Home Home > GIT Browse > linux-next
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2018-07-03 12:15:28 +0200
committerJiri Kosina <jkosina@suse.cz>2018-07-03 12:15:28 +0200
commitd721ca913efd6abc9a3de3741e25a4c840de0e14 (patch)
treeb35bcd50a62d0d4511fdfced9c4deeec8a1744c2
parent34cf262a24007225d0ea39ee49326de4f45155ac (diff)
parentbd85685545c51fa0435cbccd564f97f67606f6eb (diff)
Merge remote-tracking branch 'origin/users/tiwai/SLE15/for-next' into SLE15
Pull driver fixes from Takashi Iwai
-rw-r--r--patches.drivers/ACPI-watchdog-properly-initialize-resources50
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Add-PCI-region2-iomap-for-SBZ10
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Delete-pointless-assignments-to-stru73
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Delete-redundant-UNSOL-event-request84
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Don-t-test-for-QUIRK_NONE45
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Fix-DMic-data-rate-for-Alienware-M1764
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Restore-PCM-Analog-Mic-In238
-rw-r--r--patches.drivers/ALSA-hda-ca0132-Restore-behavior-of-QUIRK_ALIENWARE41
-rw-r--r--patches.drivers/ALSA-hda-ca0132-make-array-ca0132_alt_chmaps-static38
-rw-r--r--patches.drivers/ALSA-hda-ca0132-use-ARRAY_SIZE71
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-a-quirk-for-FSC-ESPRIMO-U921034
-rw-r--r--patches.drivers/ALSA-hda-realtek-Fix-pop-noise-on-Lenovo-P50-co63
-rw-r--r--patches.drivers/ALSA-hda-realtek-Fix-the-problem-of-two-front-mics-o56
-rw-r--r--patches.drivers/HID-intel-ish-hid-use-put_device-instead-of-kfree36
-rw-r--r--patches.drivers/HID-intel_ish-hid-ipc-register-more-pm-callbacks-to-114
-rw-r--r--patches.drivers/HID-lenovo-Add-support-for-IBM-Lenovo-Scrollpoint-mi134
-rw-r--r--patches.drivers/HID-wacom-Correct-logical-maximum-Y-for-2nd-gen-Intu44
-rw-r--r--patches.drivers/HID-wacom-Release-device-resource-data-obtained-by-d39
-rw-r--r--patches.drivers/Input-xpad-fix-GPD-Win-2-controller-name44
-rw-r--r--patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE936
-rw-r--r--patches.drivers/PCI-Mark-Broadcom-HT1100-and-HT2000-Root-Port-Extend51
-rw-r--r--patches.drivers/PCI-Restore-config-space-on-runtime-resume-despite-b86
-rw-r--r--patches.drivers/can-hi311x-Acquire-SPI-lock-on-do_get_berr_counter94
-rw-r--r--patches.drivers/can-hi311x-Work-around-TX-complete-interrupt-erratum73
-rw-r--r--patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable54
-rw-r--r--patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa79
-rw-r--r--patches.drivers/drm-i915-Apply-batch-location-restrictions-before-pi131
-rw-r--r--patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of-1
-rw-r--r--patches.drivers/drm-qxl-Call-qxl_bo_unref-outside-atomic-context64
-rw-r--r--patches.drivers/i2c-pmcmsp-fix-error-return-from-master_xfer35
-rw-r--r--patches.drivers/i2c-pmcmsp-return-message-count-on-master_xfer-succe35
-rw-r--r--patches.drivers/i2c-viperboard-return-message-count-on-master_xfer-s35
-rw-r--r--patches.drivers/iio-ad7793-implement-IIO_CHAN_INFO_SAMP_FREQ152
-rw-r--r--patches.drivers/iio-kfifo_buf-check-for-uint-overflow64
-rw-r--r--patches.drivers/iwlwifi-fw-harden-page-loading-code145
-rw-r--r--patches.drivers/iwlwifi-pcie-compare-with-number-of-IRQs-requested-f75
-rw-r--r--patches.drivers/media-uvcvideo-Support-realtek-s-UVC-1.5-device94
-rw-r--r--patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no8
-rw-r--r--patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y238
-rw-r--r--patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar97
-rw-r--r--patches.drivers/serial-altera-ensure-port-regshift-is-honored-consis78
-rw-r--r--patches.drivers/serial-arc_uart-Fix-out-of-bounds-access-through-DT-45
-rw-r--r--patches.drivers/serial-fsl_lpuart-Fix-out-of-bounds-access-through-D35
-rw-r--r--patches.drivers/serial-imx-Fix-out-of-bounds-access-through-serial-p47
-rw-r--r--patches.drivers/serial-mxs-auart-Fix-out-of-bounds-access-through-se41
-rw-r--r--patches.drivers/serial-samsung-Fix-out-of-bounds-access-through-seri45
-rw-r--r--patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa48
-rw-r--r--patches.drivers/serial-sh-sci-Fix-out-of-bounds-access-through-DT-al44
-rw-r--r--patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr63
-rw-r--r--patches.drivers/serial-xuartps-Fix-out-of-bounds-access-through-DT-a39
-rw-r--r--patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o73
-rw-r--r--patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.156
-rw-r--r--patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing119
-rw-r--r--patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak62
-rw-r--r--patches.fixes/kconfig-Fix-expr_free-E_NOT-leak59
-rw-r--r--patches.fixes/kobject-don-t-use-WARN-for-registration-failures51
-rw-r--r--patches.fixes/lib-kobject-Join-string-literals-back140
-rw-r--r--patches.suse/mmc-version-check-printk-downgrade28
-rw-r--r--series.conf57
59 files changed, 3646 insertions, 9 deletions
diff --git a/patches.drivers/ACPI-watchdog-properly-initialize-resources b/patches.drivers/ACPI-watchdog-properly-initialize-resources
new file mode 100644
index 0000000000..b6a12ba780
--- /dev/null
+++ b/patches.drivers/ACPI-watchdog-properly-initialize-resources
@@ -0,0 +1,50 @@
+From 6ce14f6416c84bd9c81777edf899b57ac5000c87 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 19 Sep 2017 01:49:02 +0200
+Subject: [PATCH] ACPI / watchdog: properly initialize resources
+Git-commit: 6ce14f6416c84bd9c81777edf899b57ac5000c87
+Patch-mainline: v4.14-rc2
+References: bsc#1051510
+
+We copy a local resource structure into a list, but only
+initialize some of its members, as pointed out by gcc-4.4:
+
+Drivers/acpi/acpi_watchdog.c: In function 'acpi_watchdog_init':
+drivers/acpi/acpi_watchdog.c:105: error: 'res.child' may be used uninitialized in this function
+drivers/acpi/acpi_watchdog.c:105: error: 'res.sibling' may be used uninitialized in this function
+drivers/acpi/acpi_watchdog.c:105: error: 'res.parent' may be used uninitialized in this function
+drivers/acpi/acpi_watchdog.c:105: error: 'res.desc' may be used uninitialized in this function
+drivers/acpi/acpi_watchdog.c:105: error: 'res.name' may be used uninitialized in this function
+
+Newer compilers can presumably optimize the uninitialized access
+away entirely and don't warn at all, but rely on the kzalloc()
+to zero the structure first. This adds an explicit initialization
+to force consistent behavior.
+
+Fixes: 058dfc767008 (ACPI / watchdog: Add support for WDAT hardware watchdog)
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/acpi/acpi_watchdog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
+index bf22c29d2517..11b113f8e367 100644
+--- a/drivers/acpi/acpi_watchdog.c
++++ b/drivers/acpi/acpi_watchdog.c
+@@ -66,7 +66,7 @@ void __init acpi_watchdog_init(void)
+ for (i = 0; i < wdat->entries; i++) {
+ const struct acpi_generic_address *gas;
+ struct resource_entry *rentry;
+- struct resource res;
++ struct resource res = {};
+ bool found;
+
+ gas = &entries[i].register_region;
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Add-PCI-region2-iomap-for-SBZ b/patches.drivers/ALSA-hda-ca0132-Add-PCI-region2-iomap-for-SBZ
index fb432b21ca..731c9e6816 100644
--- a/patches.drivers/ALSA-hda-ca0132-Add-PCI-region2-iomap-for-SBZ
+++ b/patches.drivers/ALSA-hda-ca0132-Add-PCI-region2-iomap-for-SBZ
@@ -25,17 +25,17 @@ Signed-off-by: Takashi Iwai <tiwai@suse.de>
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
-@@ -27,6 +27,9 @@
- #include <linux/mutex.h>
+@@ -28,6 +28,9 @@
#include <linux/module.h>
#include <linux/firmware.h>
+ #include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/io.h>
+#include <linux/pci.h>
#include <sound/core.h>
#include "hda_codec.h"
#include "hda_local.h"
-@@ -763,6 +766,11 @@ struct ca0132_spec {
+@@ -764,6 +767,11 @@ struct ca0132_spec {
#ifdef ENABLE_TUNING_CONTROLS
long cur_ctl_vals[TUNING_CTLS_COUNT];
#endif
@@ -47,7 +47,7 @@ Signed-off-by: Takashi Iwai <tiwai@suse.de>
};
/*
-@@ -4702,6 +4710,8 @@ static void ca0132_free(struct hda_codec
+@@ -4700,6 +4708,8 @@ static void ca0132_free(struct hda_codec
snd_hda_sequence_write(codec, spec->base_exit_verbs);
ca0132_exit_chip(codec);
snd_hda_power_down(codec);
@@ -56,7 +56,7 @@ Signed-off-by: Takashi Iwai <tiwai@suse.de>
kfree(spec->spec_init_verbs);
kfree(codec->spec);
}
-@@ -4917,6 +4927,15 @@ static int patch_ca0132(struct hda_codec
+@@ -4915,6 +4925,15 @@ static int patch_ca0132(struct hda_codec
else
spec->quirk = QUIRK_NONE;
diff --git a/patches.drivers/ALSA-hda-ca0132-Delete-pointless-assignments-to-stru b/patches.drivers/ALSA-hda-ca0132-Delete-pointless-assignments-to-stru
new file mode 100644
index 0000000000..2a5fbcdc03
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Delete-pointless-assignments-to-stru
@@ -0,0 +1,73 @@
+From 7919cd82b9f9be97111be386cbaac59958800ef9 Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:15 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Delete pointless assignments to struct auto_pin_cfg fields
+Git-commit: 7919cd82b9f9be97111be386cbaac59958800ef9
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+ca0132_config() was setting some values in the auto_pin_cfg for
+the codec... but it is called prior to snd_hda_parse_pin_defcfg(),
+which does a memset() to clear the entire structure as one of its
+first actions, making the entire exercise pointless.
+
+Kill all use of struct auto_pin_cfg from ca0132_config().
+
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 04e949aa01ad..c66834a9bac6 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7343,7 +7343,6 @@ static const struct hda_codec_ops ca0132_patch_ops = {
+ static void ca0132_config(struct hda_codec *codec)
+ {
+ struct ca0132_spec *spec = codec->spec;
+- struct auto_pin_cfg *cfg = &spec->autocfg;
+
+ spec->dacs[0] = 0x2;
+ spec->dacs[1] = 0x3;
+@@ -7405,12 +7404,7 @@ static void ca0132_config(struct hda_codec *codec)
+ /* SPDIF I/O */
+ spec->dig_out = 0x05;
+ spec->multiout.dig_out_nid = spec->dig_out;
+- cfg->dig_out_pins[0] = 0x0c;
+- cfg->dig_outs = 1;
+- cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
+ spec->dig_in = 0x09;
+- cfg->dig_in_pin = 0x0e;
+- cfg->dig_in_type = HDA_PCM_TYPE_SPDIF;
+ break;
+ case QUIRK_R3DI:
+ codec_dbg(codec, "%s: QUIRK_R3DI applied.\n", __func__);
+@@ -7438,9 +7432,6 @@ static void ca0132_config(struct hda_codec *codec)
+ /* SPDIF I/O */
+ spec->dig_out = 0x05;
+ spec->multiout.dig_out_nid = spec->dig_out;
+- cfg->dig_out_pins[0] = 0x0c;
+- cfg->dig_outs = 1;
+- cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
+ break;
+ default:
+ spec->num_outputs = 2;
+@@ -7463,12 +7454,7 @@ static void ca0132_config(struct hda_codec *codec)
+ /* SPDIF I/O */
+ spec->dig_out = 0x05;
+ spec->multiout.dig_out_nid = spec->dig_out;
+- cfg->dig_out_pins[0] = 0x0c;
+- cfg->dig_outs = 1;
+- cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
+ spec->dig_in = 0x09;
+- cfg->dig_in_pin = 0x0e;
+- cfg->dig_in_type = HDA_PCM_TYPE_SPDIF;
+ break;
+ }
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Delete-redundant-UNSOL-event-request b/patches.drivers/ALSA-hda-ca0132-Delete-redundant-UNSOL-event-request
new file mode 100644
index 0000000000..ef07f5e321
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Delete-redundant-UNSOL-event-request
@@ -0,0 +1,84 @@
+From a3d90d6775e2066a100b9124e40880bd317d2e02 Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:16 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Delete redundant UNSOL event requests
+Git-commit: a3d90d6775e2066a100b9124e40880bd317d2e02
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+During ca0132_init(), ca0132_init_unsol() is run before the
+spec->spec_init_verbs are written. ca0132_init_unsol() calls
+snd_hda_jack_detect_enable_callback(), which requests UNSOL events
+for three or four nodes, two of which were also (redundantly)
+requested by spec_init_verbs.
+
+Kill the redundant AC_VERB_SET_UNSOLICITED_ENABLE verbs.
+
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 32 +++++++++++---------------------
+ 1 file changed, 11 insertions(+), 21 deletions(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index c66834a9bac6..dba731c0bf53 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7462,7 +7462,7 @@ static void ca0132_config(struct hda_codec *codec)
+ static int ca0132_prepare_verbs(struct hda_codec *codec)
+ {
+ /* Verbs + terminator (an empty element) */
+-#define NUM_SPEC_VERBS 4
++#define NUM_SPEC_VERBS 2
+ struct ca0132_spec *spec = codec->spec;
+
+ spec->chip_init_verbs = ca0132_init_verbs0;
+@@ -7474,34 +7474,24 @@ static int ca0132_prepare_verbs(struct hda_codec *codec)
+ if (!spec->spec_init_verbs)
+ return -ENOMEM;
+
+- /* HP jack autodetection */
+- spec->spec_init_verbs[0].nid = spec->unsol_tag_hp;
+- spec->spec_init_verbs[0].param = AC_VERB_SET_UNSOLICITED_ENABLE;
+- spec->spec_init_verbs[0].verb = AC_USRSP_EN | spec->unsol_tag_hp;
+-
+- /* MIC1 jack autodetection */
+- spec->spec_init_verbs[1].nid = spec->unsol_tag_amic1;
+- spec->spec_init_verbs[1].param = AC_VERB_SET_UNSOLICITED_ENABLE;
+- spec->spec_init_verbs[1].verb = AC_USRSP_EN | spec->unsol_tag_amic1;
+-
+ /* config EAPD */
+- spec->spec_init_verbs[2].nid = 0x0b;
+- spec->spec_init_verbs[2].param = 0x78D;
+- spec->spec_init_verbs[2].verb = 0x00;
++ spec->spec_init_verbs[0].nid = 0x0b;
++ spec->spec_init_verbs[0].param = 0x78D;
++ spec->spec_init_verbs[0].verb = 0x00;
+
+ /* Previously commented configuration */
+ /*
+- spec->spec_init_verbs[3].nid = 0x0b;
+- spec->spec_init_verbs[3].param = AC_VERB_SET_EAPD_BTLENABLE;
++ spec->spec_init_verbs[2].nid = 0x0b;
++ spec->spec_init_verbs[2].param = AC_VERB_SET_EAPD_BTLENABLE;
++ spec->spec_init_verbs[2].verb = 0x02;
++
++ spec->spec_init_verbs[3].nid = 0x10;
++ spec->spec_init_verbs[3].param = 0x78D;
+ spec->spec_init_verbs[3].verb = 0x02;
+
+ spec->spec_init_verbs[4].nid = 0x10;
+- spec->spec_init_verbs[4].param = 0x78D;
++ spec->spec_init_verbs[4].param = AC_VERB_SET_EAPD_BTLENABLE;
+ spec->spec_init_verbs[4].verb = 0x02;
+-
+- spec->spec_init_verbs[5].nid = 0x10;
+- spec->spec_init_verbs[5].param = AC_VERB_SET_EAPD_BTLENABLE;
+- spec->spec_init_verbs[5].verb = 0x02;
+ */
+
+ /* Terminator: spec->spec_init_verbs[NUM_SPEC_VERBS-1] */
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Don-t-test-for-QUIRK_NONE b/patches.drivers/ALSA-hda-ca0132-Don-t-test-for-QUIRK_NONE
new file mode 100644
index 0000000000..da7df24c36
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Don-t-test-for-QUIRK_NONE
@@ -0,0 +1,45 @@
+From 126b75e03894f3053b723130cb9b824e6f15d8e6 Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:18 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Don't test for QUIRK_NONE
+Git-commit: 126b75e03894f3053b723130cb9b824e6f15d8e6
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+QUIRK_NONE is, quite explicitly, the default case. The entire
+point of a quirks system is to allow "programming by difference"
+from a given base case, which requires that merely defining a new
+quirk for some piece of hardware should not change the behavior of
+the driver for that hardware. In turn, this means that testing
+for QUIRK_NONE explicitly is a violation of that implicit contract.
+
+Change a test for QUIRK_NONE and QUIRK_ALIENWARE to default, and
+add a test for QUIRK_SBZ to disable the default behavior in that
+instance.
+
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 25fccce1eff1..49635d1c9c39 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7237,8 +7237,9 @@ static int ca0132_init(struct hda_codec *codec)
+ case QUIRK_R3DI:
+ r3di_setup_defaults(codec);
+ break;
+- case QUIRK_NONE:
+- case QUIRK_ALIENWARE:
++ case QUIRK_SBZ:
++ break;
++ default:
+ ca0132_setup_defaults(codec);
+ ca0132_init_analog_mic2(codec);
+ ca0132_init_dmic(codec);
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Fix-DMic-data-rate-for-Alienware-M17 b/patches.drivers/ALSA-hda-ca0132-Fix-DMic-data-rate-for-Alienware-M17
new file mode 100644
index 0000000000..d8dd815172
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Fix-DMic-data-rate-for-Alienware-M17
@@ -0,0 +1,64 @@
+From a57a46b93244a0a916b894d8b2ca2a6cfe1904d3 Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:20 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Fix DMic data rate for Alienware M17x R4
+Git-commit: a57a46b93244a0a916b894d8b2ca2a6cfe1904d3
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+The commentary says to use various parameters, and lays out what
+the mapping is... The code used a 32KHz rate when the comment
+says that it needs to use a 48KHz rate. And this has been the
+case since day one.
+
+On the Alienware M17x R4, the DMic used to have exceptionally quiet
+pickup and a lot of noise. Changing the data rate fixes both of
+these issues.
+
+Searching the kernel bug tracker for ca0132-related issues shows no
+mention of this being an issue for other hardware, and I have no
+other hardware to test with, so a quirk is used to limit the effect
+to just the M17x R4.
