--- /dev/null
+From b5b903fba96a4d1771422efd5c713ebb73f7dc82 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Wed, 28 Feb 2018 18:33:03 -0800
+Subject: auxdisplay: fix broken menu
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit b5b903fba96a4d1771422efd5c713ebb73f7dc82 upstream.
+
+Having the CHARLCD Kconfig symbol between "menuconfig AUXDISPLAY"
+and "if AUXDISPLAY" breaks the AUXDISPLAY submenus, so move the
+CHARLCD Kconfig symbol near the end of the file so that the menu
+display is continuous.
+
+Also include ARM_CHARLCD inside of the if AUXDISPLAY/endif block.
+Geert says that it should be there.
+
+Fixes: 39f8ea46724e ("auxdisplay: charlcd: Extract character LCD core from misc/panel")
+
+Cc: stable@vger.kernel.org # v4.12
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/auxdisplay/Kconfig | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/auxdisplay/Kconfig
++++ b/drivers/auxdisplay/Kconfig
+@@ -14,9 +14,6 @@ menuconfig AUXDISPLAY
+
+ If you say N, all options in this submenu will be skipped and disabled.
+
+-config CHARLCD
+- tristate "Character LCD core support" if COMPILE_TEST
+-
+ if AUXDISPLAY
+
+ config HD44780
+@@ -157,8 +154,6 @@ config HT16K33
+ Say yes here to add support for Holtek HT16K33, RAM mapping 16*8
+ LED controller driver with keyscan.
+
+-endif # AUXDISPLAY
+-
+ config ARM_CHARLCD
+ bool "ARM Ltd. Character LCD Driver"
+ depends on PLAT_VERSATILE
+@@ -169,6 +164,8 @@ config ARM_CHARLCD
+ line and the Linux version on the second line, but that's
+ still useful.
+
++endif # AUXDISPLAY
++
+ config PANEL
+ tristate "Parallel port LCD/Keypad Panel support"
+ depends on PARPORT
+@@ -448,3 +445,6 @@ config PANEL_BOOT_MESSAGE
+ printf()-formatted message is valid with newline and escape codes.
+
+ endif # PANEL
++
++config CHARLCD
++ tristate "Character LCD core support" if COMPILE_TEST
--- /dev/null
+From c5b4a50b74018b3677098151ec5f4fce07d5e6a0 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 11 Jun 2018 19:24:16 +0100
+Subject: Btrfs: fix return value on rename exchange failure
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit c5b4a50b74018b3677098151ec5f4fce07d5e6a0 upstream.
+
+If we failed during a rename exchange operation after starting/joining a
+transaction, we would end up replacing the return value, stored in the
+local 'ret' variable, with the return value from btrfs_end_transaction().
+So this could end up returning 0 (success) to user space despite the
+operation having failed and aborted the transaction, because if there are
+multiple tasks having a reference on the transaction at the time
+btrfs_end_transaction() is called by the rename exchange, that function
+returns 0 (otherwise it returns -EIO and not the original error value).
+So fix this by not overwriting the return value on error after getting
+a transaction handle.
+
+Fixes: cdd1fedf8261 ("btrfs: add support for RENAME_EXCHANGE and RENAME_WHITEOUT")
+CC: stable@vger.kernel.org # 4.9+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/inode.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9475,6 +9475,7 @@ static int btrfs_rename_exchange(struct
+ u64 new_idx = 0;
+ u64 root_objectid;
+ int ret;
++ int ret2;
+ bool root_log_pinned = false;
+ bool dest_log_pinned = false;
+
+@@ -9671,7 +9672,8 @@ out_fail:
+ dest_log_pinned = false;
+ }
+ }
+- ret = btrfs_end_transaction(trans);
++ ret2 = btrfs_end_transaction(trans);
++ ret = ret ? ret : ret2;
+ out_notrans:
+ if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
+ up_read(&fs_info->subvol_sem);
--- /dev/null
+From ff7c9917143b3a6cf2fa61212a32d67cf259bf9c Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Mon, 18 Jun 2018 12:47:45 -0700
+Subject: cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit ff7c9917143b3a6cf2fa61212a32d67cf259bf9c upstream.
