--- /dev/null
+From 1e6306652ba18723015d1b4967fe9de55f042499 Mon Sep 17 00:00:00 2001
+From: Ian Kent <raven@themaw.net>
+Date: Fri, 20 Apr 2018 14:55:59 -0700
+Subject: autofs: mount point create should honour passed in mode
+
+From: Ian Kent <raven@themaw.net>
+
+commit 1e6306652ba18723015d1b4967fe9de55f042499 upstream.
+
+The autofs file system mkdir inode operation blindly sets the created
+directory mode to S_IFDIR | 0555, ingoring the passed in mode, which can
+cause selinux dac_override denials.
+
+But the function also checks if the caller is the daemon (as no-one else
+should be able to do anything here) so there's no point in not honouring
+the passed in mode, allowing the daemon to set appropriate mode when
+required.
+
+Link: http://lkml.kernel.org/r/152361593601.8051.14014139124905996173.stgit@pluto.themaw.net
+Signed-off-by: Ian Kent <raven@themaw.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/autofs4/root.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -749,7 +749,7 @@ static int autofs4_dir_mkdir(struct inod
+
+ autofs4_del_active(dentry);
+
+- inode = autofs4_get_inode(dir->i_sb, S_IFDIR | 0555);
++ inode = autofs4_get_inode(dir->i_sb, S_IFDIR | mode);
+ if (!inode)
+ return -ENOMEM;
+ d_add(dentry, inode);
--- /dev/null
+From 16a34adb9392b2fe4195267475ab5b472e55292c Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 19 Apr 2018 22:03:08 -0400
+Subject: Don't leak MNT_INTERNAL away from internal mounts
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 16a34adb9392b2fe4195267475ab5b472e55292c upstream.
+
+We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for
+their copies. As it is, creating a deep stack of bindings of /proc/*/ns/*
+somewhere in a new namespace and exiting yields a stack overflow.
+
+Cc: stable@kernel.org
+Reported-by: Alexander Aring <aring@mojatatu.com>
+Bisected-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Tested-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Tested-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mo
+ goto out_free;
+ }
+
+- mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
++ mnt->mnt.mnt_flags = old->mnt.mnt_flags;
++ mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
+ /* Don't allow unprivileged users to change mount flags */
+ if (flag & CL_UNPRIVILEGED) {
+ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
--- /dev/null
+From 5deae9191130db6b617c94fb261804597cf9b508 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 14 Feb 2018 21:23:23 +0200
+Subject: drm/i915: Correctly handle limited range YCbCr data on VLV/CHV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 5deae9191130db6b617c94fb261804597cf9b508 upstream.
+
+Turns out the VLV/CHV fixed function sprite CSC expects full range
+data as input. We've been feeding it limited range data to it all
+along. To expand the data out to full range we'll use the color
+correction registers (brightness, contrast, and saturation).
+
+On CHV pipe B we were actually doing the right thing already because we
+progammed the custom CSC matrix to do expect limited range input. Now
+that well pre-expand the data out with the color correction unit, we
+need to change the CSC matrix to operate with full range input instead.
+
+This should make the sprite output of the other pipes match the sprite
+output of pipe B reasonably well. Looking at the resulting pipe CRCs,
+there can be a slight difference in the output, but as I don't know
+the formula used by the fixed function CSC of the other pipes, I don't
+think it's worth the effort to try to match the output exactly. It
+might not even be possible due to difference in internal precision etc.
+
+One slight caveat here is that the color correction registers are single
+bufferred, so we should really be updating them during vblank, but we
+still don't have a mechanism for that, so just toss in another FIXME.
