtb \
+@@ -397,6 +398,7 @@ dtb-$(CONFIG_SOC_IMX6Q) += \
+ 	imx6q-gw5904.dtb \
+ 	imx6q-h100.dtb \
+ 	imx6q-hummingboard.dtb \
++	imx6q-hummingboard2.dtb \
+ 	imx6q-icore.dtb \
+ 	imx6q-icore-ofcap10.dtb \
+ 	imx6q-icore-ofcap12.dtb \
+diff --git a/arch/arm/boot/dts/imx6dl-hummingboard2.dts b/arch/arm/boot/dts/imx6dl-hummingboard2.dts
+new file mode 100644
+index 000000000000..990b5050de5b
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6dl-hummingboard2.dts
+@@ -0,0 +1,52 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ * Based on work by Russell King
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++/dts-v1/;
++
++#include "imx6dl.dtsi"
++#include "imx6qdl-hummingboard2.dtsi"
++
++/ {
++	model = "SolidRun HummingBoard2 Solo/DualLite";
++	compatible = "solidrun,hummingboard2/dl", "fsl,imx6dl";
++};
+diff --git a/arch/arm/boot/dts/imx6q-hummingboard2.dts b/arch/arm/boot/dts/imx6q-hummingboard2.dts
+new file mode 100644
+index 000000000000..f5eec9163bb8
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6q-hummingboard2.dts
+@@ -0,0 +1,60 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ * Based on work by Russell King
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++/dts-v1/;
++
++#include "imx6q.dtsi"
++#include "imx6qdl-hummingboard2.dtsi"
++
++/ {
++	model = "SolidRun HummingBoard2 Dual/Quad";
++	compatible = "solidrun,hummingboard2/q", "fsl,imx6q";
++};
++
++&sata {
++	status = "okay";
++	fsl,transmit-level-mV = <1104>;
++	fsl,transmit-boost-mdB = <0>;
++	fsl,transmit-atten-16ths = <9>;
++	fsl,no-spread-spectrum;
++};
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+new file mode 100644
+index 000000000000..11b63f6f2b89
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -0,0 +1,543 @@
++/*
++ * Device Tree file for SolidRun HummingBoard2
++ * Copyright (C) 2015 Rabeeh Khoury <rabeeh@solid-run.com>
++ *
++ * This file is dual-licensed: you can use it either under the terms
++ * of the GPL or the X11 license, at your option. Note that this dual
++ * licensing only applies to this file, and not this project as a
++ * whole.
++ *
++ *  a) This file is free software; you can redistribute it and/or
++ *     modify it under the terms of the GNU General Public License as
++ *     published by the Free Software Foundation; either version 2 of the
++ *     License.
++ *
++ *     This file is distributed in the hope that it will be useful,
++ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *     GNU General Public License for more details.
++ *
++ * Or, alternatively,
++ *
++ *  b) Permission is hereby granted, free of charge, to any person
++ *     obtaining a copy of this software and associated documentation
++ *     files (the "Software"), to deal in the Software without
++ *     restriction, including without limitation the rights to use
++ *     copy, modify, merge, publish, distribute, sublicense, and/or
++ *     sell copies of the Software, and to permit persons to whom the
++ *     Software is furnished to do so, subject to the following
++ *     conditions:
++ *
++ *     The above copyright notice and this permission notice shall be
++ *     included in all copies or substantial portions of the Software.
++ *
++ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
++ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
++ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
++ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ *     OTHER DEALINGS IN THE SOFTWARE.
++ */
++#include "imx6qdl-microsom.dtsi"
++#include "imx6qdl-microsom-ar8035.dtsi"
++
++/ {
++	chosen {
++		stdout-path = &uart1;
++	};
++
++	ir_recv: ir-receiver {
++		compatible = "gpio-ir-receiver";
++		gpios = <&gpio7 9 1>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_gpio7_9>;
++		linux,rc-map-name = "rc-rc6-mce";
++	};
++
++	usdhc2_pwrseq: usdhc2-pwrseq {
++		compatible = "mmc-pwrseq-simple";
++		reset-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;
++	};
++
++	reg_3p3v: regulator-3p3v {
++		compatible = "regulator-fixed";
++		regulator-name = "3P3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
++	reg_1p8v: regulator-1p8v {
++		compatible = "regulator-fixed";
++		regulator-name = "1P8V";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <1800000>;
++		regulator-always-on;
++	};
++
++	reg_usbh1_vbus: regulator-usb-h1-vbus {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio1 0 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh1_vbus>;
++		regulator-name = "usb_h1_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usbotg_vbus: regulator-usb-otg-vbus {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio3 22 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbotg_vbus>;
++		regulator-name = "usb_otg_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usbh2_vbus: regulator-usb-h2-vbus {
++		compatible = "regulator-gpio";
++		enable-active-high;
++		enable-gpio = <&gpio2 13 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh2_vbus>;
++		regulator-name = "usb_h2_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-boot-on;
++	};
++
++	reg_usbh3_vbus: regulator-usb-h3-vbus {
++		compatible = "regulator-gpio";
++		enable-active-high;
++		enable-gpio = <&gpio7 10 0>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_usbh3_vbus>;
++		regulator-name = "usb_h3_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		regulator-boot-on;