+
+When scaling max/min settings are changed, internally they are converted
+to a ratio using the max turbo 1 core turbo frequency. This works fine
+when 1 core max is same irrespective of the core. But under Turbo 3.0,
+this will not be the case. For example:
+Core 0: max turbo pstate: 43 (4.3GHz)
+Core 1: max turbo pstate: 45 (4.5GHz)
+In this case 1 core turbo ratio will be maximum of all, so it will be
+45 (4.5GHz). Suppose scaling max is set to 4GHz (ratio 40) for all cores
+,then on core one it will be
+ = max_state * policy->max / max_freq;
+ = 43 * (4000000/4500000) = 38 (3.8GHz)
+ = 38
+which is 200MHz less than the desired.
+On core2, it will be correctly set to ratio 40 (4GHz). Same holds true
+for scaling min frequency limit. So this requires usage of correct turbo
+max frequency for core one, which in this case is 4.3GHz. So we need to
+adjust per CPU cpu->pstate.turbo_freq using the maximum HWP ratio of that
+core.
+
+This change uses the HWP capability of a core to adjust max turbo
+frequency. But since Broadwell HWP doesn't use ratios in the HWP
+capabilities, we have to use legacy max 1 core turbo ratio. This is not
+a problem as the HWP capabilities don't differ among cores in Broadwell.
+We need to check for non Broadwell CPU model for applying this change,
+though.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: 4.6+ <stable@vger.kernel.org> # 4.6+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -284,6 +284,7 @@ struct pstate_funcs {
+ static struct pstate_funcs pstate_funcs __read_mostly;
+
+ static int hwp_active __read_mostly;
++static int hwp_mode_bdw __read_mostly;
+ static bool per_cpu_limits __read_mostly;
+
+ static struct cpufreq_driver *intel_pstate_driver __read_mostly;
+@@ -1370,7 +1371,15 @@ static void intel_pstate_get_cpu_pstates
+ cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
+ cpu->pstate.scaling = pstate_funcs.get_scaling();
+ cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling;
+- cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
++
++ if (hwp_active && !hwp_mode_bdw) {
++ unsigned int phy_max, current_max;
++
++ intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max);
++ cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling;
++ } else {
++ cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
++ }
+
+ if (pstate_funcs.get_aperf_mperf_shift)
+ cpu->aperf_mperf_shift = pstate_funcs.get_aperf_mperf_shift();
+@@ -2252,28 +2261,36 @@ static inline bool intel_pstate_has_acpi
+ static inline void intel_pstate_request_control_from_smm(void) {}
+ #endif /* CONFIG_ACPI */
+
++#define INTEL_PSTATE_HWP_BROADWELL 0x01
++
++#define ICPU_HWP(model, hwp_mode) \
++ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_HWP, hwp_mode }
++
+ static const struct x86_cpu_id hwp_support_ids[] __initconst = {
+- { X86_VENDOR_INTEL, 6, X86_MODEL_ANY, X86_FEATURE_HWP },
++ ICPU_HWP(INTEL_FAM6_BROADWELL_X, INTEL_PSTATE_HWP_BROADWELL),
++ ICPU_HWP(INTEL_FAM6_BROADWELL_XEON_D, INTEL_PSTATE_HWP_BROADWELL),
++ ICPU_HWP(X86_MODEL_ANY, 0),
+ {}
+ };
+
+ static int __init intel_pstate_init(void)
+ {
++ const struct x86_cpu_id *id;
+ int rc;
+
+ if (no_load)
+ return -ENODEV;
+
+- if (x86_match_cpu(hwp_support_ids)) {
++ id = x86_match_cpu(hwp_support_ids);
++ if (id) {
+ copy_cpu_funcs(&core_funcs);
+ if (!no_hwp) {
+ hwp_active++;
++ hwp_mode_bdw = id->driver_data;
+ intel_pstate.attr = hwp_cpufreq_attrs;
+ goto hwp_cpu_matched;
+ }
+ } else {
+- const struct x86_cpu_id *id;
+-
+ id = x86_match_cpu(intel_pstate_cpu_ids);
+ if (!id)
+ return -ENODEV;
--- /dev/null
+From 7eb6b35d93c356f1afebbfb808bc296d6351e708 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Mon, 12 Mar 2018 14:06:53 +0200
+Subject: iio: adc: ad7791: remove sample freq sysfs attributes
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+commit 7eb6b35d93c356f1afebbfb808bc296d6351e708 upstream.