+
+v2: Rebase
+v3: s/bri/brightness/ s/con/contrast/ (Shashank)
+v4: Clarify the constants and math (Shashank)
+
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Daniel Stone <daniel@fooishbar.org>
+Cc: Russell King - ARM Linux <linux@armlinux.org.uk>
+Cc: Ilia Mirkin <imirkin@alum.mit.edu>
+Cc: Hans Verkuil <hverkuil@xs4all.nl>
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Uma Shankar <uma.shankar@intel.com>
+Cc: Jyri Sarha <jsarha@ti.com>
+Cc: "Tang, Jun" <jun.tang@intel.com>
+Reported-by: "Tang, Jun" <jun.tang@intel.com>
+Cc: stable@vger.kernel.org
+Fixes: 7f1f3851feb0 ("drm/i915: sprite support for ValleyView v4")
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180214192327.3250-5-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 10 ++++
+ drivers/gpu/drm/i915/intel_sprite.c | 83 +++++++++++++++++++++++++++---------
+ 2 files changed, 74 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6159,6 +6159,12 @@ enum {
+ #define _SPATILEOFF (VLV_DISPLAY_BASE + 0x721a4)
+ #define _SPACONSTALPHA (VLV_DISPLAY_BASE + 0x721a8)
+ #define SP_CONST_ALPHA_ENABLE (1<<31)
++#define _SPACLRC0 (VLV_DISPLAY_BASE + 0x721d0)
++#define SP_CONTRAST(x) ((x) << 18) /* u3.6 */
++#define SP_BRIGHTNESS(x) ((x) & 0xff) /* s8 */
++#define _SPACLRC1 (VLV_DISPLAY_BASE + 0x721d4)
++#define SP_SH_SIN(x) (((x) & 0x7ff) << 16) /* s4.7 */
++#define SP_SH_COS(x) (x) /* u3.7 */
+ #define _SPAGAMC (VLV_DISPLAY_BASE + 0x721f4)
+
+ #define _SPBCNTR (VLV_DISPLAY_BASE + 0x72280)
+@@ -6172,6 +6178,8 @@ enum {
+ #define _SPBKEYMAXVAL (VLV_DISPLAY_BASE + 0x722a0)
+ #define _SPBTILEOFF (VLV_DISPLAY_BASE + 0x722a4)
+ #define _SPBCONSTALPHA (VLV_DISPLAY_BASE + 0x722a8)
++#define _SPBCLRC0 (VLV_DISPLAY_BASE + 0x722d0)
++#define _SPBCLRC1 (VLV_DISPLAY_BASE + 0x722d4)
+ #define _SPBGAMC (VLV_DISPLAY_BASE + 0x722f4)
+
+ #define _MMIO_VLV_SPR(pipe, plane_id, reg_a, reg_b) \
+@@ -6188,6 +6196,8 @@ enum {
+ #define SPKEYMAXVAL(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPAKEYMAXVAL, _SPBKEYMAXVAL)
+ #define SPTILEOFF(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPATILEOFF, _SPBTILEOFF)
+ #define SPCONSTALPHA(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACONSTALPHA, _SPBCONSTALPHA)
++#define SPCLRC0(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACLRC0, _SPBCLRC0)
++#define SPCLRC1(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACLRC1, _SPBCLRC1)
+ #define SPGAMC(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPAGAMC, _SPBGAMC)
+
+ /*
+--- a/drivers/gpu/drm/i915/intel_sprite.c
++++ b/drivers/gpu/drm/i915/intel_sprite.c
+@@ -345,44 +345,87 @@ skl_plane_get_hw_state(struct intel_plan
+ }
+
+ static void
+-chv_update_csc(struct intel_plane *plane, uint32_t format)
++chv_update_csc(const struct intel_plane_state *plane_state)
+ {
++ struct intel_plane *plane = to_intel_plane(plane_state->base.plane);
+ struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
++ const struct drm_framebuffer *fb = plane_state->base.fb;
+ enum plane_id plane_id = plane->id;
+
+ /* Seems RGB data bypasses the CSC always */
+- if (!format_is_yuv(format))
++ if (!format_is_yuv(fb->format->format))
+ return;
+
+ /*
+- * BT.601 limited range YCbCr -> full range RGB
++ * BT.601 full range YCbCr -> full range RGB
+ *
+- * |r| | 6537 4769 0| |cr |
+- * |g| = |-3330 4769 -1605| x |y-64|
+- * |b| | 0 4769 8263| |cb |
++ * |r| | 5743 4096 0| |cr|
++ * |g| = |-2925 4096 -1410| x |y |
++ * |b| | 0 4096 7258| |cb|
+ *
+- * Cb and Cr apparently come in as signed already, so no
+- * need for any offset. For Y we need to remove the offset.
