Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2018-06-23 07:05:48 +0200
committerKernel Build Daemon <kbuild@suse.de>2018-06-23 07:05:48 +0200
commit445f0dbc125c5ef2f3784d29a6f764f251ceb57d (patch)
tree096a874cad7d3b7752579f2e66faee26ac9cb8f2
parent75f7ece999d647b5059fd70b90d9dc03a6dfcbf4 (diff)
parent3ef33e7efb5f98ba21555251b9c259d1cd0069d4 (diff)
Merge branch 'SLE15' into SLE15-AZURErpm-4.12.14-5.5--sle15-updatesrpm-4.12.14-5.5
-rw-r--r--patches.drivers/0001-md-fix-two-problems-with-setting-the-re-add-device-s.patch67
-rw-r--r--patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch3
-rw-r--r--patches.drivers/0001-raid10-check-bio-in-r10buf_pool_free-to-void-NULL-po.patch70
-rw-r--r--patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70122
-rw-r--r--patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref6
-rw-r--r--patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref251
-rw-r--r--patches.drivers/Input-atmel_mxt_ts-fix-the-firmware-update416
-rw-r--r--patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I36
-rw-r--r--patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr36
-rw-r--r--patches.drivers/Input-synaptics-rmi4-fix-an-unchecked-out-of-memory-44
-rw-r--r--patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs39
-rw-r--r--patches.drivers/Input-xpad-add-support-for-PDP-Xbox-One-controllers10
-rw-r--r--patches.drivers/Input-xpad-sync-supported-devices-with-360Controller206
-rw-r--r--patches.drivers/Input-xpad-sync-supported-devices-with-XBCD149
-rw-r--r--patches.drivers/be2net-Fix-HW-stall-issue-in-Lancer.patch33
-rw-r--r--patches.drivers/be2net-Handle-transmit-completion-errors-in-Lancer.patch219
-rw-r--r--patches.drivers/crypto-caam-fix-DMA-mapping-dir-for-generated-IV168
-rw-r--r--patches.drivers/crypto-caam-fix-IV-DMA-mapping-and-updating468
-rw-r--r--patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer137
-rw-r--r--patches.drivers/crypto-omap-sham-fix-memleak39
-rw-r--r--patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS38
-rw-r--r--patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini78
-rw-r--r--patches.drivers/drm-amdkfd-fix-clock-counter-retrieval-for-node-with52
-rw-r--r--patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create55
-rw-r--r--patches.drivers/drm-msm-dsi-use-correct-enum-in-dsi_get_cmd_fmt43
-rw-r--r--patches.drivers/drm-omap-fix-possible-NULL-ref-issue-in-tiler_reserv42
-rw-r--r--patches.drivers/drm-omap-fix-uninitialized-ret-variable53
-rw-r--r--patches.drivers/drm-omap-handle-alloc-failures-in-omap_connector60
-rw-r--r--patches.drivers/drm-omap-silence-unititialized-variable-warning40
-rw-r--r--patches.drivers/emulex-benet-Constify-be_misconfig_evt_port_state.patch47
-rw-r--r--patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch1150
-rw-r--r--patches.drivers/gpio-No-NULL-owner49
-rw-r--r--patches.drivers/gpio-fix-aspeed_gpio-unmask-irq36
-rw-r--r--patches.drivers/mac80211-Adjust-SAE-authentication-timeout81
-rw-r--r--patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead63
-rw-r--r--patches.drivers/staging-wilc1000-Fix-bssid-buffer-offset-in-Txq39
-rw-r--r--patches.fixes/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch281
-rw-r--r--patches.fixes/ceph-fix-alignment-of-rasize.patch35
-rw-r--r--patches.fixes/ceph-fix-use-after-free-in-ceph_statfs.patch109
-rw-r--r--patches.fixes/ceph-fix-wrong-check-for-the-case-of-updating-link-count.patch41
-rw-r--r--patches.fixes/ceph-prevent-i_version-from-going-back.patch28
-rw-r--r--patches.fixes/ceph-support-file-lock-on-directory.patch29
-rw-r--r--patches.fixes/f2fs-fix-a-panic-caused-by-null-flush_cmd_control.patch47
-rw-r--r--patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch44
-rw-r--r--patches.fixes/mm-swap-fix-false-error-message-in-_swp_swapcount.patch89
-rw-r--r--patches.fixes/xen-dont-print-error-message-in-case-og-missing-xenstore-entry.patch45
-rw-r--r--patches.kabi/bpf-prevent-memory-disambiguation-attack.patch2
-rw-r--r--patches.kabi/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch25
-rw-r--r--patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch170
-rw-r--r--patches.suse/bpf-prevent-memory-disambiguation-attack.patch10
-rw-r--r--patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch75
-rw-r--r--patches.suse/btrfs-fix-copy_items-return-value-when-logging-an-inode.patch42
-rw-r--r--patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch80
-rw-r--r--patches.suse/btrfs-return-error-value-if-create_io_em-failed-in-cow_file_range.patch40
-rw-r--r--patches.suse/ext4-unsupported-features.patch4
-rw-r--r--series.conf57
56 files changed, 5477 insertions, 21 deletions
diff --git a/patches.drivers/0001-md-fix-two-problems-with-setting-the-re-add-device-s.patch b/patches.drivers/0001-md-fix-two-problems-with-setting-the-re-add-device-s.patch
new file mode 100644
index 0000000000..fd966b8570
--- /dev/null
+++ b/patches.drivers/0001-md-fix-two-problems-with-setting-the-re-add-device-s.patch
@@ -0,0 +1,67 @@
+From 011abdc9df559ec75779bb7c53a744c69b2a94c6 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Thu, 26 Apr 2018 14:46:29 +1000
+Subject: [PATCH] md: fix two problems with setting the "re-add" device state.
+Git-commit: 011abdc9df559ec75779bb7c53a744c69b2a94c6
+Patch-mainline: v4.18-rc1
+References: bsc#1098176
+
+If "re-add" is written to the "state" file for a device
+which is faulty, this has an effect similar to removing
+and re-adding the device. It should take up the
+same slot in the array that it previously had, and
+an accelerated (e.g. bitmap-based) rebuild should happen.
+
+The slot that "it previously had" is determined by
+rdev->saved_raid_disk.
+However this is not set when a device fails (only when a device
+is added), and it is cleared when resync completes.
+This means that "re-add" will normally work once, but may not work a
+second time.
+
+This patch includes two fixes.
+1/ when a device fails, record the ->raid_disk value in
+ ->saved_raid_disk before clearing ->raid_disk
+2/ when "re-add" is written to a device for which
+ ->saved_raid_disk is not set, fail.
+
+I think this is suitable for stable as it can
+cause re-adding a device to be forced to do a full
+resync which takes a lot longer and so puts data at
+more risk.
+
+Cc: <stable@vger.kernel.org> (v4.1)
+Fixes: 97f6cd39da22 ("md-cluster: re-add capabilities")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+---
+ drivers/md/md.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index c208c01f63a5..bac480d75d1d 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2853,7 +2853,8 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
+ err = 0;
+ }
+ } else if (cmd_match(buf, "re-add")) {
+- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1)) {
++ if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++ rdev->saved_raid_disk >= 0) {
+ /* clear_bit is performed _after_ all the devices
+ * have their local Faulty bit cleared. If any writes
+ * happen in the meantime in the local node, they
+@@ -8641,6 +8642,7 @@ static int remove_and_add_spares(struct mddev *mddev,
+ if (mddev->pers->hot_remove_disk(
+ mddev, rdev) == 0) {
+ sysfs_unlink_rdev(mddev, rdev);
++ rdev->saved_raid_disk = rdev->raid_disk;
+ rdev->raid_disk = -1;
+ removed++;
+ }
+--
+2.13.1
+
diff --git a/patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch b/patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
index 03cc3a254c..499640f3a0 100644
--- a/patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
+++ b/patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
@@ -4,9 +4,8 @@ X-Patchwork-Id: 10450567
Date: Sat, 24 Mar 2018 16:15:30 -0700
Subject: [PATCH] qla2xxx: Mask off Scope bits in retry delay.
References: bsc#1068054
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
Git-commit: 3cedc8797b9c0f2222fd45a01f849c57c088828b
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v4.18-rc1
From: Anil Gurumurthy <anil.gurumurthy@cavium.com>
Some newer target uses "Status Qualifier" response in a returned
diff --git a/patches.drivers/0001-raid10-check-bio-in-r10buf_pool_free-to-void-NULL-po.patch b/patches.drivers/0001-raid10-check-bio-in-r10buf_pool_free-to-void-NULL-po.patch
new file mode 100644
index 0000000000..d4af3e0a7b
--- /dev/null
+++ b/patches.drivers/0001-raid10-check-bio-in-r10buf_pool_free-to-void-NULL-po.patch
@@ -0,0 +1,70 @@
+From eb81b328267b2d97d11441483f5ac9dccb505818 Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Thu, 26 Apr 2018 10:56:37 +0800
+Subject: [PATCH] raid10: check bio in r10buf_pool_free to void NULL pointer
+ dereference
+Git-commit: eb81b328267b2d97d11441483f5ac9dccb505818
+Patch-mainline: v4.18-rc1
+References: bsc#1098174
+
+For recovery case, r10buf_pool_alloc only allocates 2 bios,
+so we can't access more than 2 bios in r10buf_pool_free.
+Otherwise, we can see NULL pointer dereference as follows:
+
+[ 98.347009] BUG: unable to handle kernel NULL pointer dereference
+at 0000000000000050
+[ 98.355783] IP: r10buf_pool_free+0x38/0xe0 [raid10]
+[...]
+[ 98.543734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 98.550161] CR2: 0000000000000050 CR3: 000000089500a001 CR4: 00000000001606f0
+[ 98.558145] Call Trace:
+[ 98.560881] <IRQ>
+[ 98.563136] put_buf+0x19/0x20 [raid10]
+[ 98.567426] end_sync_request+0x6b/0x70 [raid10]
+[ 98.572591] end_sync_write+0x9b/0x160 [raid10]
+[ 98.577662] blk_update_request+0x78/0x2c0
+[ 98.582254] scsi_end_request+0x2c/0x1e0 [scsi_mod]
+[ 98.587719] scsi_io_completion+0x22f/0x610 [scsi_mod]
+[ 98.593472] blk_done_softirq+0x8e/0xc0
+[ 98.597767] __do_softirq+0xde/0x2b3
+[ 98.601770] irq_exit+0xae/0xb0
+[ 98.605285] do_IRQ+0x81/0xd0
+[ 98.608606] common_interrupt+0x7d/0x7d
+[ 98.612898] </IRQ>
+
+So we need to check the bio is valid or not before the bio is
+used in r10buf_pool_free. Another workable way is to free 2 bios
+for recovery case just like r10buf_pool_alloc.
+
+Fixes: f0250618361d ("md: raid10: don't use bio's vec table to manage resync pages")
+Reported-by: Alexis Castilla <pencerval@gmail.com>
+Tested-by: Alexis Castilla <pencerval@gmail.com>
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+---
+ drivers/md/raid10.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 64300542ab20..976ef8cae64c 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -255,9 +255,11 @@ static void r10buf_pool_free(void *__r10_bio, void *data)
+ for (j = conf->copies; j--; ) {
+ struct bio *bio = r10bio->devs[j].bio;
+
+- rp = get_resync_pages(bio);
+- resync_free_pages(rp);
+- bio_put(bio);
++ if (bio) {
++ rp = get_resync_pages(bio);
++ resync_free_pages(rp);
++ bio_put(bio);
++ }
+
+ bio = r10bio->devs[j].repl_bio;
+ if (bio)
+--
+2.13.1
+
diff --git a/patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70 b/patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70
new file mode 100644
index 0000000000..0446c0c50e
--- /dev/null
+++ b/patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70
@@ -0,0 +1,122 @@
+From a0a37862a4e1844793d39aca9ccb8fecbdcb8659 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 23 Apr 2018 14:16:03 +0300
+Subject: [PATCH] ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70
+Git-commit: a0a37862a4e1844793d39aca9ccb8fecbdcb8659
+Patch-mainline: v4.17-rc3
+References: bsc#1051510
+
+WDAT table on Lenovo Z50-70 is using RTC SRAM (ports 0x70 and 0x71) to
+store state of the timer. This conflicts with Linux RTC driver
+(rtc-cmos.c) who fails to reserve those ports for itself preventing RTC
+from functioning. In addition the WDAT table seems not to be fully
+functional because it does not reset the system when the watchdog times
+out.
+
+On this system iTCO_wdt works just fine so we simply prefer to use it
+instead of WDAT. This makes RTC working again and also results working
+watchdog via iTCO_wdt.
+
+Reported-by: Peter Milley <pbmilley@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199033
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/acpi/acpi_watchdog.c | 59 ++++++++++++++++++++++++++++++------
+ 1 file changed, 49 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
+index ebb626ffb5fa..4bde16fb97d8 100644
+--- a/drivers/acpi/acpi_watchdog.c
++++ b/drivers/acpi/acpi_watchdog.c
+@@ -12,23 +12,64 @@
+ #define pr_fmt(fmt) "ACPI: watchdog: " fmt
+
+ #include <linux/acpi.h>
++#include <linux/dmi.h>
+ #include <linux/ioport.h>
+ #include <linux/platform_device.h>
+
+ #include "internal.h"
+
++static const struct dmi_system_id acpi_watchdog_skip[] = {
++ {
++ /*
++ * On Lenovo Z50-70 there are two issues with the WDAT
++ * table. First some of the instructions use RTC SRAM
++ * to store persistent information. This does not work well
++ * with Linux RTC driver. Second, more important thing is
++ * that the instructions do not actually reset the system.
++ *
++ * On this particular system iTCO_wdt seems to work just
++ * fine so we prefer that over WDAT for now.
++ *
++ * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
++ */
++ .ident = "Lenovo Z50-70",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "20354"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"),
++ },
++ },
++ {}
++};
++
++static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
++{
++ const struct acpi_table_wdat *wdat = NULL;
++ acpi_status status;
++
++ if (acpi_disabled)
++ return NULL;
++
++ if (dmi_check_system(acpi_watchdog_skip))
++ return NULL;
++
++ status = acpi_get_table(ACPI_SIG_WDAT, 0,
++ (struct acpi_table_header **)&wdat);
++ if (ACPI_FAILURE(status)) {
++ /* It is fine if there is no WDAT */
++ return NULL;
++ }
++
++ return wdat;
++}
++
+ /**
+ * Returns true if this system should prefer ACPI based watchdog instead of
+ * the native one (which are typically the same hardware).
+ */
+ bool acpi_has_watchdog(void)
+ {
+- struct acpi_table_header hdr;
+-
+- if (acpi_disabled)
+- return false;
+-
+- return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr));
++ return !!acpi_watchdog_get_wdat();
+ }
+ EXPORT_SYMBOL_GPL(acpi_has_watchdog);
+
+@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void)
+ struct platform_device *pdev;
+ struct resource *resources;
+ size_t nresources = 0;
+- acpi_status status;
+ int i;
+
+- status = acpi_get_table(ACPI_SIG_WDAT, 0,
+- (struct acpi_table_header **)&wdat);
+- if (ACPI_FAILURE(status)) {
++ wdat = acpi_watchdog_get_wdat();
++ if (!wdat) {
+ /* It is fine if there is no WDAT */
+ return;
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref b/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref
index ad9717ee2b..d028f41b6c 100644
--- a/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref
+++ b/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref
@@ -18,7 +18,7 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
-@@ -491,7 +491,7 @@ static void remove_widget(struct snd_soc
+@@ -494,7 +494,7 @@ static void remove_widget(struct snd_soc
*/
if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) {
/* enumerated widget mixer */
@@ -27,8 +27,8 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
struct snd_kcontrol *kcontrol = w->kcontrols[i];
struct soc_enum *se =
(struct soc_enum *)kcontrol->private_value;
-@@ -509,7 +509,7 @@ static void remove_widget(struct snd_soc
- kfree(w->kcontrol_news);
+@@ -511,7 +511,7 @@ static void remove_widget(struct snd_soc
+ }
} else {
/* volume mixer or bytes controls */
- for (i = 0; i < w->num_kcontrols; i++) {
diff --git a/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref2 b/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref2
new file mode 100644
index 0000000000..fc6c3a1d0b
--- /dev/null
+++ b/patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref2
@@ -0,0 +1,51 @@
+From 05bdcf12905533b8628627b6634608cd3b57c607 Mon Sep 17 00:00:00 2001
+From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Date: Wed, 14 Mar 2018 20:42:40 +0000
+Subject: [PATCH] ASoC: topology: Check widget kcontrols before deref.