+
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 09ff85c622bb..d62c56feaf7d 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -991,6 +991,7 @@ struct ca0132_spec {
+ enum {
+ QUIRK_NONE,
+ QUIRK_ALIENWARE,
++ QUIRK_ALIENWARE_M17XR4,
+ QUIRK_SBZ,
+ QUIRK_R3DI,
+ };
+@@ -1040,6 +1041,7 @@ static const struct hda_pintbl r3di_pincfgs[] = {
+ };
+
+ static const struct snd_pci_quirk ca0132_quirks[] = {
++ SND_PCI_QUIRK(0x1028, 0x057b, "Alienware M17x R4", QUIRK_ALIENWARE_M17XR4),
+ SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE),
+ SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE),
+ SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
+@@ -6130,7 +6132,10 @@ static void ca0132_init_dmic(struct hda_codec *codec)
+ * Bit 6: set to select Data2, clear for Data1
+ * Bit 7: set to enable DMic, clear for AMic
+ */
+- val = 0x23;
++ if (spec->quirk == QUIRK_ALIENWARE_M17XR4)
++ val = 0x33;
++ else
++ val = 0x23;
+ /* keep a copy of dmic ctl val for enable/disable dmic purpuse */
+ spec->dmic_ctl = val;
+ snd_hda_codec_write(codec, spec->input_pins[0], 0,
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Restore-PCM-Analog-Mic-In2 b/patches.drivers/ALSA-hda-ca0132-Restore-PCM-Analog-Mic-In2
new file mode 100644
index 0000000000..7381ff7717
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Restore-PCM-Analog-Mic-In2
@@ -0,0 +1,38 @@
+From 5f8ddc6ee63a9057522923a6b2eb8c51993e1db0 Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:19 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Restore PCM Analog Mic-In2
+Git-commit: 5f8ddc6ee63a9057522923a6b2eb8c51993e1db0
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+Commit 009b8f979bf8cb5f7ec6d3dd7683585122ed10f8 conditionalized
+adding the "CA0132 Analog Mic-In2" PCM with a comment to the
+effect that, "desktops don't use this ADC", but the test was set
+up such that the ADC was only created for desktops. Invert the
+test.
+
+Fixes: 009b8f979bf8 ("ALSA: hda/ca0132: update core functions for sbz + r3di")
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 49635d1c9c39..09ff85c622bb 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -5966,7 +5966,7 @@ static int ca0132_build_pcms(struct hda_codec *codec)
+ info->stream[SNDRV_PCM_STREAM_CAPTURE].nid = spec->adcs[0];
+
+ /* With the DSP enabled, desktops don't use this ADC. */
+- if (spec->use_alt_functions) {
++ if (!spec->use_alt_functions) {
+ info = snd_hda_codec_pcm_new(codec, "CA0132 Analog Mic-In2");
+ if (!info)
+ return -ENOMEM;
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-Restore-behavior-of-QUIRK_ALIENWARE b/patches.drivers/ALSA-hda-ca0132-Restore-behavior-of-QUIRK_ALIENWARE
new file mode 100644
index 0000000000..c15b9e6c3e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-Restore-behavior-of-QUIRK_ALIENWARE
@@ -0,0 +1,41 @@
+From 365c7f25cd0a72b16979ba948e6c389a9a89818b Mon Sep 17 00:00:00 2001
+From: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Date: Fri, 15 Jun 2018 21:56:17 -0400
+Subject: [PATCH] ALSA: hda/ca0132: Restore behavior of QUIRK_ALIENWARE
+Git-commit: 365c7f25cd0a72b16979ba948e6c389a9a89818b
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+Commit e93ac30a32a6ba7ac3b4b2a4379af1dadb91e505 (ALSA: HDA/ca0132:
+add extra init functions for r3di + sbz) introduced an extra
+initialization function that was improperly guarded, taking effect
+on systems with QUIRK_ALIENWARE, even though such systems were
+supposedly not affected.
+
+It may be that this piece of initialization should be done for all
+systems, but that's not a call that I can make.
+
+Fixes: e93ac30a32a6 ("ALSA: HDA/ca0132: add extra init functions for r3di + sbz")
+Signed-off-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index dba731c0bf53..25fccce1eff1 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7223,7 +7223,7 @@ static int ca0132_init(struct hda_codec *codec)
+
+ snd_hda_sequence_write(codec, spec->base_init_verbs);
+
+- if (spec->quirk != QUIRK_NONE)
++ if (spec->use_alt_functions)
+ ca0132_alt_init(codec);
+
+ ca0132_download_dsp(codec);
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-make-array-ca0132_alt_chmaps-static b/patches.drivers/ALSA-hda-ca0132-make-array-ca0132_alt_chmaps-static
new file mode 100644
index 0000000000..f8d5ab2c2f
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-make-array-ca0132_alt_chmaps-static
@@ -0,0 +1,38 @@
+From 9c4a665ed83462039461dd34282e22160fb447ca Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 21 Jun 2018 19:34:57 +0100
+Subject: [PATCH] ALSA: hda/ca0132: make array ca0132_alt_chmaps static
+Git-commit: 9c4a665ed83462039461dd34282e22160fb447ca
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+The array ca0132_alt_chmaps is local to the source and does not
+need to be in global scope, so make it static.
+
+Cleans up sparse warning:
+Warning: symbol 'ca0132_alt_chmaps' was not declared. Should it be
+static?
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index d62c56feaf7d..4ff5320378e2 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -5665,7 +5665,7 @@ static const char * const ca0132_alt_slave_pfxs[] = {
+ * I think this has to do with the pin for rear surround being 0x11,
+ * and the center/lfe being 0x10. Usually the pin order is the opposite.
+ */
+-const struct snd_pcm_chmap_elem ca0132_alt_chmaps[] = {
++static const struct snd_pcm_chmap_elem ca0132_alt_chmaps[] = {
+ { .channels = 2,
+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR } },
+ { .channels = 4,
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-ca0132-use-ARRAY_SIZE b/patches.drivers/ALSA-hda-ca0132-use-ARRAY_SIZE
new file mode 100644
index 0000000000..7754e20e4e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-use-ARRAY_SIZE
@@ -0,0 +1,71 @@
+From a9291f461d2e727ac0812d7021653379fea4b782 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lefaure?= <jeremy.lefaure@lse.epita.fr>
+Date: Thu, 12 Oct 2017 22:36:31 -0400
+Subject: [PATCH] ALSA: hda/ca0132 - use ARRAY_SIZE
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: a9291f461d2e727ac0812d7021653379fea4b782
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+Using the ARRAY_SIZE macro improves the readability of the code.
+
+Found with Coccinelle with the following semantic patch:
+@r depends on (org || report)@
+type T;
+T[] E;
+position p;
+@@
+(
+ (sizeof(E)@p /sizeof(*E))
+|
+ (sizeof(E)@p /sizeof(E[...]))
+|
+ (sizeof(E)@p /sizeof(T))
+)
+
+Signed-off-by: Jérémy Lefaure <jeremy.lefaure@lse.epita.fr>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 3e73d5c6ccfc..768ea8651993 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -27,6 +27,7 @@
+ #include <linux/mutex.h>
+ #include <linux/module.h>
+ #include <linux/firmware.h>
++#include <linux/kernel.h>
+ #include <sound/core.h>
+ #include "hda_codec.h"
+ #include "hda_local.h"
+@@ -3605,8 +3606,7 @@ static int ca0132_vnode_switch_set(struct snd_kcontrol *kcontrol,
+ static int ca0132_voicefx_info(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo)
+ {
+- unsigned int items = sizeof(ca0132_voicefx_presets)
+- / sizeof(struct ct_voicefx_preset);
++ unsigned int items = ARRAY_SIZE(ca0132_voicefx_presets);
+
+ uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+ uinfo->count = 1;
+@@ -3635,10 +3635,8 @@ static int ca0132_voicefx_put(struct snd_kcontrol *kcontrol,
+ struct ca0132_spec *spec = codec->spec;
+ int i, err = 0;
+ int sel = ucontrol->value.enumerated.item[0];
+- unsigned int items = sizeof(ca0132_voicefx_presets)
+- / sizeof(struct ct_voicefx_preset);
+
+- if (sel >= items)
++ if (sel >= ARRAY_SIZE(ca0132_voicefx_presets))
+ return 0;
+
+ codec_dbg(codec, "ca0132_voicefx_put: sel=%d, preset=%s\n",
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-realtek-Add-a-quirk-for-FSC-ESPRIMO-U9210 b/patches.drivers/ALSA-hda-realtek-Add-a-quirk-for-FSC-ESPRIMO-U9210
new file mode 100644
index 0000000000..9c5eb29ba7
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Add-a-quirk-for-FSC-ESPRIMO-U9210
@@ -0,0 +1,34 @@
+From 275ec0cb946cb75ac8977f662e608fce92f8b8a8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 22 Jun 2018 12:17:45 +0200
+Subject: [PATCH] ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
+Git-commit: 275ec0cb946cb75ac8977f662e608fce92f8b8a8
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+Fujitsu Seimens ESPRIMO Mobile U9210 requires the same fixup as H270
+for the correct pin configs.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200107
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 487ceb9fd038..70bf4c30548a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2545,6 +2545,7 @@ static const struct snd_pci_quirk alc262_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", ALC262_FIXUP_FSC_S7110),
+ SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FIXUP_BENQ),
+ SND_PCI_QUIRK(0x10f1, 0x2915, "Tyan Thunder n6650W", ALC262_FIXUP_TYAN),
++ SND_PCI_QUIRK(0x1734, 0x1141, "FSC ESPRIMO U9210", ALC262_FIXUP_FSC_H270),
+ SND_PCI_QUIRK(0x1734, 0x1147, "FSC Celsius H270", ALC262_FIXUP_FSC_H270),
+ SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000", ALC262_FIXUP_LENOVO_3000),
+ SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_FIXUP_BENQ),
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-realtek-Fix-pop-noise-on-Lenovo-P50-co b/patches.drivers/ALSA-hda-realtek-Fix-pop-noise-on-Lenovo-P50-co
new file mode 100644
index 0000000000..d80b26f968
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Fix-pop-noise-on-Lenovo-P50-co
@@ -0,0 +1,63 @@
+From d5a6cabf02210b896a60eee7c04c670ee9ba6dca Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 13 Jun 2018 12:43:10 +0200
+Subject: [PATCH] ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co
+Git-commit: d5a6cabf02210b896a60eee7c04c670ee9ba6dca
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+Some Lenovo laptops, e.g. Lenovo P50, showed the pop noise at resume
+or runtime resume. It turned out to be reduced by applying
+alc_no_shutup() just like TPT440 quirk does.
+
+Since there are many Lenovo models showing the same behavior, put this
+workaround in ALC269_FIXUP_THINKPAD_ACPI entry so that it's applied
+commonly to all such Lenovo machines.
+
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Benjamin Berg <bberg@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e9bd33ea538f..487ceb9fd038 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4995,7 +4995,6 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->shutup = alc_no_shutup; /* reduce click noise */
+ spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ codec->power_save_node = 0; /* avoid click noises */
+@@ -5394,6 +5393,13 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
++static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc_fixup_no_shutup(codec, fix, action); /* reduce click noise */
++ hda_fixup_thinkpad_acpi(codec, fix, action);
++}
++
+ /* for dell wmi mic mute led */
+ #include "dell_wmi_helper.c"
+
+@@ -5946,7 +5952,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ },
+ [ALC269_FIXUP_THINKPAD_ACPI] = {
+ .type = HDA_FIXUP_FUNC,
+- .v.func = hda_fixup_thinkpad_acpi,
++ .v.func = alc_fixup_thinkpad_acpi,
+ .chained = true,
+ .chain_id = ALC269_FIXUP_SKU_IGNORE,
+ },
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-realtek-Fix-the-problem-of-two-front-mics-o b/patches.drivers/ALSA-hda-realtek-Fix-the-problem-of-two-front-mics-o
new file mode 100644
index 0000000000..44b1c6ecdd
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Fix-the-problem-of-two-front-mics-o
@@ -0,0 +1,56 @@
+From e41fc8c5bd41b96bfae5ce4c66bee6edabc932e8 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 25 Jun 2018 14:40:56 +0800
+Subject: [PATCH] ALSA: hda/realtek - Fix the problem of two front mics on more machines
+Git-commit: e41fc8c5bd41b96bfae5ce4c66bee6edabc932e8
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+We have 3 more Lenovo machines, they all have 2 front mics on them,
+so they need the fixup to change the location for one of two mics.
+
+Among these 3 Lenovo machines, one of them has the same pin cfg as the
+machine with subid 0x17aa3138, so use the pin cfg table to apply fixup
+for them. The rest machines don't share the same pin cfg, so far use
+the subid to apply fixup for them.
+
+Fixes: a3dafb2200bf ("ALSA: hda/realtek - adjust the location of one mic")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 70bf4c30548a..5ad6c7e5f92e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6610,8 +6610,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+- SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+@@ -6789,6 +6790,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x14, 0x90170110},
+ {0x19, 0x02a11030},
+ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
++ {0x14, 0x90170110},
++ {0x19, 0x02a11030},
++ {0x1a, 0x02a11040},
++ {0x1b, 0x01014020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60140},
+ {0x14, 0x90170110},
+--
+2.18.0
+
diff --git a/patches.drivers/HID-intel-ish-hid-use-put_device-instead-of-kfree b/patches.drivers/HID-intel-ish-hid-use-put_device-instead-of-kfree
new file mode 100644
index 0000000000..00f1c3df1f
--- /dev/null
+++ b/patches.drivers/HID-intel-ish-hid-use-put_device-instead-of-kfree
@@ -0,0 +1,36 @@
+From a4eb490a41a0da3b1275fc7427084cf9ae2c3c1c Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Fri, 30 Mar 2018 16:56:10 +0530
+Subject: [PATCH] HID: intel-ish-hid: use put_device() instead of kfree()
+Git-commit: a4eb490a41a0da3b1275fc7427084cf9ae2c3c1c
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+Never directly free @dev after calling device_register(), even
+if it returned an error. Always use put_device() to give up the
+reference initialized.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/intel-ish-hid/ishtp/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c
+index f272cdd9bd55..2623a567ffba 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
+@@ -418,7 +418,7 @@ static struct ishtp_cl_device *ishtp_bus_add_device(struct ishtp_device *dev,
+ list_del(&device->device_link);
+ spin_unlock_irqrestore(&dev->device_list_lock, flags);
+ dev_err(dev->devc, "Failed to register ISHTP client device\n");
+- kfree(device);
++ put_device(&device->dev);
+ return NULL;
+ }
+
+--
+2.17.1
+
diff --git a/patches.drivers/HID-intel_ish-hid-ipc-register-more-pm-callbacks-to- b/patches.drivers/HID-intel_ish-hid-ipc-register-more-pm-callbacks-to-
new file mode 100644
index 0000000000..5f9689a40a
--- /dev/null
+++ b/patches.drivers/HID-intel_ish-hid-ipc-register-more-pm-callbacks-to-
@@ -0,0 +1,114 @@
+From ebeaa367548e9e92dd9374b9464ff6e7d157117b Mon Sep 17 00:00:00 2001
+From: Even Xu <even.xu@intel.com>
+Date: Fri, 12 Feb 2016 04:11:34 +0800
+Subject: [PATCH] HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
+Git-commit: ebeaa367548e9e92dd9374b9464ff6e7d157117b
+Patch-mainline: v4.18-rc2
+References: bsc#1051510
+
+Current ISH driver only registers suspend/resume PM callbacks which don't
+support hibernation (suspend to disk). Basically after hiberation, the ISH
+can't resume properly and user may not see sensor events (for example: screen
+ rotation may not work).
+
+User will not see a crash or panic or anything except the following message
+in log:
+
+ hid-sensor-hub 001F:8086:22D8.0001: timeout waiting for response from ISHTP device
+
+So this patch adds support for S4/hiberbation to ISH by using the
+SIMPLE_DEV_PM_OPS() MACRO instead of struct dev_pm_ops directly. The suspend
+and resume functions will now be used for both suspend to RAM and hibernation.
+
+If power management is disabled, SIMPLE_DEV_PM_OPS will do nothing, the suspend
+and resume related functions won't be used, so mark them as __maybe_unused to
+clarify that this is the intended behavior, and remove #ifdefs for power
+management.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Even Xu <even.xu@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/intel-ish-hid/ipc/pci-ish.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+index 582e449be9fe..a2c53ea3b5ed 100644
+--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+@@ -205,8 +205,7 @@ static void ish_remove(struct pci_dev *pdev)
+ kfree(ishtp_dev);
+ }
+
+-#ifdef CONFIG_PM
+-static struct device *ish_resume_device;
++static struct device __maybe_unused *ish_resume_device;
+
+ /* 50ms to get resume response */
+ #define WAIT_FOR_RESUME_ACK_MS 50
+@@ -220,7 +219,7 @@ static struct device *ish_resume_device;
+ * in that case a simple resume message is enough, others we need
+ * a reset sequence.
+ */
+-static void ish_resume_handler(struct work_struct *work)
++static void __maybe_unused ish_resume_handler(struct work_struct *work)
+ {
+ struct pci_dev *pdev = to_pci_dev(ish_resume_device);
+ struct ishtp_device *dev = pci_get_drvdata(pdev);
+@@ -262,7 +261,7 @@ static void ish_resume_handler(struct work_struct *work)
+ *
+ * Return: 0 to the pm core
+ */
+-static int ish_suspend(struct device *device)
++static int __maybe_unused ish_suspend(struct device *device)
+ {
+ struct pci_dev *pdev = to_pci_dev(device);
+ struct ishtp_device *dev = pci_get_drvdata(pdev);
+@@ -288,7 +287,7 @@ static int ish_suspend(struct device *device)
+ return 0;
+ }
+
+-static DECLARE_WORK(resume_work, ish_resume_handler);
++static __maybe_unused DECLARE_WORK(resume_work, ish_resume_handler);
+ /**
+ * ish_resume() - ISH resume callback
+ * @device: device pointer
+@@ -297,7 +296,7 @@ static DECLARE_WORK(resume_work, ish_resume_handler);
+ *
+ * Return: 0 to the pm core
+ */
+-static int ish_resume(struct device *device)
++static int __maybe_unused ish_resume(struct device *device)
+ {
+ struct pci_dev *pdev = to_pci_dev(device);
+ struct ishtp_device *dev = pci_get_drvdata(pdev);
+@@ -311,21 +310,14 @@ static int ish_resume(struct device *device)
+ return 0;
+ }
+
+-static const struct dev_pm_ops ish_pm_ops = {
+- .suspend = ish_suspend,
+- .resume = ish_resume,
+-};
+-#define ISHTP_ISH_PM_OPS (&ish_pm_ops)
+-#else
+-#define ISHTP_ISH_PM_OPS NULL
+-#endif /* CONFIG_PM */
++static SIMPLE_DEV_PM_OPS(ish_pm_ops, ish_suspend, ish_resume);
+
+ static struct pci_driver ish_driver = {
+ .name = KBUILD_MODNAME,
+ .id_table = ish_pci_tbl,
+ .probe = ish_probe,
+ .remove = ish_remove,
+- .driver.pm = ISHTP_ISH_PM_OPS,
++ .driver.pm = &ish_pm_ops,
+ };
+
+ module_pci_driver(ish_driver);
+--
+2.17.1
+
diff --git a/patches.drivers/HID-lenovo-Add-support-for-IBM-Lenovo-Scrollpoint-mi b/patches.drivers/HID-lenovo-Add-support-for-IBM-Lenovo-Scrollpoint-mi
new file mode 100644
index 0000000000..46d85cf092
--- /dev/null
+++ b/patches.drivers/HID-lenovo-Add-support-for-IBM-Lenovo-Scrollpoint-mi
@@ -0,0 +1,134 @@
+From a230cd52b8a2be39cd6e9a13b3e62af57f21372a Mon Sep 17 00:00:00 2001
+From: pgzh <peter.ganzhorn@gmail.com>
+Date: Thu, 12 Apr 2018 19:36:47 +0200
+Subject: [PATCH] HID: lenovo: Add support for IBM/Lenovo Scrollpoint mice
+Git-commit: a230cd52b8a2be39cd6e9a13b3e62af57f21372a
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+The IBM/Lenovo Scrollpoint mice feature a trackpoint-like stick instead of a
+scrolling wheel capable of 2-D (vertical+horizontal) scrolling. hid-generic
+does only expose 1-D (vertical) scrolling functionality for these mice. This
+patch adds support for horizontal scrolling for the IBM/Lenovo Scrollpoint mice
+to hid-lenovo.