++ * Cb and Cr apparently come in as signed already,
++ * and we get full range data in on account of CLRC0/1
+ */
+- I915_WRITE_FW(SPCSCYGOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(-64));
++ I915_WRITE_FW(SPCSCYGOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0));
+ I915_WRITE_FW(SPCSCCBOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0));
+ I915_WRITE_FW(SPCSCCROFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0));
+
+- I915_WRITE_FW(SPCSCC01(plane_id), SPCSC_C1(4769) | SPCSC_C0(6537));
+- I915_WRITE_FW(SPCSCC23(plane_id), SPCSC_C1(-3330) | SPCSC_C0(0));
+- I915_WRITE_FW(SPCSCC45(plane_id), SPCSC_C1(-1605) | SPCSC_C0(4769));
+- I915_WRITE_FW(SPCSCC67(plane_id), SPCSC_C1(4769) | SPCSC_C0(0));
+- I915_WRITE_FW(SPCSCC8(plane_id), SPCSC_C0(8263));
+-
+- I915_WRITE_FW(SPCSCYGICLAMP(plane_id), SPCSC_IMAX(940) | SPCSC_IMIN(64));
+- I915_WRITE_FW(SPCSCCBICLAMP(plane_id), SPCSC_IMAX(448) | SPCSC_IMIN(-448));
+- I915_WRITE_FW(SPCSCCRICLAMP(plane_id), SPCSC_IMAX(448) | SPCSC_IMIN(-448));
++ I915_WRITE_FW(SPCSCC01(plane_id), SPCSC_C1(4096) | SPCSC_C0(5743));
++ I915_WRITE_FW(SPCSCC23(plane_id), SPCSC_C1(-2925) | SPCSC_C0(0));
++ I915_WRITE_FW(SPCSCC45(plane_id), SPCSC_C1(-1410) | SPCSC_C0(4096));
++ I915_WRITE_FW(SPCSCC67(plane_id), SPCSC_C1(4096) | SPCSC_C0(0));
++ I915_WRITE_FW(SPCSCC8(plane_id), SPCSC_C0(7258));
++
++ I915_WRITE_FW(SPCSCYGICLAMP(plane_id), SPCSC_IMAX(1023) | SPCSC_IMIN(0));
++ I915_WRITE_FW(SPCSCCBICLAMP(plane_id), SPCSC_IMAX(512) | SPCSC_IMIN(-512));
++ I915_WRITE_FW(SPCSCCRICLAMP(plane_id), SPCSC_IMAX(512) | SPCSC_IMIN(-512));
+
+ I915_WRITE_FW(SPCSCYGOCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0));
+ I915_WRITE_FW(SPCSCCBOCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0));
+ I915_WRITE_FW(SPCSCCROCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0));
+ }
+
++#define SIN_0 0
++#define COS_0 1
++
++static void
++vlv_update_clrc(const struct intel_plane_state *plane_state)
++{
++ struct intel_plane *plane = to_intel_plane(plane_state->base.plane);
++ struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
++ const struct drm_framebuffer *fb = plane_state->base.fb;
++ enum pipe pipe = plane->pipe;
++ enum plane_id plane_id = plane->id;
++ int contrast, brightness, sh_scale, sh_sin, sh_cos;
++
++ if (format_is_yuv(fb->format->format)) {
++ /*
++ * Expand limited range to full range:
++ * Contrast is applied first and is used to expand Y range.
++ * Brightness is applied second and is used to remove the
++ * offset from Y. Saturation/hue is used to expand CbCr range.
++ */
++ contrast = DIV_ROUND_CLOSEST(255 << 6, 235 - 16);
++ brightness = -DIV_ROUND_CLOSEST(16 * 255, 235 - 16);
++ sh_scale = DIV_ROUND_CLOSEST(128 << 7, 240 - 128);
++ sh_sin = SIN_0 * sh_scale;
++ sh_cos = COS_0 * sh_scale;
++ } else {
++ /* Pass-through everything. */
++ contrast = 1 << 6;
++ brightness = 0;
++ sh_scale = 1 << 7;
++ sh_sin = SIN_0 * sh_scale;
++ sh_cos = COS_0 * sh_scale;
++ }
++
++ /* FIXME these register are single buffered :( */
++ I915_WRITE_FW(SPCLRC0(pipe, plane_id),
++ SP_CONTRAST(contrast) | SP_BRIGHTNESS(brightness));
++ I915_WRITE_FW(SPCLRC1(pipe, plane_id),
++ SP_SH_SIN(sh_sin) | SP_SH_COS(sh_cos));
++}
++
+ static u32 vlv_sprite_ctl(const struct intel_crtc_state *crtc_state,
+ const struct intel_plane_state *plane_state)
+ {
+@@ -476,8 +519,10 @@ vlv_update_plane(struct intel_plane *pla
+
+ spin_lock_irqsave(&dev_priv->uncore.lock, irqflags);
+
++ vlv_update_clrc(plane_state);
++
+ if (IS_CHERRYVIEW(dev_priv) && pipe == PIPE_B)
+- chv_update_csc(plane, fb->format->format);
++ chv_update_csc(plane_state);
+
+ if (key->flags) {
+ I915_WRITE_FW(SPKEYMINVAL(pipe, plane_id), key->min_value);
--- /dev/null
+From a24cd490739586a7d2da3549a1844e1d7c4f4fc4 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 2 Apr 2018 23:50:31 -0400
+Subject: hypfs_kill_super(): deal with failed allocations
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit a24cd490739586a7d2da3549a1844e1d7c4f4fc4 upstream.