++	};
++
++	sound-sgtl5000 {
++		audio-codec = <&sgtl5000>;
++		audio-routing =
++			"MIC_IN", "Mic Jack",
++			"Mic Jack", "Mic Bias",
++			"Headphone Jack", "HP_OUT";
++		compatible = "fsl,imx-audio-sgtl5000";
++		model = "On-board Codec";
++		mux-ext-port = <5>;
++		mux-int-port = <1>;
++		ssi-controller = <&ssi1>;
++	};
++};
++
++&audmux {
++	status = "okay";
++};
++
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_ecspi2>;
++	cs-gpios = <&gpio2 26 0>;
++	status = "okay";
++};
++
++&hdmi {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_hdmi>;
++	ddc-i2c-bus = <&i2c2>;
++	status = "okay";
++};
++
++&i2c1 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c1>;
++	status = "okay";
++
++	pcf8523: rtc@68 {
++		compatible = "nxp,pcf8523";
++		reg = <0x68>;
++		nxp,12p5_pf;
++	};
++
++	sgtl5000: codec@0a {
++		clocks = <&clks IMX6QDL_CLK_CKO>;
++		compatible = "fsl,sgtl5000";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_sgtl5000>;
++		reg = <0x0a>;
++		VDDA-supply = <&reg_3p3v>;
++		VDDIO-supply = <&reg_3p3v>;
++	};
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c2>;
++	status = "okay";
++};
++
++&i2c3 {
++	clock-frequency = <100000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_i2c3>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	hummingboard2 {
++		pinctrl_hog: hoggrp {
++		fsl,pins = <
++				/*
++				 * 36 pin headers GPIO description. The pins
++				 * numbering as following -
++				 *
++				 * 	3.2v	5v	74	75
++				 *	73	72	71	70
++				 *	69	68	67	66
++				 *
++				 *	77	78	79	76
++				 *	65	64	61	60
++				 *	53	52	51	50
++				 *	49	48	166	132
++				 *	95	94	90	91
++				 *	GND	54	24	204
++				 *
++				 * The GPIO numbers can be extracted using
++				 * signal name from below.
++				 * Example -
++				 * MX6QDL_PAD_EIM_DA10__GPIO3_IO10 is
++				 * GPIO(3,10) which is (3-1)*32+10 = gpio 74
++				 *
++				 * i.e. The mapping of GPIO(X,Y) to Linux gpio
++				 * number is : gpio number = (X-1) * 32 + Y
++				 */
++				/* DI1_PIN15 */
++				MX6QDL_PAD_EIM_DA10__GPIO3_IO10 0x400130b1
++				/* DI1_PIN02 */
++				MX6QDL_PAD_EIM_DA11__GPIO3_IO11 0x400130b1
++				/* DISP1_DATA00 */
++				MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x400130b1
++				/* DISP1_DATA01 */
++				MX6QDL_PAD_EIM_DA8__GPIO3_IO08 0x400130b1
++				/* DISP1_DATA02 */
++				MX6QDL_PAD_EIM_DA7__GPIO3_IO07 0x400130b1
++				/* DISP1_DATA03 */
++				MX6QDL_PAD_EIM_DA6__GPIO3_IO06 0x400130b1
++				/* DISP1_DATA04 */
++				MX6QDL_PAD_EIM_DA5__GPIO3_IO05 0x400130b1
++				/* DISP1_DATA05 */
++				MX6QDL_PAD_EIM_DA4__GPIO3_IO04 0x400130b1
++				/* DISP1_DATA06 */
++				MX6QDL_PAD_EIM_DA3__GPIO3_IO03 0x400130b1
++				/* DISP1_DATA07 */
++				MX6QDL_PAD_EIM_DA2__GPIO3_IO02 0x400130b1
++				/* DI1_D0_CS */
++				MX6QDL_PAD_EIM_DA13__GPIO3_IO13 0x400130b1
++				/* DI1_D1_CS */
++				MX6QDL_PAD_EIM_DA14__GPIO3_IO14 0x400130b1
++				/* DI1_PIN01 */
++				MX6QDL_PAD_EIM_DA15__GPIO3_IO15 0x400130b1
++				/* DI1_PIN03 */
++				MX6QDL_PAD_EIM_DA12__GPIO3_IO12 0x400130b1
++				/* DISP1_DATA08 */
++				MX6QDL_PAD_EIM_DA1__GPIO3_IO01 0x400130b1
++				/* DISP1_DATA09 */
++				MX6QDL_PAD_EIM_DA0__GPIO3_IO00 0x400130b1
++				/* DISP1_DATA10 */
++				MX6QDL_PAD_EIM_EB1__GPIO2_IO29 0x400130b1
++				/* DISP1_DATA11 */
++				MX6QDL_PAD_EIM_EB0__GPIO2_IO28 0x400130b1
++				/* DISP1_DATA12 */
++				MX6QDL_PAD_EIM_A17__GPIO2_IO21 0x400130b1
++				/* DISP1_DATA13 */
++				MX6QDL_PAD_EIM_A18__GPIO2_IO20 0x400130b1
++				/* DISP1_DATA14 */
++				MX6QDL_PAD_EIM_A19__GPIO2_IO19 0x400130b1
++				/* DISP1_DATA15 */
++				MX6QDL_PAD_EIM_A20__GPIO2_IO18 0x400130b1
++				/* DISP1_DATA16 */
++				MX6QDL_PAD_EIM_A21__GPIO2_IO17 0x400130b1
++				/* DISP1_DATA17 */
++				MX6QDL_PAD_EIM_A22__GPIO2_IO16 0x400130b1
++				/* DISP1_DATA18 */
++				MX6QDL_PAD_EIM_A23__GPIO6_IO06 0x400130b1
++				/* DISP1_DATA19 */
++				MX6QDL_PAD_EIM_A24__GPIO5_IO04 0x400130b1
++				/* DISP1_DATA20 */
++				MX6QDL_PAD_EIM_D31__GPIO3_IO31 0x400130b1
++				/* DISP1_DATA21 */
++				MX6QDL_PAD_EIM_D30__GPIO3_IO30 0x400130b1
++				/* DISP1_DATA22 */
++				MX6QDL_PAD_EIM_D26__GPIO3_IO26 0x400130b1
++				/* DISP1_DATA23 */
++				MX6QDL_PAD_EIM_D27__GPIO3_IO27 0x400130b1
++				/* DI1_DISP_CLK */
++				MX6QDL_PAD_EIM_A16__GPIO2_IO22 0x400130b1
++				/* SPDIF_IN */
++				MX6QDL_PAD_ENET_RX_ER__GPIO1_IO24 0x400130b1
++				/* SPDIF_OUT */
++				MX6QDL_PAD_GPIO_17__GPIO7_IO12 0x400130b1
++
++				/* MikroBUS GPIO pin number 10 */
++				MX6QDL_PAD_EIM_LBA__GPIO2_IO27 0x400130b1
++			>;
++		};
++
++		pinctrl_hummingboard2_ecspi2: hummingboard2-ecspi2grp {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_OE__ECSPI2_MISO	0x100b1
++				MX6QDL_PAD_EIM_CS1__ECSPI2_MOSI	0x100b1
++				MX6QDL_PAD_EIM_CS0__ECSPI2_SCLK	0x100b1
++				MX6QDL_PAD_EIM_RW__GPIO2_IO26	0x000b1 /* CS */
++			>;
++		};
++
++		pinctrl_hummingboard2_gpio7_9: hummingboard2-gpio7_9 {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_CMD__GPIO7_IO09 0x80000000
++			>;
++		};
++
++		pinctrl_hummingboard2_hdmi: hummingboard2-hdmi {
++			fsl,pins = <
++				MX6QDL_PAD_KEY_ROW2__HDMI_TX_CEC_LINE 0x1f8b0
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c1: hummingboard2-i2c1 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D21__I2C1_SCL 0x4001b8b1
++				MX6QDL_PAD_EIM_D28__I2C1_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c2: hummingboard2-i2c2 {