+
+In the current state, these attributes are broken, because they are
+registered already, and the kernel throws a warning.
+The first registration happens via the `IIO_CHAN_INFO_SAMP_FREQ` flag from
+the `ad_sigma_delta` driver.
+
+In this commit these attrs are removed, and in the following the
+IIO_CHAN_INFO_SAMP_FREQ behavior will be implemented, which replaces these
+hooks.
+
+This is done to make things a bit easier to review as there is a bit of
+overlap in the patch if it's done all at once.
+
+Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ")
+
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ad7791.c | 49 -----------------------------------------------
+ 1 file changed, 49 deletions(-)
+
+--- a/drivers/iio/adc/ad7791.c
++++ b/drivers/iio/adc/ad7791.c
+@@ -244,58 +244,9 @@ static int ad7791_read_raw(struct iio_de
+ return -EINVAL;
+ }
+
+-static const char * const ad7791_sample_freq_avail[] = {
+- [AD7791_FILTER_RATE_120] = "120",
+- [AD7791_FILTER_RATE_100] = "100",
+- [AD7791_FILTER_RATE_33_3] = "33.3",
+- [AD7791_FILTER_RATE_20] = "20",
+- [AD7791_FILTER_RATE_16_6] = "16.6",
+- [AD7791_FILTER_RATE_16_7] = "16.7",
+- [AD7791_FILTER_RATE_13_3] = "13.3",
+- [AD7791_FILTER_RATE_9_5] = "9.5",
+-};
+-
+-static ssize_t ad7791_read_frequency(struct device *dev,
+- struct device_attribute *attr, char *buf)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7791_state *st = iio_priv(indio_dev);
+- unsigned int rate = st->filter & AD7791_FILTER_RATE_MASK;
+-
+- return sprintf(buf, "%s\n", ad7791_sample_freq_avail[rate]);
+-}
+-
+-static ssize_t ad7791_write_frequency(struct device *dev,
+- struct device_attribute *attr, const char *buf, size_t len)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7791_state *st = iio_priv(indio_dev);
+- int i, ret;
+-
+- i = sysfs_match_string(ad7791_sample_freq_avail, buf);
+- if (i < 0)
+- return i;
+-
+- ret = iio_device_claim_direct_mode(indio_dev);
+- if (ret)
+- return ret;
+- st->filter &= ~AD7791_FILTER_RATE_MASK;
+- st->filter |= i;
+- ad_sd_write_reg(&st->sd, AD7791_REG_FILTER, sizeof(st->filter),
+- st->filter);
+- iio_device_release_direct_mode(indio_dev);
+-
+- return len;
+-}
+-
+-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
+- ad7791_read_frequency,
+- ad7791_write_frequency);
+-
+ static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("120 100 33.3 20 16.7 16.6 13.3 9.5");
+
+ static struct attribute *ad7791_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+ NULL
+ };
--- /dev/null
+From 4a5b45383ca371e123ba103d34d4b3b87616245c Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 8 Apr 2018 21:44:01 +0200
+Subject: iio: sca3000: Fix an error handling path in 'sca3000_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 4a5b45383ca371e123ba103d34d4b3b87616245c upstream.
+
+Use 'devm_iio_kfifo_allocate()' instead of 'iio_kfifo_allocate()' in order
+to simplify code and avoid a memory leak in an error path in
+'sca3000_probe()'. A call to 'sca3000_unconfigure_ring()' was missing.