+Git-commit: 05bdcf12905533b8628627b6634608cd3b57c607
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Validate the topology input before we dereference the pointer.
+
+Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-topology.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -485,6 +485,9 @@ static void remove_widget(struct snd_soc
+ if (dobj->ops && dobj->ops->widget_unload)
+ dobj->ops->widget_unload(comp, dobj);
+
++ if (!w->kcontrols)
++ goto free_news;
++
+ /*
+ * Dynamic Widgets either have 1..N enum kcontrols or mixers.
+ * The enum may either have an array of values or strings.
+@@ -506,7 +509,6 @@ static void remove_widget(struct snd_soc
+ kfree(se);
+ kfree(w->kcontrol_news[i].name);
+ }
+- kfree(w->kcontrol_news);
+ } else {
+ /* volume mixer or bytes controls */
+ for (i = 0; i < w->num_kcontrols; i++) {
+@@ -524,8 +526,11 @@ static void remove_widget(struct snd_soc
+ snd_ctl_remove(card, kcontrol);
+ kfree(w->kcontrol_news[i].name);
+ }
+- kfree(w->kcontrol_news);
+ }
++
++free_news:
++ kfree(w->kcontrol_news);
++
+ /* widget w is freed by soc-dapm.c */
+ }
+
diff --git a/patches.drivers/Input-atmel_mxt_ts-fix-the-firmware-update b/patches.drivers/Input-atmel_mxt_ts-fix-the-firmware-update
new file mode 100644
index 0000000000..faa753c3cd
--- /dev/null
+++ b/patches.drivers/Input-atmel_mxt_ts-fix-the-firmware-update
@@ -0,0 +1,416 @@
+From 068bdb67ef74df0ad1627b7247a163e3e252ac11 Mon Sep 17 00:00:00 2001
+From: Nick Dyer <nick@shmanahar.org>
+Date: Tue, 1 May 2018 11:40:18 -0700
+Subject: [PATCH] Input: atmel_mxt_ts - fix the firmware update
+Git-commit: 068bdb67ef74df0ad1627b7247a163e3e252ac11
+Patch-mainline: v4.17-rc4
+References: bsc#1051510
+
+The automatic update mechanism will trigger an update if the
+info block CRCs are different between maxtouch configuration
+file (maxtouch.cfg) and chip.
+
+The driver compared the CRCs without retrieving the chip CRC,
+resulting always in a failure and firmware flashing action
+triggered. Fix this issue by retrieving the chip info block
+CRC before the check.
+
+Note that this solution has the benefit that by reading the
+information block and the object table into a contiguous region
+of memory, we can verify the checksum at probe time. This means
+we make sure that we are indeed talking to a chip that supports
+object protocol correctly.
+
+Using this patch on a kevin chromebook, the touchscreen and
+touchpad drivers are able to match the CRC:
+
+ atmel_mxt_ts 3-004b: Family: 164 Variant: 14 Firmware V2.3.AA Objects: 40
+ atmel_mxt_ts 5-004a: Family: 164 Variant: 17 Firmware V2.0.AA Objects: 31
+ atmel_mxt_ts 3-004b: Resetting device
+ atmel_mxt_ts 5-004a: Resetting device
+ atmel_mxt_ts 3-004b: Config CRC 0x573E89: OK
+ atmel_mxt_ts 3-004b: Touchscreen size X4095Y2729
+ input: Atmel maXTouch Touchscreen as /devices/platform/ff130000.i2c/i2c-3/3-004b/input/input5
+ atmel_mxt_ts 5-004a: Config CRC 0x0AF6BA: OK
+ atmel_mxt_ts 5-004a: Touchscreen size X1920Y1080
+ input: Atmel maXTouch Touchpad as /devices/platform/ff140000.i2c/i2c-5/5-004a/input/input6
+
+Signed-off-by: Nick Dyer <nick.dyer@shmanahar.org>
+Acked-by: Benson Leung <bleung@chromium.org>
+[ezequiel: minor patch massage]
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Tested-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/touchscreen/atmel_mxt_ts.c | 186 ++++++++++++++---------
+ 1 file changed, 110 insertions(+), 76 deletions(-)
+
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index 429b694405c7..fc149ea64be7 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -275,7 +275,8 @@ struct mxt_data {
+ char phys[64]; /* device physical location */
+ const struct mxt_platform_data *pdata;
+ struct mxt_object *object_table;
+- struct mxt_info info;
++ struct mxt_info *info;
++ void *raw_info_block;
+ unsigned int irq;
+ unsigned int max_x;
+ unsigned int max_y;
+@@ -450,12 +451,13 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
+ {
+ u8 appmode = data->client->addr;
+ u8 bootloader;
++ u8 family_id = data->info ? data->info->family_id : 0;
+
+ switch (appmode) {
+ case 0x4a:
+ case 0x4b:
+ /* Chips after 1664S use different scheme */
+- if (retry || data->info.family_id >= 0xa2) {
++ if (retry || family_id >= 0xa2) {
+ bootloader = appmode - 0x24;
+ break;
+ }
+@@ -682,7 +684,7 @@ mxt_get_object(struct mxt_data *data, u8 type)
+ struct mxt_object *object;
+ int i;
+
+- for (i = 0; i < data->info.object_num; i++) {
++ for (i = 0; i < data->info->object_num; i++) {
+ object = data->object_table + i;
+ if (object->type == type)
+ return object;
+@@ -1453,12 +1455,12 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
+ data_pos += offset;
+ }
+
+- if (cfg_info.family_id != data->info.family_id) {
++ if (cfg_info.family_id != data->info->family_id) {
+ dev_err(dev, "Family ID mismatch!\n");
+ return -EINVAL;
+ }
+
+- if (cfg_info.variant_id != data->info.variant_id) {
++ if (cfg_info.variant_id != data->info->variant_id) {
+ dev_err(dev, "Variant ID mismatch!\n");
+ return -EINVAL;
+ }
+@@ -1503,7 +1505,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
+
+ /* Malloc memory to store configuration */
+ cfg_start_ofs = MXT_OBJECT_START +
+- data->info.object_num * sizeof(struct mxt_object) +
++ data->info->object_num * sizeof(struct mxt_object) +
+ MXT_INFO_CHECKSUM_SIZE;
+ config_mem_size = data->mem_size - cfg_start_ofs;
+ config_mem = kzalloc(config_mem_size, GFP_KERNEL);
+@@ -1554,20 +1556,6 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
+ return ret;
+ }
+
+-static int mxt_get_info(struct mxt_data *data)
+-{
+- struct i2c_client *client = data->client;
+- struct mxt_info *info = &data->info;
+- int error;
+-
+- /* Read 7-byte info block starting at address 0 */
+- error = __mxt_read_reg(client, 0, sizeof(*info), info);
+- if (error)
+- return error;
+-
+- return 0;
+-}
+-
+ static void mxt_free_input_device(struct mxt_data *data)
+ {
+ if (data->input_dev) {
+@@ -1582,9 +1570,10 @@ static void mxt_free_object_table(struct mxt_data *data)
+ video_unregister_device(&data->dbg.vdev);
+ v4l2_device_unregister(&data->dbg.v4l2);
+ #endif
+-
+- kfree(data->object_table);
+ data->object_table = NULL;
++ data->info = NULL;
++ kfree(data->raw_info_block);
++ data->raw_info_block = NULL;
+ kfree(data->msg_buf);
+ data->msg_buf = NULL;
+ data->T5_address = 0;
+@@ -1600,34 +1589,18 @@ static void mxt_free_object_table(struct mxt_data *data)
+ data->max_reportid = 0;
+ }
+
+-static int mxt_get_object_table(struct mxt_data *data)
++static int mxt_parse_object_table(struct mxt_data *data,
++ struct mxt_object *object_table)
+ {
+ struct i2c_client *client = data->client;
+- size_t table_size;
+- struct mxt_object *object_table;
+- int error;
+ int i;
+ u8 reportid;
+ u16 end_address;
+
+- table_size = data->info.object_num * sizeof(struct mxt_object);
+- object_table = kzalloc(table_size, GFP_KERNEL);
+- if (!object_table) {
+- dev_err(&data->client->dev, "Failed to allocate memory\n");
+- return -ENOMEM;
+- }
+-
+- error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
+- object_table);
+- if (error) {
+- kfree(object_table);
+- return error;
+- }
+-
+ /* Valid Report IDs start counting from 1 */
+ reportid = 1;
+ data->mem_size = 0;
+- for (i = 0; i < data->info.object_num; i++) {
++ for (i = 0; i < data->info->object_num; i++) {
+ struct mxt_object *object = object_table + i;
+ u8 min_id, max_id;
+
+@@ -1651,8 +1624,8 @@ static int mxt_get_object_table(struct mxt_data *data)
+
+ switch (object->type) {
+ case MXT_GEN_MESSAGE_T5:
+- if (data->info.family_id == 0x80 &&
+- data->info.version < 0x20) {
++ if (data->info->family_id == 0x80 &&
++ data->info->version < 0x20) {
+ /*
+ * On mXT224 firmware versions prior to V2.0
+ * read and discard unused CRC byte otherwise
+@@ -1707,24 +1680,102 @@ static int mxt_get_object_table(struct mxt_data *data)
+ /* If T44 exists, T5 position has to be directly after */
+ if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
+ dev_err(&client->dev, "Invalid T44 position\n");
+- error = -EINVAL;
+- goto free_object_table;
++ return -EINVAL;
+ }
+
+ data->msg_buf = kcalloc(data->max_reportid,
+ data->T5_msg_size, GFP_KERNEL);
+- if (!data->msg_buf) {
+- dev_err(&client->dev, "Failed to allocate message buffer\n");
++ if (!data->msg_buf)
++ return -ENOMEM;
++
++ return 0;
++}
++
++static int mxt_read_info_block(struct mxt_data *data)
++{
++ struct i2c_client *client = data->client;
++ int error;
++ size_t size;
++ void *id_buf, *buf;
++ uint8_t num_objects;
++ u32 calculated_crc;
++ u8 *crc_ptr;
++
++ /* If info block already allocated, free it */
++ if (data->raw_info_block)
++ mxt_free_object_table(data);
++
++ /* Read 7-byte ID information block starting at address 0 */
++ size = sizeof(struct mxt_info);
++ id_buf = kzalloc(size, GFP_KERNEL);
++ if (!id_buf)
++ return -ENOMEM;
++
++ error = __mxt_read_reg(client, 0, size, id_buf);
++ if (error)
++ goto err_free_mem;
++
++ /* Resize buffer to give space for rest of info block */
++ num_objects = ((struct mxt_info *)id_buf)->object_num;
++ size += (num_objects * sizeof(struct mxt_object))
++ + MXT_INFO_CHECKSUM_SIZE;
++
++ buf = krealloc(id_buf, size, GFP_KERNEL);
++ if (!buf) {
+ error = -ENOMEM;
+- goto free_object_table;
++ goto err_free_mem;
++ }
++ id_buf = buf;
++
++ /* Read rest of info block */
++ error = __mxt_read_reg(client, MXT_OBJECT_START,
++ size - MXT_OBJECT_START,
++ id_buf + MXT_OBJECT_START);
++ if (error)
++ goto err_free_mem;
++
++ /* Extract & calculate checksum */
++ crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
++ data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
++
++ calculated_crc = mxt_calculate_crc(id_buf, 0,
++ size - MXT_INFO_CHECKSUM_SIZE);
++
++ /*
++ * CRC mismatch can be caused by data corruption due to I2C comms
++ * issue or else device is not using Object Based Protocol (eg i2c-hid)
++ */
++ if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
++ dev_err(&client->dev,
++ "Info Block CRC error calculated=0x%06X read=0x%06X\n",
++ calculated_crc, data->info_crc);
++ error = -EIO;
++ goto err_free_mem;
++ }
++
++ data->raw_info_block = id_buf;
++ data->info = (struct mxt_info *)id_buf;
++
++ dev_info(&client->dev,
++ "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
++ data->info->family_id, data->info->variant_id,
++ data->info->version >> 4, data->info->version & 0xf,
++ data->info->build, data->info->object_num);
++
++ /* Parse object table information */
++ error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
++ if (error) {
++ dev_err(&client->dev, "Error %d parsing object table\n", error);
++ mxt_free_object_table(data);
++ goto err_free_mem;
+ }
+
+- data->object_table = object_table;
++ data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
+
+ return 0;
+
+-free_object_table:
+- mxt_free_object_table(data);
++err_free_mem:
++ kfree(id_buf);
+ return error;
+ }
+
+@@ -2039,7 +2090,7 @@ static int mxt_initialize(struct mxt_data *data)
+ int error;
+
+ while (1) {
+- error = mxt_get_info(data);
++ error = mxt_read_info_block(data);
+ if (!error)
+ break;
+
+@@ -2070,16 +2121,9 @@ static int mxt_initialize(struct mxt_data *data)
+ msleep(MXT_FW_RESET_TIME);
+ }
+
+- /* Get object table information */
+- error = mxt_get_object_table(data);
+- if (error) {
+- dev_err(&client->dev, "Error %d reading object table\n", error);
+- return error;
+- }
+-
+ error = mxt_acquire_irq(data);
+ if (error)
+- goto err_free_object_table;
++ return error;
+
+ error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
+ &client->dev, GFP_KERNEL, data,
+@@ -2087,14 +2131,10 @@ static int mxt_initialize(struct mxt_data *data)
+ if (error) {
+ dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
+ error);
+- goto err_free_object_table;
++ return error;
+ }
+
+ return 0;
+-
+-err_free_object_table:
+- mxt_free_object_table(data);
+- return error;
+ }
+
+ static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
+@@ -2155,7 +2195,7 @@ static int mxt_init_t7_power_cfg(struct mxt_data *data)
+ static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
+ unsigned int y)
+ {
+- struct mxt_info *info = &data->info;
++ struct mxt_info *info = data->info;
+ struct mxt_dbg *dbg = &data->dbg;
+ unsigned int ofs, page;
+ unsigned int col = 0;
+@@ -2483,7 +2523,7 @@ static const struct video_device mxt_video_device = {
+
+ static void mxt_debug_init(struct mxt_data *data)
+ {
+- struct mxt_info *info = &data->info;
++ struct mxt_info *info = data->info;
+ struct mxt_dbg *dbg = &data->dbg;
+ struct mxt_object *object;
+ int error;
+@@ -2569,7 +2609,6 @@ static int mxt_configure_objects(struct mxt_data *data,
+ const struct firmware *cfg)
+ {
+ struct device *dev = &data->client->dev;
+- struct mxt_info *info = &data->info;
+ int error;
+
+ error = mxt_init_t7_power_cfg(data);
+@@ -2594,11 +2633,6 @@ static int mxt_configure_objects(struct mxt_data *data,
+
+ mxt_debug_init(data);
+
+- dev_info(dev,
+- "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
+- info->family_id, info->variant_id, info->version >> 4,
+- info->version & 0xf, info->build, info->object_num);
+-
+ return 0;
+ }
+
+@@ -2607,7 +2641,7 @@ static ssize_t mxt_fw_version_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct mxt_data *data = dev_get_drvdata(dev);
+- struct mxt_info *info = &data->info;
++ struct mxt_info *info = data->info;
+ return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
+ info->version >> 4, info->version & 0xf, info->build);
+ }
+@@ -2617,7 +2651,7 @@ static ssize_t mxt_hw_version_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct mxt_data *data = dev_get_drvdata(dev);
+- struct mxt_info *info = &data->info;
++ struct mxt_info *info = data->info;
+ return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
+ info->family_id, info->variant_id);
+ }
+@@ -2656,7 +2690,7 @@ static ssize_t mxt_object_show(struct device *dev,
+ return -ENOMEM;
+
+ error = 0;
+- for (i = 0; i < data->info.object_num; i++) {
++ for (i = 0; i < data->info->object_num; i++) {
+ object = data->object_table + i;
+
+ if (!mxt_object_readable(object->type))
+--
+2.17.1
+
diff --git a/patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I b/patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I
new file mode 100644
index 0000000000..1e90fd9293
--- /dev/null
+++ b/patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I
@@ -0,0 +1,36 @@
+From e6e7e9cd8eed0e18217c899843bffbe8c7dae564 Mon Sep 17 00:00:00 2001
+From: Johannes Wienke <languitar@semipol.de>
+Date: Mon, 4 Jun 2018 13:37:26 -0700
+Subject: [PATCH] Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
+Git-commit: e6e7e9cd8eed0e18217c899843bffbe8c7dae564
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Add ELAN0612 to the list of supported touchpads; this ID is used in Lenovo
+v330 14IKB devices.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199253
+Signed-off-by: Johannes Wienke <languitar@semipol.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/mouse/elan_i2c_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 2690a4b7ed53..8ff75114e762 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1344,6 +1344,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN060B", 0 },
+ { "ELAN060C", 0 },
+ { "ELAN0611", 0 },
++ { "ELAN0612", 0 },
+ { "ELAN1000", 0 },
+ { }
+ };
+--
+2.17.1
+
diff --git a/patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr b/patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr
new file mode 100644
index 0000000000..37831093db
--- /dev/null
+++ b/patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr
@@ -0,0 +1,36 @@
+From 5ca4d1ae9bad0f59bd6f851c39b19f5366953666 Mon Sep 17 00:00:00 2001
+From: Ethan Lee <flibitijibibo@gmail.com>
+Date: Thu, 31 May 2018 16:13:17 -0700
+Subject: [PATCH] Input: goodix - add new ACPI id for GPD Win 2 touch screen
+Git-commit: 5ca4d1ae9bad0f59bd6f851c39b19f5366953666
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+GPD Win 2 Website: http://www.gpd.hk/gpdwin2.asp
+
+Tested on a unit from the first production run sent to Indiegogo backers
+
+Signed-off-by: Ethan Lee <flibitijibibo@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/touchscreen/goodix.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index 9736c83dd418..f2d9c2c41885 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -933,6 +933,7 @@ MODULE_DEVICE_TABLE(i2c, goodix_ts_id);
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id goodix_acpi_match[] = {
+ { "GDIX1001", 0 },
++ { "GDIX1002", 0 },
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, goodix_acpi_match);
+--
+2.17.1
+
diff --git a/patches.drivers/Input-synaptics-rmi4-fix-an-unchecked-out-of-memory- b/patches.drivers/Input-synaptics-rmi4-fix-an-unchecked-out-of-memory-
new file mode 100644
index 0000000000..133c059159
--- /dev/null
+++ b/patches.drivers/Input-synaptics-rmi4-fix-an-unchecked-out-of-memory-
@@ -0,0 +1,44 @@
+From 839c42273617787318da7baf6151d553108f5e17 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 6 Apr 2018 15:36:11 -0700
+Subject: [PATCH] Input: synaptics-rmi4 - fix an unchecked out of memory error path
+Git-commit: 839c42273617787318da7baf6151d553108f5e17
+Patch-mainline: v4.17-rc4
+References: bsc#1051510
+
+When extending the rmi_spi buffers, we must check that no out of memory
+error occurs, otherwise we may access data above the currently allocated
+memory.