+
+[jkosina@suse.cz: remove change versioning from git changelog]
+Signed-off-by: Peter Ganzhorn <peter.ganzhorn@gmail.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Peter De Wachter <pdewacht@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/Kconfig | 7 ++++---
+ drivers/hid/hid-ids.h | 8 ++++++++
+ drivers/hid/hid-lenovo.c | 36 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 48 insertions(+), 3 deletions(-)
+
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -429,10 +429,11 @@ config HID_LENOVO
+ select NEW_LEDS
+ select LEDS_CLASS
+ ---help---
+- Support for Lenovo devices that are not fully compliant with HID standard.
++ Support for IBM/Lenovo devices that are not fully compliant with HID standard.
+
+- Say Y if you want support for the non-compliant features of the Lenovo
+- Thinkpad standalone keyboards, e.g:
++ Say Y if you want support for horizontal scrolling of the IBM/Lenovo
++ Scrollpoint mice or the non-compliant features of the Lenovo Thinkpad
++ standalone keyboards, e.g:
+ - ThinkPad USB Keyboard with TrackPoint (supports extra LEDs and trackpoint
+ configuration)
+ - ThinkPad Compact Bluetooth Keyboard with TrackPoint (supports Fn keys)
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -524,6 +524,13 @@
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+
++#define USB_VENDOR_ID_IBM 0x04b3
++#define USB_DEVICE_ID_IBM_SCROLLPOINT_III 0x3100
++#define USB_DEVICE_ID_IBM_SCROLLPOINT_PRO 0x3103
++#define USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL 0x3105
++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL 0x3108
++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO 0x3109
++
+ #define USB_VENDOR_ID_IDEACOM 0x1cb6
+ #define USB_DEVICE_ID_IDEACOM_IDC6650 0x6650
+ #define USB_DEVICE_ID_IDEACOM_IDC6651 0x6651
+@@ -651,6 +658,7 @@
+ #define USB_DEVICE_ID_LENOVO_TPKBD 0x6009
+ #define USB_DEVICE_ID_LENOVO_CUSBKBD 0x6047
+ #define USB_DEVICE_ID_LENOVO_CBTKBD 0x6048
++#define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL 0x6049
+ #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067
+ #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085
+
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -6,6 +6,17 @@
+ *
+ * Copyright (c) 2012 Bernhard Seibold
+ * Copyright (c) 2014 Jamie Lentin <jm@lentin.co.uk>
++ *
++ * Linux IBM/Lenovo Scrollpoint mouse driver:
++ * - IBM Scrollpoint III
++ * - IBM Scrollpoint Pro
++ * - IBM Scrollpoint Optical
++ * - IBM Scrollpoint Optical 800dpi
++ * - IBM Scrollpoint Optical 800dpi Pro
++ * - Lenovo Scrollpoint Optical
++ *
++ * Copyright (c) 2012 Peter De Wachter <pdewacht@gmail.com>
++ * Copyright (c) 2018 Peter Ganzhorn <peter.ganzhorn@gmail.com>
+ */
+
+ /*
+@@ -160,6 +171,17 @@ static int lenovo_input_mapping_cptkbd(s
+ return 0;
+ }
+
++static int lenovo_input_mapping_scrollpoint(struct hid_device *hdev,
++ struct hid_input *hi, struct hid_field *field,
++ struct hid_usage *usage, unsigned long **bit, int *max)
++{
++ if (usage->hid == HID_GD_Z) {
++ hid_map_usage(hi, usage, bit, max, EV_REL, REL_HWHEEL);
++ return 1;
++ }
++ return 0;
++}
++
+ static int lenovo_input_mapping(struct hid_device *hdev,
+ struct hid_input *hi, struct hid_field *field,
+ struct hid_usage *usage, unsigned long **bit, int *max)
+@@ -172,6 +194,14 @@ static int lenovo_input_mapping(struct h
+ case USB_DEVICE_ID_LENOVO_CBTKBD:
+ return lenovo_input_mapping_cptkbd(hdev, hi, field,
+ usage, bit, max);
++ case USB_DEVICE_ID_IBM_SCROLLPOINT_III:
++ case USB_DEVICE_ID_IBM_SCROLLPOINT_PRO:
++ case USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL:
++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL:
++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO:
++ case USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL:
++ return lenovo_input_mapping_scrollpoint(hdev, hi, field,
++ usage, bit, max);
+ default:
+ return 0;
+ }
+@@ -883,6 +913,12 @@ static const struct hid_device_id lenovo
+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_III) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_PRO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL) },
+ { }
+ };
+
diff --git a/patches.drivers/HID-wacom-Correct-logical-maximum-Y-for-2nd-gen-Intu b/patches.drivers/HID-wacom-Correct-logical-maximum-Y-for-2nd-gen-Intu
new file mode 100644
index 0000000000..5bd3ffbfcc
--- /dev/null
+++ b/patches.drivers/HID-wacom-Correct-logical-maximum-Y-for-2nd-gen-Intu
@@ -0,0 +1,44 @@
+From d471b6b22d37bf9928c6d0202bdaaf76583b8b61 Mon Sep 17 00:00:00 2001
+From: Jason Gerecke <killertofu@gmail.com>
+Date: Tue, 12 Jun 2018 13:42:46 -0700
+Subject: [PATCH] HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
+Git-commit: d471b6b22d37bf9928c6d0202bdaaf76583b8b61
+Patch-mainline: v4.18-rc2
+References: bsc#1051510
+
+The HID descriptor for the 2nd-gen Intuos Pro large (PTH-860) contains
+a typo which defines an incorrect logical maximum Y value. This causes
+a small portion of the bottom of the tablet to become unusable (both
+because the area is below the "bottom" of the tablet and because
+'wacom_wac_event' ignores out-of-range values). It also results in a
+skewed aspect ratio.
+
+To fix this, we add a quirk to 'wacom_usage_mapping' which overwrites
+the data with the correct value.
+
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Cc: stable@vger.kernel.org # v4.10+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_sys.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -284,6 +284,14 @@ static void wacom_usage_mapping(struct h
+ }
+ }
+
++ /* 2nd-generation Intuos Pro Large has incorrect Y maximum */
++ if (hdev->vendor == USB_VENDOR_ID_WACOM &&
++ hdev->product == 0x0358 &&
++ WACOM_PEN_FIELD(field) &&
++ wacom_equivalent_usage(usage->hid) == HID_GD_Y) {
++ field->logical_maximum = 43200;
++ }
++
+ switch (usage->hid) {
+ case HID_GD_X:
+ features->x_max = field->logical_maximum;
diff --git a/patches.drivers/HID-wacom-Release-device-resource-data-obtained-by-d b/patches.drivers/HID-wacom-Release-device-resource-data-obtained-by-d
new file mode 100644
index 0000000000..72d7194f57
--- /dev/null
+++ b/patches.drivers/HID-wacom-Release-device-resource-data-obtained-by-d
@@ -0,0 +1,39 @@
+From 097b8f62dd793e08f1732fc74dbb64596c7fbff9 Mon Sep 17 00:00:00 2001
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Tue, 24 Apr 2018 13:33:03 +0530
+Subject: [PATCH] HID: wacom: Release device resource data obtained by devres_alloc()
+Git-commit: 097b8f62dd793e08f1732fc74dbb64596c7fbff9
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+Free device resource data, if __wacom_devm_sysfs_create_group
+is not successful.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_sys.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index b54ef1ffcbec..ee7a37eb159a 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -1213,8 +1213,10 @@ static int __wacom_devm_sysfs_create_group(struct wacom *wacom,
+ devres->root = root;
+
+ error = sysfs_create_group(devres->root, group);
+- if (error)
++ if (error) {
++ devres_free(devres);
+ return error;
++ }
+
+ devres_add(&wacom->hdev->dev, devres);
+
+--
+2.17.1
+
diff --git a/patches.drivers/Input-xpad-fix-GPD-Win-2-controller-name b/patches.drivers/Input-xpad-fix-GPD-Win-2-controller-name
new file mode 100644
index 0000000000..9c9bce97eb
--- /dev/null
+++ b/patches.drivers/Input-xpad-fix-GPD-Win-2-controller-name
@@ -0,0 +1,44 @@
+From dd6bee81c942c0ea01030da9356026afb88f9d18 Mon Sep 17 00:00:00 2001
+From: Enno Boland <gottox@voidlinux.eu>
+Date: Tue, 19 Jun 2018 11:55:33 -0700
+Subject: [PATCH] Input: xpad - fix GPD Win 2 controller name
+Git-commit: dd6bee81c942c0ea01030da9356026afb88f9d18
+Patch-mainline: v4.18-rc3
+References: bsc#1051510
+
+This fixes using the controller with SDL2.
+
+SDL2 has a naive algorithm to apply the correct settings to a controller.
+For X-Box compatible controllers it expects that the controller name
+contains a variation of a 'XBOX'-string.
+
+This patch changes the identifier to contain "X-Box" as substring. Tested
+with Steam and C-Dogs-SDL which both detect the controller properly after
+adding this patch.
+
+Fixes: c1ba08390a8b ("Input: xpad - add GPD Win 2 Controller USB IDs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Enno Boland <gottox@voidlinux.eu>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/joystick/xpad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 48e36acbeb49..cd620e009bad 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -125,7 +125,7 @@ static const struct xpad_device {
+ u8 mapping;
+ u8 xtype;
+ } xpad_device[] = {
+- { 0x0079, 0x18d4, "GPD Win 2 Controller", 0, XTYPE_XBOX360 },
++ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
+--
+2.18.0
+
diff --git a/patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE9 b/patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE9
new file mode 100644
index 0000000000..be729d1d33
--- /dev/null
+++ b/patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE9
@@ -0,0 +1,36 @@
+From 832e4e1f76b8a84991e9db56fdcef1ebce839b8b Mon Sep 17 00:00:00 2001
+From: Thomas Vincent-Cross <me@tvc.id.au>
+Date: Tue, 27 Feb 2018 20:20:36 +1100
+Subject: [PATCH] PCI: Add function 1 DMA alias quirk for Marvell 88SE9220
+Git-commit: 832e4e1f76b8a84991e9db56fdcef1ebce839b8b
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Add Marvell 88SE9220 DMA quirk as found and tested on bug 42679.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=42679
+Signed-off-by: Thomas Vincent-Cross <me@tvc.id.au>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 57748a3b83f0..ffdfaac116b2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3896,6 +3896,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9182,
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0,
+ quirk_dma_func1_alias);
++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
++ quirk_dma_func1_alias);
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c49 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
+ quirk_dma_func1_alias);
+--
+2.18.0
+
diff --git a/patches.drivers/PCI-Mark-Broadcom-HT1100-and-HT2000-Root-Port-Extend b/patches.drivers/PCI-Mark-Broadcom-HT1100-and-HT2000-Root-Port-Extend
new file mode 100644
index 0000000000..068f6af3d3
--- /dev/null
+++ b/patches.drivers/PCI-Mark-Broadcom-HT1100-and-HT2000-Root-Port-Extend
@@ -0,0 +1,51 @@
+From 1b30dfd376e28e7f37eda5e2033f6823cdda222b Mon Sep 17 00:00:00 2001
+From: Sinan Kaya <okaya@codeaurora.org>
+Date: Tue, 10 Apr 2018 14:44:21 -0500
+Subject: [PATCH] PCI: Mark Broadcom HT1100 and HT2000 Root Port Extended Tags as broken
+Git-commit: 1b30dfd376e28e7f37eda5e2033f6823cdda222b
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Per PCIe r3.1, sec 2.2.6.2 and 7.8.4, a Requester may not use 8-bit Tags
+unless its Extended Tag Field Enable is set, but all Receivers/Completers
+must handle 8-bit Tags correctly regardless of their Extended Tag Field
+Enable.
+
+Some devices do not handle 8-bit Tags as Completers, so add a quirk for
+them. If we find such a device, we disable Extended Tags for the entire
+hierarchy to make peer-to-peer DMA possible.
+
+The Broadcom HT1100/HT2000/HT2100 seems to have issues with handling 8-bit
+tags. Mark it as broken.
+
+This fixes Xorg hangs and unresponsive keyboards with errors like this:
+
+ radeon 0000:06:00.0: GPU lockup (current fence id 0x000000000000000e last fence id 0x0000000000000
+ [drm:r600_ring_test [radeon]] *ERROR* radeon: ring 0 test failed (scratch(0x8504)=0xCAFEDEAD)
+ [drm:r600_resume [radeon]] *ERROR* r600 startup failed on resume
+
+Fixes: 60db3a4d8cc9 ("PCI: Enable PCIe Extended Tags if supported")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=196197
+Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Cc: stable@vger.kernel.org # v4.11: 62ce94a7a5a5 PCI: Mark Broadcom HT2100 Root Port Extended Tags as broken
+Cc: stable@vger.kernel.org # v4.11
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4853,6 +4853,10 @@ static void quirk_no_ext_tags(struct pci
+
+ pci_walk_bus(bridge->bus, pci_configure_extended_tags, NULL);
+ }
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0132, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0140, quirk_no_ext_tags);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0141, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0142, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0144, quirk_no_ext_tags);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0420, quirk_no_ext_tags);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags);
diff --git a/patches.drivers/PCI-Restore-config-space-on-runtime-resume-despite-b b/patches.drivers/PCI-Restore-config-space-on-runtime-resume-despite-b
new file mode 100644
index 0000000000..5238a0ea34
--- /dev/null
+++ b/patches.drivers/PCI-Restore-config-space-on-runtime-resume-despite-b
@@ -0,0 +1,86 @@
+From 5775b843a619b3c93f946e2b55a208d9f0f48b59 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Date: Sat, 3 Mar 2018 10:53:24 +0100
+Subject: [PATCH] PCI: Restore config space on runtime resume despite being unbound
+Git-commit: 5775b843a619b3c93f946e2b55a208d9f0f48b59
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+We leave PCI devices not bound to a driver in D0 during runtime suspend.
+But they may have a parent which is bound and can be transitioned to
+D3cold at runtime. Once the parent goes to D3cold, the unbound child
+may go to D3cold as well. When the child goes to D3cold, its internal
+state, including configuration of BARs, MSI, ASPM, MPS, etc., is lost.
+
+One example are recent hybrid graphics laptops which cut power to the
+discrete GPU when the root port above it goes to ACPI power state D3.
+Users may provoke this by unbinding the GPU driver and allowing runtime
+PM on the GPU via sysfs: The PM core will then treat the GPU as
+"suspended", which in turn allows the root port to runtime suspend,
+causing the power resources listed in its _PR3 object to be powered off.
+The GPU's BARs will be uninitialized when a driver later probes it.
+
+Another example are hybrid graphics laptops where the GPU itself (rather
+than the root port) is capable of runtime suspending to D3cold. If the
+GPU's integrated HDA controller is not bound and the GPU's driver
+decides to runtime suspend to D3cold, the HDA controller's BARs will be
+uninitialized when a driver later probes it.
+
+Fix by saving and restoring config space over a runtime suspend cycle
+even if the device is not bound.
+
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Peter Wu <peter@lekensteyn.nl> # Nvidia Optimus
+Tested-by: Lukas Wunner <lukas@wunner.de> # MacBook Pro
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+[lukas: add commit message, bikeshed code comments for clarity]
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/92fb6e6ae2730915eb733c08e2f76c6a313e3860.1520068884.git.lukas@wunner.de
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pci-driver.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1159,11 +1159,14 @@ static int pci_pm_runtime_suspend(struct
+ int error;
+
+ /*
+- * If pci_dev->driver is not set (unbound), the device should
+- * always remain in D0 regardless of the runtime PM status
++ * If pci_dev->driver is not set (unbound), we leave the device in D0,
++ * but it may go to D3cold when the bridge above it runtime suspends.
++ * Save its config space in case that happens.
+ */
+- if (!pci_dev->driver)
++ if (!pci_dev->driver) {
++ pci_save_state(pci_dev);
+ return 0;
++ }
+
+ if (!pm || !pm->runtime_suspend)
+ return -ENOSYS;
+@@ -1211,16 +1214,18 @@ static int pci_pm_runtime_resume(struct
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+
+ /*
+- * If pci_dev->driver is not set (unbound), the device should
+- * always remain in D0 regardless of the runtime PM status
++ * Restoring config space is necessary even if the device is not bound
++ * to a driver because although we left it in D0, it may have gone to
++ * D3cold when the bridge above it runtime suspended.
+ */
++ pci_restore_standard_config(pci_dev);
++
+ if (!pci_dev->driver)
+ return 0;
+
+ if (!pm || !pm->runtime_resume)
+ return -ENOSYS;
+
+- pci_restore_standard_config(pci_dev);
+ pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ __pci_enable_wake(pci_dev, PCI_D0, true, false);
+ pci_fixup_device(pci_fixup_resume, pci_dev);
diff --git a/patches.drivers/can-hi311x-Acquire-SPI-lock-on-do_get_berr_counter b/patches.drivers/can-hi311x-Acquire-SPI-lock-on-do_get_berr_counter
new file mode 100644
index 0000000000..054a52ca16
--- /dev/null
+++ b/patches.drivers/can-hi311x-Acquire-SPI-lock-on-do_get_berr_counter
@@ -0,0 +1,94 @@
+From 5cec9425b41dcf834c3d48776900d6acb7e96f38 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 9 May 2018 14:38:43 +0200
+Subject: [PATCH] can: hi311x: Acquire SPI lock on ->do_get_berr_counter
+Git-commit: 5cec9425b41dcf834c3d48776900d6acb7e96f38
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+hi3110_get_berr_counter() may run concurrently to the rest of the driver
+but neglects to acquire the lock protecting access to the SPI device.
+As a result, it and the rest of the driver may clobber each other's tx
+and rx buffers.
+
+We became aware of this issue because transmission of packets with
+"cangen -g 0 -i -x" frequently hung. It turns out that agetty executes
+->do_get_berr_counter every few seconds via the following call stack:
+
+ CPU: 2 PID: 1605 Comm: agetty
+ [<7f3f7500>] (hi3110_get_berr_counter [hi311x])
+ [<7f130204>] (can_fill_info [can_dev])
+ [<80693bc0>] (rtnl_fill_ifinfo)
+ [<806949ec>] (rtnl_dump_ifinfo)
+ [<806b4834>] (netlink_dump)
+ [<806b4bc8>] (netlink_recvmsg)
+ [<8065f180>] (sock_recvmsg)
+ [<80660f90>] (___sys_recvmsg)
+ [<80661e7c>] (__sys_recvmsg)
+ [<80661ec0>] (SyS_recvmsg)
+ [<80108b20>] (ret_fast_syscall+0x0/0x1c)
+
+agetty listens to netlink messages in order to update the login prompt
+when IP addresses change (if /etc/issue contains \4 or \6 escape codes):
+https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/?id=e36deb6424e8
+
+It's a useful feature, though it seems questionable that it causes CAN
+bit error statistics to be queried.