++			fsl,pins = <
++				MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1
++				MX6QDL_PAD_KEY_ROW3__I2C2_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_i2c3: hummingboard2-i2c3 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D17__I2C3_SCL 0x4001b8b1
++				MX6QDL_PAD_EIM_D18__I2C3_SDA 0x4001b8b1
++			>;
++		};
++
++		pinctrl_hummingboard2_mipi: hummingboard2_mipi {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_DAT2__GPIO2_IO10 0x4001b8b1
++				MX6QDL_PAD_KEY_COL4__GPIO4_IO14 0x4001b8b1
++				MX6QDL_PAD_NANDF_CS2__CCM_CLKO2 0x130b0
++			>;
++		};
++
++		pinctrl_hummingboard2_pcie_reset: hummingboard2-pcie-reset {
++			fsl,pins = <
++				MX6QDL_PAD_SD4_DAT3__GPIO2_IO11 0x1b0b1
++			>;
++		};
++
++		pinctrl_hummingboard2_pwm1: pwm1grp {
++			fsl,pins = <
++				MX6QDL_PAD_DISP0_DAT8__PWM1_OUT 0x1b0b1
++			>;
++		};
++
++		pinctrl_hummingboard2_sgtl5000: hummingboard2-sgtl5000 {
++			fsl,pins = <
++				MX6QDL_PAD_DISP0_DAT19__AUD5_RXD 0x130b0
++				MX6QDL_PAD_KEY_COL0__AUD5_TXC 0x130b0
++				MX6QDL_PAD_KEY_ROW0__AUD5_TXD 0x110b0
++				MX6QDL_PAD_KEY_COL1__AUD5_TXFS 0x130b0
++				MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0
++			>;
++		};
++
++		pinctrl_hummingboard2_usbh1_vbus: hummingboard2-usbh1-vbus {
++			fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbh2_vbus: hummingboard2-usbh2-vbus {
++			fsl,pins = <MX6QDL_PAD_SD4_DAT5__GPIO2_IO13 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbh3_vbus: hummingboard2-usbh3-vbus {
++			fsl,pins = <MX6QDL_PAD_SD4_CLK__GPIO7_IO10 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usbotg_id: hummingboard2-usbotg-id {
++			/*
++			 * Similar to pinctrl_usbotg_2, but we want it
++			 * pulled down for a fixed host connection.
++			 */
++			fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
++		};
++
++		pinctrl_hummingboard2_usbotg_vbus: hummingboard2-usbotg-vbus {
++			fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x1b0b0>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
++			fsl,pins = <
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x13071
++				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
++				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2: hummingboard2-usdhc2 {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x17059
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x10059
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x17059
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x17059
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x17059
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x13059
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_100mhz: hummingboard2-usdhc2-100mhz {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x170b9
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x100b9
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x170b9
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x170b9
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x170b9
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x130b9
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc2_200mhz: hummingboard2-usdhc2-200mhz {
++			fsl,pins = <
++				MX6QDL_PAD_SD2_CMD__SD2_CMD    0x170f9
++				MX6QDL_PAD_SD2_CLK__SD2_CLK    0x100f9
++				MX6QDL_PAD_SD2_DAT0__SD2_DATA0 0x170f9
++				MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x170f9
++				MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x170f9
++				MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x130f9
++			>;
++		};
++
++		pinctrl_hummingboard2_usdhc3: hummingboard2-usdhc3 {
++			fsl,pins = <
++				MX6QDL_PAD_SD3_CMD__SD3_CMD    0x17059
++				MX6QDL_PAD_SD3_CLK__SD3_CLK    0x10059
++				MX6QDL_PAD_SD3_DAT0__SD3_DATA0 0x17059
++				MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
++				MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
++				MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
++				MX6QDL_PAD_SD3_DAT4__SD3_DATA4 0x17059
++				MX6QDL_PAD_SD3_DAT5__SD3_DATA5 0x17059
++				MX6QDL_PAD_SD3_DAT6__SD3_DATA6 0x17059
++				MX6QDL_PAD_SD3_DAT7__SD3_DATA7 0x17059
++				MX6QDL_PAD_SD3_RST__SD3_RESET  0x17059
++			>;
++		};
++
++		pinctrl_hummingboard2_uart3: hummingboard2-uart3 {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_D25__UART3_TX_DATA	0x1b0b1
++				MX6QDL_PAD_EIM_D24__UART3_RX_DATA	0x40013000
++			>;
++		};
++	};
++};
++
++&ldb {
++	status = "disabled";
++
++	lvds-channel@0 {
++		fsl,data-mapping = "spwg";
++		fsl,data-width = <18>;
++	};
++};
++
++&pcie {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_pcie_reset>;
++	reset-gpio = <&gpio2 11 0>;
++	status = "okay";
++};
++
++&pwm1 {
++        pinctrl-names = "default";
++        pinctrl-0 = <&pinctrl_hummingboard2_pwm1>;
++        status = "okay";
++};
++
++&pwm3 {
++	status = "disabled";
++};
++
++&pwm4 {
++	status = "disabled";
++};
++
++&ssi1 {
++	status = "okay";
++};
++
++&usbh1 {
++	disable-over-current;
++	vbus-supply = <&reg_usbh1_vbus>;
++	status = "okay";
++};
++
++&usbotg {
++	disable-over-current;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_usbotg_id>;
++	vbus-supply = <&reg_usbotg_vbus>;
++	status = "okay";
++};
++
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2
++	>;
++	pinctrl-1 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2_100mhz
++	>;
++	pinctrl-2 = <
++		&pinctrl_hummingboard2_usdhc2_aux