+
+Propagate the error code returned by 'rmi_spi_manage_pools()' instead.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Duggan <aduggan@synaptics.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/rmi4/rmi_spi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c
+index 76edbf2c1bce..082defc329a8 100644
+--- a/drivers/input/rmi4/rmi_spi.c
++++ b/drivers/input/rmi4/rmi_spi.c
+@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi,
+ if (len > RMI_SPI_XFER_SIZE_LIMIT)
+ return -EINVAL;
+
+- if (rmi_spi->xfer_buf_size < len)
+- rmi_spi_manage_pools(rmi_spi, len);
++ if (rmi_spi->xfer_buf_size < len) {
++ ret = rmi_spi_manage_pools(rmi_spi, len);
++ if (ret < 0)
++ return ret;
++ }
+
+ if (addr == 0)
+ /*
+--
+2.17.1
+
diff --git a/patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs b/patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs
new file mode 100644
index 0000000000..8bbc0cd7ae
--- /dev/null
+++ b/patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs
@@ -0,0 +1,39 @@
+From c1ba08390a8bb13c927e699330896adc15b78205 Mon Sep 17 00:00:00 2001
+From: Ethan Lee <flibitijibibo@gmail.com>
+Date: Fri, 1 Jun 2018 11:46:08 -0700
+Subject: [PATCH] Input: xpad - add GPD Win 2 Controller USB IDs
+Git-commit: c1ba08390a8bb13c927e699330896adc15b78205
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+GPD Win 2 Website: http://www.gpd.hk/gpdwin2.asp
+
+Tested on a unit from the first production run sent to Indiegogo backers
+
+Signed-off-by: Ethan Lee <flibitijibibo@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -126,6 +126,7 @@ static const struct xpad_device {
+ u8 mapping;
+ u8 xtype;
+ } xpad_device[] = {
++ { 0x0079, 0x18d4, "GPD Win 2 Controller", 0, XTYPE_XBOX360 },
+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
+@@ -411,6 +412,7 @@ static const signed short xpad_abs_trigg
+
+ static struct usb_device_id xpad_table[] = {
+ { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */
++ XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */
+ XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */
diff --git a/patches.drivers/Input-xpad-add-support-for-PDP-Xbox-One-controllers b/patches.drivers/Input-xpad-add-support-for-PDP-Xbox-One-controllers
index 240e88e3cb..6f24c6a8c6 100644
--- a/patches.drivers/Input-xpad-add-support-for-PDP-Xbox-One-controllers
+++ b/patches.drivers/Input-xpad-add-support-for-PDP-Xbox-One-controllers
@@ -23,15 +23,15 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
-@@ -186,6 +186,7 @@ static const struct xpad_device {
- { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
+@@ -205,6 +205,7 @@ static const struct xpad_device {
{ 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
-@@ -389,6 +390,22 @@ static const u8 xboxone_hori_init[] = {
+@@ -446,6 +447,22 @@ static const u8 xboxone_hori_init[] = {
};
/*
@@ -54,7 +54,7 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
* A specific rumble packet is required for some PowerA pads to start
* sending input reports. One of those pads is (0x24c6:0x543a).
*/
-@@ -418,6 +435,8 @@ static const struct xboxone_init_packet
+@@ -475,6 +492,8 @@ static const struct xboxone_init_packet
XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
diff --git a/patches.drivers/Input-xpad-sync-supported-devices-with-360Controller b/patches.drivers/Input-xpad-sync-supported-devices-with-360Controller
new file mode 100644
index 0000000000..afbcb28ccd
--- /dev/null
+++ b/patches.drivers/Input-xpad-sync-supported-devices-with-360Controller
@@ -0,0 +1,206 @@
+From c225370e01b87d3c4ef40d98295ac0bb1e5a3116 Mon Sep 17 00:00:00 2001
+From: Benjamin Valentin <benpicco@googlemail.com>
+Date: Sun, 18 Jun 2017 15:40:37 -0700
+Subject: [PATCH] Input: xpad - sync supported devices with 360Controller
+Git-commit: c225370e01b87d3c4ef40d98295ac0bb1e5a3116
+Patch-mainline: v4.13-rc1
+References: bsc#1051510
+
+360Controller [0] is an OpenSource driver for Xbox/Xbox360/XboxOne
+controllers on macOS.
+
+It contains a couple device IDs unknown to the Linux driver, so I wrote a
+small Python script [1] to extract them and feed them into my previous
+script [2] to compare them with the IDs known to Linux.
+
+For most devices, this information is not really needed as xpad is able to
+automatically detect the type of an unknown Xbox Controller at run-time.
+I've therefore stripped all the generic/vague entries.
+
+I've excluded the Logitech G920, it's handled by a HID driver already.
+I've also excluded the Scene It! Big Button IR, it's handled by an
+out-of-tree driver. [3]
+
+[0] https://github.com/360Controller/360Controller
+[1] http://codepad.org/v9GyLKMq
+[2] http://codepad.org/qh7jclpD
+[3] https://github.com/micolous/xbox360bb
+
+Reviewed-by: Cameron Gutman <aicommander@gmail.com>
+Signed-off-by: Benjamin Valentin <benpicco@googlemail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/joystick/xpad.c | 57 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index def96cd2479b..b8d08f2296ff 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -131,8 +131,10 @@ static const struct xpad_device {
+ { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
+ { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX },
+ { 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
++ { 0x045e, 0x0288, "Microsoft Xbox Controller S v2", 0, XTYPE_XBOX },
+ { 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX },
+ { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 },
++ { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 },
+ { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
+ { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE },
+@@ -145,6 +147,7 @@ static const struct xpad_device {
+ { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 },
+ { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX },
+ { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
++ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 },
+ { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX },
+ { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
+@@ -158,14 +161,19 @@ static const struct xpad_device {
+ { 0x0738, 0x4718, "Mad Catz Street Fighter IV FightStick SE", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4726, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x0738, 0x4736, "Mad Catz MicroCon Gamepad", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 },
++ { 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
++ { 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 },
++ { 0x0738, 0xb738, "Mad Catz MVC2TE Stick 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 },
+ { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
+ { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", DANCEPAD_MAP_CONFIG, XTYPE_XBOX },
+@@ -181,30 +189,52 @@ static const struct xpad_device {
+ { 0x0e6f, 0x0105, "HSM3 Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0113, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0x0131, "PDP EA Sports Controller", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0x0133, "Xbox 360 Wired Controller", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0164, "PDP Battlefield One", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x0165, "PDP Titanfall 2", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0x0501, "PDP Xbox 360 Controller", 0, XTYPE_XBOX360 },
++ { 0x0e6f, 0xf900, "PDP Afterglow AX.1", 0, XTYPE_XBOX360 },
+ { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", 0, XTYPE_XBOX },
+ { 0x0e8f, 0x3008, "Generic xbox control (dealextreme)", 0, XTYPE_XBOX },
+ { 0x0f0d, 0x000a, "Hori Co. DOA4 FightStick", 0, XTYPE_XBOX360 },
++ { 0x0f0d, 0x000c, "Hori PadEX Turbo", 0, XTYPE_XBOX360 },
+ { 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x0f0d, 0x001b, "Hori Real Arcade Pro VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
++ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
+ { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
++ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+ { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
++ { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x12ab, 0x8809, "Xbox DDR dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x1430, 0x4748, "RedOctane Guitar Hero X-plorer", 0, XTYPE_XBOX360 },
+ { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
++ { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
+ { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
++ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+@@ -215,22 +245,42 @@ static const struct xpad_device {
+ { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf018, "Mad Catz Street Fighter IV SE Fighting Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf019, "Mad Catz Brawlstick for Xbox 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf021, "Mad Cats Ghost Recon FS GamePad", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf023, "MLG Pro Circuit Controller (Xbox)", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf025, "Mad Catz Call Of Duty", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf027, "Mad Catz FPS Pro", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf028, "Street Fighter IV FightPad", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf02e, "Mad Catz Fightpad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf038, "Street Fighter IV FightStick TE", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf039, "Mad Catz MvC2 TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf03a, "Mad Catz SFxT Fightstick Pro", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf03d, "Street Fighter IV Arcade Stick TE - Chun Li", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf03e, "Mad Catz MLG FightStick TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf03f, "Mad Catz FightStick SoulCaliber", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf042, "Mad Catz FightStick TES+", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf080, "Mad Catz FightStick TE2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf501, "HoriPad EX2 Turbo", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf502, "Hori Real Arcade Pro.VX SA", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf503, "Hori Fighting Stick VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf504, "Hori Real Arcade Pro. EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf505, "Hori Fighting Stick EX2B", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf506, "Hori Real Arcade Pro.EX Premium VLX", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf900, "Harmonix Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf901, "Gamestop Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf903, "Tron Xbox 360 controller", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf904, "PDP Versus Fighting Pad", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf906, "MortalKombat FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
++ { 0x24c6, 0x530a, "Xbox 360 Pro EX Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x531a, "PowerA Pro Ex", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5397, "FUS1ON Tournament Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x541a, "PowerA Xbox One Mini Wired Controller", 0, XTYPE_XBOXONE },
+@@ -238,12 +288,18 @@ static const struct xpad_device {
+ { 0x24c6, 0x543a, "PowerA Xbox One wired controller", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 },
++ { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
++ { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
++ { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE },
++ { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
++ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
+ };
+@@ -338,6 +394,7 @@ static struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */
++ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
+ XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */
+ XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */
+--
+2.17.1
+
diff --git a/patches.drivers/Input-xpad-sync-supported-devices-with-XBCD b/patches.drivers/Input-xpad-sync-supported-devices-with-XBCD
new file mode 100644
index 0000000000..0cbb297ca6
--- /dev/null
+++ b/patches.drivers/Input-xpad-sync-supported-devices-with-XBCD
@@ -0,0 +1,149 @@
+From be19788c73d382f66dd3fba3c5ccef59cf12a126 Mon Sep 17 00:00:00 2001
+From: Benjamin Valentin <benpicco@googlemail.com>
+Date: Sun, 18 Jun 2017 15:41:20 -0700
+Subject: [PATCH] Input: xpad - sync supported devices with XBCD
+Git-commit: be19788c73d382f66dd3fba3c5ccef59cf12a126
+Patch-mainline: v4.13-rc1
+References: bsc#1051510
+
+XBCD [0][1] is an OpenSource driver for Xbox controllers on Windows.
+Later it also started supporting Xbox360 controllers (presumably before
+the official Windows driver was released).
+
+It contains a couple device IDs unknown to the Linux driver, so I extracted
+those from xbcd.inf and added them to our list.
+
+It has a special type for Wheels and I have the feeling they might need
+some extra handling. They all have 'Wheel' in their name, so that
+information is available for future improvements.
+
+[0] https://www.s-config.com/xbcd-original-xbox-controllers-win10/
+[1] http://www.redcl0ud.com/xbcd.html
+
+Reviewed-by: Cameron Gutman <aicommander@gmail.com>
+Signed-off-by: Benjamin Valentin <benpicco@googlemail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/joystick/xpad.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index b8d08f2296ff..298a6ba51411 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -126,7 +126,10 @@ static const struct xpad_device {
+ u8 mapping;
+ u8 xtype;
+ } xpad_device[] = {
++ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
++ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
++ { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 },
+ { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
+ { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX },
+@@ -147,16 +150,30 @@ static const struct xpad_device {
+ { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 },
+ { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX },
+ { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
++ { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX },
+ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 },
+ { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX },
+ { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
++ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX },
++ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX },
++ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX },
++ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX },
++ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
++ { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX },
++ { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 },
++ { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX },
+ { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX },
++ { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX },
+ { 0x0738, 0x4522, "Mad Catz LumiCON", 0, XTYPE_XBOX },
+ { 0x0738, 0x4526, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX },
++ { 0x0738, 0x4530, "Mad Catz Universal MC2 Racing Wheel and Pedals", 0, XTYPE_XBOX },
+ { 0x0738, 0x4536, "Mad Catz MicroCON", 0, XTYPE_XBOX },
+ { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", 0, XTYPE_XBOX },
++ { 0x0738, 0x4586, "Mad Catz MicroCon Wireless Controller", 0, XTYPE_XBOX },
++ { 0x0738, 0x4588, "Mad Catz Blaster", 0, XTYPE_XBOX },
++ { 0x0738, 0x45ff, "Mad Catz Beat Pad (w/ Handle)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4718, "Mad Catz Street Fighter IV FightStick SE", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4726, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
+@@ -164,6 +181,7 @@ static const struct xpad_device {
+ { 0x0738, 0x4736, "Mad Catz MicroCon Gamepad", 0, XTYPE_XBOX360 },
+ { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 },
++ { 0x0738, 0x4743, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+@@ -175,6 +193,9 @@ static const struct xpad_device {
+ { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
++ { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
++ { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
++ { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", DANCEPAD_MAP_CONFIG, XTYPE_XBOX },
+ { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX },
+@@ -182,10 +203,13 @@ static const struct xpad_device {
+ { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX },
+ { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX },
++ { 0x0e4c, 0x1103, "Radica Gamester Reflex", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX },
+ { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX },
++ { 0x0e4c, 0x3510, "Radica Gamester", 0, XTYPE_XBOX },
+ { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", 0, XTYPE_XBOX },
+ { 0x0e6f, 0x0005, "Eclipse wireless Controller", 0, XTYPE_XBOX },
+ { 0x0e6f, 0x0006, "Edge wireless Controller", 0, XTYPE_XBOX },
++ { 0x0e6f, 0x0008, "After Glow Pro Controller", 0, XTYPE_XBOX },
+ { 0x0e6f, 0x0105, "HSM3 Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0113, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 },
+@@ -221,6 +245,7 @@ static const struct xpad_device {
+ { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
+ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
++ { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
+ { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+@@ -255,6 +280,8 @@ static const struct xpad_device {
+ { 0x1bad, 0xf027, "Mad Catz FPS Pro", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf028, "Street Fighter IV FightPad", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf02e, "Mad Catz Fightpad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x1bad, 0xf030, "Mad Catz Xbox 360 MC2 MicroCon Racing Wheel", 0, XTYPE_XBOX360 },
++ { 0x1bad, 0xf036, "Mad Catz MicroCon GamePad Pro", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf038, "Street Fighter IV FightStick TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xf039, "Mad Catz MvC2 TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0xf03a, "Mad Catz SFxT Fightstick Pro", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -300,6 +327,7 @@ static const struct xpad_device {
+ { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
+ };
+@@ -387,9 +415,11 @@ static struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */
+ XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */
++ XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */
+ XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */
+ { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
+ XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
++ XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz GamePad */
+ XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f X-Box 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
+--
+2.17.1
+
diff --git a/patches.drivers/be2net-Fix-HW-stall-issue-in-Lancer.patch b/patches.drivers/be2net-Fix-HW-stall-issue-in-Lancer.patch
new file mode 100644
index 0000000000..005effe546
--- /dev/null
+++ b/patches.drivers/be2net-Fix-HW-stall-issue-in-Lancer.patch
@@ -0,0 +1,33 @@
+From: Suresh Reddy <suresh.reddy@broadcom.com>
+Date: Tue, 6 Feb 2018 08:52:41 -0500
+Subject: be2net: Fix HW stall issue in Lancer
+Patch-mainline: v4.16-rc1
+Git-commit: 3df40aad1a864af124bd50a1371ef16089ac9af2
+References: bsc#1086288 FATE#324877
+
+Lancer HW cannot handle a TSO packet with a single segment.