+
+Be that as it may, if hi3110_get_berr_counter() is invoked while a frame
+is sent by hi3110_hw_tx(), bogus SPI transfers like the following may
+Occur:
+
+ => 12 00 (hi3110_get_berr_counter() wanted to transmit
+ EC 00 to query the transmit error counter,
+ but the first byte was overwritten by
+ hi3110_hw_tx_frame())
+
+ => EA 00 3E 80 01 FB (hi3110_hw_tx_frame() wanted to transmit a
+ frame, but the first byte was overwritten by
+ hi3110_get_berr_counter() because it wanted
+ to query the receive error counter)
+
+This sequence hangs the transmission because the driver believes it has
+sent a frame and waits for the interrupt signaling completion, but in
+reality the chip has never sent away the frame since the commands it
+received were malformed.
+
+Fix by acquiring the SPI lock in hi3110_get_berr_counter().
+
+I've scrutinized the entire driver for further unlocked SPI accesses but
+found no others.
+
+Cc: Mathias Duckeck <m.duckeck@kunbus.de>
+Cc: Akshay Bhat <akshay.bhat@timesys.com>
+Cc: Casey Fitzpatrick <casey.fitzpatrick@timesys.com>
+Cc: Stef Walter <stefw@redhat.com>
+Cc: Karel Zak <kzak@redhat.com>
+Cc: stable@vger.kernel.org # v4.12+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Akshay Bhat <akshay.bhat@timesys.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/spi/hi311x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 5590c559a8ca..c2cf254e4e95 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -427,8 +427,10 @@ static int hi3110_get_berr_counter(const struct net_device *net,
+ struct hi3110_priv *priv = netdev_priv(net);
+ struct spi_device *spi = priv->spi;
+
++ mutex_lock(&priv->hi3110_lock);
+ bec->txerr = hi3110_read(spi, HI3110_READ_TEC);
+ bec->rxerr = hi3110_read(spi, HI3110_READ_REC);
++ mutex_unlock(&priv->hi3110_lock);
+
+ return 0;
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/can-hi311x-Work-around-TX-complete-interrupt-erratum b/patches.drivers/can-hi311x-Work-around-TX-complete-interrupt-erratum
new file mode 100644
index 0000000000..a60aeb4667
--- /dev/null
+++ b/patches.drivers/can-hi311x-Work-around-TX-complete-interrupt-erratum
@@ -0,0 +1,73 @@
+From 32bee8f48fa048a3198109de50e51c092507ff52 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 9 May 2018 14:43:43 +0200
+Subject: [PATCH] can: hi311x: Work around TX complete interrupt erratum
+Git-commit: 32bee8f48fa048a3198109de50e51c092507ff52
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+When sending packets as fast as possible using "cangen -g 0 -i -x", the
+HI-3110 occasionally latches the interrupt pin high on completion of a
+packet, but doesn't set the TXCPLT bit in the INTF register. The INTF
+register contains 0x00 as if no interrupt has occurred. Even waiting
+for a few milliseconds after the interrupt doesn't help.
+
+Work around this apparent erratum by instead checking the TXMTY bit in
+the STATF register ("TX FIFO empty"). We know that we've queued up a
+packet for transmission if priv->tx_len is nonzero. If the TX FIFO is
+empty, transmission of that packet must have completed.
+
+Note that this is congruent with our handling of received packets, which
+likewise gleans from the STATF register whether a packet is waiting in
+the RX FIFO, instead of looking at the INTF register.
+
+Cc: Mathias Duckeck <m.duckeck@kunbus.de>
+Cc: Akshay Bhat <akshay.bhat@timesys.com>
+Cc: Casey Fitzpatrick <casey.fitzpatrick@timesys.com>
+Cc: stable@vger.kernel.org # v4.12+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Akshay Bhat <akshay.bhat@timesys.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/spi/hi311x.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index c2cf254e4e95..53e320c92a8b 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -91,6 +91,7 @@
+ #define HI3110_STAT_BUSOFF BIT(2)
+ #define HI3110_STAT_ERRP BIT(3)
+ #define HI3110_STAT_ERRW BIT(4)
++#define HI3110_STAT_TXMTY BIT(7)
+
+ #define HI3110_BTR0_SJW_SHIFT 6
+ #define HI3110_BTR0_BRP_SHIFT 0
+@@ -737,10 +738,7 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
+ }
+ }
+
+- if (intf == 0)
+- break;
+-
+- if (intf & HI3110_INT_TXCPLT) {
++ if (priv->tx_len && statf & HI3110_STAT_TXMTY) {
+ net->stats.tx_packets++;
+ net->stats.tx_bytes += priv->tx_len - 1;
+ can_led_event(net, CAN_LED_EVENT_TX);
+@@ -750,6 +748,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
+ }
+ netif_wake_queue(net);
+ }
++
++ if (intf == 0)
++ break;
+ }
+ mutex_unlock(&priv->hi3110_lock);
+ return IRQ_HANDLED;
+--
+2.17.1
+
diff --git a/patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable b/patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable
new file mode 100644
index 0000000000..8f5cad7cdd
--- /dev/null
+++ b/patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable
@@ -0,0 +1,54 @@
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+Subject: [PATCH RESENT v4] dell_rbu: make firmware payload memory uncachable
+Message-Id: <20180418054634.10289-1-tiwai@suse.de>
+Patch-mainline: Submitted, LKML Wed, 18 Apr 2018 07:46:34 +0200
+References: bsc#1087978
+
+The dell_rbu driver takes firmware update payloads and puts them in memory so
+the system BIOS can find them after a reboot. This sometimes fails (though
+rarely), because the memory containing the payload is in the CPU cache but
+never gets written back to main memory before the system is rebooted (CPU
+cache contents are lost on reboot).
+
+With this patch, the payload memory will be changed to uncachable to ensure
+that the payload is actually in main memory before the system is rebooted.
+
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/firmware/dell_rbu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/firmware/dell_rbu.c
++++ b/drivers/firmware/dell_rbu.c
+@@ -45,6 +45,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/firmware.h>
+ #include <linux/dma-mapping.h>
++#include <asm/set_memory.h>
+
+ MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
+ MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
+@@ -181,6 +182,11 @@ static int create_packet(void *data, siz
+ packet_data_temp_buf = NULL;
+ }
+ }
++ /*
++ * set to uncachable or it may never get written back before reboot
++ */
++ set_memory_uc((unsigned long)packet_data_temp_buf, 1 << ordernum);
++
+ spin_lock(&rbu_data.lock);
+
+ newpacket->data = packet_data_temp_buf;
+@@ -349,6 +355,8 @@ static void packet_empty_list(void)
+ * to make sure there are no stale RBU packets left in memory
+ */
+ memset(newpacket->data, 0, rbu_data.packetsize);
++ set_memory_wb((unsigned long)newpacket->data,
++ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+ newpacket->ordernum);
+ kfree(newpacket);
diff --git a/patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa b/patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa
new file mode 100644
index 0000000000..a719b21a35
--- /dev/null
+++ b/patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa
@@ -0,0 +1,79 @@
+From 84d0c27d6233a9ba0578b20f5a09701eb66cee42 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 7 May 2018 19:10:31 +0900
+Subject: [PATCH] driver core: Don't ignore class_dir_create_and_add() failure.
+Git-commit: 84d0c27d6233a9ba0578b20f5a09701eb66cee42
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+syzbot is hitting WARN() at kernfs_add_one() [1].
+This is because kernfs_create_link() is confused by previous device_add()
+call which continued without setting dev->kobj.parent field when
+get_device_parent() failed by memory allocation fault injection.
+Fix this by propagating the error from class_dir_create_and_add() to
+the calllers of get_device_parent().
+
+[1] https://syzkaller.appspot.com/bug?id=fae0fb607989ea744526d1c082a5b8de6529116f
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reported-by: syzbot <syzbot+df47f81c226b31d89fb1@syzkaller.appspotmail.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/base/core.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1332,7 +1332,7 @@ class_dir_create_and_add(struct class *c
+
+ dir = kzalloc(sizeof(*dir), GFP_KERNEL);
+ if (!dir)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ dir->class = class;
+ kobject_init(&dir->kobj, &class_dir_ktype);
+@@ -1342,7 +1342,7 @@ class_dir_create_and_add(struct class *c
+ retval = kobject_add(&dir->kobj, parent_kobj, "%s", class->name);
+ if (retval < 0) {
+ kobject_put(&dir->kobj);
+- return NULL;
++ return ERR_PTR(retval);
+ }
+ return &dir->kobj;
+ }
+@@ -1649,6 +1649,10 @@ int device_add(struct device *dev)
+
+ parent = get_device(dev->parent);
+ kobj = get_device_parent(dev, parent);
++ if (IS_ERR(kobj)) {
++ error = PTR_ERR(kobj);
++ goto parent_error;
++ }
+ if (kobj)
+ dev->kobj.parent = kobj;
+
+@@ -1747,6 +1751,7 @@ done:
+ kobject_del(&dev->kobj);
+ Error:
+ cleanup_glue_dir(dev, glue_dir);
++parent_error:
+ put_device(parent);
+ name_error:
+ kfree(dev->p);
+@@ -2566,6 +2571,11 @@ int device_move(struct device *dev, stru
+ device_pm_lock();
+ new_parent = get_device(new_parent);
+ new_parent_kobj = get_device_parent(dev, new_parent);
++ if (IS_ERR(new_parent_kobj)) {
++ error = PTR_ERR(new_parent_kobj);
++ put_device(new_parent);
++ goto out;
++ }
+
+ pr_debug("device: '%s': %s: moving to '%s'\n", dev_name(dev),
+ __func__, new_parent ? dev_name(new_parent) : "<NULL>");
diff --git a/patches.drivers/drm-i915-Apply-batch-location-restrictions-before-pi b/patches.drivers/drm-i915-Apply-batch-location-restrictions-before-pi
new file mode 100644
index 0000000000..a709973be5
--- /dev/null
+++ b/patches.drivers/drm-i915-Apply-batch-location-restrictions-before-pi
@@ -0,0 +1,131 @@
+From 7ba33e1c9d1e03f442b161c701d1f811ea13c75e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sun, 10 Jun 2018 20:43:09 +0100
+Subject: [PATCH] drm/i915: Apply batch location restrictions before pinning
+Git-commit: 7ba33e1c9d1e03f442b161c701d1f811ea13c75e
+Patch-mainline: v4.18-rc2
+No-fix: 746c8f143afad7aaa66c484485fc39888d437a3f
+References: bsc#1051510
+
+We special case the position of the batch within the GTT to prevent
+negative self-relocation deltas from underflowing. However, that
+restriction is being applied after a trial pin of the batch in its
+current position. Thus we are not rejecting an invalid location if the
+batch has been used before, leading to an assertion if we happen to need
+to rearrange the entire payload. In the worst case, this may cause a GPU
+hang on gen7 or perhaps missing state.
+
+References: https://bugs.freedesktop.org/show_bug.cgi?id=105720
+Fixes: 2889caa92321 ("drm/i915: Eliminate lots of iterations over the execobjects array")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Martin Peres <martin.peres@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180610194325.13467-2-chris@chris-wilson.co.uk
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+(cherry picked from commit 746c8f143afad7aaa66c484485fc39888d437a3f)
+
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem_execbuffer.c | 49 ++++++++++++----------
+ 1 file changed, 27 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index f627a8c47c58..22df17c8ca9b 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -489,7 +489,9 @@ eb_validate_vma(struct i915_execbuffer *eb,
+ }
+
+ static int
+-eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma)
++eb_add_vma(struct i915_execbuffer *eb,
++ unsigned int i, unsigned batch_idx,
++ struct i915_vma *vma)
+ {
+ struct drm_i915_gem_exec_object2 *entry = &eb->exec[i];
+ int err;
+@@ -522,6 +524,24 @@ eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma)
+ eb->flags[i] = entry->flags;
+ vma->exec_flags = &eb->flags[i];
+
++ /*
++ * SNA is doing fancy tricks with compressing batch buffers, which leads
++ * to negative relocation deltas. Usually that works out ok since the
++ * relocate address is still positive, except when the batch is placed
++ * very low in the GTT. Ensure this doesn't happen.
++ *
++ * Note that actual hangs have only been observed on gen7, but for
++ * paranoia do it everywhere.
++ */
++ if (i == batch_idx) {
++ if (!(eb->flags[i] & EXEC_OBJECT_PINNED))
++ eb->flags[i] |= __EXEC_OBJECT_NEEDS_BIAS;
++ if (eb->reloc_cache.has_fence)
++ eb->flags[i] |= EXEC_OBJECT_NEEDS_FENCE;
++
++ eb->batch = vma;
++ }
++
+ err = 0;
+ if (eb_pin_vma(eb, entry, vma)) {
+ if (entry->offset != vma->node.start) {
+@@ -716,7 +736,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
+ {
+ struct radix_tree_root *handles_vma = &eb->ctx->handles_vma;
+ struct drm_i915_gem_object *obj;
+- unsigned int i;
++ unsigned int i, batch;
+ int err;
+
+ if (unlikely(i915_gem_context_is_closed(eb->ctx)))
+@@ -728,6 +748,8 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
+ INIT_LIST_HEAD(&eb->relocs);
+ INIT_LIST_HEAD(&eb->unbound);
+
++ batch = eb_batch_index(eb);
++
+ for (i = 0; i < eb->buffer_count; i++) {
+ u32 handle = eb->exec[i].handle;
+ struct i915_lut_handle *lut;
+@@ -770,33 +792,16 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
+ lut->handle = handle;
+
+ add_vma:
+- err = eb_add_vma(eb, i, vma);
++ err = eb_add_vma(eb, i, batch, vma);
+ if (unlikely(err))
+ goto err_vma;
+
+ GEM_BUG_ON(vma != eb->vma[i]);
+ GEM_BUG_ON(vma->exec_flags != &eb->flags[i]);
++ GEM_BUG_ON(drm_mm_node_allocated(&vma->node) &&
++ eb_vma_misplaced(&eb->exec[i], vma, eb->flags[i]));
+ }
+
+- /* take note of the batch buffer before we might reorder the lists */
+- i = eb_batch_index(eb);
+- eb->batch = eb->vma[i];
+- GEM_BUG_ON(eb->batch->exec_flags != &eb->flags[i]);
+-
+- /*
+- * SNA is doing fancy tricks with compressing batch buffers, which leads
+- * to negative relocation deltas. Usually that works out ok since the
+- * relocate address is still positive, except when the batch is placed
+- * very low in the GTT. Ensure this doesn't happen.
+- *
+- * Note that actual hangs have only been observed on gen7, but for
+- * paranoia do it everywhere.
+- */
+- if (!(eb->flags[i] & EXEC_OBJECT_PINNED))
+- eb->flags[i] |= __EXEC_OBJECT_NEEDS_BIAS;
+- if (eb->reloc_cache.has_fence)
+- eb->flags[i] |= EXEC_OBJECT_NEEDS_FENCE;
+-
+ eb->args->flags |= __EXEC_VALIDATED;
+ return eb_reserve(eb);
+
+--
+2.17.1
+
diff --git a/patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of- b/patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of-
index d46fe34877..75884ff972 100644
--- a/patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of-
+++ b/patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of-
@@ -5,6 +5,7 @@ Subject: [PATCH] drm/msm: Fix possible null dereference on failure of get_pages(
Git-commit: 3976626ea3d2011f8fd3f3a47070a8b792018253
Patch-mainline: v4.17-rc3
References: bsc#1051510
+No-fix: 03c94d60261c28689465a16086eb290ab3012aa3
Commit 62e3a3e342af changed get_pages() to initialise
msm_gem_object::pages before trying to initialise msm_gem_object::sgt,
diff --git a/patches.drivers/drm-qxl-Call-qxl_bo_unref-outside-atomic-context b/patches.drivers/drm-qxl-Call-qxl_bo_unref-outside-atomic-context
new file mode 100644
index 0000000000..2289ecb392
--- /dev/null
+++ b/patches.drivers/drm-qxl-Call-qxl_bo_unref-outside-atomic-context
@@ -0,0 +1,64 @@
+From 889ad63d41eea20184b0483e7e585e5b20fb6cfe Mon Sep 17 00:00:00 2001
+From: Jeremy Cline <jcline@redhat.com>
+Date: Fri, 1 Jun 2018 16:05:32 -0400
+Subject: [PATCH] drm/qxl: Call qxl_bo_unref outside atomic context
+Git-commit: 889ad63d41eea20184b0483e7e585e5b20fb6cfe
+Patch-mainline: v4.18-rc2
+References: bsc#1051510
+
+"qxl_bo_unref" may sleep, but calling "qxl_release_map" causes
+"preempt_disable()" to be called and "preempt_enable()" isn't called
+until "qxl_release_unmap" is used. Move the call to "qxl_bo_unref" out
+from in between the two to avoid sleeping from an atomic context.
+
+This issue can be demonstrated on a kernel with CONFIG_LOCKDEP=y by
+creating a VM using QXL, using a desktop environment using Xorg, then
+moving the cursor on or off a window.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1571128
+Fixes: 9428088c90b6 ("drm/qxl: reapply cursor after resetting primary")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180601200532.13619-1-jcline@redhat.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/qxl/qxl_display.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index ecb35ed0eac8..61e51516fec5 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -630,7 +630,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ struct qxl_cursor_cmd *cmd;
+ struct qxl_cursor *cursor;
+ struct drm_gem_object *obj;
+- struct qxl_bo *cursor_bo = NULL, *user_bo = NULL;
++ struct qxl_bo *cursor_bo = NULL, *user_bo = NULL, *old_cursor_bo = NULL;
+ int ret;
+ void *user_ptr;
+ int size = 64*64*4;
+@@ -684,7 +684,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ cursor_bo, 0);
+ cmd->type = QXL_CURSOR_SET;
+
+- qxl_bo_unref(&qcrtc->cursor_bo);
++ old_cursor_bo = qcrtc->cursor_bo;
+ qcrtc->cursor_bo = cursor_bo;
+ cursor_bo = NULL;
+ } else {
+@@ -704,6 +704,9 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ qxl_release_fence_buffer_objects(release);
+
++ if (old_cursor_bo)
++ qxl_bo_unref(&old_cursor_bo);
++
+ qxl_bo_unref(&cursor_bo);
+
+ return;
+--
+2.17.1
+
diff --git a/patches.drivers/i2c-pmcmsp-fix-error-return-from-master_xfer b/patches.drivers/i2c-pmcmsp-fix-error-return-from-master_xfer
new file mode 100644
index 0000000000..64b646ac32
--- /dev/null
+++ b/patches.drivers/i2c-pmcmsp-fix-error-return-from-master_xfer
@@ -0,0 +1,35 @@
+From 12d9bbc5a7f347eaa65ff2a9d34995cadc05eb1b Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:46:30 +0200
+Subject: [PATCH] i2c: pmcmsp: fix error return from master_xfer
+Git-commit: 12d9bbc5a7f347eaa65ff2a9d34995cadc05eb1b
+Patch-mainline: v4.17-rc6
+References: bsc#1051510
+
+Returning -1 (-EPERM) is not appropriate here, go with -EIO.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 1b144df1d7d6 ("i2c: New PMC MSP71xx TWI bus driver")
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-pmcmsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
+index ec27e27e8d06..dae8ac618a52 100644
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -564,7 +564,7 @@ static int pmcmsptwi_master_xfer(struct i2c_adapter *adap,
+ * TODO: We could potentially loop and retry in the case
+ * of MSP_TWI_XFER_TIMEOUT.