++		&pinctrl_hummingboard2_usdhc2_200mhz
++	>;
++	mmc-pwrseq = <&usdhc2_pwrseq>;
++	cd-gpios = <&gpio1 4 0>;
++	status = "okay";
++};
++
++&usdhc3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <
++		&pinctrl_hummingboard2_usdhc3
++	>;
++	vmmc-supply = <&reg_3p3v>;
++	vqmmc-supply = <&reg_3p3v>;
++	bus-width = <8>;
++	non-removable;
++	status = "okay";
++};
++
++&uart3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hummingboard2_uart3>;
++	status = "okay";
++};
+-- 
+2.12.2
+
+From 3da2a99c4a8f19e846b19071441d2c6b88e00c06 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:30 +0000
+Subject: [PATCH 2/4] ARM: dts: imx6*-hummingboard2: fix SD card detect
+
+Fix the SD card detect signal, which was missing the polarity
+specification, and the pull-up necessary for proper signalling.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 11b63f6f2b89..734487edf200 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -393,7 +393,7 @@
+ 
+ 		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
+ 			fsl,pins = <
+-				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x13071
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
+ 				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
+ 				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
+ 			>;
+@@ -520,7 +520,7 @@
+ 		&pinctrl_hummingboard2_usdhc2_200mhz
+ 	>;
+ 	mmc-pwrseq = <&usdhc2_pwrseq>;
+-	cd-gpios = <&gpio1 4 0>;
++	cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ 	status = "okay";
+ };
+ 
+-- 
+2.12.2
+
+From 57b0103b600a535a35e5ff9714649519a0b3a77a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:35 +0000
+Subject: [PATCH 3/4] ARM: dts: imx6*-hummingboard2: use proper gpio flags
+ definitions
+
+Use proper gpio flag definitions for GPIOs rather than using opaque
+uninformative numbers.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 734487edf200..88aaed26dd77 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -50,7 +50,7 @@
+ 
+ 	ir_recv: ir-receiver {
+ 		compatible = "gpio-ir-receiver";
+-		gpios = <&gpio7 9 1>;
++		gpios = <&gpio7 9 GPIO_ACTIVE_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_gpio7_9>;
+ 		linux,rc-map-name = "rc-rc6-mce";
+@@ -80,7 +80,7 @@
+ 	reg_usbh1_vbus: regulator-usb-h1-vbus {
+ 		compatible = "regulator-fixed";
+ 		enable-active-high;
+-		gpio = <&gpio1 0 0>;
++		gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh1_vbus>;
+ 		regulator-name = "usb_h1_vbus";
+@@ -91,7 +91,7 @@
+ 	reg_usbotg_vbus: regulator-usb-otg-vbus {
+ 		compatible = "regulator-fixed";
+ 		enable-active-high;
+-		gpio = <&gpio3 22 0>;
++		gpio = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbotg_vbus>;
+ 		regulator-name = "usb_otg_vbus";
+@@ -102,7 +102,7 @@
+ 	reg_usbh2_vbus: regulator-usb-h2-vbus {
+ 		compatible = "regulator-gpio";
+ 		enable-active-high;
+-		enable-gpio = <&gpio2 13 0>;
++		enable-gpio = <&gpio2 13 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh2_vbus>;
+ 		regulator-name = "usb_h2_vbus";
+@@ -114,7 +114,7 @@
+ 	reg_usbh3_vbus: regulator-usb-h3-vbus {
+ 		compatible = "regulator-gpio";
+ 		enable-active-high;
+-		enable-gpio = <&gpio7 10 0>;
++		enable-gpio = <&gpio7 10 GPIO_ACTIVE_HIGH>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_hummingboard2_usbh3_vbus>;
+ 		regulator-name = "usb_h3_vbus";
+-- 
+2.12.2
+
+From f931de70370ff576f381cb9745bc54225a1a8056 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 13 Jan 2017 14:45:40 +0000
+Subject: [PATCH 4/4] ARM: dts: imx6*-hummingboard2: convert to more
+ conventional vmmc-supply
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+---
+ arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+index 88aaed26dd77..f19d30b34ac4 100644
+--- a/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-hummingboard2.dtsi
+@@ -56,11 +56,6 @@
+ 		linux,rc-map-name = "rc-rc6-mce";
+ 	};
+ 
+-	usdhc2_pwrseq: usdhc2-pwrseq {
+-		compatible = "mmc-pwrseq-simple";
+-		reset-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;
+-	};
+-
+ 	reg_3p3v: regulator-3p3v {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "3P3V";
+@@ -123,6 +118,18 @@
+ 		regulator-boot-on;
+ 	};
+ 
++	reg_usdhc2_vmmc: reg-usdhc2-vmmc {
++		compatible = "regulator-fixed";
++		gpio = <&gpio4 30 GPIO_ACTIVE_HIGH>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_hummingboard2_vmmc>;
++		regulator-boot-on;
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		regulator-name = "usdhc2_vmmc";
++		startup-delay-us = <1000>;
++	};
++
+ 	sound-sgtl5000 {
+ 		audio-codec = <&sgtl5000>;
+ 		audio-routing =
+@@ -393,7 +400,6 @@
+ 
+ 		pinctrl_hummingboard2_usdhc2_aux: hummingboard2-usdhc2-aux {
+ 			fsl,pins = <
+-				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
+ 				MX6QDL_PAD_KEY_ROW1__SD2_VSELECT 0x1b071
+ 				MX6QDL_PAD_DISP0_DAT9__GPIO4_IO30 0x1b0b0
+ 			>;
+@@ -432,6 +438,12 @@
+ 			>;
+ 		};
+ 
++		pinctrl_hummingboard2_vmmc: hummingboard2-vmmc {
++			fsl,pins = <
++				MX6QDL_PAD_GPIO_4__GPIO1_IO04    0x1f071
++			>;
++		};
++
+ 		pinctrl_hummingboard2_usdhc3: hummingboard2-usdhc3 {
+ 			fsl,pins = <
+ 				MX6QDL_PAD_SD3_CMD__SD3_CMD    0x17059
+@@ -519,7 +531,7 @@
+ 		&pinctrl_hummingboard2_usdhc2_aux
+ 		&pinctrl_hummingboard2_usdhc2_200mhz
+ 	>;
+-	mmc-pwrseq = <&usdhc2_pwrseq>;
++	vmmc-supply = <&reg_usdhc2_vmmc>;
+ 	cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ 	status = "okay";
+ };
+-- 
+2.12.2
+