+Disable TSO/GSO for such packets.
+
+Signed-off-by: Suresh Reddy <suresh.reddy@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: David Chang <dchang@suse.com>
+---
+ drivers/net/ethernet/emulex/benet/be_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -5106,9 +5106,12 @@ static netdev_features_t be_features_che
+ features &= ~NETIF_F_TSO6;
+
+ /* Lancer cannot handle the packet with MSS less than 256.
++ * Also it can't handle a TSO packet with a single segment
+ * Disable the GSO support in such cases
+ */
+- if (lancer_chip(adapter) && skb_shinfo(skb)->gso_size < 256)
++ if (lancer_chip(adapter) &&
++ (skb_shinfo(skb)->gso_size < 256 ||
++ skb_shinfo(skb)->gso_segs == 1))
+ features &= ~NETIF_F_GSO_MASK;
+ }
+
diff --git a/patches.drivers/be2net-Handle-transmit-completion-errors-in-Lancer.patch b/patches.drivers/be2net-Handle-transmit-completion-errors-in-Lancer.patch
new file mode 100644
index 0000000000..f8973899e3
--- /dev/null
+++ b/patches.drivers/be2net-Handle-transmit-completion-errors-in-Lancer.patch
@@ -0,0 +1,219 @@
+From: Suresh Reddy <suresh.reddy@broadcom.com>
+Date: Tue, 6 Feb 2018 08:52:42 -0500
+Subject: be2net: Handle transmit completion errors in Lancer
+Patch-mainline: v4.16-rc1
+Git-commit: ffc39620102dfe62711fadb9a297b66aee816013
+References: bsc#1086288 FATE#324877
+
+If the driver receives a TX CQE with status as 0x1 or 0x9 or 0xb,
+the completion indexes should not be used. The driver must stop
+consuming CQEs from this TXQ/CQ. The TXQ from this point on-wards
+to be in a bad state. Driver should destroy and recreate the TXQ.
+
+0x1: LANCER_TX_COMP_LSO_ERR
+0x9 LANCER_TX_COMP_SGE_ERR
+0xb: LANCER_TX_COMP_PARITY_ERR
+
+Reset the adapter if driver sees this error in TX completion. Also
+adding sge error counter in ethtool stats.
+
+Signed-off-by: Suresh Reddy <suresh.reddy@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: David Chang <dchang@suse.com>
+---
+ drivers/net/ethernet/emulex/benet/be.h | 7 +
+ drivers/net/ethernet/emulex/benet/be_ethtool.c | 1
+ drivers/net/ethernet/emulex/benet/be_hw.h | 1
+ drivers/net/ethernet/emulex/benet/be_main.c | 108 ++++++++++++++-----------
+ 4 files changed, 69 insertions(+), 48 deletions(-)
+
+--- a/drivers/net/ethernet/emulex/benet/be.h
++++ b/drivers/net/ethernet/emulex/benet/be.h
+@@ -248,6 +248,7 @@ struct be_tx_stats {
+ u32 tx_spoof_check_err;
+ u32 tx_qinq_err;
+ u32 tx_internal_parity_err;
++ u32 tx_sge_err;
+ struct u64_stats_sync sync;
+ struct u64_stats_sync sync_compl;
+ };
+@@ -944,8 +945,10 @@ static inline bool is_ipv6_ext_hdr(struc
+ #define BE_ERROR_EEH 1
+ #define BE_ERROR_UE BIT(1)
+ #define BE_ERROR_FW BIT(2)
+-#define BE_ERROR_HW (BE_ERROR_EEH | BE_ERROR_UE)
+-#define BE_ERROR_ANY (BE_ERROR_EEH | BE_ERROR_UE | BE_ERROR_FW)
++#define BE_ERROR_TX BIT(3)
++#define BE_ERROR_HW (BE_ERROR_EEH | BE_ERROR_UE | BE_ERROR_TX)
++#define BE_ERROR_ANY (BE_ERROR_EEH | BE_ERROR_UE | BE_ERROR_FW | \
++ BE_ERROR_TX)
+ #define BE_CLEAR_ALL 0xFF
+
+ static inline u8 be_check_error(struct be_adapter *adapter, u32 err_type)
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -189,6 +189,7 @@ static const struct be_ethtool_stat et_t
+ * packet data. This counter is applicable only for Lancer adapters.
+ */
+ {DRVSTAT_TX_INFO(tx_internal_parity_err)},
++ {DRVSTAT_TX_INFO(tx_sge_err)},
+ {DRVSTAT_TX_INFO(tx_bytes)},
+ {DRVSTAT_TX_INFO(tx_pkts)},
+ {DRVSTAT_TX_INFO(tx_vxlan_offload_pkts)},
+--- a/drivers/net/ethernet/emulex/benet/be_hw.h
++++ b/drivers/net/ethernet/emulex/benet/be_hw.h
+@@ -261,6 +261,7 @@ struct be_eth_hdr_wrb {
+ #define LANCER_TX_COMP_HSW_DROP_MAC_ERR 0x3
+ #define LANCER_TX_COMP_HSW_DROP_VLAN_ERR 0x5
+ #define LANCER_TX_COMP_QINQ_ERR 0x7
++#define LANCER_TX_COMP_SGE_ERR 0x9
+ #define LANCER_TX_COMP_PARITY_ERR 0xb
+ #define LANCER_TX_COMP_DMA_ERR 0xd
+
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -2584,7 +2584,48 @@ static void be_post_rx_frags(struct be_r
+ }
+ }
+
+-static struct be_tx_compl_info *be_tx_compl_get(struct be_tx_obj *txo)
++static inline void be_update_tx_err(struct be_tx_obj *txo, u8 status)
++{
++ switch (status) {
++ case BE_TX_COMP_HDR_PARSE_ERR:
++ tx_stats(txo)->tx_hdr_parse_err++;
++ break;
++ case BE_TX_COMP_NDMA_ERR:
++ tx_stats(txo)->tx_dma_err++;
++ break;
++ case BE_TX_COMP_ACL_ERR:
++ tx_stats(txo)->tx_spoof_check_err++;
++ break;
++ }
++}
++
++static inline void lancer_update_tx_err(struct be_tx_obj *txo, u8 status)
++{
++ switch (status) {
++ case LANCER_TX_COMP_LSO_ERR:
++ tx_stats(txo)->tx_tso_err++;
++ break;
++ case LANCER_TX_COMP_HSW_DROP_MAC_ERR:
++ case LANCER_TX_COMP_HSW_DROP_VLAN_ERR:
++ tx_stats(txo)->tx_spoof_check_err++;
++ break;
++ case LANCER_TX_COMP_QINQ_ERR:
++ tx_stats(txo)->tx_qinq_err++;
++ break;
++ case LANCER_TX_COMP_PARITY_ERR:
++ tx_stats(txo)->tx_internal_parity_err++;
++ break;
++ case LANCER_TX_COMP_DMA_ERR:
++ tx_stats(txo)->tx_dma_err++;
++ break;
++ case LANCER_TX_COMP_SGE_ERR:
++ tx_stats(txo)->tx_sge_err++;
++ break;
++ }
++}
++
++static struct be_tx_compl_info *be_tx_compl_get(struct be_adapter *adapter,
++ struct be_tx_obj *txo)
+ {
+ struct be_queue_info *tx_cq = &txo->cq;
+ struct be_tx_compl_info *txcp = &txo->txcp;
+@@ -2600,6 +2641,24 @@ static struct be_tx_compl_info *be_tx_co
+ txcp->status = GET_TX_COMPL_BITS(status, compl);
+ txcp->end_index = GET_TX_COMPL_BITS(wrb_index, compl);
+
++ if (txcp->status) {
++ if (lancer_chip(adapter)) {
++ lancer_update_tx_err(txo, txcp->status);
++ /* Reset the adapter incase of TSO,
++ * SGE or Parity error
++ */
++ if (txcp->status == LANCER_TX_COMP_LSO_ERR ||
++ txcp->status == LANCER_TX_COMP_PARITY_ERR ||
++ txcp->status == LANCER_TX_COMP_SGE_ERR)
++ be_set_error(adapter, BE_ERROR_TX);
++ } else {
++ be_update_tx_err(txo, txcp->status);
++ }
++ }
++
++ if (be_check_error(adapter, BE_ERROR_TX))
++ return NULL;
++
+ compl->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] = 0;
+ queue_tail_inc(tx_cq);
+ return txcp;
+@@ -2742,7 +2801,7 @@ static void be_tx_compl_clean(struct be_
+ cmpl = 0;
+ num_wrbs = 0;
+ txq = &txo->q;
+- while ((txcp = be_tx_compl_get(txo))) {
++ while ((txcp = be_tx_compl_get(adapter, txo))) {
+ num_wrbs +=
+ be_tx_compl_process(adapter, txo,
+ txcp->end_index);
+@@ -3121,42 +3180,6 @@ loop_continue:
+ return work_done;
+ }
+
+-static inline void be_update_tx_err(struct be_tx_obj *txo, u8 status)
+-{
+- switch (status) {
+- case BE_TX_COMP_HDR_PARSE_ERR:
+- tx_stats(txo)->tx_hdr_parse_err++;
+- break;
+- case BE_TX_COMP_NDMA_ERR:
+- tx_stats(txo)->tx_dma_err++;
+- break;
+- case BE_TX_COMP_ACL_ERR:
+- tx_stats(txo)->tx_spoof_check_err++;
+- break;
+- }
+-}
+-
+-static inline void lancer_update_tx_err(struct be_tx_obj *txo, u8 status)
+-{
+- switch (status) {
+- case LANCER_TX_COMP_LSO_ERR:
+- tx_stats(txo)->tx_tso_err++;
+- break;
+- case LANCER_TX_COMP_HSW_DROP_MAC_ERR:
+- case LANCER_TX_COMP_HSW_DROP_VLAN_ERR:
+- tx_stats(txo)->tx_spoof_check_err++;
+- break;
+- case LANCER_TX_COMP_QINQ_ERR:
+- tx_stats(txo)->tx_qinq_err++;
+- break;
+- case LANCER_TX_COMP_PARITY_ERR:
+- tx_stats(txo)->tx_internal_parity_err++;
+- break;
+- case LANCER_TX_COMP_DMA_ERR:
+- tx_stats(txo)->tx_dma_err++;
+- break;
+- }
+-}
+
+ static void be_process_tx(struct be_adapter *adapter, struct be_tx_obj *txo,
+ int idx)
+@@ -3164,16 +3187,9 @@ static void be_process_tx(struct be_adap
+ int num_wrbs = 0, work_done = 0;
+ struct be_tx_compl_info *txcp;
+
+- while ((txcp = be_tx_compl_get(txo))) {
++ while ((txcp = be_tx_compl_get(adapter, txo))) {
+ num_wrbs += be_tx_compl_process(adapter, txo, txcp->end_index);
+ work_done++;
+-
+- if (txcp->status) {
+- if (lancer_chip(adapter))
+- lancer_update_tx_err(txo, txcp->status);
+- else
+- be_update_tx_err(txo, txcp->status);
+- }
+ }
+
+ if (work_done) {
diff --git a/patches.drivers/crypto-caam-fix-DMA-mapping-dir-for-generated-IV b/patches.drivers/crypto-caam-fix-DMA-mapping-dir-for-generated-IV
new file mode 100644
index 0000000000..5341051f64
--- /dev/null
+++ b/patches.drivers/crypto-caam-fix-DMA-mapping-dir-for-generated-IV
@@ -0,0 +1,168 @@
+From a38acd236cac914aafffd80af79b9556fc2c3934 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
+Date: Wed, 28 Mar 2018 15:39:17 +0300
+Subject: [PATCH] crypto: caam - fix DMA mapping dir for generated IV
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: a38acd236cac914aafffd80af79b9556fc2c3934
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+In case of GIVCIPHER, IV is generated by the device.
+Fix the DMA mapping direction.
+
+Cc: <stable@vger.kernel.org> # 3.19+
+Fixes: 7222d1a34103 ("crypto: caam - add support for givencrypt cbc(aes) and rfc3686(ctr(aes))")
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/caam/caamalg.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 7207a535942d..3e18b9266027 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -769,6 +769,7 @@ struct aead_edesc {
+ * @src_nents: number of segments in input s/w scatterlist
+ * @dst_nents: number of segments in output s/w scatterlist
+ * @iv_dma: dma address of iv for checking continuity and link table
++ * @iv_dir: DMA mapping direction for IV
+ * @sec4_sg_bytes: length of dma mapped sec4_sg space
+ * @sec4_sg_dma: bus physical mapped address of h/w link table
+ * @sec4_sg: pointer to h/w link table
+@@ -778,6 +779,7 @@ struct ablkcipher_edesc {
+ int src_nents;
+ int dst_nents;
+ dma_addr_t iv_dma;
++ enum dma_data_direction iv_dir;
+ int sec4_sg_bytes;
+ dma_addr_t sec4_sg_dma;
+ struct sec4_sg_entry *sec4_sg;
+@@ -787,7 +789,8 @@ struct ablkcipher_edesc {
+ static void caam_unmap(struct device *dev, struct scatterlist *src,
+ struct scatterlist *dst, int src_nents,
+ int dst_nents,
+- dma_addr_t iv_dma, int ivsize, dma_addr_t sec4_sg_dma,
++ dma_addr_t iv_dma, int ivsize,
++ enum dma_data_direction iv_dir, dma_addr_t sec4_sg_dma,
+ int sec4_sg_bytes)
+ {
+ if (dst != src) {
+@@ -799,7 +802,7 @@ static void caam_unmap(struct device *dev, struct scatterlist *src,
+ }
+
+ if (iv_dma)
+- dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
++ dma_unmap_single(dev, iv_dma, ivsize, iv_dir);
+ if (sec4_sg_bytes)
+ dma_unmap_single(dev, sec4_sg_dma, sec4_sg_bytes,
+ DMA_TO_DEVICE);
+@@ -810,7 +813,7 @@ static void aead_unmap(struct device *dev,
+ struct aead_request *req)
+ {
+ caam_unmap(dev, req->src, req->dst,
+- edesc->src_nents, edesc->dst_nents, 0, 0,
++ edesc->src_nents, edesc->dst_nents, 0, 0, DMA_NONE,
+ edesc->sec4_sg_dma, edesc->sec4_sg_bytes);
+ }
+
+@@ -823,7 +826,7 @@ static void ablkcipher_unmap(struct device *dev,
+
+ caam_unmap(dev, req->src, req->dst,
+ edesc->src_nents, edesc->dst_nents,
+- edesc->iv_dma, ivsize,
++ edesc->iv_dma, ivsize, edesc->iv_dir,
+ edesc->sec4_sg_dma, edesc->sec4_sg_bytes);
+ }
+
+@@ -1287,7 +1290,7 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
+ GFP_DMA | flags);
+ if (!edesc) {
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
+- 0, 0, 0);
++ 0, DMA_NONE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1550,7 +1553,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ if (dma_mapping_error(jrdev, iv_dma)) {
+ dev_err(jrdev, "unable to map IV\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
+- 0, 0, 0);
++ 0, DMA_NONE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1572,7 +1575,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ if (!edesc) {
+ dev_err(jrdev, "could not allocate extended descriptor\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, 0, 0);
++ iv_dma, ivsize, DMA_TO_DEVICE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1581,6 +1584,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ edesc->sec4_sg_bytes = sec4_sg_bytes;
+ edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+ desc_bytes;
++ edesc->iv_dir = DMA_TO_DEVICE;
+
+ if (!in_contig) {
+ dma_to_sec4_sg_one(edesc->sec4_sg, iv_dma, ivsize, 0);
+@@ -1598,7 +1602,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ if (dma_mapping_error(jrdev, edesc->sec4_sg_dma)) {
+ dev_err(jrdev, "unable to map S/G table\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, 0, 0);
++ iv_dma, ivsize, DMA_TO_DEVICE, 0, 0);
+ kfree(edesc);
+ return ERR_PTR(-ENOMEM);
+ }
+@@ -1756,11 +1760,11 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ * Check if iv can be contiguous with source and destination.