+
+hypfs_fill_super() might fail to allocate sbi; hypfs_kill_super()
+should not oops on that.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/hypfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -320,7 +320,7 @@ static void hypfs_kill_super(struct supe
+
+ if (sb->s_root)
+ hypfs_delete_tree(sb->s_root);
+- if (sb_info->update_file)
++ if (sb_info && sb_info->update_file)
+ hypfs_remove(sb_info->update_file);
+ kfree(sb->s_fs_info);
+ sb->s_fs_info = NULL;
--- /dev/null
+From 9e5053ad9d590e095829a8bb07adbbdbd893f0f9 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Wed, 28 Mar 2018 11:15:09 +0300
+Subject: iwlwifi: add a bunch of new 9000 PCI IDs
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit 9e5053ad9d590e095829a8bb07adbbdbd893f0f9 upstream.
+
+A lot of new PCI IDs were added for the 9000 series. Add them to the
+list of supported PCI IDs.
+
+Cc: stable@vger.kernel.org # 4.13+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 157 +++++++++++++++++++++++++-
+ 1 file changed, 155 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016-2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -36,6 +37,7 @@
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+@@ -515,9 +517,9 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
+
+ /* 9000 Series */
+- {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_cfg)},
+@@ -542,11 +544,15 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
+@@ -567,16 +573,42 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_shared_clk)},
+@@ -593,12 +625,94 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x02A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x42A4, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg_soc)},
+@@ -624,11 +738,44 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x9DF0, 0x0610, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x0710, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x4030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x42A4, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_cfg_soc)},
+@@ -645,10 +792,16 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0xA370, 0x0264, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x02A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)},
+
+ /* a000 Series */
+ {IWL_PCI_DEVICE(0x2720, 0x0A10, iwla000_2ac_cfg_hr_cdb)},
--- /dev/null
+From 86a2b2043af79deff5cf000c5a08847faa4f2ee0 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Wed, 21 Feb 2018 22:18:59 +0200
+Subject: iwlwifi: add shared clock PHY config flag for some devices
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit 86a2b2043af79deff5cf000c5a08847faa4f2ee0 upstream.
+
+Some devices use a shared clock which is very sensitive to variations
+and cause trouble in some situations. We need to set a bit in the phy
+configuration to indicate that to the FW. To make this generic, add a
+extra_phy_config_flags element to the device configuration and OR it
+into the phy_cfg before sending it to the firmware. And also create a
+set of configurations for devices that use shared clocks and need this
+extra bit to be set.
+
+Fixes: c62446d2b028 ("iwlwifi: add new 9460 series PCI IDs")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 62 ++++++++++++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/fw/file.h | 1
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 5 +
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 38 +++++++-------
+ 5 files changed, 91 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+@@ -53,6 +53,7 @@
+ #include <linux/stringify.h>
+ #include "iwl-config.h"
+ #include "iwl-agn-hw.h"
++#include "fw/file.h"
+
+ /* Highest firmware API version supported */
+ #define IWL9000_UCODE_API_MAX 34
+@@ -264,6 +265,67 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc
+ .integrated = true,
+ .soc_latency = 5000,
+ };
++
++const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
++ .name = "Intel(R) Dual Band Wireless AC 9460",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
++const struct iwl_cfg iwl9461_2ac_cfg_shared_clk = {
++ .name = "Intel(R) Dual Band Wireless AC 9461",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
++const struct iwl_cfg iwl9462_2ac_cfg_shared_clk = {
++ .name = "Intel(R) Dual Band Wireless AC 9462",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
++const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = {
++ .name = "Intel(R) Dual Band Wireless AC 9560",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
+ MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
+@@ -434,6 +434,7 @@ enum iwl_fw_phy_cfg {
+ FW_PHY_CFG_TX_CHAIN = 0xf << FW_PHY_CFG_TX_CHAIN_POS,
+ FW_PHY_CFG_RX_CHAIN_POS = 20,
+ FW_PHY_CFG_RX_CHAIN = 0xf << FW_PHY_CFG_RX_CHAIN_POS,
++ FW_PHY_CFG_SHARED_CLK = BIT(31),
+ };
+
+ #define IWL_UCODE_MAX_CS 1
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -394,6 +394,7 @@ struct iwl_cfg {