arm-of-restrict-dma-configuration.patch

@@ -0,0 +1,121 @@
+From 723288836628bc1c0855f3bb7b64b1803e4b9e4a Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Thu, 31 Aug 2017 11:32:54 +0100
+Subject: of: restrict DMA configuration
+
+Moving DMA configuration to happen later at driver probe time had the
+unnoticed side-effect that we now perform DMA configuration for *every*
+device represented in DT, rather than only those explicitly created by
+the of_platform and PCI code.
+
+As Christoph points out, this is not really the best thing to do. Whilst
+there may well be other DMA-capable buses that can benefit from having
+their children automatically configured after the bridge has probed,
+there are also plenty of others like USB, MDIO, etc. that definitely do
+not support DMA and should not be indiscriminately processed.
+
+The good news is that in most cases the DT "dma-ranges" property serves
+as an appropriate indicator - per a strict interpretation of the spec,
+anything lacking a "dma-ranges" property should be considered not to
+have a mapping of DMA address space from its children to its parent,
+thus anything for which of_dma_get_range() does not succeed does not
+need DMA configuration. Certain bus types have a general expectation of
+DMA capability and carry a well-established precedent that an absent
+"dma-ranges" implies the same as the empty property, so we automatically
+opt those in to DMA configuration regardless, to avoid regressing most
+existing platforms.
+
+Fixes: 09515ef5ddad ("of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices")
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+---
+ drivers/of/device.c | 48 ++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index e0a28ea..04c4c95 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -9,6 +9,9 @@
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
++#include <linux/pci.h>
++#include <linux/platform_device.h>
++#include <linux/amba/bus.h>
+ 
+ #include <asm/errno.h>
+ #include "of_private.h"
+@@ -84,31 +87,28 @@ int of_device_add(struct platform_device *ofdev)
+  */
+ int of_dma_configure(struct device *dev, struct device_node *np)
+ {
+-	u64 dma_addr, paddr, size;
++	u64 dma_addr, paddr, size = 0;
+ 	int ret;
+ 	bool coherent;
+ 	unsigned long offset;
+ 	const struct iommu_ops *iommu;
+ 	u64 mask;
+ 
+-	/*
+-	 * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
+-	 * setup the correct supported mask.
+-	 */
+-	if (!dev->coherent_dma_mask)
+-		dev->coherent_dma_mask = DMA_BIT_MASK(32);
+-
+-	/*
+-	 * Set it to coherent_dma_mask by default if the architecture
+-	 * code has not set it.
+-	 */
+-	if (!dev->dma_mask)
+-		dev->dma_mask = &dev->coherent_dma_mask;
+-
+ 	ret = of_dma_get_range(np, &dma_addr, &paddr, &size);
+ 	if (ret < 0) {
++		/*
++		 * For legacy reasons, we have to assume some devices need
++		 * DMA configuration regardless of whether "dma-ranges" is
++		 * correctly specified or not.
++		 */
++		if (!dev_is_pci(dev) &&
++#ifdef CONFIG_ARM_AMBA
++		    dev->bus != &amba_bustype &&
++#endif
++		    dev->bus != &platform_bus_type)
++			return ret == -ENODEV ? 0 : ret;
++
+ 		dma_addr = offset = 0;
+-		size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
+ 	} else {
+ 		offset = PFN_DOWN(paddr - dma_addr);
+ 
+@@ -129,6 +129,22 @@ int of_dma_configure(struct device *dev, struct device_node *np)
+ 		dev_dbg(dev, "dma_pfn_offset(%#08lx)\n", offset);
+ 	}
+ 
++	/*
++	 * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
++	 * setup the correct supported mask.
++	 */
++	if (!dev->coherent_dma_mask)
++		dev->coherent_dma_mask = DMA_BIT_MASK(32);
++	/*
++	 * Set it to coherent_dma_mask by default if the architecture
++	 * code has not set it.
++	 */
++	if (!dev->dma_mask)
++		dev->dma_mask = &dev->coherent_dma_mask;
++
++	if (!size)
++		size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
++
+ 	dev->dma_pfn_offset = offset;
+ 
+ 	/*
+-- 
+cgit v1.1
+

arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch

@@ -0,0 +1,100 @@
+From bb3e08008c0e48fd4f51a0f0957eecae61a24d69 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 1 Nov 2016 09:35:30 +0000
+Subject: [PATCH] Revert "mmc: omap_hsmmc: Use dma_request_chan() for
+ requesting DMA channel"
+
+This reverts commit 81eef6ca92014845d40e3f1310e42b7010303acc.
+---
+ drivers/mmc/host/omap_hsmmc.c | 50 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 24ebc9a..3563321 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -32,6 +32,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/of_gpio.h>
+ #include <linux/of_device.h>
++#include <linux/omap-dmaengine.h>
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/core.h>
+ #include <linux/mmc/mmc.h>
+@@ -1992,6 +1993,8 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int ret, irq;
+ 	const struct of_device_id *match;
++	dma_cap_mask_t mask;
++	unsigned tx_req, rx_req;
+ 	const struct omap_mmc_of_data *data;
+ 	void __iomem *base;
+ 
+@@ -2121,17 +2124,44 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 
+ 	omap_hsmmc_conf_bus_power(host);
+ 
+-	host->rx_chan = dma_request_chan(&pdev->dev, "rx");
+-	if (IS_ERR(host->rx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "RX DMA channel request failed\n");
+-		ret = PTR_ERR(host->rx_chan);
++	if (!pdev->dev.of_node) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA TX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		tx_req = res->start;
++
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA RX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		rx_req = res->start;
++	}
++
++	dma_cap_zero(mask);
++	dma_cap_set(DMA_SLAVE, mask);
++
++	host->rx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &rx_req, &pdev->dev, "rx");
++
++	if (!host->rx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain RX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+-	host->tx_chan = dma_request_chan(&pdev->dev, "tx");
+-	if (IS_ERR(host->tx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "TX DMA channel request failed\n");
+-		ret = PTR_ERR(host->tx_chan);
++	host->tx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &tx_req, &pdev->dev, "tx");
++
++	if (!host->tx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain TX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+@@ -2189,9 +2219,9 @@ err_slot_name:
+ 	mmc_remove_host(mmc);
+ err_irq:
+ 	device_init_wakeup(&pdev->dev, false);
+-	if (!IS_ERR_OR_NULL(host->tx_chan))
++	if (host->tx_chan)
+ 		dma_release_channel(host->tx_chan);
+-	if (!IS_ERR_OR_NULL(host->rx_chan))
++	if (host->rx_chan)
+ 		dma_release_channel(host->rx_chan);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+-- 
+2.9.3
+

arm-tegra-fix-gpu-iommu.patch

@@ -0,0 +1,39 @@
+From patchwork Sun Jul  9 16:36:14 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: ARM: tegra: Register host1x node with iommu binding on tegra124
+From: Paul Kocialkowski <contact@paulk.fr>
+X-Patchwork-Id: 9831825
+Message-Id: <20170709163614.6746-1-contact@paulk.fr>
+To: linux-arm-kernel@lists.infradead.org, linux-tegra@vger.kernel.org,
+ linux-kernel@vger.kernel.org
+Cc: Thierry Reding <thierry.reding@gmail.com>,
+ Stephen Warren <swarren@wwwdotorg.org>,
+ Mikko Perttunen <mperttunen@nvidia.com>,
+ Paul Kocialkowski <contact@paulk.fr>, 
+ Jonathan Hunter <jonathanh@nvidia.com>
+Date: Sun,  9 Jul 2017 19:36:14 +0300
+
+This registers the host1x node with the SMMU (as HC swgroup) to allow
+the host1x code to attach to it. It avoid failing the probe sequence,
+which resulted in the tegra drm driver not probing and thus nothing
+being displayed on-screen.
+
+Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
+---
+ arch/arm/boot/dts/tegra124.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/tegra124.dtsi b/arch/arm/boot/dts/tegra124.dtsi
+index 187a36c6d0fc..b3b89befffeb 100644
+--- a/arch/arm/boot/dts/tegra124.dtsi
++++ b/arch/arm/boot/dts/tegra124.dtsi
+@@ -85,6 +85,7 @@
+ 		clocks = <&tegra_car TEGRA124_CLK_HOST1X>;
+ 		resets = <&tegra_car 28>;
+ 		reset-names = "host1x";
++		iommus = <&mc TEGRA_SWGROUP_HC>;
+ 
+ 		#address-cells = <2>;
+ 		#size-cells = <2>;