+ * If so, include it. If not, create scatterlist.
+ */
+- iv_dma = dma_map_single(jrdev, greq->giv, ivsize, DMA_TO_DEVICE);
++ iv_dma = dma_map_single(jrdev, greq->giv, ivsize, DMA_FROM_DEVICE);
+ if (dma_mapping_error(jrdev, iv_dma)) {
+ dev_err(jrdev, "unable to map IV\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
+- 0, 0, 0);
++ 0, DMA_NONE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1781,7 +1785,7 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ if (!edesc) {
+ dev_err(jrdev, "could not allocate extended descriptor\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, 0, 0);
++ iv_dma, ivsize, DMA_FROM_DEVICE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1790,6 +1794,7 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ edesc->sec4_sg_bytes = sec4_sg_bytes;
+ edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+ desc_bytes;
++ edesc->iv_dir = DMA_FROM_DEVICE;
+
+ if (mapped_src_nents > 1)
+ sg_to_sec4_sg_last(req->src, mapped_src_nents, edesc->sec4_sg,
+@@ -1807,7 +1812,7 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ if (dma_mapping_error(jrdev, edesc->sec4_sg_dma)) {
+ dev_err(jrdev, "unable to map S/G table\n");
+ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, 0, 0);
++ iv_dma, ivsize, DMA_FROM_DEVICE, 0, 0);
+ kfree(edesc);
+ return ERR_PTR(-ENOMEM);
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/crypto-caam-fix-IV-DMA-mapping-and-updating b/patches.drivers/crypto-caam-fix-IV-DMA-mapping-and-updating
new file mode 100644
index 0000000000..37ceb4b545
--- /dev/null
+++ b/patches.drivers/crypto-caam-fix-IV-DMA-mapping-and-updating
@@ -0,0 +1,468 @@
+From 115957bb3e59fcb226ce76b97af14533f239e0ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
+Date: Wed, 28 Mar 2018 15:39:18 +0300
+Subject: [PATCH] crypto: caam - fix IV DMA mapping and updating
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 115957bb3e59fcb226ce76b97af14533f239e0ac
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+There are two IV-related issues:
+(1) crypto API does not guarantee to provide an IV buffer that is DMAable,
+thus it's incorrect to DMA map it
+(2) for in-place decryption, since ciphertext is overwritten with
+plaintext, updated req->info will contain the last block of plaintext
+(instead of the last block of ciphertext)
+
+While these two issues could be fixed separately, it's straightforward
+to fix both in the same time - by allocating extra space in the
+ablkcipher_edesc for the IV that will be fed to the crypto engine;
+this allows for fixing (2) by saving req->src[last_block] in req->info
+directly, i.e. without allocating another temporary buffer.
+
+A side effect of the fix is that it's no longer possible to have the IV
+and req->src contiguous. Code checking for this case is removed.
+
+Cc: <stable@vger.kernel.org> # 4.13+
+Fixes: 854b06f76879 ("crypto: caam - properly set IV after {en,de}crypt")
+Link: http://lkml.kernel.org/r/20170113084620.GF22022@gondor.apana.org.au
+Reported-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/caam/caamalg.c | 212 +++++++++++++++-------------------
+ 1 file changed, 91 insertions(+), 121 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 3e18b9266027..d67667970f7e 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -774,6 +774,7 @@ struct aead_edesc {
+ * @sec4_sg_dma: bus physical mapped address of h/w link table
+ * @sec4_sg: pointer to h/w link table
+ * @hw_desc: the h/w job descriptor followed by any referenced link tables
++ * and IV
+ */
+ struct ablkcipher_edesc {
+ int src_nents;
+@@ -915,6 +916,18 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize,
+ ivsize, 0);
+
++ /* In case initial IV was generated, copy it in GIVCIPHER request */
++ if (edesc->iv_dir == DMA_FROM_DEVICE) {
++ u8 *iv;
++ struct skcipher_givcrypt_request *greq;
++
++ greq = container_of(req, struct skcipher_givcrypt_request,
++ creq);
++ iv = (u8 *)edesc->hw_desc + desc_bytes(edesc->hw_desc) +
++ edesc->sec4_sg_bytes;
++ memcpy(greq->giv, iv, ivsize);
++ }
++
+ kfree(edesc);
+
+ ablkcipher_request_complete(req, err);
+@@ -925,10 +938,10 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ {
+ struct ablkcipher_request *req = context;
+ struct ablkcipher_edesc *edesc;
++#ifdef DEBUG
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+
+-#ifdef DEBUG
+ dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
+ #endif
+
+@@ -946,14 +959,6 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+
+ ablkcipher_unmap(jrdev, edesc, req);
+-
+- /*
+- * The crypto API expects us to set the IV (req->info) to the last
+- * ciphertext block.
+- */
+- scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize,
+- ivsize, 0);
+-
+ kfree(edesc);
+
+ ablkcipher_request_complete(req, err);
+@@ -1102,15 +1107,14 @@ static void init_authenc_job(struct aead_request *req,
+ */
+ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
+ struct ablkcipher_edesc *edesc,
+- struct ablkcipher_request *req,
+- bool iv_contig)
++ struct ablkcipher_request *req)
+ {
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ u32 *desc = edesc->hw_desc;
+- u32 out_options = 0, in_options;
+- dma_addr_t dst_dma, src_dma;
+- int len, sec4_sg_index = 0;
++ u32 out_options = 0;
++ dma_addr_t dst_dma;
++ int len;
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "presciv@"__stringify(__LINE__)": ",
+@@ -1126,30 +1130,18 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
+ len = desc_len(sh_desc);
+ init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
+
+- if (iv_contig) {
+- src_dma = edesc->iv_dma;
+- in_options = 0;
+- } else {
+- src_dma = edesc->sec4_sg_dma;
+- sec4_sg_index += edesc->src_nents + 1;
+- in_options = LDST_SGF;
+- }
+- append_seq_in_ptr(desc, src_dma, req->nbytes + ivsize, in_options);
++ append_seq_in_ptr(desc, edesc->sec4_sg_dma, req->nbytes + ivsize,
++ LDST_SGF);
+
+ if (likely(req->src == req->dst)) {
+- if (edesc->src_nents == 1 && iv_contig) {
+- dst_dma = sg_dma_address(req->src);
+- } else {
+- dst_dma = edesc->sec4_sg_dma +
+- sizeof(struct sec4_sg_entry);
+- out_options = LDST_SGF;
+- }
++ dst_dma = edesc->sec4_sg_dma + sizeof(struct sec4_sg_entry);
++ out_options = LDST_SGF;
+ } else {
+ if (edesc->dst_nents == 1) {
+ dst_dma = sg_dma_address(req->dst);
+ } else {
+- dst_dma = edesc->sec4_sg_dma +
+- sec4_sg_index * sizeof(struct sec4_sg_entry);
++ dst_dma = edesc->sec4_sg_dma + (edesc->src_nents + 1) *
++ sizeof(struct sec4_sg_entry);
+ out_options = LDST_SGF;
+ }
+ }
+@@ -1161,13 +1153,12 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
+ */
+ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr,
+ struct ablkcipher_edesc *edesc,
+- struct ablkcipher_request *req,
+- bool iv_contig)
++ struct ablkcipher_request *req)
+ {
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ u32 *desc = edesc->hw_desc;
+- u32 out_options, in_options;
++ u32 in_options;
+ dma_addr_t dst_dma, src_dma;
+ int len, sec4_sg_index = 0;
+
+@@ -1193,15 +1184,9 @@ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr,
+ }
+ append_seq_in_ptr(desc, src_dma, req->nbytes, in_options);
+
+- if (iv_contig) {
+- dst_dma = edesc->iv_dma;
+- out_options = 0;
+- } else {
+- dst_dma = edesc->sec4_sg_dma +
+- sec4_sg_index * sizeof(struct sec4_sg_entry);
+- out_options = LDST_SGF;
+- }
+- append_seq_out_ptr(desc, dst_dma, req->nbytes + ivsize, out_options);
++ dst_dma = edesc->sec4_sg_dma + sec4_sg_index *
++ sizeof(struct sec4_sg_entry);
++ append_seq_out_ptr(desc, dst_dma, req->nbytes + ivsize, LDST_SGF);
+ }
+
+ /*
+@@ -1494,8 +1479,7 @@ static int aead_decrypt(struct aead_request *req)
+ * allocate and map the ablkcipher extended descriptor for ablkcipher
+ */
+ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+- *req, int desc_bytes,
+- bool *iv_contig_out)
++ *req, int desc_bytes)
+ {
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
+@@ -1504,8 +1488,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ GFP_KERNEL : GFP_ATOMIC;
+ int src_nents, mapped_src_nents, dst_nents = 0, mapped_dst_nents = 0;
+ struct ablkcipher_edesc *edesc;
+- dma_addr_t iv_dma = 0;
+- bool in_contig;
++ dma_addr_t iv_dma;
++ u8 *iv;
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ int dst_sg_idx, sec4_sg_ents, sec4_sg_bytes;
+
+@@ -1549,33 +1533,20 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ }
+ }
+
+- iv_dma = dma_map_single(jrdev, req->info, ivsize, DMA_TO_DEVICE);
+- if (dma_mapping_error(jrdev, iv_dma)) {
+- dev_err(jrdev, "unable to map IV\n");
+- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
+- 0, DMA_NONE, 0, 0);
+- return ERR_PTR(-ENOMEM);
+- }
+-
+- if (mapped_src_nents == 1 &&
+- iv_dma + ivsize == sg_dma_address(req->src)) {
+- in_contig = true;
+- sec4_sg_ents = 0;
+- } else {
+- in_contig = false;
+- sec4_sg_ents = 1 + mapped_src_nents;
+- }
++ sec4_sg_ents = 1 + mapped_src_nents;
+ dst_sg_idx = sec4_sg_ents;
+ sec4_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0;
+ sec4_sg_bytes = sec4_sg_ents * sizeof(struct sec4_sg_entry);
+
+- /* allocate space for base edesc and hw desc commands, link tables */
+- edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes,
++ /*
++ * allocate space for base edesc and hw desc commands, link tables, IV
++ */
++ edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes + ivsize,
+ GFP_DMA | flags);
+ if (!edesc) {
+ dev_err(jrdev, "could not allocate extended descriptor\n");
+- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, DMA_TO_DEVICE, 0, 0);
++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
++ 0, DMA_NONE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1586,12 +1557,22 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ desc_bytes;
+ edesc->iv_dir = DMA_TO_DEVICE;
+
+- if (!in_contig) {
+- dma_to_sec4_sg_one(edesc->sec4_sg, iv_dma, ivsize, 0);
+- sg_to_sec4_sg_last(req->src, mapped_src_nents,
+- edesc->sec4_sg + 1, 0);
++ /* Make sure IV is located in a DMAable area */
++ iv = (u8 *)edesc->hw_desc + desc_bytes + sec4_sg_bytes;
++ memcpy(iv, req->info, ivsize);
++
++ iv_dma = dma_map_single(jrdev, iv, ivsize, DMA_TO_DEVICE);
++ if (dma_mapping_error(jrdev, iv_dma)) {
++ dev_err(jrdev, "unable to map IV\n");
++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
++ 0, DMA_NONE, 0, 0);
++ kfree(edesc);
++ return ERR_PTR(-ENOMEM);
+ }
+
++ dma_to_sec4_sg_one(edesc->sec4_sg, iv_dma, ivsize, 0);
++ sg_to_sec4_sg_last(req->src, mapped_src_nents, edesc->sec4_sg + 1, 0);
++
+ if (mapped_dst_nents > 1) {
+ sg_to_sec4_sg_last(req->dst, mapped_dst_nents,
+ edesc->sec4_sg + dst_sg_idx, 0);
+@@ -1615,7 +1596,6 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ sec4_sg_bytes, 1);
+ #endif
+
+- *iv_contig_out = in_contig;
+ return edesc;
+ }
+
+@@ -1625,19 +1605,16 @@ static int ablkcipher_encrypt(struct ablkcipher_request *req)
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
+ struct device *jrdev = ctx->jrdev;
+- bool iv_contig;
+ u32 *desc;
+ int ret = 0;
+
+ /* allocate extended descriptor */
+- edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN *
+- CAAM_CMD_SZ, &iv_contig);
++ edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * CAAM_CMD_SZ);
+ if (IS_ERR(edesc))
+ return PTR_ERR(edesc);
+
+ /* Create and submit job descriptor*/
+- init_ablkcipher_job(ctx->sh_desc_enc,
+- ctx->sh_desc_enc_dma, edesc, req, iv_contig);
++ init_ablkcipher_job(ctx->sh_desc_enc, ctx->sh_desc_enc_dma, edesc, req);
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "ablkcipher jobdesc@"__stringify(__LINE__)": ",
+ DUMP_PREFIX_ADDRESS, 16, 4, edesc->hw_desc,
+@@ -1661,20 +1638,25 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req)
+ struct ablkcipher_edesc *edesc;
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
++ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ struct device *jrdev = ctx->jrdev;
+- bool iv_contig;
+ u32 *desc;
+ int ret = 0;
+
+ /* allocate extended descriptor */
+- edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN *
+- CAAM_CMD_SZ, &iv_contig);
++ edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * CAAM_CMD_SZ);
+ if (IS_ERR(edesc))
+ return PTR_ERR(edesc);
+
++ /*
++ * The crypto API expects us to set the IV (req->info) to the last
++ * ciphertext block.
++ */
++ scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize,
++ ivsize, 0);
++
+ /* Create and submit job descriptor*/
+- init_ablkcipher_job(ctx->sh_desc_dec,
+- ctx->sh_desc_dec_dma, edesc, req, iv_contig);
++ init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req);
+ desc = edesc->hw_desc;
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "ablkcipher jobdesc@"__stringify(__LINE__)": ",
+@@ -1699,8 +1681,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req)
+ */
+ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ struct skcipher_givcrypt_request *greq,
+- int desc_bytes,
+- bool *iv_contig_out)
++ int desc_bytes)
+ {
+ struct ablkcipher_request *req = &greq->creq;
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+@@ -1710,8 +1691,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ GFP_KERNEL : GFP_ATOMIC;
+ int src_nents, mapped_src_nents, dst_nents, mapped_dst_nents;
+ struct ablkcipher_edesc *edesc;
+- dma_addr_t iv_dma = 0;
+- bool out_contig;
++ dma_addr_t iv_dma;
++ u8 *iv;
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ int dst_sg_idx, sec4_sg_ents, sec4_sg_bytes;
+
+@@ -1756,36 +1737,20 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ }
+ }
+
+- /*
+- * Check if iv can be contiguous with source and destination.
+- * If so, include it. If not, create scatterlist.