+ u8 max_vht_ampdu_exponent;
+ u8 ucode_api_max;
+ u8 ucode_api_min;
++ u32 extra_phy_cfg_flags;
+ };
+
+ /*
+@@ -476,6 +477,10 @@ extern const struct iwl_cfg iwl9460_2ac_
+ extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
+ extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
+ extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
++extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
++extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
++extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwla000_2ac_cfg_jf;
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -435,6 +435,10 @@ static int iwl_send_phy_cfg_cmd(struct i
+
+ /* Set parameters */
+ phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm));
++
++ /* set flags extra PHY configuration flags from the device's cfg */
++ phy_cfg_cmd.phy_cfg |= cpu_to_le32(mvm->cfg->extra_phy_cfg_flags);
++
+ phy_cfg_cmd.calib_control.event_trigger =
+ mvm->fw->default_calib[ucode_type].event_trigger;
+ phy_cfg_cmd.calib_control.flow_trigger =
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -577,25 +577,25 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0064, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x00A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x00A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0230, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0238, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x023C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0260, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0064, iwl9461_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x00A0, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x00A4, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0230, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0234, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0238, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x023C, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0260, iwl9461_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
--- /dev/null
+From c66b23c2840446a82c389e4cb1a12eb2a71fa2e4 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 2 Apr 2018 23:56:44 -0400
+Subject: jffs2_kill_sb(): deal with failed allocations
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit c66b23c2840446a82c389e4cb1a12eb2a71fa2e4 upstream.
+
+jffs2_fill_super() might fail to allocate jffs2_sb_info;
+jffs2_kill_sb() must survive that.
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jffs2/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -342,7 +342,7 @@ static void jffs2_put_super (struct supe
+ static void jffs2_kill_sb(struct super_block *sb)
+ {
+ struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
+- if (!sb_rdonly(sb))
++ if (c && !sb_rdonly(sb))
+ jffs2_stop_garbage_collect_thread(c);
+ kill_mtd_super(sb);
+ kfree(c);
--- /dev/null
+From sean@mess.org Sun Apr 22 11:46:45 2018
+From: Sean Young <sean@mess.org>
+Date: Sun, 15 Apr 2018 10:51:51 +0100
+Subject: media: staging: lirc_zilog: incorrect reference counting
+To: linux-media@vger.kernel.org, Warren Sturm <warren.sturm@gmail.com>, Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Cc: Andy Walls <awalls.cx18@gmail.com>, stable@vger.kernel.org, #@mess.org
+Message-ID: <8e2f2296b7f6fed6eea4b6fc24ab2b1966780d04.1523785758.git.sean@mess.org>
+
+From: Sean Young <sean@mess.org>
+
+[not upstream as the driver is deleted in 4.16 - gregkh]
+
+Whenever poll is called, the reference count is increased but never
+decreased. This means that on rmmod, the lirc_thread is not stopped,
+and will trample over freed memory.
+
+Zilog/Hauppauge IR driver unloaded
+BUG: unable to handle kernel paging request at ffffffffc17ba640
+Oops: 0010 [#1] SMP
+CPU: 1 PID: 667 Comm: zilog-rx-i2c-1 Tainted: P C OE 4.13.16-302.fc27.x86_64 #1
+Hardware name: Gigabyte Technology Co., Ltd. GA-MA790FXT-UD5P/GA-MA790FXT-UD5P, BIOS F6 08/06/2009
+task: ffff964eb452ca00 task.stack: ffffb254414dc000
+RIP: 0010:0xffffffffc17ba640
+RSP: 0018:ffffb254414dfe78 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: ffff964ec1b35890 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
+RBP: ffffb254414dff00 R08: 000000000000036e R09: ffff964ecfc8dfd0
+R10: ffffb254414dfe78 R11: 00000000000f4240 R12: ffff964ec2bf28a0
+R13: ffff964ec1b358a8 R14: ffff964ec1b358d0 R15: ffff964ec1b35800
+FS: 0000000000000000(0000) GS:ffff964ecfc80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffc17ba640 CR3: 000000023058c000 CR4: 00000000000006e0
+Call Trace:
+ kthread+0x125/0x140
+ ? kthread_park+0x60/0x60
+ ? do_syscall_64+0x67/0x140
+ ret_from_fork+0x25/0x30
+Code: Bad RIP value.
+RIP: 0xffffffffc17ba640 RSP: ffffb254414dfe78
+CR2: ffffffffc17ba640
+
+Note that zilog-rx-i2c-1 should have exited by now, but hasn't due to
+the missing put in poll().