arm-thermal-fixes.patch

@@ -0,0 +1,224 @@
+From 0fe4d2181cc4cb3eba303c0e03f878d2558d0f3a Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Fri, 31 Mar 2017 20:03:04 +0000
+Subject: [PATCH] ARM: dts: bcm283x: Add CPU thermal zone with 1
+ trip point
+
+As suggested by Eduardo Valentin this adds the thermal zone for
+the bcm2835 SoC with its single thermal sensor. We start with
+the criticial trip point and leave the cooling devices empty
+since we don't have any at the moment. Since the coefficients
+could vary depending on the SoC we need to define them separate.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ arch/arm/boot/dts/bcm2835.dtsi |  4 ++++
+ arch/arm/boot/dts/bcm2836.dtsi |  4 ++++
+ arch/arm/boot/dts/bcm283x.dtsi | 21 +++++++++++++++++++++
+ 3 files changed, 29 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
+index 0890d97e674d..659b6e9513b1 100644
+--- a/arch/arm/boot/dts/bcm2835.dtsi
++++ b/arch/arm/boot/dts/bcm2835.dtsi
+@@ -24,6 +24,10 @@
+ 	};
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	407000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2835-thermal";
+diff --git a/arch/arm/boot/dts/bcm2836.dtsi b/arch/arm/boot/dts/bcm2836.dtsi
+index 519a44f5d25a..da3deeb42592 100644
+--- a/arch/arm/boot/dts/bcm2836.dtsi
++++ b/arch/arm/boot/dts/bcm2836.dtsi
+@@ -77,6 +77,10 @@
+ 	interrupts = <8>;
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	407000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2836-thermal";
+diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
+index 561f27d8d922..86a5db53da8f 100644
+--- a/arch/arm/boot/dts/bcm283x.dtsi
++++ b/arch/arm/boot/dts/bcm283x.dtsi
+@@ -19,6 +19,26 @@
+ 		bootargs = "earlyprintk console=ttyAMA0";
+ 	};
+ 
++	thermal-zones {
++		cpu_thermal: cpu-thermal {
++			polling-delay-passive = <0>;
++			polling-delay = <1000>;
++
++			thermal-sensors = <&thermal>;
++
++			trips {
++				cpu-crit {
++					temperature	= <80000>;
++					hysteresis	= <0>;
++					type		= "critical";
++				};
++			};
++
++			cooling-maps {
++			};
++		};
++	};
++
+ 	soc {
+ 		compatible = "simple-bus";
+ 		#address-cells = <1>;
+@@ -430,6 +450,7 @@
+ 			compatible = "brcm,bcm2835-thermal";
+ 			reg = <0x7e212000 0x8>;
+ 			clocks = <&clocks BCM2835_CLOCK_TSENS>;
++			#thermal-sensor-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.13.3
+
+From 4ae6f954b96c1fea86c6f21ae8fc413f5fc3444e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Fri, 31 Mar 2017 20:03:05 +0000
+Subject: [PATCH] ARM64: dts: bcm2837: Define CPU thermal coefficients
+
+This defines the bcm2837 SoC specific thermal coefficients in
+order to initialize the thermal driver correctly.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2837.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+index 19f2fe620a21..2d5de6f0f78d 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+@@ -75,6 +75,10 @@
+ 	interrupts = <8>;
+ };
+ 
++&cpu_thermal {
++	coefficients = <(-538)	412000>;
++};
++
+ /* enable thermal sensor with the correct compatible property set */
+ &thermal {
+ 	compatible = "brcm,bcm2837-thermal";
+-- 
+2.13.3
+
+From 1fe3854a83b580727c9464b37b62ba77ead1d6f6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 14 Jun 2017 12:13:27 +0300
+Subject: [PATCH] thermal: bcm2835: fix an error code in probe()
+
+This causes a static checker because we're passing a valid pointer to
+PTR_ERR().  "err" is already the correct error code, so we can just
+delete this line.
+
+Fixes: bcb7dd9ef206 ("thermal: bcm2835: add thermal driver for bcm2835 SoC")
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/broadcom/bcm2835_thermal.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
+index 0ecf80890c84..e6863c841662 100644
+--- a/drivers/thermal/broadcom/bcm2835_thermal.c
++++ b/drivers/thermal/broadcom/bcm2835_thermal.c
+@@ -245,7 +245,6 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+ 		 */
+ 		err = tz->ops->get_trip_temp(tz, 0, &trip_temp);
+ 		if (err < 0) {
+-			err = PTR_ERR(tz);
+ 			dev_err(&pdev->dev,
+ 				"Not able to read trip_temp: %d\n",
+ 				err);
+-- 
+2.13.3
+
+From e3bdc8d7623d5875403ad40443e7b049ae200fcd Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Tue, 6 Jun 2017 15:12:37 +0530
+Subject: [PATCH] thermal: imx: Handle return value of clk_prepare_enable
+
+clk_prepare_enable() can fail here and we must check its return value.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/imx_thermal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
+index f7ec39f46ee4..4798b4b1fd77 100644
+--- a/drivers/thermal/imx_thermal.c
++++ b/drivers/thermal/imx_thermal.c
+@@ -660,8 +660,11 @@ static int imx_thermal_resume(struct device *dev)
+ {
+ 	struct imx_thermal_data *data = dev_get_drvdata(dev);
+ 	struct regmap *map = data->tempmon;
++	int ret;
+ 
+-	clk_prepare_enable(data->thermal_clk);
++	ret = clk_prepare_enable(data->thermal_clk);
++	if (ret)
++		return ret;
+ 	/* Enabled thermal sensor after resume */
+ 	regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN);
+ 	regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP);
+-- 
+2.13.3
+
+From 919054fdfc8adf58c5512fe9872eb53ea0f5525d Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Tue, 6 Jun 2017 15:04:46 +0530
+Subject: [PATCH] thermal: hisilicon: Handle return value of clk_prepare_enable
+
+clk_prepare_enable() can fail here and we must check its return value.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+---
+ drivers/thermal/hisi_thermal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
+index f6429666a1cf..9c3ce341eb97 100644
+--- a/drivers/thermal/hisi_thermal.c
++++ b/drivers/thermal/hisi_thermal.c
+@@ -397,8 +397,11 @@ static int hisi_thermal_suspend(struct device *dev)
+ static int hisi_thermal_resume(struct device *dev)
+ {
+ 	struct hisi_thermal_data *data = dev_get_drvdata(dev);
++	int ret;
+ 
+-	clk_prepare_enable(data->clk);
++	ret = clk_prepare_enable(data->clk);
++	if (ret)
++		return ret;
+ 
+ 	data->irq_enabled = true;
+ 	hisi_thermal_enable_bind_irq_sensor(data);
+-- 
+2.13.3
+

arm64-Add-option-of-13-for-FORCE_MAX_ZONEORDER.patch

@@ -0,0 +1,29 @@
+From 487ff7b0e537506057960a0c2d9482d19f2acf4a Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 26 Apr 2017 11:12:54 +0100
+Subject: [PATCH] Add option of 13 for FORCE_MAX_ZONEORDER
+
+This is a hack, but it's what the other distros currently use
+for aarch64 with 4K pages so we'll do the same while upstream
+decides what the best outcome is (which isn't this).
+
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 3741859765cf..deec9511f1d3 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -751,6 +751,7 @@ config XEN
+ config FORCE_MAX_ZONEORDER
+ 	int
+ 	default "14" if (ARM64_64K_PAGES && TRANSPARENT_HUGEPAGE)
++	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)
+ 	default "12" if (ARM64_16K_PAGES && TRANSPARENT_HUGEPAGE)
+ 	default "11"
+ 	help
+-- 
+2.12.2
+