+- */
+- iv_dma = dma_map_single(jrdev, greq->giv, ivsize, DMA_FROM_DEVICE);
+- if (dma_mapping_error(jrdev, iv_dma)) {
+- dev_err(jrdev, "unable to map IV\n");
+- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
+- 0, DMA_NONE, 0, 0);
+- return ERR_PTR(-ENOMEM);
+- }
+-
+ sec4_sg_ents = mapped_src_nents > 1 ? mapped_src_nents : 0;
+ dst_sg_idx = sec4_sg_ents;
+- if (mapped_dst_nents == 1 &&
+- iv_dma + ivsize == sg_dma_address(req->dst)) {
+- out_contig = true;
+- } else {
+- out_contig = false;
+- sec4_sg_ents += 1 + mapped_dst_nents;
+- }
++ sec4_sg_ents += 1 + mapped_dst_nents;
+
+- /* allocate space for base edesc and hw desc commands, link tables */
++ /*
++ * allocate space for base edesc and hw desc commands, link tables, IV
++ */
+ sec4_sg_bytes = sec4_sg_ents * sizeof(struct sec4_sg_entry);
+- edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes,
++ edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes + ivsize,
+ GFP_DMA | flags);
+ if (!edesc) {
+ dev_err(jrdev, "could not allocate extended descriptor\n");
+- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents,
+- iv_dma, ivsize, DMA_FROM_DEVICE, 0, 0);
++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
++ 0, DMA_NONE, 0, 0);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -1796,16 +1761,24 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ desc_bytes;
+ edesc->iv_dir = DMA_FROM_DEVICE;
+
++ /* Make sure IV is located in a DMAable area */
++ iv = (u8 *)edesc->hw_desc + desc_bytes + sec4_sg_bytes;
++ iv_dma = dma_map_single(jrdev, iv, ivsize, DMA_FROM_DEVICE);
++ if (dma_mapping_error(jrdev, iv_dma)) {
++ dev_err(jrdev, "unable to map IV\n");
++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0,
++ 0, DMA_NONE, 0, 0);
++ kfree(edesc);
++ return ERR_PTR(-ENOMEM);
++ }
++
+ if (mapped_src_nents > 1)
+ sg_to_sec4_sg_last(req->src, mapped_src_nents, edesc->sec4_sg,
+ 0);
+
+- if (!out_contig) {
+- dma_to_sec4_sg_one(edesc->sec4_sg + dst_sg_idx,
+- iv_dma, ivsize, 0);
+- sg_to_sec4_sg_last(req->dst, mapped_dst_nents,
+- edesc->sec4_sg + dst_sg_idx + 1, 0);
+- }
++ dma_to_sec4_sg_one(edesc->sec4_sg + dst_sg_idx, iv_dma, ivsize, 0);
++ sg_to_sec4_sg_last(req->dst, mapped_dst_nents, edesc->sec4_sg +
++ dst_sg_idx + 1, 0);
+
+ edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
+ sec4_sg_bytes, DMA_TO_DEVICE);
+@@ -1825,7 +1798,6 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ sec4_sg_bytes, 1);
+ #endif
+
+- *iv_contig_out = out_contig;
+ return edesc;
+ }
+
+@@ -1836,19 +1808,17 @@ static int ablkcipher_givencrypt(struct skcipher_givcrypt_request *creq)
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+ struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
+ struct device *jrdev = ctx->jrdev;
+- bool iv_contig = false;
+ u32 *desc;
+ int ret = 0;
+
+ /* allocate extended descriptor */
+- edesc = ablkcipher_giv_edesc_alloc(creq, DESC_JOB_IO_LEN *
+- CAAM_CMD_SZ, &iv_contig);
++ edesc = ablkcipher_giv_edesc_alloc(creq, DESC_JOB_IO_LEN * CAAM_CMD_SZ);
+ if (IS_ERR(edesc))
+ return PTR_ERR(edesc);
+
+ /* Create and submit job descriptor*/
+ init_ablkcipher_giv_job(ctx->sh_desc_givenc, ctx->sh_desc_givenc_dma,
+- edesc, req, iv_contig);
++ edesc, req);
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR,
+ "ablkcipher jobdesc@" __stringify(__LINE__) ": ",
+--
+2.17.1
+
diff --git a/patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer b/patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer
new file mode 100644
index 0000000000..a497f9750e
--- /dev/null
+++ b/patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer
@@ -0,0 +1,137 @@
+From 8a2a0dd35f2e54c023d9041a5428b6c5639af86c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
+Date: Mon, 16 Apr 2018 08:07:05 -0500
+Subject: [PATCH] crypto: caam - strip input zeros from RSA input buffer
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 8a2a0dd35f2e54c023d9041a5428b6c5639af86c
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Sometimes the provided RSA input buffer provided is not stripped
+of leading zeros. This could cause its size to be bigger than that
+of the modulus, making the HW complain:
+
+caam_jr 2142000.jr1: 40000789: DECO: desc idx 7:
+Protocol Size Error - A protocol has seen an error in size. When
+running RSA, pdb size N < (size of F) when no formatting is used; or
+pdb size N < (F + 11) when formatting is used.
+
+Fix the problem by stripping off the leading zero from input data
+before feeding it to the CAAM accelerator.
+
+Fixes: 8c419778ab57e ("crypto: caam - add support for RSA algorithm")
+Cc: <stable@vger.kernel.org> # 4.8+
+Reported-by: Martin Townsend <mtownsend1973@gmail.com>
+Link: https://lkml.kernel.org/r/CABatt_ytYORYKtApcB4izhNanEKkGFi9XAQMjHi_n-8YWoCRiw@mail.gmail.com
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Tested-by: Fabio Estevam <fabio.estevam@nxp.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/caam/caampkc.c | 54 ++++++++++++++++++++++++++++++++++++++++++
+ drivers/crypto/caam/caampkc.h | 8 ++++++
+ 2 files changed, 62 insertions(+)
+
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -90,18 +90,71 @@ static void rsa_priv_f1_done(struct devi
+ akcipher_request_complete(req, err);
+ }
+
++static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
++ unsigned int nbytes,
++ unsigned int flags)
++{
++ struct sg_mapping_iter miter;
++ int lzeros, ents;
++ unsigned int len;
++ unsigned int tbytes = nbytes;
++ const u8 *buff;
++
++ ents = sg_nents_for_len(sgl, nbytes);
++ if (ents < 0)
++ return ents;
++
++ sg_miter_start(&miter, sgl, ents, SG_MITER_FROM_SG | flags);
++
++ lzeros = 0;
++ len = 0;
++ while (nbytes > 0) {
++ while (len && !*buff) {
++ lzeros++;
++ len--;
++ buff++;
++ }
++
++ if (len && *buff)
++ break;
++
++ sg_miter_next(&miter);
++ buff = miter.addr;
++ len = miter.length;
++
++ nbytes -= lzeros;
++ lzeros = 0;
++ }
++
++ miter.consumed = lzeros;
++ sg_miter_stop(&miter);
++ nbytes -= lzeros;
++
++ return tbytes - nbytes;
++}
++
+ static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req,
+ size_t desclen)
+ {
+ struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+ struct caam_rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
+ struct device *dev = ctx->dev;
++ struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req);
+ struct rsa_edesc *edesc;
+ gfp_t flags = (req->base.flags & (CRYPTO_TFM_REQ_MAY_BACKLOG |
+ CRYPTO_TFM_REQ_MAY_SLEEP)) ? GFP_KERNEL : GFP_ATOMIC;
++ int sg_flags = (flags == GFP_ATOMIC) ? SG_MITER_ATOMIC : 0;
+ int sgc;
+ int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
+ int src_nents, dst_nents;
++ int lzeros;
++
++ lzeros = caam_rsa_count_leading_zeros(req->src, req->src_len, sg_flags);
++ if (lzeros < 0)
++ return ERR_PTR(lzeros);
++
++ req->src_len -= lzeros;
++ req->src = scatterwalk_ffwd(req_ctx->src, req->src, lzeros);
+
+ src_nents = sg_nents_for_len(req->src, req->src_len);
+ dst_nents = sg_nents_for_len(req->dst, req->dst_len);
+@@ -533,6 +586,7 @@ static struct akcipher_alg caam_rsa = {
+ .max_size = caam_rsa_max_size,
+ .init = caam_rsa_init_tfm,
+ .exit = caam_rsa_exit_tfm,
++ .reqsize = sizeof(struct caam_rsa_req_ctx),
+ .base = {
+ .cra_name = "rsa",
+ .cra_driver_name = "rsa-caam",
+--- a/drivers/crypto/caam/caampkc.h
++++ b/drivers/crypto/caam/caampkc.h
+@@ -41,6 +41,14 @@ struct caam_rsa_ctx {
+ };
+
+ /**
++ * caam_rsa_req_ctx - per request context.
++ * @src: input scatterlist (stripped of leading zeros)
++ */
++struct caam_rsa_req_ctx {
++ struct scatterlist src[2];
++};
++
++/**
+ * rsa_edesc - s/w-extended rsa descriptor
+ * @src_nents : number of segments in input scatterlist
+ * @dst_nents : number of segments in output scatterlist
diff --git a/patches.drivers/crypto-omap-sham-fix-memleak b/patches.drivers/crypto-omap-sham-fix-memleak
new file mode 100644
index 0000000000..63ca32acad
--- /dev/null
+++ b/patches.drivers/crypto-omap-sham-fix-memleak
@@ -0,0 +1,39 @@
+From 9dbc8a0328efa485a6f5b68b867f9f523a3fbeff Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Tue, 17 Apr 2018 14:53:13 -0500
+Subject: [PATCH] crypto: omap-sham - fix memleak
+Git-commit: 9dbc8a0328efa485a6f5b68b867f9f523a3fbeff
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Fixes: 8043bb1ae03cb ("crypto: omap-sham - convert driver logic to use sgs for data xmit")
+
+The memory pages freed in omap_sham_finish_req() were less than those
+allocated in omap_sham_copy_sgs().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Acked-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/omap-sham.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index ad02aa63b519..d1a1c74fb56a 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -1087,7 +1087,7 @@ static void omap_sham_finish_req(struct ahash_request *req, int err)
+
+ if (test_bit(FLAGS_SGS_COPIED, &dd->flags))
+ free_pages((unsigned long)sg_virt(ctx->sg),
+- get_order(ctx->sg->length));
++ get_order(ctx->sg->length + ctx->bufcnt));
+
+ if (test_bit(FLAGS_SGS_ALLOCED, &dd->flags))
+ kfree(ctx->sg);
+--
+2.17.1
+
diff --git a/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS b/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS
new file mode 100644
index 0000000000..7bc0bda0ca
--- /dev/null
+++ b/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS
@@ -0,0 +1,38 @@
+From 730f23b66095a700e2f0786abda6bca011b31558 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 3 May 2018 22:29:30 +1000
+Subject: [PATCH] crypto: vmx - Remove overly verbose printk from AES XTS init
+Git-commit: 730f23b66095a700e2f0786abda6bca011b31558
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+In p8_aes_xts_init() we do a printk(KERN_INFO ...) to report the
+fallback implementation we're using. However with a slow console this
+can significantly affect the speed of crypto operations. So remove it.
+
+Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS")
+Cc: stable@vger.kernel.org # v4.8+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/vmx/aes_xts.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
+index 8cd6e62e4c90..8bd9aff0f55f 100644
+--- a/drivers/crypto/vmx/aes_xts.c
++++ b/drivers/crypto/vmx/aes_xts.c
+@@ -53,8 +53,6 @@ static int p8_aes_xts_init(struct crypto_tfm *tfm)
+ alg, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+- printk(KERN_INFO "Using '%s' as fallback implementation.\n",
+- crypto_skcipher_driver_name(fallback));
+
+ crypto_skcipher_set_flags(
+ fallback,
+--
+2.17.1
+
diff --git a/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini b/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini
new file mode 100644
index 0000000000..508a6291ae
--- /dev/null
+++ b/patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini
@@ -0,0 +1,78 @@
+From 1411b5218adbcf1d45ddb260db5553c52e8d917c Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 3 May 2018 22:29:29 +1000
+Subject: [PATCH] crypto: vmx - Remove overly verbose printk from AES init routines
+Git-commit: 1411b5218adbcf1d45ddb260db5553c52e8d917c
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+In the vmx AES init routines we do a printk(KERN_INFO ...) to report
+the fallback implementation we're using.
+
+However with a slow console this can significantly affect the speed of
+crypto operations. Using 'cryptsetup benchmark' the removal of the
+printk() leads to a ~5x speedup for aes-cbc decryption.
+
+So remove them.
+
+Fixes: 8676590a1593 ("crypto: vmx - Adding AES routines for VMX module")
+Fixes: 8c755ace357c ("crypto: vmx - Adding CBC routines for VMX module")
+Fixes: 4f7f60d312b3 ("crypto: vmx - Adding CTR routines for VMX module")
+Fixes: cc333cd68dfa ("crypto: vmx - Adding GHASH routines for VMX module")
+Cc: stable@vger.kernel.org # v4.1+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/vmx/aes.c | 2 --
+ drivers/crypto/vmx/aes_cbc.c | 3 ---
+ drivers/crypto/vmx/aes_ctr.c | 2 --
+ drivers/crypto/vmx/ghash.c | 2 --
+ 4 files changed, 9 deletions(-)
+
+--- a/drivers/crypto/vmx/aes.c
++++ b/drivers/crypto/vmx/aes.c
+@@ -53,8 +53,6 @@ static int p8_aes_init(struct crypto_tfm
+ alg, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+- printk(KERN_INFO "Using '%s' as fallback implementation.\n",
+- crypto_tfm_alg_driver_name((struct crypto_tfm *) fallback));
+
+ crypto_cipher_set_flags(fallback,
+ crypto_cipher_get_flags((struct
+--- a/drivers/crypto/vmx/aes_cbc.c
++++ b/drivers/crypto/vmx/aes_cbc.c
+@@ -57,9 +57,6 @@ static int p8_aes_cbc_init(struct crypto
+ alg, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+- printk(KERN_INFO "Using '%s' as fallback implementation.\n",
+- crypto_skcipher_driver_name(fallback));
+-
+
+ crypto_skcipher_set_flags(
+ fallback,
+--- a/drivers/crypto/vmx/aes_ctr.c
++++ b/drivers/crypto/vmx/aes_ctr.c
+@@ -53,8 +53,6 @@ static int p8_aes_ctr_init(struct crypto
+ alg, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+- printk(KERN_INFO "Using '%s' as fallback implementation.\n",
+- crypto_tfm_alg_driver_name((struct crypto_tfm *) fallback));
+
+ crypto_blkcipher_set_flags(
+ fallback,
+--- a/drivers/crypto/vmx/ghash.c
++++ b/drivers/crypto/vmx/ghash.c
+@@ -64,8 +64,6 @@ static int p8_ghash_init_tfm(struct cryp
+ alg, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+- printk(KERN_INFO "Using '%s' as fallback implementation.\n",
+- crypto_tfm_alg_driver_name(crypto_shash_tfm(fallback)));
+
+ crypto_shash_set_flags(fallback,
+ crypto_shash_get_flags((struct crypto_shash
diff --git a/patches.drivers/drm-amdkfd-fix-clock-counter-retrieval-for-node-with b/patches.drivers/drm-amdkfd-fix-clock-counter-retrieval-for-node-with
new file mode 100644
index 0000000000..40d99b74c7
--- /dev/null
+++ b/patches.drivers/drm-amdkfd-fix-clock-counter-retrieval-for-node-with
@@ -0,0 +1,52 @@
+From 1cf6cc74bbeb85bb87c3ca3f3df97a283c3aa737 Mon Sep 17 00:00:00 2001
+From: Andres Rodriguez <andres.rodriguez@amd.com>
+Date: Tue, 10 Apr 2018 17:32:33 -0400
+Subject: [PATCH] drm/amdkfd: fix clock counter retrieval for node without GPU
+Git-commit: 1cf6cc74bbeb85bb87c3ca3f3df97a283c3aa737
+Patch-mainline: v4.17-rc3
+References: bsc#1051510
+
+Currently if a user requests clock counters for a node without a GPU
+resource we will always return EINVAL.
+
+Instead if no GPU resource is attached, fill the gpu_clock_counter
+argument with zeroes so that we may proceed and return valid CPU
+counters.
+
+Signed-off-by: Andres Rodriguez <andres.rodriguez@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index f65e0142d42e..59808a39ecf4 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -749,12 +749,13 @@ static int kfd_ioctl_get_clock_counters(struct file *filep,
+ struct timespec64 time;
+
+ dev = kfd_device_by_id(args->gpu_id);
+- if (dev == NULL)
+- return -EINVAL;
+-
+- /* Reading GPU clock counter from KGD */
+- args->gpu_clock_counter =
+- dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
++ if (dev)
++ /* Reading GPU clock counter from KGD */
++ args->gpu_clock_counter =
++ dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
++ else
++ /* Node without GPU resource */
++ args->gpu_clock_counter = 0;
+
+ /* No access to rdtsc. Using raw monotonic time */
+ getrawmonotonic64(&time);
+--
+2.17.1
+
diff --git a/patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create b/patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create
new file mode 100644
index 0000000000..6b49de696e
--- /dev/null
+++ b/patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create
@@ -0,0 +1,55 @@
+From 2b6207291b7b277a5df9d1aab44b56815a292dba Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 16 May 2018 17:00:26 +0300
+Subject: [PATCH] drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
+Git-commit: 2b6207291b7b277a5df9d1aab44b56815a292dba
+Patch-mainline: v4.17-rc6
+References: bsc#1051510
+
+There is a comment here which says that DIV_ROUND_UP() and that's where
+the problem comes from. Say you pick:
+
+ args->bpp = UINT_MAX - 7;
+ args->width = 4;
+ args->height = 1;
+
+The integer overflow in DIV_ROUND_UP() means "cpp" is UINT_MAX / 8 and
+because of how we picked args->width that means cpp < UINT_MAX / 4.