+ */
+- return -1;
++ return -EIO;
+ }
+
+ return num;
+--
+2.17.1
+
diff --git a/patches.drivers/i2c-pmcmsp-return-message-count-on-master_xfer-succe b/patches.drivers/i2c-pmcmsp-return-message-count-on-master_xfer-succe
new file mode 100644
index 0000000000..fc3ab9e675
--- /dev/null
+++ b/patches.drivers/i2c-pmcmsp-return-message-count-on-master_xfer-succe
@@ -0,0 +1,35 @@
+From de9a8634f1cb4560a35696d472cc7f1383d9b866 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:46:29 +0200
+Subject: [PATCH] i2c: pmcmsp: return message count on master_xfer success
+Git-commit: de9a8634f1cb4560a35696d472cc7f1383d9b866
+Patch-mainline: v4.17-rc6
+References: bsc#1051510
+
+Returning zero is wrong in this case.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 1b144df1d7d6 ("i2c: New PMC MSP71xx TWI bus driver")
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-pmcmsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
+index 2aa0e83174c5..ec27e27e8d06 100644
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -567,7 +567,7 @@ static int pmcmsptwi_master_xfer(struct i2c_adapter *adap,
+ return -1;
+ }
+
+- return 0;
++ return num;
+ }
+
+ static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter)
+--
+2.17.1
+
diff --git a/patches.drivers/i2c-viperboard-return-message-count-on-master_xfer-s b/patches.drivers/i2c-viperboard-return-message-count-on-master_xfer-s
new file mode 100644
index 0000000000..959f5156ce
--- /dev/null
+++ b/patches.drivers/i2c-viperboard-return-message-count-on-master_xfer-s
@@ -0,0 +1,35 @@
+From 35cd67a0caf767aba472452865dcb4471fcce2b1 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:47:48 +0200
+Subject: [PATCH] i2c: viperboard: return message count on master_xfer success
+Git-commit: 35cd67a0caf767aba472452865dcb4471fcce2b1
+Patch-mainline: v4.17-rc6
+References: bsc#1051510
+
+Returning zero is wrong in this case.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 174a13aa8669 ("i2c: Add viperboard i2c master driver")
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-viperboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-viperboard.c b/drivers/i2c/busses/i2c-viperboard.c
+index e4be86b3de9a..7235c7302bb7 100644
+--- a/drivers/i2c/busses/i2c-viperboard.c
++++ b/drivers/i2c/busses/i2c-viperboard.c
+@@ -337,7 +337,7 @@ static int vprbrd_i2c_xfer(struct i2c_adapter *i2c, struct i2c_msg *msgs,
+ }
+ mutex_unlock(&vb->lock);
+ }
+- return 0;
++ return num;
+ error:
+ mutex_unlock(&vb->lock);
+ return error;
+--
+2.17.1
+
diff --git a/patches.drivers/iio-ad7793-implement-IIO_CHAN_INFO_SAMP_FREQ b/patches.drivers/iio-ad7793-implement-IIO_CHAN_INFO_SAMP_FREQ
new file mode 100644
index 0000000000..fea3bc0a6a
--- /dev/null
+++ b/patches.drivers/iio-ad7793-implement-IIO_CHAN_INFO_SAMP_FREQ
@@ -0,0 +1,152 @@
+From 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 Mon Sep 17 00:00:00 2001
+From: Michael Nosthoff <committed@heine.so>
+Date: Fri, 9 Mar 2018 16:13:52 +0100
+Subject: [PATCH] iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ
+Git-commit: 490fba90a90eb7b741f57fefd2bcf2c1e11eb471
+Patch-mainline: v4.17
+References: bsc#1051510
+
+This commit is a follow-up to changes made to ad_sigma_delta.h
+in staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ
+which broke ad7793 as it was not altered to match those changes.
+
+This driver predates the availability of IIO_CHAN_INFO_SAMP_FREQ
+attribute wherein usage has some advantages like it can be accessed by
+in-kernel consumers as well as reduces the code size.
+
+Therefore, use IIO_CHAN_INFO_SAMP_FREQ to implement the
+sampling_frequency attribute instead of using IIO_DEV_ATTR_SAMP_FREQ()
+macro.
+
+Move code from the functions associated with IIO_DEV_ATTR_SAMP_FREQ()
+into respective read and write hooks with the mask set to
+IIO_CHAN_INFO_SAMP_FREQ.
+
+Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ")
+
+Signed-off-by: Michael Nosthoff <committed@heine.so>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/ad7793.c | 75 +++++++++++++---------------------------
+ 1 file changed, 24 insertions(+), 51 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
+index 801afb61310b..d4bbe5b53318 100644
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avail[16] = {0, 470, 242, 123, 62, 50, 39,
+ static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0,
+ 33, 0, 17, 16, 12, 10, 8, 6, 4};
+
+-static ssize_t ad7793_read_frequency(struct device *dev,
+- struct device_attribute *attr,
+- char *buf)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+-
+- return sprintf(buf, "%d\n",
+- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]);
+-}
+-
+-static ssize_t ad7793_write_frequency(struct device *dev,
+- struct device_attribute *attr,
+- const char *buf,
+- size_t len)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+- long lval;
+- int i, ret;
+-
+- ret = kstrtol(buf, 10, &lval);
+- if (ret)
+- return ret;
+-
+- if (lval == 0)
+- return -EINVAL;
+-
+- for (i = 0; i < 16; i++)
+- if (lval == st->chip_info->sample_freq_avail[i])
+- break;
+- if (i == 16)
+- return -EINVAL;
+-
+- ret = iio_device_claim_direct_mode(indio_dev);
+- if (ret)
+- return ret;
+- st->mode &= ~AD7793_MODE_RATE(-1);
+- st->mode |= AD7793_MODE_RATE(i);
+- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode);
+- iio_device_release_direct_mode(indio_dev);
+-
+- return len;
+-}
+-
+-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
+- ad7793_read_frequency,
+- ad7793_write_frequency);
+-
+ static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
+ "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4");
+
+@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_scale_available,
+ ad7793_show_scale_available, NULL, 0);
+
+ static struct attribute *ad7793_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+ &iio_dev_attr_in_m_in_scale_available.dev_attr.attr,
+ NULL
+@@ -435,7 +385,6 @@ static const struct attribute_group ad7793_attribute_group = {
+ };
+
+ static struct attribute *ad7797_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr,
+ NULL
+ };
+@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_dev *indio_dev,
+ *val -= offset;
+ }
+ return IIO_VAL_INT;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ *val = st->chip_info
++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)];
++ return IIO_VAL_INT;
+ }
+ return -EINVAL;
+ }
+@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_dev *indio_dev,
+ break;
+ }
+ break;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ if (!val) {
++ ret = -EINVAL;
++ break;
++ }
++
++ for (i = 0; i < 16; i++)
++ if (val == st->chip_info->sample_freq_avail[i])
++ break;
++
++ if (i == 16) {
++ ret = -EINVAL;
++ break;
++ }
++
++ st->mode &= ~AD7793_MODE_RATE(-1);
++ st->mode |= AD7793_MODE_RATE(i);
++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode),
++ st->mode);
++ break;
+ default:
+ ret = -EINVAL;
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/iio-kfifo_buf-check-for-uint-overflow b/patches.drivers/iio-kfifo_buf-check-for-uint-overflow
new file mode 100644
index 0000000000..85db3def1f
--- /dev/null
+++ b/patches.drivers/iio-kfifo_buf-check-for-uint-overflow
@@ -0,0 +1,64 @@
+From 3d13de4b027d5f6276c0f9d3a264f518747d83f2 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 26 Mar 2018 14:27:52 -0700
+Subject: [PATCH] iio:kfifo_buf: check for uint overflow
+Git-commit: 3d13de4b027d5f6276c0f9d3a264f518747d83f2
+Patch-mainline: v4.17
+References: bsc#1051510
+
+Currently, the following causes a kernel OOPS in memcpy:
+
+echo 1073741825 > buffer/length
+echo 1 > buffer/enable
+
+Note that using 1073741824 instead of 1073741825 causes "write error:
+Cannot allocate memory" but no OOPS.
+
+This is because 1073741824 == 2^30 and 1073741825 == 2^30+1. Since kfifo
+rounds up to the nearest power of 2, it will actually call kmalloc with
+roundup_pow_of_two(length) * bytes_per_datum.
+
+Using length == 1073741825 and bytes_per_datum == 2, we get:
+
+kmalloc(roundup_pow_of_two(1073741825) * 2
+or kmalloc(2147483648 * 2)
+or kmalloc(4294967296)
+or kmalloc(UINT_MAX + 1)
+
+so this overflows to 0, causing kmalloc to return ZERO_SIZE_PTR and
+subsequent memcpy to fail once the device is enabled.
+
+Fix this by checking for overflow prior to allocating a kfifo. With this
+check added, the above code returns -EINVAL when enabling the buffer,
+rather than causing an OOPS.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/buffer/kfifo_buf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iio/buffer/kfifo_buf.c b/drivers/iio/buffer/kfifo_buf.c
+index ac622edf2486..70c302a93d7f 100644
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -27,6 +27,13 @@ static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
+ if ((length == 0) || (bytes_per_datum == 0))
+ return -EINVAL;
+
++ /*
++ * Make sure we don't overflow an unsigned int after kfifo rounds up to
++ * the next power of 2.
++ */
++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum)
++ return -EINVAL;
++
+ return __kfifo_alloc((struct __kfifo *)&buf->kf, length,
+ bytes_per_datum, GFP_KERNEL);
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/iwlwifi-fw-harden-page-loading-code b/patches.drivers/iwlwifi-fw-harden-page-loading-code
new file mode 100644
index 0000000000..0cacf0b74d
--- /dev/null
+++ b/patches.drivers/iwlwifi-fw-harden-page-loading-code
@@ -0,0 +1,145 @@
+From 9039d985811d5b109b58b202b7594fd24e433fed Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Tue, 13 Feb 2018 11:09:40 +0200
+Subject: [PATCH] iwlwifi: fw: harden page loading code
+Git-commit: 9039d985811d5b109b58b202b7594fd24e433fed
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+The page loading code trusts the data provided in the firmware images
+a bit too much and may cause a buffer overflow or copy unknown data if
+the block sizes don't match what we expect.
+
+To prevent potential problems, harden the code by checking if the
+sizes we are copying are what we expect.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ .../net/wireless/intel/iwlwifi/fw/paging.c | 49 ++++++++++++++++---
+ 1 file changed, 41 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/paging.c b/drivers/net/wireless/intel/iwlwifi/fw/paging.c
+index 1fec8e3a6b35..6afcfd1f0eec 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/paging.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/paging.c
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -30,6 +31,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -163,7 +165,7 @@ static int iwl_alloc_fw_paging_mem(struct iwl_fw_runtime *fwrt,
+ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt,
+ const struct fw_img *image)
+ {
+- int sec_idx, idx;
++ int sec_idx, idx, ret;
+ u32 offset = 0;
+
+ /*
+@@ -190,17 +192,23 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt,
+ */
+ if (sec_idx >= image->num_sec - 1) {
+ IWL_ERR(fwrt, "Paging: Missing CSS and/or paging sections\n");
+- iwl_free_fw_paging(fwrt);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err;
+ }
+
+ /* copy the CSS block to the dram */
+ IWL_DEBUG_FW(fwrt, "Paging: load paging CSS to FW, sec = %d\n",
+ sec_idx);
+
++ if (image->sec[sec_idx].len > fwrt->fw_paging_db[0].fw_paging_size) {
++ IWL_ERR(fwrt, "CSS block is larger than paging size\n");
++ ret = -EINVAL;
++ goto err;
++ }
++
+ memcpy(page_address(fwrt->fw_paging_db[0].fw_paging_block),
+ image->sec[sec_idx].data,
+- fwrt->fw_paging_db[0].fw_paging_size);
++ image->sec[sec_idx].len);
+ dma_sync_single_for_device(fwrt->trans->dev,
+ fwrt->fw_paging_db[0].fw_paging_phys,
+ fwrt->fw_paging_db[0].fw_paging_size,
+@@ -221,6 +229,14 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt,
+ for (idx = 1; idx < fwrt->num_of_paging_blk; idx++) {
+ struct iwl_fw_paging *block = &fwrt->fw_paging_db[idx];
+
++ if (block->fw_paging_size > image->sec[sec_idx].len - offset) {
++ IWL_ERR(fwrt,
++ "Paging: paging size is larger than remaining data in block %d\n",
++ idx);
++ ret = -EINVAL;
++ goto err;
++ }
++
+ memcpy(page_address(block->fw_paging_block),
+ image->sec[sec_idx].data + offset,
+ block->fw_paging_size);
+@@ -231,19 +247,32 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt,
+
+ IWL_DEBUG_FW(fwrt,
+ "Paging: copied %d paging bytes to block %d\n",
+- fwrt->fw_paging_db[idx].fw_paging_size,
+- idx);
++ block->fw_paging_size, idx);
+
+- offset += fwrt->fw_paging_db[idx].fw_paging_size;
++ offset += block->fw_paging_size;
++
++ if (offset > image->sec[sec_idx].len) {
++ IWL_ERR(fwrt,
++ "Paging: offset goes over section size\n");
++ ret = -EINVAL;
++ goto err;
++ }
+ }
+
+ /* copy the last paging block */
+ if (fwrt->num_of_pages_in_last_blk > 0) {
+ struct iwl_fw_paging *block = &fwrt->fw_paging_db[idx];
+
++ if (image->sec[sec_idx].len - offset > block->fw_paging_size) {
++ IWL_ERR(fwrt,
++ "Paging: last block is larger than paging size\n");
++ ret = -EINVAL;
++ goto err;
++ }
++
+ memcpy(page_address(block->fw_paging_block),
+ image->sec[sec_idx].data + offset,
+- FW_PAGING_SIZE * fwrt->num_of_pages_in_last_blk);
++ image->sec[sec_idx].len - offset);
+ dma_sync_single_for_device(fwrt->trans->dev,
+ block->fw_paging_phys,
+ block->fw_paging_size,
+@@ -255,6 +284,10 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt,
+ }
+
+ return 0;
++
++err:
++ iwl_free_fw_paging(fwrt);
++ return ret;
+ }
+
+ static int iwl_save_fw_paging(struct iwl_fw_runtime *fwrt,
+--
+2.17.1
+
diff --git a/patches.drivers/iwlwifi-pcie-compare-with-number-of-IRQs-requested-f b/patches.drivers/iwlwifi-pcie-compare-with-number-of-IRQs-requested-f
new file mode 100644
index 0000000000..008fc30353
--- /dev/null
+++ b/patches.drivers/iwlwifi-pcie-compare-with-number-of-IRQs-requested-f
@@ -0,0 +1,75 @@
+From ab1068d6866e28bf6427ceaea681a381e5870a4a Mon Sep 17 00:00:00 2001
+From: Hao Wei Tee <angelsl@in04.sg>
+Date: Tue, 29 May 2018 10:25:17 +0300
+Subject: [PATCH] iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
+Git-commit: ab1068d6866e28bf6427ceaea681a381e5870a4a
+Patch-mainline: v4.17
+References: bsc#1051510
+
+When there are 16 or more logical CPUs, we request for
+`IWL_MAX_RX_HW_QUEUES` (16) IRQs only as we limit to that number of
+IRQs, but later on we compare the number of IRQs returned to
+nr_online_cpus+2 instead of max_irqs, the latter being what we
+actually asked for. This ends up setting num_rx_queues to 17 which
+causes lots of out-of-bounds array accesses later on.
+
+Compare to max_irqs instead, and also add an assertion in case
+num_rx_queues > IWM_MAX_RX_HW_QUEUES.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199551
+
+Fixes: 2e5d4a8f61dc ("iwlwifi: pcie: Add new configuration to enable MSIX")
+Signed-off-by: Hao Wei Tee <angelsl@in04.sg>
+Tested-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index f8a0234d332c..5517ea4c2aa0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1590,14 +1590,13 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
+ struct iwl_trans *trans)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+- int max_irqs, num_irqs, i, ret, nr_online_cpus;
++ int max_irqs, num_irqs, i, ret;
+ u16 pci_cmd;
+
+ if (!trans->cfg->mq_rx_supported)
+ goto enable_msi;
+
+- nr_online_cpus = num_online_cpus();
+- max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES);
++ max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES);
+ for (i = 0; i < max_irqs; i++)
+ trans_pcie->msix_entries[i].entry = i;
+
+@@ -1623,16 +1622,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
+ * Two interrupts less: non rx causes shared with FBQ and RSS.
+ * More than two interrupts: we will use fewer RSS queues.
+ */
+- if (num_irqs <= nr_online_cpus) {
++ if (num_irqs <= max_irqs - 2) {
+ trans_pcie->trans->num_rx_queues = num_irqs + 1;
+ trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX |
+ IWL_SHARED_IRQ_FIRST_RSS;
+- } else if (num_irqs == nr_online_cpus + 1) {
++ } else if (num_irqs == max_irqs - 1) {
+ trans_pcie->trans->num_rx_queues = num_irqs;
+ trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX;
+ } else {
+ trans_pcie->trans->num_rx_queues = num_irqs - 1;
+ }
++ WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES);
+
+ trans_pcie->alloc_vecs = num_irqs;
+ trans_pcie->msix_enabled = true;
+--
+2.18.0
+
diff --git a/patches.drivers/media-uvcvideo-Support-realtek-s-UVC-1.5-device b/patches.drivers/media-uvcvideo-Support-realtek-s-UVC-1.5-device
new file mode 100644
index 0000000000..714441a2da
--- /dev/null
+++ b/patches.drivers/media-uvcvideo-Support-realtek-s-UVC-1.5-device
@@ -0,0 +1,94 @@
+From f620d1d7afc7db57ab59f35000752840c91f67e7 Mon Sep 17 00:00:00 2001
+From: ming_qian <ming_qian@realsil.com.cn>
+Date: Tue, 8 May 2018 22:13:08 -0400
+Subject: [PATCH] media: uvcvideo: Support realtek's UVC 1.5 device
+Git-commit: f620d1d7afc7db57ab59f35000752840c91f67e7
+Patch-mainline: v4.18-rc1
+References: bsc#1099109
+
+Media: uvcvideo: Support UVC 1.5 video probe & commit controls
+
+The length of UVC 1.5 video control is 48, and it is 34 for UVC 1.1.
+Change it to 48 for UVC 1.5 device, and the UVC 1.5 device can be
+recognized.
+
+More changes to the driver are needed for full UVC 1.5 compatibility.
+However, at least the UVC 1.5 Realtek RTS5847/RTS5852 cameras have been
+reported to work well.
+
+[laurent.pinchart@ideasonboard.com: Factor out code to helper function, update size checks]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: ming_qian <ming_qian@realsil.com.cn>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Tested-by: Ana Guerrero Lopez <ana.guerrero@collabora.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/uvc/uvc_video.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct
+ }
+ }
+
++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
++{
++ /*
++ * Return the size of the video probe and commit controls, which depends
++ * on the protocol version.