+
+Sent via the next merge window as unimportant bug and there are
+other patches dependent on it.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/sca3000.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/iio/accel/sca3000.c
++++ b/drivers/iio/accel/sca3000.c
+@@ -1277,7 +1277,7 @@ static int sca3000_configure_ring(struct
+ {
+ struct iio_buffer *buffer;
+
+- buffer = iio_kfifo_allocate();
++ buffer = devm_iio_kfifo_allocate(&indio_dev->dev);
+ if (!buffer)
+ return -ENOMEM;
+
+@@ -1287,11 +1287,6 @@ static int sca3000_configure_ring(struct
+ return 0;
+ }
+
+-static void sca3000_unconfigure_ring(struct iio_dev *indio_dev)
+-{
+- iio_kfifo_free(indio_dev->buffer);
+-}
+-
+ static inline
+ int __sca3000_hw_ring_state_set(struct iio_dev *indio_dev, bool state)
+ {
+@@ -1546,8 +1541,6 @@ static int sca3000_remove(struct spi_dev
+ if (spi->irq)
+ free_irq(spi->irq, indio_dev);
+
+- sca3000_unconfigure_ring(indio_dev);
+-
+ return 0;
+ }
+
--- /dev/null
+From c1797b11a09c8323c92b074fd48b89a936c991d0 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 22 Jun 2018 10:52:51 +0100
+Subject: irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit c1797b11a09c8323c92b074fd48b89a936c991d0 upstream.
+
+On a NUMA system, if an ITS is local to an offline node, the ITS driver may
+pick an offline CPU to bind the LPI. In this case, pick an online CPU (and
+the first one will do).
+
+But on some systems, binding an LPI to non-local node CPU may cause
+deadlock (see Cavium erratum 23144). In this case, just fail the activate
+and return an error code.
+
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180622095254.5906-5-marc.zyngier@arm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2309,7 +2309,14 @@ static int its_irq_domain_activate(struc
+ cpu_mask = cpumask_of_node(its_dev->its->numa_node);
+
+ /* Bind the LPI to the first possible CPU */
+- cpu = cpumask_first(cpu_mask);
++ cpu = cpumask_first_and(cpu_mask, cpu_online_mask);
++ if (cpu >= nr_cpu_ids) {
++ if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144)
++ return -EINVAL;
++
++ cpu = cpumask_first(cpu_online_mask);
++ }
++
+ its_dev->event_map.col_map[event] = cpu;
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
--- /dev/null
+From 03eeafdd9ab06a770d42c2b264d50dff7e2f4eee Mon Sep 17 00:00:00 2001
+From: Waiman Long <longman@redhat.com>
+Date: Thu, 24 May 2018 09:26:38 -0400
+Subject: locking/rwsem: Fix up_read_non_owner() warning with DEBUG_RWSEMS
+
+From: Waiman Long <longman@redhat.com>
+
+commit 03eeafdd9ab06a770d42c2b264d50dff7e2f4eee upstream.
+
+It was found that the use of up_read_non_owner() in NFS was causing
+the following warning when DEBUG_RWSEMS was configured.
+
+ DEBUG_LOCKS_WARN_ON(sem->owner != ((struct task_struct *)(1UL << 0)))
+
+Looking into the rwsem.c file, it was discovered that the corresponding
+down_read_non_owner() function was not setting the owner field properly.
+This is fixed now, and the warning should be gone.
+
+Fixes: 5149cbac4235 ("locking/rwsem: Add DEBUG_RWSEMS to look for lock/unlock mismatches")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Gavin Schenk <g.schenk@eckelmann.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: linux-nfs@vger.kernel.org
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/1527168398-4291-1-git-send-email-longman@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/locking/rwsem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/locking/rwsem.c
++++ b/kernel/locking/rwsem.c
+@@ -181,6 +181,7 @@ void down_read_non_owner(struct rw_semap
+ might_sleep();
+
+ __down_read(sem);
++ rwsem_set_reader_owned(sem);
+ }
+
+ EXPORT_SYMBOL(down_read_non_owner);
--- /dev/null
+From 18f3e95b90b28318ef35910d21c39908de672331 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Tue, 12 Jun 2018 17:54:42 +0800
+Subject: MIPS: io: Add barrier after register read in inX()
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 18f3e95b90b28318ef35910d21c39908de672331 upstream.