+
+This code has been replaced completely in kernel v4.16 by a new driver,
+see commit acaa34bf06e9 ("media: rc: implement zilog transmitter"), and
+commit f95367a7b758 ("media: staging: remove lirc_zilog driver").
+
+Cc: stable@vger.kernel.org # v4.15- (all up to and including v4.15)
+Reported-by: Warren Sturm <warren.sturm@gmail.com>
+Tested-by: Warren Sturm <warren.sturm@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/lirc/lirc_zilog.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/media/lirc/lirc_zilog.c
++++ b/drivers/staging/media/lirc/lirc_zilog.c
+@@ -1228,6 +1228,7 @@ static unsigned int poll(struct file *fi
+
+ dev_dbg(ir->l.dev, "%s result = %s\n", __func__,
+ ret ? "POLLIN|POLLRDNORM" : "none");
++ put_ir_rx(rx, false);
+ return ret;
+ }
+
--- /dev/null
+From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
+From: Matthew Wilcox <mawilcox@microsoft.com>
+Date: Fri, 20 Apr 2018 14:56:20 -0700
+Subject: mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
+
+From: Matthew Wilcox <mawilcox@microsoft.com>
+
+commit abc1be13fd113ddef5e2d807a466286b864caed3 upstream.
+
+f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
+Unfortunately, the page cache also uses the mapping's GFP flags for
+allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
+flag, and masks off __GFP_ZERO in some paths, but not all. That causes
+radix tree nodes to be allocated with a NULL list_head, which causes
+backtraces like:
+
+ __list_del_entry+0x30/0xd0
+ list_lru_del+0xac/0x1ac
+ page_cache_tree_insert+0xd8/0x110
+
+The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
+if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
+innermost location, and remove it from earlier in the callchain.
+
+Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
+Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
+Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
+Reported-by: Chris Fries <cfries@google.com>
+Debugged-by: Minchan Kim <minchan@kernel.org>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/filemap.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -688,7 +688,7 @@ int replace_page_cache_page(struct page
+ VM_BUG_ON_PAGE(!PageLocked(new), new);
+ VM_BUG_ON_PAGE(new->mapping, new);
+
+- error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
++ error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
+ if (!error) {
+ struct address_space *mapping = old->mapping;
+ void (*freepage)(struct page *);
+@@ -744,7 +744,7 @@ static int __add_to_page_cache_locked(st
+ return error;
+ }
+
+- error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
++ error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
+ if (error) {
+ if (!huge)
+ mem_cgroup_cancel_charge(page, memcg, false);
+@@ -1486,8 +1486,7 @@ no_page:
+ if (fgp_flags & FGP_ACCESSED)
+ __SetPageReferenced(page);
+
+- err = add_to_page_cache_lru(page, mapping, offset,
+- gfp_mask & GFP_RECLAIM_MASK);
++ err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
+ if (unlikely(err)) {
+ put_page(page);
+ page = NULL;
+@@ -2275,7 +2274,7 @@ static int page_cache_read(struct file *
+ if (!page)
+ return -ENOMEM;
+
+- ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
++ ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
+ if (ret == 0)
+ ret = mapping->a_ops->readpage(file, page);
+ else if (ret == -EEXIST)
--- /dev/null
+From fc5f33768cca7144f8d793205b229d46740d183b Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Sat, 7 Apr 2018 20:37:40 +0200
+Subject: net: dsa: Discard frames from unused ports
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit fc5f33768cca7144f8d793205b229d46740d183b upstream.
+
+The Marvell switches under some conditions will pass a frame to the
+host with the port being the CPU port. Such frames are invalid, and
+should be dropped. Not dropping them can result in a crash when
+incrementing the receive statistics for an invalid port.
+
+This has been reworked for 4.14, which does not have the central
+dsa_master_find_slave() function, so each tag driver needs to check.