++ */
++ if (stream->dev->uvc_version < 0x0110)
++ return 26;
++ else if (stream->dev->uvc_version < 0x0150)
++ return 34;
++ else
++ return 48;
++}
++
+ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ struct uvc_streaming_control *ctrl, int probe, __u8 query)
+ {
+ __u8 *data;
+- __u16 size;
++ __u16 size = uvc_video_ctrl_size(stream);
+ int ret;
+
+- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
+ query == UVC_GET_DEF)
+ return -EIO;
+@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc
+ ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
+ ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
+
+- if (size == 34) {
++ if (size >= 34) {
+ ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
+ ctrl->bmFramingInfo = data[30];
+ ctrl->bPreferedVersion = data[31];
+@@ -255,10 +268,9 @@ static int uvc_set_video_ctrl(struct uvc
+ struct uvc_streaming_control *ctrl, int probe)
+ {
+ __u8 *data;
+- __u16 size;
++ __u16 size = uvc_video_ctrl_size(stream);
+ int ret;
+
+- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ data = kzalloc(size, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
+@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc
+ put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
+ put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
+
+- if (size == 34) {
++ if (size >= 34) {
+ put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
+ data[30] = ctrl->bmFramingInfo;
+ data[31] = ctrl->bPreferedVersion;
diff --git a/patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no b/patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no
index 55f109052e..47cbe4d432 100644
--- a/patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no
+++ b/patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no
@@ -1,8 +1,9 @@
+From 7caf0c1efd62a755441faa03daa7dd88f0c2150d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
-Subject: [PATCH] platform/x86: ideapad-laptop: Add MIIX 720-12IKB to no_hw_rfkill
Date: Mon, 14 May 2018 15:31:28 +0200
-Message-id: <20180514133128.31578-1-tiwai@suse.de>
-Patch-mainline: Submitted, platform-driver-x86 ML
+Subject: [PATCH] platform/x86: ideapad-laptop: Add MIIX 720-12IKB to no_hw_rfkill
+Git-commit: 7caf0c1efd62a755441faa03daa7dd88f0c2150d
+Patch-mainline: v4.18-rc1
References: bsc#1093035
Yet another Lenovo model to be added to the no_hw_rfkill blacklist:
@@ -11,6 +12,7 @@ ideapad MIIX 720-12IKB. Otherwise it's always hard-blocked.
Reported-by: Robin Roevens <robin.roevens1@pandora.be>
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1093035
Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
drivers/platform/x86/ideapad-laptop.c | 7 +++++++
diff --git a/patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y2 b/patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y2
new file mode 100644
index 0000000000..912487611e
--- /dev/null
+++ b/patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y2
@@ -0,0 +1,38 @@
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 22 Jun 2018 10:59:17 +0200
+Subject: [PATCH] platform/x86: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too
+Message-Id: <20180622085917.22969-1-tiwai@suse.de>
+Patch-mainline: Submitted, platform-driver-x86 ML
+References: bsc#1098626
+
+The commit 5d9f40b56630 ("platform/x86: ideapad-laptop: Add
+Y520-15IKBN to no_hw_rfkill") added the entry for Y20-15IKBN, and it
+turned out that another variant, Y20-15IKBM, also requires the
+no_hw_rfkill.
+
+Trim the last letter from the string so that it matches to both
+Y20-15IKBN and Y20-15IKBM models.
+
+Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1098626
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/ideapad-laptop.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -1002,10 +1002,10 @@ static const struct dmi_system_id no_hw_
+ },
+ },
+ {
+- .ident = "Lenovo Legion Y520-15IKBN",
++ .ident = "Lenovo Legion Y520-15IKB",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Y520-15IKBN"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Y520-15IKB"),
+ },
+ },
+ {
diff --git a/patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar b/patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar
new file mode 100644
index 0000000000..d6a562db30
--- /dev/null
+++ b/patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar
@@ -0,0 +1,97 @@
+From 13dc04d0e5fdc25c8f713ad23fdce51cf2bf96ba Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Fri, 4 May 2018 10:44:09 -0700
+Subject: [PATCH] serial: 8250: omap: Fix idling of clocks for unused uarts
+Git-commit: 13dc04d0e5fdc25c8f713ad23fdce51cf2bf96ba
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+I noticed that unused UARTs won't necessarily idle properly always
+unless at least one byte tx transfer is done first.
+
+After some debugging I narrowed down the problem to the scr register
+dma configuration bits that need to be set before softreset for the
+clocks to idle. Unless we do this, the module clkctrl idlest bits
+may be set to 1 instead of 3 meaning the clock will never idle and
+is blocking deeper idle states for the whole domain.
+
+This might be related to the configuration done by the bootloader
+or kexec booting where certain configurations cause the 8250 or
+the clkctrl clock to jam in a way where setting of the scr bits
+and reset is needed to clear it. I've tried diffing the 8250
+registers for the various modes, but did not see anything specific.
+So far I've only seen this on omap4 but I'm suspecting this might
+also happen on the other clkctrl using SoCs considering they
+already have a quirk enabled for UART_ERRATA_CLOCK_DISABLE.
+
+Let's fix the issue by configuring scr before reset for basic dma
+even if we don't use it. The scr register will be reset when we do
+softreset few lines after, and we restore scr on resume. We should
+do this for all the SoCs with UART_ERRATA_CLOCK_DISABLE quirk flag
+set since the ones with UART_ERRATA_CLOCK_DISABLE are all based
+using clkctrl similar to omap4.
+
+Looks like both OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL
+bits are needed for the clkctrl to idle after a softreset.
+
+And we need to add omap4 to also use the UART_ERRATA_CLOCK_DISABLE
+for the related workaround to be enabled. This same compatible
+value will also be used for omap5.
+
+Fixes: cdb929e4452a ("serial: 8250_omap: workaround errata around idling UART after using DMA")
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Matthijs van Duin <matthijsvanduin@gmail.com>
+Cc: Sekhar Nori <nsekhar@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/8250/8250_omap.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 6aaa84355fd1..1b337fee07ed 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1110,13 +1110,14 @@ static int omap8250_no_handle_irq(struct uart_port *port)
+ return 0;
+ }
+
++static const u8 omap4_habit = UART_ERRATA_CLOCK_DISABLE;
+ static const u8 am3352_habit = OMAP_DMA_TX_KICK | UART_ERRATA_CLOCK_DISABLE;
+ static const u8 dra742_habit = UART_ERRATA_CLOCK_DISABLE;
+
+ static const struct of_device_id omap8250_dt_ids[] = {
+ { .compatible = "ti,omap2-uart" },
+ { .compatible = "ti,omap3-uart" },
+- { .compatible = "ti,omap4-uart" },
++ { .compatible = "ti,omap4-uart", .data = &omap4_habit, },
+ { .compatible = "ti,am3352-uart", .data = &am3352_habit, },
+ { .compatible = "ti,am4372-uart", .data = &am3352_habit, },
+ { .compatible = "ti,dra742-uart", .data = &dra742_habit, },
+@@ -1362,6 +1363,19 @@ static int omap8250_soft_reset(struct device *dev)
+ int sysc;
+ int syss;
+
++ /*
++ * At least on omap4, unused uarts may not idle after reset without
++ * a basic scr dma configuration even with no dma in use. The
++ * module clkctrl status bits will be 1 instead of 3 blocking idle
++ * for the whole clockdomain. The softreset below will clear scr,
++ * and we restore it on resume so this is safe to do on all SoCs
++ * needing omap8250_soft_reset() quirk. Do it in two writes as
++ * recommended in the comment for omap8250_update_scr().
++ */
++ serial_out(up, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
++ serial_out(up, UART_OMAP_SCR,
++ OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL);
++
+ sysc = serial_in(up, UART_OMAP_SYSC);
+
+ /* softreset the UART */
+--
+2.17.1
+
diff --git a/patches.drivers/serial-altera-ensure-port-regshift-is-honored-consis b/patches.drivers/serial-altera-ensure-port-regshift-is-honored-consis
new file mode 100644
index 0000000000..41407ccd96
--- /dev/null
+++ b/patches.drivers/serial-altera-ensure-port-regshift-is-honored-consis
@@ -0,0 +1,78 @@
+From 0e254963b6ba4d63ac911e79537fea38dd03dc50 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Thu, 25 Jan 2018 14:30:43 +0100
+Subject: [PATCH] serial: altera: ensure port->regshift is honored consistently
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 0e254963b6ba4d63ac911e79537fea38dd03dc50
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Most register accesses in the altera driver honor port->regshift by
+using altera_uart_writel(). There are a few accesses however that were
+missed when the driver was converted to use port->regshift and some
+others were added later in commit 4d9d7d896d77 ("serial: altera_uart:
+add earlycon support").
+
+Fixes: 2780ad42f5fe ("tty: serial: altera_uart: Use port->regshift to store bus shift")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Tobias Klauser <tklauser@distanz.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/altera_uart.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
+index b88b05f8e81e..ae30398fcf56 100644
+--- a/drivers/tty/serial/altera_uart.c
++++ b/drivers/tty/serial/altera_uart.c
+@@ -327,7 +327,7 @@ static int altera_uart_startup(struct uart_port *port)
+
+ /* Enable RX interrupts now */
+ pp->imr = ALTERA_UART_CONTROL_RRDY_MSK;
+- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG);
+
+ spin_unlock_irqrestore(&port->lock, flags);
+
+@@ -343,7 +343,7 @@ static void altera_uart_shutdown(struct uart_port *port)
+
+ /* Disable all interrupts now */
+ pp->imr = 0;
+- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG);
+
+ spin_unlock_irqrestore(&port->lock, flags);
+
+@@ -432,7 +432,7 @@ static void altera_uart_console_putc(struct uart_port *port, int c)
+ ALTERA_UART_STATUS_TRDY_MSK))
+ cpu_relax();
+
+- writel(c, port->membase + ALTERA_UART_TXDATA_REG);
++ altera_uart_writel(port, c, ALTERA_UART_TXDATA_REG);
+ }
+
+ static void altera_uart_console_write(struct console *co, const char *s,
+@@ -502,13 +502,13 @@ static int __init altera_uart_earlycon_setup(struct earlycon_device *dev,
+ return -ENODEV;
+
+ /* Enable RX interrupts now */
+- writel(ALTERA_UART_CONTROL_RRDY_MSK,
+- port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, ALTERA_UART_CONTROL_RRDY_MSK,
++ ALTERA_UART_CONTROL_REG);
+
+ if (dev->baud) {
+ unsigned int baudclk = port->uartclk / dev->baud;
+
+- writel(baudclk, port->membase + ALTERA_UART_DIVISOR_REG);
++ altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
+ }
+
+ dev->con->write = altera_uart_earlycon_write;
+--
+2.17.1
+
diff --git a/patches.drivers/serial-arc_uart-Fix-out-of-bounds-access-through-DT- b/patches.drivers/serial-arc_uart-Fix-out-of-bounds-access-through-DT-
new file mode 100644
index 0000000000..201fa5aaba
--- /dev/null
+++ b/patches.drivers/serial-arc_uart-Fix-out-of-bounds-access-through-DT-
@@ -0,0 +1,45 @@
+From f9f5786987e81d166c60833edcb7d1836aa16944 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:29 +0100
+Subject: [PATCH] serial: arc_uart: Fix out-of-bounds access through DT alias
+Git-commit: f9f5786987e81d166c60833edcb7d1836aa16944
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The arc_uart_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a
+legitimate DTB.
+
+Fixes: ea28fd56fcde69af ("serial/arc-uart: switch to devicetree based probing")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/arc_uart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
+index 2599f9ecccfe..d904a3a345e7 100644
+--- a/drivers/tty/serial/arc_uart.c
++++ b/drivers/tty/serial/arc_uart.c
+@@ -593,6 +593,11 @@ static int arc_serial_probe(struct platform_device *pdev)
+ if (dev_id < 0)
+ dev_id = 0;
+
++ if (dev_id >= ARRAY_SIZE(arc_uart_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", dev_id);
++ return -EINVAL;
++ }
++
+ uart = &arc_uart_ports[dev_id];
+ port = &uart->port;
+
+--
+2.17.1
+
diff --git a/patches.drivers/serial-fsl_lpuart-Fix-out-of-bounds-access-through-D b/patches.drivers/serial-fsl_lpuart-Fix-out-of-bounds-access-through-D
new file mode 100644
index 0000000000..d756c21f8c
--- /dev/null
+++ b/patches.drivers/serial-fsl_lpuart-Fix-out-of-bounds-access-through-D
@@ -0,0 +1,35 @@
+From ffab87fdecc655cc676f8be8dd1a2c5e22bd6d47 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:30 +0100
+Subject: [PATCH] serial: fsl_lpuart: Fix out-of-bounds access through DT alias
+Git-commit: ffab87fdecc655cc676f8be8dd1a2c5e22bd6d47
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The lpuart_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: c9e2e946fb0ba5d2 ("tty: serial: add Freescale lpuart driver support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1987,6 +1987,10 @@ static int lpuart_probe(struct platform_
+ dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret);
+ return ret;
+ }
++ if (ret >= ARRAY_SIZE(lpuart_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", ret);
++ return -EINVAL;
++ }
+ sport->port.line = ret;
+ sport->lpuart32 = of_device_is_compatible(np, "fsl,ls1021a-lpuart");
+
diff --git a/patches.drivers/serial-imx-Fix-out-of-bounds-access-through-serial-p b/patches.drivers/serial-imx-Fix-out-of-bounds-access-through-serial-p
new file mode 100644
index 0000000000..8da62cf148
--- /dev/null
+++ b/patches.drivers/serial-imx-Fix-out-of-bounds-access-through-serial-p
@@ -0,0 +1,47 @@
+From 5673444821406dda5fc25e4b52aca419f8065a19 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:31 +0100
+Subject: [PATCH] serial: imx: Fix out-of-bounds access through serial port index
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 5673444821406dda5fc25e4b52aca419f8065a19
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The imx_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, or from platform data, which may lead to an
+out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: ff05967a07225ab6 ("serial/imx: add of_alias_get_id() reference back")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/imx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 689a117943a0..78bacd020221 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2069,6 +2069,12 @@ static int serial_imx_probe(struct platform_device *pdev)
+ else if (ret < 0)
+ return ret;
+
++ if (sport->port.line >= ARRAY_SIZE(imx_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n",
++ sport->port.line);
++ return -EINVAL;
++ }
++
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(base))
+--
+2.17.1
+
diff --git a/patches.drivers/serial-mxs-auart-Fix-out-of-bounds-access-through-se b/patches.drivers/serial-mxs-auart-Fix-out-of-bounds-access-through-se
new file mode 100644
index 0000000000..e4b6244421
--- /dev/null
+++ b/patches.drivers/serial-mxs-auart-Fix-out-of-bounds-access-through-se
@@ -0,0 +1,41 @@
+From dd345a31bfdec350d2593e6de5964e55c7f19c76 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:32 +0100
+Subject: [PATCH] serial: mxs-auart: Fix out-of-bounds access through serial port index
+Git-commit: dd345a31bfdec350d2593e6de5964e55c7f19c76
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The auart_port[] array is indexed using a value derived from the
+"serialN" alias in DT, or from platform data, which may lead to an
+out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: 1ea6607d4cdc9179 ("serial: mxs-auart: Allow device tree probing")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/mxs-auart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 079dc47aa142..caa8a41b6e71 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1663,6 +1663,10 @@ static int mxs_auart_probe(struct platform_device *pdev)
+ s->port.line = pdev->id < 0 ? 0 : pdev->id;
+ else if (ret < 0)
+ return ret;
++ if (s->port.line >= ARRAY_SIZE(auart_port)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", s->port.line);
++ return -EINVAL;
++ }
+
+ if (of_id) {
+ pdev->id_entry = of_id->data;
+--
+2.17.1
+
diff --git a/patches.drivers/serial-samsung-Fix-out-of-bounds-access-through-seri b/patches.drivers/serial-samsung-Fix-out-of-bounds-access-through-seri
new file mode 100644
index 0000000000..95d661b5fd
--- /dev/null
+++ b/patches.drivers/serial-samsung-Fix-out-of-bounds-access-through-seri
@@ -0,0 +1,45 @@
+From 49ee23b71877831ac087d6083f6f397dc19c9664 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:34 +0100
+Subject: [PATCH] serial: samsung: Fix out-of-bounds access through serial port index
+Git-commit: 49ee23b71877831ac087d6083f6f397dc19c9664
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The s3c24xx_serial_ports[] array is indexed using a value derived from
+the "serialN" alias in DT, or from an incrementing probe index, which
+may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_SAMSUNG_UARTS), so this can even be triggered using
+a legitimate DTB or legitimate board code.
+
+Fixes: 13a9f6c64fdc55eb ("serial: samsung: Consider DT alias when probing ports")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/samsung.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index f9fecc5ed0ce..3f2f8c118ce0 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1818,6 +1818,10 @@ static int s3c24xx_serial_probe(struct platform_device *pdev)
+
+ dbg("s3c24xx_serial_probe(%p) %d\n", pdev, index);
+
++ if (index >= ARRAY_SIZE(s3c24xx_serial_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", index);
++ return -EINVAL;
++ }
+ ourport = &s3c24xx_serial_ports[index];
+
+ ourport->drv_data = s3c24xx_get_driver_data(pdev);
+--
+2.17.1
+
diff --git a/patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa b/patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa
new file mode 100644
index 0000000000..1ab940a057
--- /dev/null
+++ b/patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa
@@ -0,0 +1,48 @@
+From aa2f80e752c75e593b3820f42c416ed9458fa73e Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 10 May 2018 08:41:13 +0200
+Subject: [PATCH] serial: samsung: fix maxburst parameter for DMA transactions
+Git-commit: aa2f80e752c75e593b3820f42c416ed9458fa73e
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+The best granularity of residue that DMA engine can report is in the BURST
+units, so the serial driver must use MAXBURST = 1 and DMA_SLAVE_BUSWIDTH_1_BYTE
+if it relies on exact number of bytes transferred by DMA engine.
+
+Fixes: 62c37eedb74c ("serial: samsung: add dma reqest/release functions")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/samsung.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 3f2f8c118ce0..64e96926f1ad 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -862,15 +862,12 @@ static int s3c24xx_serial_request_dma(struct s3c24xx_uart_port *p)
+ dma->rx_conf.direction = DMA_DEV_TO_MEM;
+ dma->rx_conf.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ dma->rx_conf.src_addr = p->port.mapbase + S3C2410_URXH;
+- dma->rx_conf.src_maxburst = 16;
++ dma->rx_conf.src_maxburst = 1;
+
+ dma->tx_conf.direction = DMA_MEM_TO_DEV;
+ dma->tx_conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ dma->tx_conf.dst_addr = p->port.mapbase + S3C2410_UTXH;
+- if (dma_get_cache_alignment() >= 16)
+- dma->tx_conf.dst_maxburst = 16;
+- else
+- dma->tx_conf.dst_maxburst = 1;
++ dma->tx_conf.dst_maxburst = 1;
+
+ dma->rx_chan = dma_request_chan(p->port.dev, "rx");
+
+--
+2.17.1
+
diff --git a/patches.drivers/serial-sh-sci-Fix-out-of-bounds-access-through-DT-al b/patches.drivers/serial-sh-sci-Fix-out-of-bounds-access-through-DT-al
new file mode 100644
index 0000000000..7a3109988e
--- /dev/null
+++ b/patches.drivers/serial-sh-sci-Fix-out-of-bounds-access-through-DT-al
@@ -0,0 +1,44 @@
+From 090fa4b0dccfa3d04e1c5ab0fe4eba16e6713895 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:35 +0100
+Subject: [PATCH] serial: sh-sci: Fix out-of-bounds access through DT alias
+Git-commit: 090fa4b0dccfa3d04e1c5ab0fe4eba16e6713895
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The sci_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_SH_SCI_NR_UARTS), so this can even be triggered using a
+legitimate DTB.
+
+Fixes: 97ed9790c514066b ("serial: sh-sci: Remove unused platform data capabilities field")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sh-sci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index af1c3246cee1..0ec2d938011d 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3109,6 +3109,10 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev,
+ dev_err(&pdev->dev, "failed to get alias id (%d)\n", id);
+ return NULL;
+ }
++ if (id >= ARRAY_SIZE(sci_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", id);
++ return NULL;
++ }
+
+ sp = &sci_ports[id];
+ *dev_id = id;
+--
+2.17.1
+
diff --git a/patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr b/patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr
new file mode 100644
index 0000000000..af7df668cd
--- /dev/null
+++ b/patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr
@@ -0,0 +1,63 @@
+From d63c16f8e1ab761775275adcf54f4bef7c330295 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 1 Jun 2018 11:28:21 +0200
+Subject: [PATCH] serial: sh-sci: Stop using printk format %pCr
+Git-commit: d63c16f8e1ab761775275adcf54f4bef7c330295
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Printk format "%pCr" will be removed soon, as clk_get_rate() must not be
+called in atomic context.