+
+While a barrier is present in the outX() functions before the register
+write, a similar barrier is missing in the inX() functions after the
+register read. This could allow memory accesses following inX() to
+observe stale data.
+
+This patch is very similar to commit a1cc7034e33d12dc1 ("MIPS: io: Add
+barrier after register read in readX()"). Because war_io_reorder_wmb()
+is both used by writeX() and outX(), if readX() need a barrier then so
+does inX().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Patchwork: https://patchwork.linux-mips.org/patch/19516/
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: James Hogan <james.hogan@mips.com>
+Cc: linux-mips@linux-mips.org
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: Huacai Chen <chenhuacai@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/io.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -414,6 +414,8 @@ static inline type pfx##in##bwlq##p(unsi
+ __val = *__addr; \
+ slow; \
+ \
++ /* prevent prefetching of coherent DMA data prematurely */ \
++ rmb(); \
+ return pfx##ioswab##bwlq(__addr, __val); \
+ }
+
--- /dev/null
+From 326345f995a83e326fa2e01d54bfa9a6a307bd4d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sat, 26 May 2018 19:12:51 +0200
+Subject: MIPS: pb44: Fix i2c-gpio GPIO descriptor table
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 326345f995a83e326fa2e01d54bfa9a6a307bd4d upstream.
+
+I used bad names in my clumsiness when rewriting many board
+files to use GPIO descriptors instead of platform data. A few
+had the platform_device ID set to -1 which would indeed give
+the device name "i2c-gpio".
+
+But several had it set to >=0 which gives the names
+"i2c-gpio.0", "i2c-gpio.1" ...
+
+Fix the one affected board in the MIPS tree. Sorry.
+
+Fixes: b2e63555592f ("i2c: gpio: Convert to use descriptors")
+Reported-by: Simon Guinot <simon.guinot@sequanux.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Wolfram Sang <wsa@the-dreams.de>
+Cc: Simon Guinot <simon.guinot@sequanux.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.15+
+Patchwork: https://patchwork.linux-mips.org/patch/19387/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/ath79/mach-pb44.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/ath79/mach-pb44.c
++++ b/arch/mips/ath79/mach-pb44.c
+@@ -34,7 +34,7 @@
+ #define PB44_KEYS_DEBOUNCE_INTERVAL (3 * PB44_KEYS_POLL_INTERVAL)
+
+ static struct gpiod_lookup_table pb44_i2c_gpiod_table = {
+- .dev_id = "i2c-gpio",
++ .dev_id = "i2c-gpio.0",
+ .table = {
+ GPIO_LOOKUP_IDX("ath79-gpio", PB44_GPIO_I2C_SDA,
+ NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
--- /dev/null
+From 702d1e81feae70aa16ca364b4d2d95ccad801022 Mon Sep 17 00:00:00 2001
+From: Terry Zhou <bjzhou@marvell.com>
+Date: Wed, 23 May 2018 10:44:05 +0200
+Subject: pinctrl: armada-37xx: Fix spurious irq management
+
+From: Terry Zhou <bjzhou@marvell.com>
+
+commit 702d1e81feae70aa16ca364b4d2d95ccad801022 upstream.
+
+Until now, if we found spurious irq in irq_handler, we only updated the
+status in register but not the status in the code. Due to this the system
+will got stuck dues to the infinite loop
+
+[gregory.clement@bootlin.com: update comment and add fix and stable tags]
+Fixes: 30ac0d3b0702 ("pinctrl: armada-37xx: Add edge both type gpio irq support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Terry Zhou <bjzhou@marvell.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -679,12 +679,13 @@ static void armada_37xx_irq_handler(stru
+ writel(1 << hwirq,
+ info->base +
+ IRQ_STATUS + 4 * i);
+- continue;
++ goto update_status;
+ }
+ }
+
+ generic_handle_irq(virq);
+
++update_status:
+ /* Update status in case a new IRQ appears */
+ spin_lock_irqsave(&info->irq_lock, flags);
+ status = readl_relaxed(info->base +
--- /dev/null
+From bc3322bc166a2905bc91f774d7b22773dc7c063a Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Thu, 7 Jun 2018 13:51:33 -0300
+Subject: pinctrl: devicetree: Fix pctldev pointer overwrite
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+commit bc3322bc166a2905bc91f774d7b22773dc7c063a upstream.