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Fixes: 91da11f870f0 ("net: Distributed Switch Architecture protocol support")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/tag_brcm.c | 3 +++
+ net/dsa/tag_dsa.c | 3 +++
+ net/dsa/tag_edsa.c | 3 +++
+ net/dsa/tag_ksz.c | 3 +++
+ net/dsa/tag_lan9303.c | 3 +++
+ net/dsa/tag_mtk.c | 3 +++
+ net/dsa/tag_qca.c | 3 +++
+ net/dsa/tag_trailer.c | 3 +++
+ 8 files changed, 24 insertions(+)
+
+--- a/net/dsa/tag_brcm.c
++++ b/net/dsa/tag_brcm.c
+@@ -121,6 +121,9 @@ static struct sk_buff *brcm_tag_rcv(stru
+ if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ /* Remove Broadcom tag and update checksum */
+ skb_pull_rcsum(skb, BRCM_TAG_LEN);
+
+--- a/net/dsa/tag_dsa.c
++++ b/net/dsa/tag_dsa.c
+@@ -107,6 +107,9 @@ static struct sk_buff *dsa_rcv(struct sk
+ if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ /*
+ * Convert the DSA header to an 802.1q header if the 'tagged'
+ * bit in the DSA header is set. If the 'tagged' bit is clear,
+--- a/net/dsa/tag_edsa.c
++++ b/net/dsa/tag_edsa.c
+@@ -120,6 +120,9 @@ static struct sk_buff *edsa_rcv(struct s
+ if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ /*
+ * If the 'tagged' bit is set, convert the DSA tag to a 802.1q
+ * tag and delete the ethertype part. If the 'tagged' bit is
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -92,6 +92,9 @@ static struct sk_buff *ksz_rcv(struct sk
+ if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ pskb_trim_rcsum(skb, skb->len - KSZ_EGRESS_TAG_LEN);
+
+ skb->dev = ds->ports[source_port].netdev;
+--- a/net/dsa/tag_lan9303.c
++++ b/net/dsa/tag_lan9303.c
+@@ -108,6 +108,9 @@ static struct sk_buff *lan9303_rcv(struc
+ return NULL;
+ }
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ if (!ds->ports[source_port].netdev) {
+ dev_warn_ratelimited(&dev->dev, "Dropping packet due to invalid netdev or device\n");
+ return NULL;
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -81,6 +81,9 @@ static struct sk_buff *mtk_tag_rcv(struc
+ if (!ds->ports[port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(port)))
++ return NULL;
++
+ skb->dev = ds->ports[port].netdev;
+
+ return skb;
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -104,6 +104,9 @@ static struct sk_buff *qca_tag_rcv(struc
+ if (!ds->ports[port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(port)))
++ return NULL;
++
+ /* Update skb & forward the frame accordingly */
+ skb->dev = ds->ports[port].netdev;
+
+--- a/net/dsa/tag_trailer.c
++++ b/net/dsa/tag_trailer.c
+@@ -76,6 +76,9 @@ static struct sk_buff *trailer_rcv(struc
+ if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+ return NULL;
+
++ if (unlikely(ds->cpu_port_mask & BIT(source_port)))
++ return NULL;
++
+ pskb_trim_rcsum(skb, skb->len - 4);
+
+ skb->dev = ds->ports[source_port].netdev;
--- /dev/null
+From 659038428cb43a66e3eff71e2c845c9de3611a98 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 3 Apr 2018 00:13:17 -0400
+Subject: orangefs_kill_sb(): deal with allocation failures
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 659038428cb43a66e3eff71e2c845c9de3611a98 upstream.
+
+orangefs_fill_sb() might've failed to allocate ORANGEFS_SB(s); don't
+oops in that case.
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/orangefs/super.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/orangefs/super.c
++++ b/fs/orangefs/super.c
+@@ -594,6 +594,11 @@ void orangefs_kill_sb(struct super_block
+ /* provided sb cleanup */
+ kill_anon_super(sb);
+
++ if (!ORANGEFS_SB(sb)) {
++ mutex_lock(&orangefs_request_mutex);
++ mutex_unlock(&orangefs_request_mutex);
++ return;
++ }
+ /*
+ * issue the unmount to userspace to tell it to remove the
+ * dynamic mount info it has for this superblock
--- /dev/null
+From sean@mess.org Sun Apr 22 11:46:09 2018
+From: Sean Young <sean@mess.org>
+Date: Sun, 15 Apr 2018 10:51:50 +0100
+Subject: Revert "media: lirc_zilog: driver only sends LIRCCODE"
+To: linux-media@vger.kernel.org, Warren Sturm <warren.sturm@gmail.com>, Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Cc: Andy Walls <awalls.cx18@gmail.com>, stable@vger.kernel.org, #@mess.org, v4.14-v4.15@mess.org
+Message-ID: <c2664b59ff88989b4d9a6c7722a56cd8878caf28.1523785758.git.sean@mess.org>
+
+From: Sean Young <sean@mess.org>
+
+[not upstream as the driver is deleted in 4.16 - gregkh]
+
+The lirc config documented here
+https://www.blushingpenguin.com/mark/blog/?p=24 uses raw_codes for sending
+IR. Each key only has one pulse, which in fact is an index into the
+haup-ir-blaster.bin file. Changing the driver to LIRCCODE (although more
+accurate) breaks this configuration.