arm64-xgene-acpi-fix.patch

@@ -0,0 +1,38 @@
+From bdb9458a3382ba745a66be5526d3899103c76eda Mon Sep 17 00:00:00 2001
+From: Loc Ho <lho@apm.com>
+Date: Fri, 21 Jul 2017 11:24:37 -0700
+Subject: ACPI: APEI: Enable APEI multiple GHES source to share a single
+ external IRQ
+
+X-Gene platforms describe multiple GHES error sources with the same
+hardware error notification type (external interrupt) and interrupt
+number.
+
+Change the GHES interrupt request to support sharing the same IRQ.
+
+This change includs contributions from Tuan Phan <tphan@apm.com>.
+
+Signed-off-by: Loc Ho <lho@apm.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+---
+ drivers/acpi/apei/ghes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index d661d45..eed09fc 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1157,7 +1157,8 @@ static int ghes_probe(struct platform_device *ghes_dev)
+ 			       generic->header.source_id);
+ 			goto err_edac_unreg;
+ 		}
+-		rc = request_irq(ghes->irq, ghes_irq_func, 0, "GHES IRQ", ghes);
++		rc = request_irq(ghes->irq, ghes_irq_func, IRQF_SHARED,
++				 "GHES IRQ", ghes);
+ 		if (rc) {
+ 			pr_err(GHES_PFX "Failed to register IRQ for generic hardware error source: %d\n",
+ 			       generic->header.source_id);
+-- 
+cgit v1.1
+

ath9k-rx-dma-stop-check.patch

@@ -0,0 +1,38 @@
+From: "kernel-team@fedoraproject.org" <kernel-team@fedoraproject.org>
+Date: Wed, 6 Feb 2013 09:57:47 -0500
+Subject: [PATCH] ath9k: rx dma stop check
+
+---
+ drivers/net/wireless/ath/ath9k/mac.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index bba85d1a6cd1..ebbee8f17130 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -693,7 +693,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
+ {
+ #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
+ 	struct ath_common *common = ath9k_hw_common(ah);
+-	u32 mac_status, last_mac_status = 0;
++	u32 mac_status = 0, last_mac_status = 0;
+ 	int i;
+ 
+ 	/* Enable access to the DMA observation bus */
+@@ -723,6 +723,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
+ 	}
+ 
+ 	if (i == 0) {
++		if (!AR_SREV_9300_20_OR_LATER(ah) &&
++		    (mac_status & 0x700) == 0) {
++			/*
++			 * DMA is idle but the MAC is still stuck
++			 * processing events
++			 */
++			*reset = true;
++			return true;
++		}
++
+ 		ath_err(common,
+ 			"DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
+ 			AH_RX_STOP_DMA_TIMEOUT / 1000,

baseconfig/CONFIG_60XX_WDT

@@ -0,0 +1 @@
+# CONFIG_60XX_WDT is not set

baseconfig/CONFIG_6LOWPAN

@@ -0,0 +1 @@
+CONFIG_6LOWPAN=m

baseconfig/CONFIG_6LOWPAN_DEBUGFS

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_DEBUGFS=y

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_DEST

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_HOP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m

baseconfig/CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m

baseconfig/CONFIG_6LOWPAN_GHC_ICMPV6

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_ICMPV6=m

baseconfig/CONFIG_6LOWPAN_GHC_UDP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_GHC_UDP=m

baseconfig/CONFIG_6LOWPAN_NHC

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC=m

baseconfig/CONFIG_6LOWPAN_NHC_DEST

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_DEST=m

baseconfig/CONFIG_6LOWPAN_NHC_FRAGMENT

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_FRAGMENT=m

baseconfig/CONFIG_6LOWPAN_NHC_HOP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_HOP=m

baseconfig/CONFIG_6LOWPAN_NHC_IPV6

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_IPV6=m

baseconfig/CONFIG_6LOWPAN_NHC_MOBILITY

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_MOBILITY=m

baseconfig/CONFIG_6LOWPAN_NHC_ROUTING

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_ROUTING=m

baseconfig/CONFIG_6LOWPAN_NHC_UDP

@@ -0,0 +1 @@
+CONFIG_6LOWPAN_NHC_UDP=m

baseconfig/CONFIG_6PACK

@@ -0,0 +1 @@
+CONFIG_6PACK=m

baseconfig/CONFIG_8139CP

@@ -0,0 +1 @@
+CONFIG_8139CP=m

baseconfig/CONFIG_8139TOO

@@ -0,0 +1 @@
+CONFIG_8139TOO=m

baseconfig/CONFIG_8139TOO_8129

@@ -0,0 +1 @@
+CONFIG_8139TOO_8129=y

baseconfig/CONFIG_8139TOO_PIO

@@ -0,0 +1 @@
+# CONFIG_8139TOO_PIO is not set

baseconfig/CONFIG_8139TOO_TUNE_TWISTER

@@ -0,0 +1 @@
+# CONFIG_8139TOO_TUNE_TWISTER is not set

baseconfig/CONFIG_8139_OLD_RX_RESET

@@ -0,0 +1 @@
+# CONFIG_8139_OLD_RX_RESET is not set

baseconfig/CONFIG_8723AU_AP_MODE

@@ -0,0 +1 @@
+# CONFIG_8723AU_AP_MODE is not set

baseconfig/CONFIG_8723AU_BT_COEXIST

@@ -0,0 +1 @@
+# CONFIG_8723AU_BT_COEXIST is not set

baseconfig/CONFIG_9P_FS

@@ -0,0 +1 @@
+CONFIG_9P_FS=m

baseconfig/CONFIG_9P_FSCACHE

@@ -0,0 +1 @@
+CONFIG_9P_FSCACHE=y

baseconfig/CONFIG_9P_FS_POSIX_ACL

@@ -0,0 +1 @@
+CONFIG_9P_FS_POSIX_ACL=y