+
+Commit b89405b6102f ("pinctrl: devicetree: Fix dt_to_map_one_config
+handling of hogs") causes the pinctrl hog pins to not get initialized
+on i.MX platforms leaving them with the IOMUX settings untouched.
+
+This causes several regressions on i.MX such as:
+
+- OV5640 camera driver can not be probed anymore on imx6qdl-sabresd
+because the camera clock pin is in a pinctrl_hog group and since
+its pinctrl initialization is skipped, the camera clock is kept
+in GPIO functionality instead of CLK_CKO function.
+
+- Audio stopped working on imx6qdl-wandboard and imx53-qsb for
+the same reason.
+
+Richard Fitzgerald explains the problem:
+
+"I see the bug. If the hog node isn't a 1st level child of the pinctrl
+parent node it will go around the for(;;) loop again but on the first
+pass I overwrite pctldev with the result of
+get_pinctrl_dev_from_of_node() so it doesn't point to the pinctrl driver
+any more."
+
+Fix the issue by stashing the original pctldev so it doesn't
+get overwritten.
+
+Fixes: b89405b6102f ("pinctrl: devicetree: Fix dt_to_map_one_config handling of hogs")
+Cc: <stable@vger.kernel.org>
+Reported-by: Mika Penttilä <mika.penttila@nextfour.com>
+Reported-by: Steve Longerbeam <slongerbeam@gmail.com>
+Suggested-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/devicetree.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -101,10 +101,11 @@ struct pinctrl_dev *of_pinctrl_get(struc
+ }
+
+ static int dt_to_map_one_config(struct pinctrl *p,
+- struct pinctrl_dev *pctldev,
++ struct pinctrl_dev *hog_pctldev,
+ const char *statename,
+ struct device_node *np_config)
+ {
++ struct pinctrl_dev *pctldev = NULL;
+ struct device_node *np_pctldev;
+ const struct pinctrl_ops *ops;
+ int ret;
+@@ -123,8 +124,10 @@ static int dt_to_map_one_config(struct p
+ return -EPROBE_DEFER;
+ }
+ /* If we're creating a hog we can use the passed pctldev */
+- if (pctldev && (np_pctldev == p->dev->of_node))
++ if (hog_pctldev && (np_pctldev == p->dev->of_node)) {
++ pctldev = hog_pctldev;
+ break;
++ }
+ pctldev = get_pinctrl_dev_from_of_node(np_pctldev);
+ if (pctldev)
+ break;
--- /dev/null
+From 5cf9a338db94cfd570aa2607bef1b30996f188e3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pawe=C5=82=20Chmiel?= <pawel.mikolaj.chmiel@gmail.com>
+Date: Mon, 16 Apr 2018 17:52:45 +0200
+Subject: pinctrl: samsung: Correct EINTG banks order
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+commit 5cf9a338db94cfd570aa2607bef1b30996f188e3 upstream.
+
+All banks with GPIO interrupts should be at beginning of bank array and
+without any other types of banks between them. This order is expected
+by exynos_eint_gpio_irq, when doing interrupt group to bank translation.
+Otherwise, kernel NULL pointer dereference would happen when trying to
+handle interrupt, due to wrong bank being looked up. Observed on
+s5pv210, when trying to handle gpj0 interrupt, where kernel was mapping
+it to gpi bank.