+
+Replace it by open-coding the operation. This is safe here, as the code
+runs in task context.
+
+Link: http://lkml.kernel.org/r/1527845302-12159-4-git-send-email-geert+renesas@glider.be
+To: Jia-Ju Bai <baijiaju1990@gmail.com>
+To: Jonathan Corbet <corbet@lwn.net>
+To: Michael Turquette <mturquette@baylibre.com>
+To: Stephen Boyd <sboyd@kernel.org>
+To: Zhang Rui <rui.zhang@intel.com>
+To: Eduardo Valentin <edubezval@gmail.com>
+To: Eric Anholt <eric@anholt.net>
+To: Stefan Wahren <stefan.wahren@i2se.com>
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: linux-doc@vger.kernel.org
+Cc: linux-clk@vger.kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-serial@vger.kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-renesas-soc@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable@vger.kernel.org # 4.5+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sh-sci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index fdbbff547106..a4f82ec665fe 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -2704,8 +2704,8 @@ static int sci_init_clocks(struct sci_port *sci_port, struct device *dev)
+ dev_dbg(dev, "failed to get %s (%ld)\n", clk_names[i],
+ PTR_ERR(clk));
+ else
+- dev_dbg(dev, "clk %s is %pC rate %pCr\n", clk_names[i],
+- clk, clk);
++ dev_dbg(dev, "clk %s is %pC rate %lu\n", clk_names[i],
++ clk, clk_get_rate(clk));
+ sci_port->clks[i] = IS_ERR(clk) ? NULL : clk;
+ }
+ return 0;
+--
+2.17.1
+
diff --git a/patches.drivers/serial-xuartps-Fix-out-of-bounds-access-through-DT-a b/patches.drivers/serial-xuartps-Fix-out-of-bounds-access-through-DT-a
new file mode 100644
index 0000000000..4569a275f5
--- /dev/null
+++ b/patches.drivers/serial-xuartps-Fix-out-of-bounds-access-through-DT-a
@@ -0,0 +1,39 @@
+From e7d75e18d0fc3f7193b65282b651f980c778d935 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:37 +0100
+Subject: [PATCH] serial: xuartps: Fix out-of-bounds access through DT alias
+Git-commit: e7d75e18d0fc3f7193b65282b651f980c778d935
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The cdns_uart_port[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: 928e9263492069ee ("tty: xuartps: Initialize ports according to aliases")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b9b2bc76bcac..abcb4d09a2d8 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id)
+ struct uart_port *port;
+
+ /* Try the given port id if failed use default method */
+- if (cdns_uart_port[id].mapbase != 0) {
++ if (id < CDNS_UART_NR_PORTS && cdns_uart_port[id].mapbase != 0) {
+ /* Find the next unused port */
+ for (id = 0; id < CDNS_UART_NR_PORTS; id++)
+ if (cdns_uart_port[id].mapbase == 0)
+--
+2.17.1
+
diff --git a/patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o b/patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o
new file mode 100644
index 0000000000..2a30e759d4
--- /dev/null
+++ b/patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o
@@ -0,0 +1,73 @@
+From 955bc61328dc0a297fb3baccd84e9d3aee501ed8 Mon Sep 17 00:00:00 2001
+From: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Date: Wed, 2 May 2018 10:55:31 +0200
+Subject: [PATCH] w1: mxc_w1: Enable clock before calling clk_get_rate() on it
+Git-commit: 955bc61328dc0a297fb3baccd84e9d3aee501ed8
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+According to the API, you may only call clk_get_rate() after actually
+enabling it.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: a5fd9139f74c ("w1: add 1-wire master driver for i.MX27 / i.MX31")
+Signed-off-by: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/w1/masters/mxc_w1.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c
+index 74f2e6e6202a..8851d441e5fd 100644
+--- a/drivers/w1/masters/mxc_w1.c
++++ b/drivers/w1/masters/mxc_w1.c
+@@ -112,6 +112,10 @@ static int mxc_w1_probe(struct platform_device *pdev)
+ if (IS_ERR(mdev->clk))
+ return PTR_ERR(mdev->clk);
+
++ err = clk_prepare_enable(mdev->clk);
++ if (err)
++ return err;
++
+ clkrate = clk_get_rate(mdev->clk);
+ if (clkrate < 10000000)
+ dev_warn(&pdev->dev,
+@@ -125,12 +129,10 @@ static int mxc_w1_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ mdev->regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(mdev->regs))
+- return PTR_ERR(mdev->regs);
+-
+- err = clk_prepare_enable(mdev->clk);
+- if (err)
+- return err;
++ if (IS_ERR(mdev->regs)) {
++ err = PTR_ERR(mdev->regs);
++ goto out_disable_clk;
++ }
+
+ /* Software reset 1-Wire module */
+ writeb(MXC_W1_RESET_RST, mdev->regs + MXC_W1_RESET);
+@@ -146,8 +148,12 @@ static int mxc_w1_probe(struct platform_device *pdev)
+
+ err = w1_add_master_device(&mdev->bus_master);
+ if (err)
+- clk_disable_unprepare(mdev->clk);
++ goto out_disable_clk;
+
++ return 0;
++
++out_disable_clk:
++ clk_disable_unprepare(mdev->clk);
+ return err;
+ }
+
+--
+2.17.1
+
diff --git a/patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.1 b/patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.1
new file mode 100644
index 0000000000..b75ccf3eb0
--- /dev/null
+++ b/patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.1
@@ -0,0 +1,56 @@
+From 2ae89c7a82ea9d81a19b4fc2df23bef4b112f24e Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Sat, 2 Jun 2018 09:02:09 -0700
+Subject: [PATCH] kconfig: Avoid format overflow warning from GCC 8.1
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 2ae89c7a82ea9d81a19b4fc2df23bef4b112f24e
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+In file included from scripts/kconfig/zconf.tab.c:2485:
+Scripts/kconfig/confdata.c: In function ‘conf_write’:
+scripts/kconfig/confdata.c:773:22: warning: ‘%s’ directive writing likely 7 or more bytes into a region of size between 1 and 4097 [-Wformat-overflow=]
+ sprintf(newname, "%s%s", dirname, basename);
+ ^~
+scripts/kconfig/confdata.c:773:19: note: assuming directive output of 7 bytes
+ sprintf(newname, "%s%s", dirname, basename);
+ ^~~~~~
+scripts/kconfig/confdata.c:773:2: note: ‘sprintf’ output 1 or more bytes (assuming 4104) into a destination of size 4097
+ sprintf(newname, "%s%s", dirname, basename);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+scripts/kconfig/confdata.c:776:23: warning: ‘.tmpconfig.’ directive writing 11 bytes into a region of size between 1 and 4097 [-Wformat-overflow=]
+ sprintf(tmpname, "%s.tmpconfig.%d", dirname, (int)getpid());
+ ^~~~~~~~~~~
+scripts/kconfig/confdata.c:776:3: note: ‘sprintf’ output between 13 and 4119 bytes into a destination of size 4097
+ sprintf(tmpname, "%s.tmpconfig.%d", dirname, (int)getpid());
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Increase the size of tmpname and newname to make GCC happy.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/confdata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 5f87ad561b08..39e20974f4a3 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -720,7 +720,7 @@ int conf_write(const char *name)
+ struct menu *menu;
+ const char *basename;
+ const char *str;
+- char dirname[PATH_MAX+1], tmpname[PATH_MAX+1], newname[PATH_MAX+1];
++ char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8];
+ char *env;
+
+ dirname[0] = 0;
+--
+2.17.1
+
diff --git a/patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing b/patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing
new file mode 100644
index 0000000000..19a9fd0992
--- /dev/null
+++ b/patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing
@@ -0,0 +1,119 @@
+From 0724a7c32a54e3e50d28e19e30c59014f61d4e2c Mon Sep 17 00:00:00 2001
+From: Ulf Magnusson <ulfalizer@gmail.com>
+Date: Sun, 8 Oct 2017 19:11:21 +0200
+Subject: [PATCH] kconfig: Don't leak main menus during parsing
+Git-commit: 0724a7c32a54e3e50d28e19e30c59014f61d4e2c
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+If a 'mainmenu' entry appeared in the Kconfig files, two things would
+Leak:
+
+ - The 'struct property' allocated for the default "Linux Kernel
+ Configuration" prompt.
+
+ - The string for the T_WORD/T_WORD_QUOTE prompt after the
+ T_MAINMENU token, allocated on the heap in zconf.l.
+
+To fix it, introduce a new 'no_mainmenu_stmt' nonterminal that matches
+if there's no 'mainmenu' and adds the default prompt. That means the
+prompt only gets allocated once regardless of whether there's a
+'mainmenu' statement or not, and managing it becomes simple.
+
+Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 344,568 bytes in 14,352 blocks
+ ...
+
+Summary after the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 344,440 bytes in 14,350 blocks
+ ...
+
+Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/zconf.y | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
+index df9cb12111e4..c1e4e82f56b5 100644
+--- a/scripts/kconfig/zconf.y
++++ b/scripts/kconfig/zconf.y
+@@ -109,7 +109,27 @@ static struct menu *current_menu, *current_entry;
+ %%
+ input: nl start | start;
+
+-start: mainmenu_stmt stmt_list | stmt_list;
++start: mainmenu_stmt stmt_list | no_mainmenu_stmt stmt_list;
++
++/* mainmenu entry */
++
++mainmenu_stmt: T_MAINMENU prompt nl
++{
++ menu_add_prompt(P_MENU, $2, NULL);
++};
++
++/* Default main menu, if there's no mainmenu entry */
++
++no_mainmenu_stmt: /* empty */
++{
++ /*
++ * Hack: Keep the main menu title on the heap so we can safely free it
++ * later regardless of whether it comes from the 'prompt' in
++ * mainmenu_stmt or here
++ */
++ menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL);
++};
++
+
+ stmt_list:
+ /* empty */
+@@ -352,13 +372,6 @@ if_block:
+ | if_block choice_stmt
+ ;
+
+-/* mainmenu entry */
+-
+-mainmenu_stmt: T_MAINMENU prompt nl
+-{
+- menu_add_prompt(P_MENU, $2, NULL);
+-};
+-
+ /* menu entry */
+
+ menu: T_MENU prompt T_EOL
+@@ -507,6 +520,7 @@ word_opt: /* empty */ { $$ = NULL; }
+
+ void conf_parse(const char *name)
+ {
++ const char *tmp;
+ struct symbol *sym;
+ int i;
+
+@@ -514,7 +528,6 @@ void conf_parse(const char *name)
+
+ sym_init();
+ _menu_init();
+- rootmenu.prompt = menu_add_prompt(P_MENU, "Linux Kernel Configuration", NULL);
+
+ if (getenv("ZCONF_DEBUG"))
+ zconfdebug = 1;
+@@ -524,8 +537,10 @@ void conf_parse(const char *name)
+ if (!modules_sym)
+ modules_sym = sym_find( "n" );
+
++ tmp = rootmenu.prompt->text;
+ rootmenu.prompt->text = _(rootmenu.prompt->text);
+ rootmenu.prompt->text = sym_expand_string_value(rootmenu.prompt->text);
++ free((char*)tmp);
+
+ menu_finalize(&rootmenu);
+ for_all_symbols(i, sym) {
+--
+2.17.1
+
diff --git a/patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak b/patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak
new file mode 100644
index 0000000000..cc0722c8f0
--- /dev/null
+++ b/patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak
@@ -0,0 +1,62 @@
+From ae7440ef0c8013d68c00dad6900e7cce5311bb1c Mon Sep 17 00:00:00 2001
+From: Ulf Magnusson <ulfalizer@gmail.com>
+Date: Sun, 8 Oct 2017 19:35:44 +0200
+Subject: [PATCH] kconfig: Fix automatic menu creation mem leak
+Git-commit: ae7440ef0c8013d68c00dad6900e7cce5311bb1c
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+expr_trans_compare() always allocates and returns a new expression,
+giving the following leak outline:
+
+ ...
+ *Allocate*
+ basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no);
+ ...
+ for (menu = parent->next; menu; menu = menu->next) {
+ ...
+ *Copy*
+ dep2 = expr_copy(basedep);
+ ...
+ *Free copy*
+ expr_free(dep2);
+ }
+ *basedep lost!*
+
+Fix by freeing 'basedep' after the loop.
+
+Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 344,376 bytes in 14,349 blocks
+ ...
+
+Summary after the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 44,448 bytes in 1,852 blocks
+ ...
+
+Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/menu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
+index 2baebe346de9..5b2415991c3e 100644
+--- a/scripts/kconfig/menu.c
++++ b/scripts/kconfig/menu.c
+@@ -440,6 +440,7 @@ void menu_finalize(struct menu *parent)
+ menu->parent = parent;
+ last_menu = menu;
+ }
++ expr_free(basedep);
+ if (last_menu) {
+ parent->list = parent->next;
+ parent->next = last_menu->next;
+--
+2.17.1
+
diff --git a/patches.fixes/kconfig-Fix-expr_free-E_NOT-leak b/patches.fixes/kconfig-Fix-expr_free-E_NOT-leak
new file mode 100644
index 0000000000..9f5098fe5a
--- /dev/null
+++ b/patches.fixes/kconfig-Fix-expr_free-E_NOT-leak
@@ -0,0 +1,59 @@
+From 5b1374b3b3c2fc4f63a398adfa446fb8eff791a4 Mon Sep 17 00:00:00 2001
+From: Ulf Magnusson <ulfalizer@gmail.com>
+Date: Sun, 8 Oct 2017 19:35:45 +0200
+Subject: [PATCH] kconfig: Fix expr_free() E_NOT leak
+Git-commit: 5b1374b3b3c2fc4f63a398adfa446fb8eff791a4
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+Only the E_NOT operand and not the E_NOT node itself was freed, due to
+accidentally returning too early in expr_free(). Outline of leak:
+
+ switch (e->type) {
+ ...
+ case E_NOT:
+ expr_free(e->left.expr);
+ return;
+ ...
+ }
+ *Never reached, 'e' leaked*
+ free(e);
+
+Fix by changing the 'return' to a 'break'.
+
+Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 44,448 bytes in 1,852 blocks
+ ...
+
+Summary after the fix:
+
+ LEAK SUMMARY:
+ definitely lost: 1,608 bytes in 67 blocks
+ ...
+
+Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/expr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
+index cbf4996dd9c1..ed29bad1f03a 100644
+--- a/scripts/kconfig/expr.c
++++ b/scripts/kconfig/expr.c
+@@ -113,7 +113,7 @@ void expr_free(struct expr *e)
+ break;
+ case E_NOT:
+ expr_free(e->left.expr);
+- return;
++ break;
+ case E_EQUAL:
+ case E_GEQ:
+ case E_GTH:
+--
+2.17.1
+
diff --git a/patches.fixes/kobject-don-t-use-WARN-for-registration-failures b/patches.fixes/kobject-don-t-use-WARN-for-registration-failures
new file mode 100644
index 0000000000..a73f98cbf8
--- /dev/null
+++ b/patches.fixes/kobject-don-t-use-WARN-for-registration-failures
@@ -0,0 +1,51 @@
+From 3e14c6abbfb5c94506edda9d8e2c145d79375798 Mon Sep 17 00:00:00 2001
+From: Dmitry Vyukov <dvyukov@google.com>
+Date: Wed, 11 Apr 2018 17:22:43 +0200
+Subject: [PATCH] kobject: don't use WARN for registration failures
+Git-commit: 3e14c6abbfb5c94506edda9d8e2c145d79375798
+Patch-mainline: v4.17-rc3
+References: bsc#1051510
+
+This WARNING proved to be noisy. The function still returns an error
+and callers should handle it. That's how most of kernel code works.
+Downgrade the WARNING to pr_err() and leave WARNINGs for kernel bugs.
+
+Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
+Reported-by: syzbot+209c0f67f99fec8eb14b@syzkaller.appspotmail.com
+Reported-by: syzbot+7fb6d9525a4528104e05@syzkaller.appspotmail.com
+Reported-by: syzbot+2e63711063e2d8f9ea27@syzkaller.appspotmail.com
+Reported-by: syzbot+de73361ee4971b6e6f75@syzkaller.appspotmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ lib/kobject.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index e1d1f290bf35..18989b5b3b56 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -233,13 +233,12 @@ static int kobject_add_internal(struct kobject *kobj)
+
+ /* be noisy on error issues */
+ if (error == -EEXIST)
+- WARN(1,
+- "%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
+- __func__, kobject_name(kobj));
++ pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
++ __func__, kobject_name(kobj));
+ else
+- WARN(1, "%s failed for %s (error: %d parent: %s)\n",
+- __func__, kobject_name(kobj), error,
+- parent ? kobject_name(parent) : "'none'");
++ pr_err("%s failed for %s (error: %d parent: %s)\n",
++ __func__, kobject_name(kobj), error,
++ parent ? kobject_name(parent) : "'none'");
+ } else
+ kobj->state_in_sysfs = 1;
+
+--
+2.17.1
+
diff --git a/patches.fixes/lib-kobject-Join-string-literals-back b/patches.fixes/lib-kobject-Join-string-literals-back
new file mode 100644
index 0000000000..1d5e2f831f
--- /dev/null
+++ b/patches.fixes/lib-kobject-Join-string-literals-back
@@ -0,0 +1,140 @@
+From 82d1f1178a8578599fb52e697ee8ce8b68f1efd0 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 15 Mar 2018 15:23:43 +0200
+Subject: [PATCH] lib/kobject: Join string literals back
+Git-commit: 82d1f1178a8578599fb52e697ee8ce8b68f1efd0
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+There is no need to split string literals. Moreover, it would be simpler
+to grep for an actual code line, when debugging, by using almost any
+part of the string literal in question.
+
+While here, replace printk(LEVEL) by pr_lvl() macros.