+
+I've fixed it by preventing the integer overflow in DIV_ROUND_UP(). I
+removed the check for !cpp because it's not possible after this change.
+I also changed all the 0xffffffffU references to U32_MAX.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180516140026.GA19340@mwanda
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/drm_dumb_buffers.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c
+index 39ac15ce4702..9e2ae02f31e0 100644
+--- a/drivers/gpu/drm/drm_dumb_buffers.c
++++ b/drivers/gpu/drm/drm_dumb_buffers.c
+@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
+ return -EINVAL;
+
+ /* overflow checks for 32bit size calculations */
+- /* NOTE: DIV_ROUND_UP() can overflow */
++ if (args->bpp > U32_MAX - 8)
++ return -EINVAL;
+ cpp = DIV_ROUND_UP(args->bpp, 8);
+- if (!cpp || cpp > 0xffffffffU / args->width)
++ if (cpp > U32_MAX / args->width)
+ return -EINVAL;
+ stride = cpp * args->width;
+- if (args->height > 0xffffffffU / stride)
++ if (args->height > U32_MAX / stride)
+ return -EINVAL;
+
+ /* test for wrap-around */
+--
+2.17.1
+
diff --git a/patches.drivers/drm-msm-dsi-use-correct-enum-in-dsi_get_cmd_fmt b/patches.drivers/drm-msm-dsi-use-correct-enum-in-dsi_get_cmd_fmt
new file mode 100644
index 0000000000..42acfaa9cb
--- /dev/null
+++ b/patches.drivers/drm-msm-dsi-use-correct-enum-in-dsi_get_cmd_fmt
@@ -0,0 +1,43 @@
+From a4af89286f8fc382459308764ea05935dc477cdc Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Mon, 19 Mar 2018 22:26:32 +0100
+Subject: [PATCH] drm/msm/dsi: use correct enum in dsi_get_cmd_fmt
+Git-commit: a4af89286f8fc382459308764ea05935dc477cdc
+Patch-mainline: v4.17-rc3
+References: bsc#1051510
+
+The function dsi_get_cmd_fmt returns enum dsi_cmd_dst_format,
+use the correct enum value also for MIPI_DSI_FMT_RGB666/_PACKED.
+
+This has been discovered using clang:
+ drivers/gpu/drm/msm/dsi/dsi_host.c:743:35: warning: implicit conversion
+ from enumeration type 'enum dsi_vid_dst_format' to different
+ enumeration type 'enum dsi_cmd_dst_format' [-Wenum-conversion]
+ case MIPI_DSI_FMT_RGB666: return VID_DST_FORMAT_RGB666;
+ ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Archit Taneja <architt@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 2f770386ab4a..8baba30d6c65 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -776,7 +776,7 @@ static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt(
+ switch (mipi_fmt) {
+ case MIPI_DSI_FMT_RGB888: return CMD_DST_FORMAT_RGB888;
+ case MIPI_DSI_FMT_RGB666_PACKED:
+- case MIPI_DSI_FMT_RGB666: return VID_DST_FORMAT_RGB666;
++ case MIPI_DSI_FMT_RGB666: return CMD_DST_FORMAT_RGB666;
+ case MIPI_DSI_FMT_RGB565: return CMD_DST_FORMAT_RGB565;
+ default: return CMD_DST_FORMAT_RGB888;
+ }
+--
+2.17.1
+
diff --git a/patches.drivers/drm-omap-fix-possible-NULL-ref-issue-in-tiler_reserv b/patches.drivers/drm-omap-fix-possible-NULL-ref-issue-in-tiler_reserv
new file mode 100644
index 0000000000..6dbadcd6ce
--- /dev/null
+++ b/patches.drivers/drm-omap-fix-possible-NULL-ref-issue-in-tiler_reserv
@@ -0,0 +1,42 @@
+From 6a0f0c55619f0b82a677cab72e77c3444a5eee58 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 29 Mar 2018 13:40:37 +0300
+Subject: [PATCH] drm/omap: fix possible NULL ref issue in tiler_reserve_2d
+Git-commit: 6a0f0c55619f0b82a677cab72e77c3444a5eee58
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+tiler_reserve_2d allocates memory but does not check if it got the
+memory. Add the check and return ENOMEM on failure.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180329104038.29154-2-tomi.valkeinen@ti.com
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -389,12 +389,16 @@ int tiler_unpin(struct tiler_block *bloc
+ struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, uint16_t w,
+ uint16_t h, uint16_t align)
+ {
+- struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
++ struct tiler_block *block;
+ u32 min_align = 128;
+ int ret;
+ unsigned long flags;
+ size_t slot_bytes;
+
++ block = kzalloc(sizeof(*block), GFP_KERNEL);
++ if (!block)
++ return ERR_PTR(-ENOMEM);
++
+ BUG_ON(!validfmt(fmt));
+
+ /* convert width/height to slots */
diff --git a/patches.drivers/drm-omap-fix-uninitialized-ret-variable b/patches.drivers/drm-omap-fix-uninitialized-ret-variable
new file mode 100644
index 0000000000..d401655787
--- /dev/null
+++ b/patches.drivers/drm-omap-fix-uninitialized-ret-variable
@@ -0,0 +1,53 @@
+From 77eeac24b10fc84d3ffd5b11a897dff88dde244d Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 29 Mar 2018 13:40:36 +0300
+Subject: [PATCH] drm/omap: fix uninitialized ret variable
+Git-commit: 77eeac24b10fc84d3ffd5b11a897dff88dde244d
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+audio_config function for both HDMI4 and HDMI5 return uninitialized
+value as the error code if the display is not currently enabled. For
+some reason this has not caused any issues.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180329104038.29154-1-tomi.valkeinen@ti.com
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/omapdrm/dss/hdmi4.c | 2 +-
+ drivers/gpu/drm/omapdrm/dss/hdmi5.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+index 97c88861d67a..5879f45f6fc9 100644
+--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c
++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+@@ -679,7 +679,7 @@ static int hdmi_audio_config(struct device *dev,
+ struct omap_dss_audio *dss_audio)
+ {
+ struct omap_hdmi *hd = dev_get_drvdata(dev);
+- int ret;
++ int ret = 0;
+
+ mutex_lock(&hd->lock);
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+index d28da9ac3e90..ae1a001d1b83 100644
+--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
++++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+@@ -671,7 +671,7 @@ static int hdmi_audio_config(struct device *dev,
+ struct omap_dss_audio *dss_audio)
+ {
+ struct omap_hdmi *hd = dev_get_drvdata(dev);
+- int ret;
++ int ret = 0;
+
+ mutex_lock(&hd->lock);
+
+--
+2.17.1
+
diff --git a/patches.drivers/drm-omap-handle-alloc-failures-in-omap_connector b/patches.drivers/drm-omap-handle-alloc-failures-in-omap_connector
new file mode 100644
index 0000000000..6b1b23753f
--- /dev/null
+++ b/patches.drivers/drm-omap-handle-alloc-failures-in-omap_connector
@@ -0,0 +1,60 @@
+From 47aaaec818dfd1009d1358974a2931f05dd57203 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Wed, 2 May 2018 12:11:59 +0300
+Subject: [PATCH] drm/omap: handle alloc failures in omap_connector
+Git-commit: 47aaaec818dfd1009d1358974a2931f05dd57203
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+Handle memory allocation failures in omap_connector to avoid NULL
+derefs.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180502091159.7071-5-tomi.valkeinen@ti.com
+Reviewed-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/omapdrm/omap_connector.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c
+index a0d7b1d905e8..5cde26ac937b 100644
+--- a/drivers/gpu/drm/omapdrm/omap_connector.c
++++ b/drivers/gpu/drm/omapdrm/omap_connector.c
+@@ -121,6 +121,9 @@ static int omap_connector_get_modes(struct drm_connector *connector)
+ if (dssdrv->read_edid) {
+ void *edid = kzalloc(MAX_EDID, GFP_KERNEL);
+
++ if (!edid)
++ return 0;
++
+ if ((dssdrv->read_edid(dssdev, edid, MAX_EDID) > 0) &&
+ drm_edid_is_valid(edid)) {
+ drm_mode_connector_update_edid_property(
+@@ -139,6 +142,9 @@ static int omap_connector_get_modes(struct drm_connector *connector)
+ struct drm_display_mode *mode = drm_mode_create(dev);
+ struct videomode vm = {0};
+
++ if (!mode)
++ return 0;
++
+ dssdrv->get_timings(dssdev, &vm);
+
+ drm_display_mode_from_videomode(&vm, mode);
+@@ -200,6 +206,10 @@ static int omap_connector_mode_valid(struct drm_connector *connector,
+ if (!r) {
+ /* check if vrefresh is still valid */
+ new_mode = drm_mode_duplicate(dev, mode);
++
++ if (!new_mode)
++ return MODE_BAD;
++
+ new_mode->clock = vm.pixelclock / 1000;
+ new_mode->vrefresh = 0;
+ if (mode->vrefresh == drm_mode_vrefresh(new_mode))
+--
+2.17.1
+
diff --git a/patches.drivers/drm-omap-silence-unititialized-variable-warning b/patches.drivers/drm-omap-silence-unititialized-variable-warning
new file mode 100644
index 0000000000..3422e17318
--- /dev/null
+++ b/patches.drivers/drm-omap-silence-unititialized-variable-warning
@@ -0,0 +1,40 @@
+From 4a9fbfcab19d3f71ad2bf0bcb653c4ee84e69c7f Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 18 Apr 2018 17:29:37 +0300
+Subject: [PATCH] drm/omap: silence unititialized variable warning
+Git-commit: 4a9fbfcab19d3f71ad2bf0bcb653c4ee84e69c7f
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+Smatch complains that "area_free" could be used without being
+initialized. This code is several years old and premusably works fine
+so this can't be a very serious bug. But it's easy enough to silence
+the warning. If "area_free" is false at the end of the function then
+we return -ENOMEM.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180418142937.GA13828@mwanda
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/omapdrm/tcm-sita.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/tcm-sita.c b/drivers/gpu/drm/omapdrm/tcm-sita.c
+index d7f7bc9f061a..817be3c41863 100644
+--- a/drivers/gpu/drm/omapdrm/tcm-sita.c
++++ b/drivers/gpu/drm/omapdrm/tcm-sita.c
+@@ -90,7 +90,7 @@ static int l2r_t2b(u16 w, u16 h, u16 a, s16 offset,
+ {
+ int i;
+ unsigned long index;
+- bool area_free;
++ bool area_free = false;
+ unsigned long slots_per_band = PAGE_SIZE / slot_bytes;
+ unsigned long bit_offset = (offset > 0) ? offset / slot_bytes : 0;
+ unsigned long curr_bit = bit_offset;
+--
+2.17.1
+
diff --git a/patches.drivers/emulex-benet-Constify-be_misconfig_evt_port_state.patch b/patches.drivers/emulex-benet-Constify-be_misconfig_evt_port_state.patch
new file mode 100644
index 0000000000..fcafffa926
--- /dev/null
+++ b/patches.drivers/emulex-benet-Constify-be_misconfig_evt_port_state.patch
@@ -0,0 +1,47 @@
+From: =?UTF-8?q?Hern=C3=A1n=20Gonzalez?= <hernan@vanguardiasur.com.ar>
+Date: Tue, 27 Feb 2018 19:29:23 -0300
+Subject: emulex/benet: Constify *be_misconfig_evt_port_state[]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v4.17-rc1
+Git-commit: 262c9740159ab0286663b46b00e20845fed05e57
+References: bsc#1086288 FATE#324877
+
+Note: This is compile only tested as I have no access to the hw.
+No benefit gained except for some self-documenting.
+
+add/remove: 0/0 grow/shrink: 0/0 up/down: 0/0 (0)
+Function old new delta
+Total: Before=2757703, After=2757703, chg +0.00%
+
+Signed-off-by: Hernán Gonzalez <hernan@vanguardiasur.com.ar>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: David Chang <dchang@suse.com>
+---
+ drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +-
+ drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -19,7 +19,7 @@
+ #include "be.h"
+ #include "be_cmds.h"
+
+-char *be_misconfig_evt_port_state[] = {
++const char * const be_misconfig_evt_port_state[] = {
+ "Physical Link is functional",
+ "Optics faulted/incorrectly installed/not installed - Reseat optics. If issue not resolved, replace.",
+ "Optics of two types installed – Remove one optic or install matching pair of optics.",
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
+@@ -201,7 +201,7 @@ enum {
+ phy_state == BE_PHY_UNQUALIFIED || \
+ phy_state == BE_PHY_UNCERTIFIED)
+
+-extern char *be_misconfig_evt_port_state[];
++extern const char * const be_misconfig_evt_port_state[];
+
+ /* async event indicating misconfigured port */
+ struct be_async_event_misconfig_port {
diff --git a/patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch b/patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch
new file mode 100644
index 0000000000..92b7aac77e
--- /dev/null
+++ b/patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch
@@ -0,0 +1,1150 @@
+From: Joe Perches <joe@perches.com>
+Date: Fri, 23 Mar 2018 16:34:44 -0700
+Subject: ethernet: Use octal not symbolic permissions
+Patch-mainline: v4.17-rc1
+Git-commit: d3757ba4c1421d2ad00d2bf97119005e37ad2902
+References: bsc#1086288 FATE#324877
+
+Prefer the direct use of octal for permissions.
+
+Done with checkpatch -f --types=SYMBOLIC_PERMS --fix-inplace
+and some typing.