+
+Cc: stable@vger.kernel.org
+Fixes: 023e06dfa688 ("pinctrl: exynos: add exynos5410 SoC specific data")
+Fixes: 608a26a7bc04 ("pinctrl: Add s5pv210 support to pinctrl-exynos)
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Reviewed-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-exynos-arm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+@@ -105,12 +105,12 @@ static const struct samsung_pin_bank_dat
+ EXYNOS_PIN_BANK_EINTG(7, 0x1c0, "gpg1", 0x38),
+ EXYNOS_PIN_BANK_EINTG(7, 0x1e0, "gpg2", 0x3c),
+ EXYNOS_PIN_BANK_EINTG(7, 0x200, "gpg3", 0x40),
+- EXYNOS_PIN_BANK_EINTN(7, 0x220, "gpi"),
+ EXYNOS_PIN_BANK_EINTG(8, 0x240, "gpj0", 0x44),
+ EXYNOS_PIN_BANK_EINTG(6, 0x260, "gpj1", 0x48),
+ EXYNOS_PIN_BANK_EINTG(8, 0x280, "gpj2", 0x4c),
+ EXYNOS_PIN_BANK_EINTG(8, 0x2a0, "gpj3", 0x50),
+ EXYNOS_PIN_BANK_EINTG(5, 0x2c0, "gpj4", 0x54),
++ EXYNOS_PIN_BANK_EINTN(7, 0x220, "gpi"),
+ EXYNOS_PIN_BANK_EINTN(8, 0x2e0, "mp01"),
+ EXYNOS_PIN_BANK_EINTN(4, 0x300, "mp02"),
+ EXYNOS_PIN_BANK_EINTN(8, 0x320, "mp03"),
+@@ -630,7 +630,6 @@ static const struct samsung_pin_bank_dat
+ EXYNOS_PIN_BANK_EINTG(4, 0x100, "gpc3", 0x20),
+ EXYNOS_PIN_BANK_EINTG(7, 0x120, "gpc1", 0x24),
+ EXYNOS_PIN_BANK_EINTG(7, 0x140, "gpc2", 0x28),
+- EXYNOS_PIN_BANK_EINTN(2, 0x160, "gpm5"),
+ EXYNOS_PIN_BANK_EINTG(8, 0x180, "gpd1", 0x2c),
+ EXYNOS_PIN_BANK_EINTG(8, 0x1A0, "gpe0", 0x30),
+ EXYNOS_PIN_BANK_EINTG(2, 0x1C0, "gpe1", 0x34),
+@@ -641,6 +640,7 @@ static const struct samsung_pin_bank_dat
+ EXYNOS_PIN_BANK_EINTG(2, 0x260, "gpg2", 0x48),
+ EXYNOS_PIN_BANK_EINTG(4, 0x280, "gph0", 0x4c),
+ EXYNOS_PIN_BANK_EINTG(8, 0x2A0, "gph1", 0x50),
++ EXYNOS_PIN_BANK_EINTN(2, 0x160, "gpm5"),
+ EXYNOS_PIN_BANK_EINTN(8, 0x2C0, "gpm7"),
+ EXYNOS_PIN_BANK_EINTN(6, 0x2E0, "gpy0"),
+ EXYNOS_PIN_BANK_EINTN(4, 0x300, "gpy1"),
pci-add-acs-quirk-for-intel-300-series.patch
pci-pciehp-clear-presence-detect-and-data-link-layer-status-changed-on-resume.patch
pci-account-for-all-bridges-on-bus-when-distributing-bus-numbers.patch
+auxdisplay-fix-broken-menu.patch
+pinctrl-armada-37xx-fix-spurious-irq-management.patch
+pinctrl-samsung-correct-eintg-banks-order.patch
+pinctrl-devicetree-fix-pctldev-pointer-overwrite.patch
+cpufreq-intel_pstate-fix-scaling-max-min-limits-with-turbo-3.0.patch
+mips-pb44-fix-i2c-gpio-gpio-descriptor-table.patch
+mips-io-add-barrier-after-register-read-in-inx.patch
+time-make-sure-jiffies_to_msecs-preserves-non-zero-time-periods.patch
+irqchip-gic-v3-its-don-t-bind-lpi-to-unavailable-numa-node.patch
+locking-rwsem-fix-up_read_non_owner-warning-with-debug_rwsems.patch
+x.509-unpack-rsa-signaturevalue-field-from-bit-string.patch
+btrfs-fix-return-value-on-rename-exchange-failure.patch
+iio-adc-ad7791-remove-sample-freq-sysfs-attributes.patch
+iio-sca3000-fix-an-error-handling-path-in-sca3000_probe.patch
--- /dev/null
+From abcbcb80cd09cd40f2089d912764e315459b71f7 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Fri, 22 Jun 2018 16:33:57 +0200
+Subject: time: Make sure jiffies_to_msecs() preserves non-zero time periods
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit abcbcb80cd09cd40f2089d912764e315459b71f7 upstream.