+
+This code has been replaced completely in kernel v4.16 by a new driver,
+see commit acaa34bf06e9 ("media: rc: implement zilog transmitter"), and
+commit f95367a7b758 ("media: staging: remove lirc_zilog driver").
+
+This reverts commit 89d8a2cc51d1f29ea24a0b44dde13253141190a0.
+
+Fixes: 615cd3fe6ccc ("[media] media: lirc_dev: make better use of file->private_data")
+
+Cc: stable@vger.kernel.org # v4.14-v4.15
+Reported-by: Warren Sturm <warren.sturm@gmail.com>
+Tested-by: Warren Sturm <warren.sturm@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/lirc/lirc_zilog.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/media/lirc/lirc_zilog.c
++++ b/drivers/staging/media/lirc/lirc_zilog.c
+@@ -288,7 +288,7 @@ static void release_ir_tx(struct kref *r
+ struct IR_tx *tx = container_of(ref, struct IR_tx, ref);
+ struct IR *ir = tx->ir;
+
+- ir->l.features &= ~LIRC_CAN_SEND_LIRCCODE;
++ ir->l.features &= ~LIRC_CAN_SEND_PULSE;
+ /* Don't put_ir_device(tx->ir) here, so our lock doesn't get freed */
+ ir->tx = NULL;
+ kfree(tx);
+@@ -1267,14 +1267,14 @@ static long ioctl(struct file *filep, un
+ if (!(features & LIRC_CAN_SEND_MASK))
+ return -ENOTTY;
+
+- result = put_user(LIRC_MODE_LIRCCODE, uptr);
++ result = put_user(LIRC_MODE_PULSE, uptr);
+ break;
+ case LIRC_SET_SEND_MODE:
+ if (!(features & LIRC_CAN_SEND_MASK))
+ return -ENOTTY;
+
+ result = get_user(mode, uptr);
+- if (!result && mode != LIRC_MODE_LIRCCODE)
++ if (!result && mode != LIRC_MODE_PULSE)
+ return -EINVAL;
+ break;
+ default:
+@@ -1512,7 +1512,7 @@ static int ir_probe(struct i2c_client *c
+ kref_init(&tx->ref);
+ ir->tx = tx;
+
+- ir->l.features |= LIRC_CAN_SEND_LIRCCODE;
++ ir->l.features |= LIRC_CAN_SEND_PULSE;
+ mutex_init(&tx->client_lock);
+ tx->c = client;
+ tx->need_boot = 1;
--- /dev/null
+From 4a3877c4cedd95543f8726b0a98743ed8db0c0fb Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 3 Apr 2018 01:15:46 -0400
+Subject: rpc_pipefs: fix double-dput()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 4a3877c4cedd95543f8726b0a98743ed8db0c0fb upstream.
+
+if we ever hit rpc_gssd_dummy_depopulate() dentry passed to
+it has refcount equal to 1. __rpc_rmpipe() drops it and
+dput() done after that hits an already freed dentry.
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/rpc_pipe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentry
+ struct dentry *clnt_dir = pipe_dentry->d_parent;
+ struct dentry *gssd_dir = clnt_dir->d_parent;
+
++ dget(pipe_dentry);
+ __rpc_rmpipe(d_inode(clnt_dir), pipe_dentry);
+ __rpc_depopulate(clnt_dir, gssd_dummy_info_file, 0, 1);
+ __rpc_depopulate(gssd_dir, gssd_dummy_clnt_dir, 0, 1);
udf-fix-leak-of-utf-16-surrogates-into-encoded-strings.patch
fanotify-fix-logic-of-events-on-child.patch
mmc-sdhci-pci-only-do-amd-tuning-for-hs200.patch
+drm-i915-correctly-handle-limited-range-ycbcr-data-on-vlv-chv.patch
+jffs2_kill_sb-deal-with-failed-allocations.patch
+hypfs_kill_super-deal-with-failed-allocations.patch
+orangefs_kill_sb-deal-with-allocation-failures.patch
+rpc_pipefs-fix-double-dput.patch
+don-t-leak-mnt_internal-away-from-internal-mounts.patch
+autofs-mount-point-create-should-honour-passed-in-mode.patch
+mm-filemap.c-fix-null-pointer-in-page_cache_tree_insert.patch
+net-dsa-discard-frames-from-unused-ports.patch
+iwlwifi-add-shared-clock-phy-config-flag-for-some-devices.patch
+iwlwifi-add-a-bunch-of-new-9000-pci-ids.patch
+revert-media-lirc_zilog-driver-only-sends-lirccode.patch
+media-staging-lirc_zilog-incorrect-reference-counting.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