+
+No functional change intended.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ lib/kobject.c | 39 ++++++++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 21 deletions(-)
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index afd5a3fc6123..e1d1f290bf35 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -204,8 +204,9 @@ static int kobject_add_internal(struct kobject *kobj)
+ return -ENOENT;
+
+ if (!kobj->name || !kobj->name[0]) {
+- WARN(1, "kobject: (%p): attempted to be registered with empty "
+- "name!\n", kobj);
++ WARN(1,
++ "kobject: (%p): attempted to be registered with empty name!\n",
++ kobj);
+ return -EINVAL;
+ }
+
+@@ -232,9 +233,8 @@ static int kobject_add_internal(struct kobject *kobj)
+
+ /* be noisy on error issues */
+ if (error == -EEXIST)
+- WARN(1, "%s failed for %s with "
+- "-EEXIST, don't try to register things with "
+- "the same name in the same directory.\n",
++ WARN(1,
++ "%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
+ __func__, kobject_name(kobj));
+ else
+ WARN(1, "%s failed for %s (error: %d parent: %s)\n",
+@@ -334,8 +334,8 @@ void kobject_init(struct kobject *kobj, struct kobj_type *ktype)
+ }
+ if (kobj->state_initialized) {
+ /* do not error out as sometimes we can recover */
+- printk(KERN_ERR "kobject (%p): tried to init an initialized "
+- "object, something is seriously wrong.\n", kobj);
++ pr_err("kobject (%p): tried to init an initialized object, something is seriously wrong.\n",
++ kobj);
+ dump_stack();
+ }
+
+@@ -344,7 +344,7 @@ void kobject_init(struct kobject *kobj, struct kobj_type *ktype)
+ return;
+
+ error:
+- printk(KERN_ERR "kobject (%p): %s\n", kobj, err_str);
++ pr_err("kobject (%p): %s\n", kobj, err_str);
+ dump_stack();
+ }
+ EXPORT_SYMBOL(kobject_init);
+@@ -357,7 +357,7 @@ static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
+
+ retval = kobject_set_name_vargs(kobj, fmt, vargs);
+ if (retval) {
+- printk(KERN_ERR "kobject: can not set name properly!\n");
++ pr_err("kobject: can not set name properly!\n");
+ return retval;
+ }
+ kobj->parent = parent;
+@@ -399,8 +399,7 @@ int kobject_add(struct kobject *kobj, struct kobject *parent,
+ return -EINVAL;
+
+ if (!kobj->state_initialized) {
+- printk(KERN_ERR "kobject '%s' (%p): tried to add an "
+- "uninitialized object, something is seriously wrong.\n",
++ pr_err("kobject '%s' (%p): tried to add an uninitialized object, something is seriously wrong.\n",
+ kobject_name(kobj), kobj);
+ dump_stack();
+ return -EINVAL;
+@@ -590,9 +589,9 @@ struct kobject *kobject_get(struct kobject *kobj)
+ {
+ if (kobj) {
+ if (!kobj->state_initialized)
+- WARN(1, KERN_WARNING "kobject: '%s' (%p): is not "
+- "initialized, yet kobject_get() is being "
+- "called.\n", kobject_name(kobj), kobj);
++ WARN(1, KERN_WARNING
++ "kobject: '%s' (%p): is not initialized, yet kobject_get() is being called.\n",
++ kobject_name(kobj), kobj);
+ kref_get(&kobj->kref);
+ }
+ return kobj;
+@@ -622,8 +621,7 @@ static void kobject_cleanup(struct kobject *kobj)
+ kobject_name(kobj), kobj, __func__, kobj->parent);
+
+ if (t && !t->release)
+- pr_debug("kobject: '%s' (%p): does not have a release() "
+- "function, it is broken and must be fixed.\n",
++ pr_debug("kobject: '%s' (%p): does not have a release() function, it is broken and must be fixed.\n",
+ kobject_name(kobj), kobj);
+
+ /* send "remove" if the caller did not do it but sent "add" */
+@@ -686,9 +684,9 @@ void kobject_put(struct kobject *kobj)
+ {
+ if (kobj) {
+ if (!kobj->state_initialized)
+- WARN(1, KERN_WARNING "kobject: '%s' (%p): is not "
+- "initialized, yet kobject_put() is being "
+- "called.\n", kobject_name(kobj), kobj);
++ WARN(1, KERN_WARNING
++ "kobject: '%s' (%p): is not initialized, yet kobject_put() is being called.\n",
++ kobject_name(kobj), kobj);
+ kref_put(&kobj->kref, kobject_release);
+ }
+ }
+@@ -752,8 +750,7 @@ struct kobject *kobject_create_and_add(const char *name, struct kobject *parent)
+
+ retval = kobject_add(kobj, parent, "%s", name);
+ if (retval) {
+- printk(KERN_WARNING "%s: kobject_add error: %d\n",
+- __func__, retval);
++ pr_warn("%s: kobject_add error: %d\n", __func__, retval);
+ kobject_put(kobj);
+ kobj = NULL;
+ }
+--
+2.17.1
+
diff --git a/patches.suse/mmc-version-check-printk-downgrade b/patches.suse/mmc-version-check-printk-downgrade
new file mode 100644
index 0000000000..93a656db18
--- /dev/null
+++ b/patches.suse/mmc-version-check-printk-downgrade
@@ -0,0 +1,28 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: Downgrade printk level for MMC SDHCI host version error
+Patch-mainline: Never, SLE15 only
+References: bsc#1097941
+
+MMC SDHCI drivers spew an error when the controller returns the
+version number greater than 2. This is annoying on the machines with
+O2 micro chip like many Dell models, where the chip gives 3.
+Since it's the only known error case so far, downgrade the print level
+so that it won't appear during boot with quiet option.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3242,7 +3242,7 @@ int sdhci_setup_host(struct sdhci_host *
+ override_timeout_clk = host->timeout_clk;
+
+ if (host->version > SDHCI_SPEC_300) {
+- pr_err("%s: Unknown controller version (%d). You may experience problems.\n",
++ pr_info("%s: Unknown controller version (%d). You may experience problems.\n",
+ mmc_hostname(mmc), host->version);
+ }
+
diff --git a/series.conf b/series.conf
index e29539c80f..a8c1bb3516 100644
--- a/series.conf
+++ b/series.conf
@@ -6577,6 +6577,7 @@
patches.drivers/Input-uinput-avoid-crash-when-sending-FF-request-to-
patches.drivers/PM-core-Fix-device_pm_check_callbacks
patches.drivers/PM-docs-Drop-an-excess-character-from-devices.rst
+ patches.drivers/ACPI-watchdog-properly-initialize-resources
patches.apparmor/0001-apparmor-Fix-shadowed-local-variable-in-unpack_trans.patch
patches.apparmor/0002-apparmor-Fix-logical-error-in-verify_header.patch
patches.apparmor/0003-apparmor-Fix-an-error-code-in-aafs_create.patch
@@ -7984,6 +7985,7 @@
patches.drivers/ALSA-hiface-Add-sanity-checks-for-invalid-EPs
patches.drivers/ALSA-caiaq-Add-yet-more-sanity-checks-for-invalid-EP
patches.drivers/ALSA-line6-Add-yet-more-sanity-checks-for-invalid-EP
+ patches.drivers/ALSA-hda-ca0132-use-ARRAY_SIZE
patches.drivers/ALSA-hda-silence-uninitialized-variable-warning-in-a
patches.drivers/ALSA-hda-Add-model-string-for-Intel-reference-board-
patches.drivers/ALSA-hda-Avoid-racy-recreation-of-widget-kobjects
@@ -10981,6 +10983,9 @@
patches.drivers/Input-synaptics-reset-the-ABS_X-Y-fuzz-after-initial
patches.drivers/Input-synaptics-rmi4-do-not-delete-interrupt-memory-
patches.fixes/Input-synaptics-rmi4-unmask-F03-interrupts-when-port
+ patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing
+ patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak
+ patches.fixes/kconfig-Fix-expr_free-E_NOT-leak
patches.fixes/printk-Add-console-owner-and-waiter-logic-to-load-ba.patch
patches.fixes/printk-Hide-console-waiter-logic-into-helpers.patch
patches.fixes/printk-Never-set-console_may_schedule-in-console_try.patch
@@ -12484,6 +12489,7 @@
patches.drivers/drm-panel-simple-Fix-the-bus-format-for-the-Ontat-pa
patches.drivers/drm-meson-Fix-an-un-handled-error-path-in-meson_drv_
patches.drivers/drm-meson-Fix-some-error-handling-paths-in-meson_drv
+ patches.drivers/PCI-Restore-config-space-on-runtime-resume-despite-b
patches.drivers/drm-rockchip-Clear-all-interrupts-before-requesting-
patches.drivers/drm-rcar-du-lvds-Fix-LVDS-startup-on-R-Car-Gen2
patches.drivers/drm-rcar-du-lvds-Fix-LVDS-startup-on-R-Car-Gen3
@@ -12638,10 +12644,19 @@
patches.drivers/nfp-use-full-40-bits-of-the-NSP-buffer-address.patch
patches.fixes/0001-xhci-zero-usb-device-slot_id-member-when-disabling-a.patch
patches.fixes/0001-USB-fix-USB3-devices-behind-USB3-hubs-not-resuming-a.patch
+ patches.drivers/serial-altera-ensure-port-regshift-is-honored-consis
+ patches.drivers/serial-arc_uart-Fix-out-of-bounds-access-through-DT-
+ patches.drivers/serial-fsl_lpuart-Fix-out-of-bounds-access-through-D
+ patches.drivers/serial-imx-Fix-out-of-bounds-access-through-serial-p
+ patches.drivers/serial-mxs-auart-Fix-out-of-bounds-access-through-se
+ patches.drivers/serial-samsung-Fix-out-of-bounds-access-through-seri
+ patches.drivers/serial-sh-sci-Fix-out-of-bounds-access-through-DT-al
+ patches.drivers/serial-xuartps-Fix-out-of-bounds-access-through-DT-a
patches.drivers/vt-change-SGR-21-to-follow-the-standards
patches.drivers/staging-rtl8192u-return-ENOMEM-on-failed-allocation-
patches.drivers/staging-comedi-ni_mio_common-ack-ai-fifo-error-inter
patches.drivers/staging-bcm2835-audio-Release-resources-on-module_ex
+ patches.fixes/lib-kobject-Join-string-literals-back
patches.drivers/firmware-fix-checking-for-return-values-for-fw_add_d
patches.suse/suse-hv-hv_balloon-fix-printk-loglevel.patch
patches.suse/suse-hv-hv_balloon-simplify-hv_online_page-hv_page_online_on.patch
@@ -12810,6 +12825,7 @@
patches.drivers/iw_cxgb4-print-mapped-ports-correctly.patch
patches.drivers/ACPI-hotplug-PCI-Check-presence-of-slot-itself-in-ge
patches.drivers/pci-dpc-do-not-enable-dpc-if-aer-control-is-not-allowed-by-the-bios
+ patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE9
patches.suse/suse-hv-PCI-hv-Serialize-the-present-and-eject-work-items.patch
patches.suse/suse-hv-PCI-hv-Fix-2-hang-issues-in-hv_compose_msi_msg.patch
patches.suse/suse-hv-PCI-hv-Fix-a-comment-typo-in-_hv_pcifront_read_confi.patch
@@ -12958,6 +12974,7 @@
patches.drivers/bnxt_en-Ignore-src-port-field-in-decap-filter-nodes.patch
patches.fixes/0002-xprtrdma-Fix-corner-cases-when-handling-device-remov.patch
patches.fixes/xfs-fix-intent-use-after-free-on-abort.patch
+ patches.drivers/PCI-Mark-Broadcom-HT1100-and-HT2000-Root-Port-Extend
patches.drivers/PCI-Remove-messages-about-reassigning-resources
patches.drivers/drm-amdgpu-sdma-fix-mask-in-emit_pipeline_sync
patches.drivers/drm-amdgpu-si-implement-get-set-pcie_lanes-asic-call
@@ -13082,6 +13099,7 @@
patches.fixes/0001-usbip-usbip_host-fix-to-hold-parent-lock-for-device_.patch
patches.fixes/0001-usb-core-Add-quirk-for-HP-v222w-16GB-Mini.patch
patches.fixes/0001-usb-typec-ucsi-Increase-command-completion-timeout-v.patch
+ patches.fixes/kobject-don-t-use-WARN-for-registration-failures
patches.fixes/ceph-check-if-mds-create-snaprealm-when-setting-quota.patch
patches.fixes/libceph-un-backoff-on-tick-when-we-have-a-authenticated-session.patch
patches.fixes/libceph-reschedule-a-tick-in-finish_hunting.patch
@@ -13135,6 +13153,9 @@
patches.drivers/gpio-fix-aspeed_gpio-unmask-irq
patches.drivers/gpioib-do-not-free-unrequested-descriptors
patches.drivers/gpio-fix-error-path-in-lineevent_create
+ patches.drivers/HID-lenovo-Add-support-for-IBM-Lenovo-Scrollpoint-mi
+ patches.drivers/HID-wacom-Release-device-resource-data-obtained-by-d
+ patches.drivers/HID-intel-ish-hid-use-put_device-instead-of-kfree
patches.suse/0228-dm-bufio-fix-buffer-alignment.patch
patches.drivers/drm-i915-Adjust-eDP-s-logical-vco-in-a-reliable-plac
patches.drivers/drm-i915-Fix-drm-intel_enable_lvds-ERROR-message-in-
@@ -13162,6 +13183,8 @@
patches.drivers/rfkill-gpio-fix-memory-leak-in-probe-error-path
patches.drivers/mac80211-Adjust-SAE-authentication-timeout
patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead
+ patches.drivers/can-hi311x-Acquire-SPI-lock-on-do_get_berr_counter
+ patches.drivers/can-hi311x-Work-around-TX-complete-interrupt-erratum
patches.fixes/0001-mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap-v.patch
patches.drivers/nvme-add-quirk-to-force-medium-priority-for-sq-creation.patch
patches.drivers/drm-set-FMODE_UNSIGNED_OFFSET-for-drm-files
@@ -13184,6 +13207,9 @@
patches.fixes/0001-usbip-usbip_host-fix-NULL-ptr-deref-and-use-after-fr.patch
patches.fixes/0001-usbip-usbip_host-fix-bad-unlock-balance-during-stub_.patch
patches.drivers/i2c-designware-fix-poll-after-enable-regression
+ patches.drivers/i2c-pmcmsp-return-message-count-on-master_xfer-succe
+ patches.drivers/i2c-pmcmsp-fix-error-return-from-master_xfer
+ patches.drivers/i2c-viperboard-return-message-count-on-master_xfer-s
patches.drivers/radix-tree-test-suite-fix-mapshift-build-target.patch
patches.drivers/radix-tree-test-suite-fix-compilation-issue.patch
patches.drivers/radix-tree-test-suite-add-item_delete_rcu.patch
@@ -13220,12 +13246,15 @@
patches.drivers/nvme-fix-extended-data-LBA-supported-setting.patch
patches.fixes/mm-huge_memory-c-_split_huge_page-use-atomic-clearpagedirty.patch
patches.suse/mm-fix-the-NULL-mapping-case-in-__isolate_lru_page.patch
+ patches.drivers/iio-ad7793-implement-IIO_CHAN_INFO_SAMP_FREQ
+ patches.drivers/iio-kfifo_buf-check-for-uint-overflow
patches.drivers/intel_th-Use-correct-device-when-freeing-buffers
patches.drivers/drm-i915-Disable-LVDS-on-Radiant-P845
patches.drivers/drm-i915-lvds-Move-acpi-lid-notification-registratio
patches.drivers/drm-psr-Fix-missed-entry-in-PSR-setup-time-table
patches.drivers/be2net-Fix-error-detection-logic-for-BE3.patch
patches.drivers/Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames
+ patches.drivers/iwlwifi-pcie-compare-with-number-of-IRQs-requested-f
patches.drivers/nvme-fix-lockdep-warning-in-nvme_mpath_clear_current_path.patch
patches.drivers/nvme-fc-remove-setting-DNR-on-exception-conditions.patch
patches.drivers/nvme-fabrics-remove-unnecessary-controller-subnqn-va.patch
@@ -13251,6 +13280,10 @@
patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs
patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr
patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I
+ patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o
+ patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa
+ patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa
+ patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar
patches.drivers/drm-i915-Restore-planes-after-load-detection
patches.drivers/drm-exynos-Allow-DRM_EXYNOS-on-s5pv210
patches.drivers/drm-i915-Don-t-request-a-bug-report-for-unsafe-modul
@@ -13297,9 +13330,12 @@
patches.drivers/ALSA-hda-realtek-Enable-mic-mute-hotkey-for-several-
patches.drivers/ALSA-hda-Handle-kzalloc-failure-in-snd_hda_attach_pc
patches.drivers/ASoC-omap-Remove-OMAP_MUX-dependency-from-Nokia-N810
+ patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.1
+ patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr
patches.drivers/mwifiex-pcie-tighten-a-check-in-mwifiex_pcie_process
patches.drivers/ath10k-correct-target-assert-problem-due-to-CE5-stuc
patches.drivers/ath10k-search-all-IEs-for-variant-before-falling-bac
+ patches.drivers/iwlwifi-fw-harden-page-loading-code
patches.drivers/ibmvnic-Mark-NAPI-flag-as-disabled-when-released.patch
patches.drivers/ibmvnic-Introduce-active-CRQ-state.patch
patches.drivers/ibmvnic-Check-CRQ-command-return-codes.patch
@@ -13341,6 +13377,7 @@
patches.arch/powerpc-Use-barrier_nospec-in-copy_from_user.patch
patches.arch/powerpc-64-Use-barrier_nospec-in-syscall-entry.patch
patches.suse/powerpc-64s-Enhance-the-information-in-cpu_show_spec.patch
+ patches.drivers/media-uvcvideo-Support-realtek-s-UVC-1.5-device
patches.fixes/mm-page_alloc-do-not-break-_gfp_thisnode-by-zonelist-reset.patch
patches.fixes/fs-binfmt_misc-c-do-not-allow-offset-overflow.patch
patches.fixes/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch
@@ -13358,6 +13395,7 @@
patches.suse/cpufreq-intel_pstate-HWP-boost-performance-on-IO-wak.patch
patches.suse/cpufreq-intel_pstate-New-sysfs-entry-to-control-HWP-.patch
patches.suse/cpufreq-intel_pstate-enable-boost-for-Skylake-Xeon.patch
+ patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no
patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
patches.fixes/ceph-support-file-lock-on-directory.patch
patches.fixes/ceph-fix-st_nlink-stat-for-directories.patch
@@ -13383,7 +13421,22 @@
patches.drivers/nvme-fabrics-handle-the-admin-only-case-properly-in-.patch
patches.drivers/nvme-fabrics-fix-and-refine-state-checks-in-__nvmf_c.patch
patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch
+ patches.drivers/HID-intel_ish-hid-ipc-register-more-pm-callbacks-to-
+ patches.drivers/HID-wacom-Correct-logical-maximum-Y-for-2nd-gen-Intu
+ patches.drivers/drm-qxl-Call-qxl_bo_unref-outside-atomic-context
+ patches.drivers/drm-i915-Apply-batch-location-restrictions-before-pi
patches.suse/x86-spectre_v1-Disable-compiler-optimizations-over-a.patch
+ patches.drivers/Input-xpad-fix-GPD-Win-2-controller-name
+ patches.drivers/ALSA-hda-realtek-Fix-pop-noise-on-Lenovo-P50-co
+ patches.drivers/ALSA-hda-ca0132-Delete-pointless-assignments-to-stru
+ patches.drivers/ALSA-hda-ca0132-Delete-redundant-UNSOL-event-request
+ patches.drivers/ALSA-hda-ca0132-Restore-behavior-of-QUIRK_ALIENWARE
+ patches.drivers/ALSA-hda-ca0132-Don-t-test-for-QUIRK_NONE
+ patches.drivers/ALSA-hda-ca0132-Restore-PCM-Analog-Mic-In2
+ patches.drivers/ALSA-hda-ca0132-Fix-DMic-data-rate-for-Alienware-M17
+ patches.drivers/ALSA-hda-ca0132-make-array-ca0132_alt_chmaps-static
+ patches.drivers/ALSA-hda-realtek-Add-a-quirk-for-FSC-ESPRIMO-U9210
+ patches.drivers/ALSA-hda-realtek-Fix-the-problem-of-two-front-mics-o
patches.fixes/ceph-fix-dentry-leak-in-splice_dentry.patch
# dhowells/linux-fs keys-uefi
@@ -13835,8 +13888,10 @@
# Other driver fixes
########################################################
patches.suse/tpm-Downgrade-error-level
- patches.drivers/platform-x86-ideapad-laptop-Add-MIIX-720-12IKB-to-no
patches.suse/Input-synaptics-Add-intertouch-blacklist-for-Thinkpa.patch
+ patches.suse/mmc-version-check-printk-downgrade
+ patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y2
+ patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable
########################################################
# Other drivers we have added to the tree