+
+For the common cases where 1000 is a multiple of HZ, or HZ is a multiple of
+1000, jiffies_to_msecs() never returns zero when passed a non-zero time
+period.
+
+However, if HZ > 1000 and not an integer multiple of 1000 (e.g. 1024 or
+1200, as used on alpha and DECstation), jiffies_to_msecs() may return zero
+for small non-zero time periods. This may break code that relies on
+receiving back a non-zero value.
+
+jiffies_to_usecs() does not need such a fix: one jiffy can only be less
+than one µs if HZ > 1000000, and such large values of HZ are already
+rejected at build time, twice:
+
+ - include/linux/jiffies.h does #error if HZ >= 12288,
+ - kernel/time/time.c has BUILD_BUG_ON(HZ > USEC_PER_SEC).
+
+Broken since forever.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: linux-alpha@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180622143357.7495-1-geert@linux-m68k.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/time.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -28,6 +28,7 @@
+ */
+
+ #include <linux/export.h>
++#include <linux/kernel.h>
+ #include <linux/timex.h>
+ #include <linux/capability.h>
+ #include <linux/timekeeper_internal.h>
+@@ -314,9 +315,10 @@ unsigned int jiffies_to_msecs(const unsi
+ return (j + (HZ / MSEC_PER_SEC) - 1)/(HZ / MSEC_PER_SEC);
+ #else
+ # if BITS_PER_LONG == 32
+- return (HZ_TO_MSEC_MUL32 * j) >> HZ_TO_MSEC_SHR32;
++ return (HZ_TO_MSEC_MUL32 * j + (1ULL << HZ_TO_MSEC_SHR32) - 1) >>
++ HZ_TO_MSEC_SHR32;
+ # else
+- return (j * HZ_TO_MSEC_NUM) / HZ_TO_MSEC_DEN;
++ return DIV_ROUND_UP(j * HZ_TO_MSEC_NUM, HZ_TO_MSEC_DEN);
+ # endif
+ #endif
+ }
--- /dev/null
+From b65c32ec5a942ab3ada93a048089a938918aba7f Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
+Date: Sat, 19 May 2018 14:23:54 +0200
+Subject: X.509: unpack RSA signatureValue field from BIT STRING
+
+From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+
+commit b65c32ec5a942ab3ada93a048089a938918aba7f upstream.
+
+The signatureValue field of a X.509 certificate is encoded as a BIT STRING.
+For RSA signatures this BIT STRING is of so-called primitive subtype, which
+contains a u8 prefix indicating a count of unused bits in the encoding.
+
+We have to strip this prefix from signature data, just as we already do for
+key data in x509_extract_key_data() function.
+
+This wasn't noticed earlier because this prefix byte is zero for RSA key
+sizes divisible by 8. Since BIT STRING is a big-endian encoding adding zero
+prefixes has no bearing on its value.
+
+The signature length, however was incorrect, which is a problem for RSA
+implementations that need it to be exactly correct (like AMD CCP).
+
+Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Fixes: c26fd69fa009 ("X.509: Add a crypto key parser for binary (DER) X.509 certificates")
+Cc: stable@vger.kernel.org
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -249,6 +249,15 @@ int x509_note_signature(void *context, s
+ return -EINVAL;
+ }
+
++ if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0) {
++ /* Discard the BIT STRING metadata */
++ if (vlen < 1 || *(const u8 *)value != 0)
++ return -EBADMSG;
++
++ value++;
++ vlen--;
++ }
++
+ ctx->cert->raw_sig = value;
+ ctx->cert->raw_sig_size = vlen;
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