+
+Miscellanea:
+
+o Whitespace neatening around these conversions.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: David Chang <dchang@suse.com>
+---
+ drivers/net/ethernet/8390/apne.c | 2
+ drivers/net/ethernet/8390/lib8390.c | 2
+ drivers/net/ethernet/8390/ne.c | 2
+ drivers/net/ethernet/8390/ne2k-pci.c | 2
+ drivers/net/ethernet/8390/smc-ultra.c | 2
+ drivers/net/ethernet/8390/stnic.c | 2
+ drivers/net/ethernet/8390/wd.c | 2
+ drivers/net/ethernet/altera/altera_tse_main.c | 6 -
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 -
+ drivers/net/ethernet/amd/xgbe/xgbe-main.c | 2
+ drivers/net/ethernet/broadcom/bnx2.c | 2
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 +-
+ drivers/net/ethernet/broadcom/sb1250-mac.c | 10 -
+ drivers/net/ethernet/broadcom/tg3.c | 6 -
+ drivers/net/ethernet/brocade/bna/bnad.c | 2
+ drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 10 -
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 2
+ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 6 -
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 112 +++++++++----------
+ drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 10 -
+ drivers/net/ethernet/ec_bhf.c | 2
+ drivers/net/ethernet/emulex/benet/be_main.c | 6 -
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 7 -
+ drivers/net/ethernet/ibm/ibmveth.c | 2
+ drivers/net/ethernet/intel/igb/igb_hwmon.c | 2
+ drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c | 2
+ drivers/net/ethernet/marvell/mvneta.c | 8 -
+ drivers/net/ethernet/marvell/skge.c | 2
+ drivers/net/ethernet/marvell/sky2.c | 2
+ drivers/net/ethernet/mellanox/mlx4/main.c | 16 +-
+ drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 10 -
+ drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 32 ++---
+ drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c | 6 -
+ drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 14 +-
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 30 ++---
+ drivers/net/ethernet/qualcomm/qca_debug.c | 2
+ drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4
+ drivers/net/ethernet/sfc/mcdi_mon.c | 2
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 26 ++--
+ drivers/net/ethernet/sun/niu.c | 10 -
+ 40 files changed, 194 insertions(+), 195 deletions(-)
+
+--- a/drivers/net/ethernet/8390/apne.c
++++ b/drivers/net/ethernet/8390/apne.c
+@@ -117,7 +117,7 @@ static const char version[] =
+ static int apne_owned; /* signal if card already owned */
+
+ static u32 apne_msg_enable;
+-module_param_named(msg_enable, apne_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, apne_msg_enable, uint, 0444);
+ MODULE_PARM_DESC(msg_enable, "Debug message level (see linux/netdevice.h for bitmap)");
+
+ struct net_device * __init apne_probe(int unit)
+--- a/drivers/net/ethernet/8390/lib8390.c
++++ b/drivers/net/ethernet/8390/lib8390.c
+@@ -113,7 +113,7 @@ static void __NS8390_init(struct net_dev
+
+ static unsigned version_printed;
+ static u32 msg_enable;
+-module_param(msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param(msg_enable, uint, 0444);
+ MODULE_PARM_DESC(msg_enable, "Debug message level (see linux/netdevice.h for bitmap)");
+
+ /*
+--- a/drivers/net/ethernet/8390/ne.c
++++ b/drivers/net/ethernet/8390/ne.c
+@@ -77,7 +77,7 @@ static u32 ne_msg_enable;
+ module_param_hw_array(io, int, ioport, NULL, 0);
+ module_param_hw_array(irq, int, irq, NULL, 0);
+ module_param_array(bad, int, NULL, 0);
+-module_param_named(msg_enable, ne_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, ne_msg_enable, uint, 0444);
+ MODULE_PARM_DESC(io, "I/O base address(es),required");
+ MODULE_PARM_DESC(irq, "IRQ number(s)");
+ MODULE_PARM_DESC(bad, "Accept card(s) with bad signatures");
+--- a/drivers/net/ethernet/8390/ne2k-pci.c
++++ b/drivers/net/ethernet/8390/ne2k-pci.c
+@@ -76,7 +76,7 @@ MODULE_AUTHOR("Donald Becker / Paul Gort
+ MODULE_DESCRIPTION("PCI NE2000 clone driver");
+ MODULE_LICENSE("GPL");
+
+-module_param_named(msg_enable, ne2k_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, ne2k_msg_enable, uint, 0444);
+ module_param_array(options, int, NULL, 0);
+ module_param_array(full_duplex, int, NULL, 0);
+ MODULE_PARM_DESC(msg_enable, "Debug message level (see linux/netdevice.h for bitmap)");
+--- a/drivers/net/ethernet/8390/smc-ultra.c
++++ b/drivers/net/ethernet/8390/smc-ultra.c
+@@ -563,7 +563,7 @@ static int irq[MAX_ULTRA_CARDS];
+
+ module_param_hw_array(io, int, ioport, NULL, 0);
+ module_param_hw_array(irq, int, irq, NULL, 0);
+-module_param_named(msg_enable, ultra_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, ultra_msg_enable, uint, 0444);
+ MODULE_PARM_DESC(io, "I/O base address(es)");
+ MODULE_PARM_DESC(irq, "IRQ number(s) (assigned)");
+ MODULE_PARM_DESC(msg_enable, "Debug message level (see linux/netdevice.h for bitmap)");
+--- a/drivers/net/ethernet/8390/stnic.c
++++ b/drivers/net/ethernet/8390/stnic.c
+@@ -71,7 +71,7 @@ static void stnic_init (struct net_devic
+
+ static u32 stnic_msg_enable;
+
+-module_param_named(msg_enable, stnic_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, stnic_msg_enable, uint, 0444);
+ MODULE_PARM_DESC(msg_enable, "Debug message level (see linux/netdevice.h for bitmap)");
+
+ /* SH7750 specific read/write io. */
+--- a/drivers/net/ethernet/8390/wd.c
++++ b/drivers/net/ethernet/8390/wd.c
+@@ -507,7 +507,7 @@ module_param_hw_array(io, int, ioport, N
+ module_param_hw_array(irq, int, irq, NULL, 0);
+ module_param_hw_array(mem, int, iomem, NULL, 0);
+ module_param_hw_array(mem_end, int, iomem, NULL, 0);
+-module_param_named(msg_enable, wd_msg_enable, uint, (S_IRUSR|S_IRGRP|S_IROTH));
++module_param_named(msg_enable, wd_msg_enable, uint, 0444);
+ MODULE_PARM_DESC(io, "I/O base address(es)");
+ MODULE_PARM_DESC(irq, "IRQ number(s) (ignored for PureData boards)");
+ MODULE_PARM_DESC(mem, "memory base address(es)(ignored for PureData boards)");
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -56,7 +56,7 @@
+ static atomic_t instance_count = ATOMIC_INIT(~0);
+ /* Module parameters */
+ static int debug = -1;
+-module_param(debug, int, S_IRUGO | S_IWUSR);
++module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Message Level (-1: default, 0: no output, 16: all)");
+
+ static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
+@@ -65,12 +65,12 @@ static const u32 default_msg_level = (NE
+
+ #define RX_DESCRIPTORS 64
+ static int dma_rx_num = RX_DESCRIPTORS;
+-module_param(dma_rx_num, int, S_IRUGO | S_IWUSR);
++module_param(dma_rx_num, int, 0644);
+ MODULE_PARM_DESC(dma_rx_num, "Number of descriptors in the RX list");
+
+ #define TX_DESCRIPTORS 64
+ static int dma_tx_num = TX_DESCRIPTORS;
+-module_param(dma_tx_num, int, S_IRUGO | S_IWUSR);
++module_param(dma_tx_num, int, 0644);
+ MODULE_PARM_DESC(dma_tx_num, "Number of descriptors in the TX list");
+
+
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -136,21 +136,21 @@ static unsigned int ecc_ded_period = 600
+
+ #ifdef CONFIG_AMD_XGBE_HAVE_ECC
+ /* Only expose the ECC parameters if supported */
+-module_param(ecc_sec_info_threshold, uint, S_IWUSR | S_IRUGO);
++module_param(ecc_sec_info_threshold, uint, 0644);
+ MODULE_PARM_DESC(ecc_sec_info_threshold,
+ " ECC corrected error informational threshold setting");
+
+-module_param(ecc_sec_warn_threshold, uint, S_IWUSR | S_IRUGO);
++module_param(ecc_sec_warn_threshold, uint, 0644);
+ MODULE_PARM_DESC(ecc_sec_warn_threshold,
+ " ECC corrected error warning threshold setting");
+
+-module_param(ecc_sec_period, uint, S_IWUSR | S_IRUGO);
++module_param(ecc_sec_period, uint, 0644);
+ MODULE_PARM_DESC(ecc_sec_period, " ECC corrected error period (in seconds)");
+
+-module_param(ecc_ded_threshold, uint, S_IWUSR | S_IRUGO);
++module_param(ecc_ded_threshold, uint, 0644);
+ MODULE_PARM_DESC(ecc_ded_threshold, " ECC detected error threshold setting");
+
+-module_param(ecc_ded_period, uint, S_IWUSR | S_IRUGO);
++module_param(ecc_ded_period, uint, 0644);
+ MODULE_PARM_DESC(ecc_ded_period, " ECC detected error period (in seconds)");
+ #endif
+
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+@@ -130,7 +130,7 @@ MODULE_VERSION(XGBE_DRV_VERSION);
+ MODULE_DESCRIPTION(XGBE_DRV_DESC);
+
+ static int debug = -1;
+-module_param(debug, int, S_IWUSR | S_IRUGO);
++module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, " Network interface message level setting");
+
+ static const u32 default_msg_level = (NETIF_MSG_LINK | NETIF_MSG_IFDOWN |
+--- a/drivers/net/ethernet/broadcom/bnx2.c
++++ b/drivers/net/ethernet/broadcom/bnx2.c
+@@ -87,7 +87,7 @@ MODULE_FIRMWARE(FW_RV2P_FILE_09_Ax);
+
+ static int disable_msi = 0;
+
+-module_param(disable_msi, int, S_IRUGO);
++module_param(disable_msi, int, 0444);
+ MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
+
+ typedef enum {
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -97,29 +97,29 @@ MODULE_FIRMWARE(FW_FILE_NAME_E1H);
+ MODULE_FIRMWARE(FW_FILE_NAME_E2);
+
+ int bnx2x_num_queues;
+-module_param_named(num_queues, bnx2x_num_queues, int, S_IRUGO);
++module_param_named(num_queues, bnx2x_num_queues, int, 0444);
+ MODULE_PARM_DESC(num_queues,
+ " Set number of queues (default is as a number of CPUs)");
+
+ static int disable_tpa;
+-module_param(disable_tpa, int, S_IRUGO);
++module_param(disable_tpa, int, 0444);
+ MODULE_PARM_DESC(disable_tpa, " Disable the TPA (LRO) feature");
+
+ static int int_mode;
+-module_param(int_mode, int, S_IRUGO);
++module_param(int_mode, int, 0444);
+ MODULE_PARM_DESC(int_mode, " Force interrupt mode other than MSI-X "
+ "(1 INT#x; 2 MSI)");
+
+ static int dropless_fc;
+-module_param(dropless_fc, int, S_IRUGO);
++module_param(dropless_fc, int, 0444);
+ MODULE_PARM_DESC(dropless_fc, " Pause on exhausted host ring");
+
+ static int mrrs = -1;
+-module_param(mrrs, int, S_IRUGO);
++module_param(mrrs, int, 0444);
+ MODULE_PARM_DESC(mrrs, " Force Max Read Req Size (0..3) (for debug)");
+
+ static int debug;
+-module_param(debug, int, S_IRUGO);
++module_param(debug, int, 0444);
+ MODULE_PARM_DESC(debug, " Default debug msglevel");
+
+ static struct workqueue_struct *bnx2x_wq;
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -63,24 +63,24 @@ MODULE_DESCRIPTION("Broadcom SiByte SOC
+
+ /* 1 normal messages, 0 quiet .. 7 verbose. */
+ static int debug = 1;
+-module_param(debug, int, S_IRUGO);
++module_param(debug, int, 0444);
+ MODULE_PARM_DESC(debug, "Debug messages");
+
+ #ifdef CONFIG_SBMAC_COALESCE
+ static int int_pktcnt_tx = 255;
+-module_param(int_pktcnt_tx, int, S_IRUGO);
++module_param(int_pktcnt_tx, int, 0444);
+ MODULE_PARM_DESC(int_pktcnt_tx, "TX packet count");
+
+ static int int_timeout_tx = 255;
+-module_param(int_timeout_tx, int, S_IRUGO);
++module_param(int_timeout_tx, int, 0444);
+ MODULE_PARM_DESC(int_timeout_tx, "TX timeout value");
+
+ static int int_pktcnt_rx = 64;
+-module_param(int_pktcnt_rx, int, S_IRUGO);
++module_param(int_pktcnt_rx, int, 0444);
+ MODULE_PARM_DESC(int_pktcnt_rx, "RX packet count");
+
+ static int int_timeout_rx = 64;
+-module_param(int_timeout_rx, int, S_IRUGO);
++module_param(int_timeout_rx, int, 0444);
+ MODULE_PARM_DESC(int_timeout_rx, "RX timeout value");
+ #endif
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10789,11 +10789,11 @@ static ssize_t tg3_show_temp(struct devi
+ }
+
+
+-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, tg3_show_temp, NULL,
++static SENSOR_DEVICE_ATTR(temp1_input, 0444, tg3_show_temp, NULL,
+ TG3_TEMP_SENSOR_OFFSET);
+-static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, tg3_show_temp, NULL,
++static SENSOR_DEVICE_ATTR(temp1_crit, 0444, tg3_show_temp, NULL,
+ TG3_TEMP_CAUTION_OFFSET);
+-static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, tg3_show_temp, NULL,
++static SENSOR_DEVICE_ATTR(temp1_max, 0444, tg3_show_temp, NULL,
+ TG3_TEMP_MAX_OFFSET);
+
+ static struct attribute *tg3_attrs[] = {
+--- a/drivers/net/ethernet/brocade/bna/bnad.c
++++ b/drivers/net/ethernet/brocade/bna/bnad.c
+@@ -46,7 +46,7 @@ module_param(bnad_ioc_auto_recover, uint
+ MODULE_PARM_DESC(bnad_ioc_auto_recover, "Enable / Disable auto recovery");
+
+ static uint bna_debugfs_enable = 1;
+-module_param(bna_debugfs_enable, uint, S_IRUGO | S_IWUSR);
++module_param(bna_debugfs_enable, uint, 0644);
+ MODULE_PARM_DESC(bna_debugfs_enable, "Enables debugfs feature, default=1,"
+ " Range[false:0|true:1]");
+
+--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
++++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+@@ -486,11 +486,11 @@ struct bnad_debugfs_entry {
+ };
+
+ static const struct bnad_debugfs_entry bnad_debugfs_files[] = {
+- { "fwtrc", S_IFREG|S_IRUGO, &bnad_debugfs_op_fwtrc, },
+- { "fwsave", S_IFREG|S_IRUGO, &bnad_debugfs_op_fwsave, },
+- { "regrd", S_IFREG|S_IRUGO|S_IWUSR, &bnad_debugfs_op_regrd, },
+- { "regwr", S_IFREG|S_IWUSR, &bnad_debugfs_op_regwr, },
+- { "drvinfo", S_IFREG|S_IRUGO, &bnad_debugfs_op_drvinfo, },
++ { "fwtrc", S_IFREG | 0444, &bnad_debugfs_op_fwtrc, },
++ { "fwsave", S_IFREG | 0444, &bnad_debugfs_op_fwsave, },
++ { "regrd", S_IFREG | 0644, &bnad_debugfs_op_regrd, },
++ { "regwr", S_IFREG | 0200, &bnad_debugfs_op_regwr, },
++ { "drvinfo", S_IFREG | 0444, &bnad_debugfs_op_drvinfo, },
+ };
+
+ static struct dentry *bna_debugfs_root;
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -61,7 +61,7 @@ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Debug message level bitmap");
+
+ static int cpi_alg = CPI_ALG_NONE;
+-module_param(cpi_alg, int, S_IRUGO);
++module_param(cpi_alg, int, 0444);
+ MODULE_PARM_DESC(cpi_alg,
+ "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)");
+
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -776,11 +776,11 @@ static ssize_t store_nservers(struct dev
+
+ #define CXGB3_ATTR_R(name, val_expr) \
+ CXGB3_SHOW(name, val_expr) \
+-static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
++static DEVICE_ATTR(name, 0444, show_##name, NULL)
+
+ #define CXGB3_ATTR_RW(name, val_expr, store_method) \
+ CXGB3_SHOW(name, val_expr) \
+-static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_##name, store_method)
++static DEVICE_ATTR(name, 0644, show_##name, store_method)
+
+ CXGB3_ATTR_R(cam_size, t3_mc5_size(&adap->mc5));
+ CXGB3_ATTR_RW(nfilters, adap->params.mc5.nfilters, store_nfilters);
+@@ -857,7 +857,7 @@ static ssize_t store_##name(struct devic
+ { \
+ return tm_attr_store(d, buf, len, sched); \
+ } \
+-static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_##name, store_##name)
++static DEVICE_ATTR(name, 0644, show_##name, store_##name)
+
+ TM_ATTR(sched0, 0);
+ TM_ATTR(sched1, 1);
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -2745,7 +2745,7 @@ DEFINE_SIMPLE_DEBUGFS_FILE(tid_info);
+ static void add_debugfs_mem(struct adapter *adap, const char *name,
+ unsigned int idx, unsigned int size_mb)
+ {
+- debugfs_create_file_size(name, S_IRUSR, adap->debugfs_root,
++ debugfs_create_file_size(name, 0400, adap->debugfs_root,
+ (void *)adap + idx, &mem_debugfs_fops,
+ size_mb << 20);
+ }
+@@ -2938,65 +2938,65 @@ int t4_setup_debugfs(struct adapter *ada
+ struct dentry *de;
+
+ static struct t4_debugfs_entry t4_debugfs_files[] = {
+- { "cim_la", &cim_la_fops, S_IRUSR, 0 },
+- { "cim_pif_la", &cim_pif_la_fops, S_IRUSR, 0 },
+- { "cim_ma_la", &cim_ma_la_fops, S_IRUSR, 0 },
+- { "cim_qcfg", &cim_qcfg_fops, S_IRUSR, 0 },
+- { "clk", &clk_debugfs_fops, S_IRUSR, 0 },
+- { "devlog", &devlog_fops, S_IRUSR, 0 },
+- { "mboxlog", &mboxlog_fops, S_IRUSR, 0 },
+- { "mbox0", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 0 },
+- { "mbox1", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 1 },
+- { "mbox2", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 2 },
+- { "mbox3", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 3 },
+- { "mbox4", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 4 },
+- { "mbox5", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 5 },
+- { "mbox6", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 6 },
+- { "mbox7", &mbox_debugfs_fops, S_IRUSR | S_IWUSR, 7 },
+- { "trace0", &mps_trc_debugfs_fops, S_IRUSR | S_IWUSR, 0 },
+- { "trace1", &mps_trc_debugfs_fops, S_IRUSR | S_IWUSR, 1 },
+- { "trace2", &mps_trc_debugfs_fops, S_IRUSR | S_IWUSR, 2 },
+- { "trace3", &mps_trc_debugfs_fops, S_IRUSR | S_IWUSR, 3 },
+- { "l2t", &t4_l2t_fops, S_IRUSR, 0},
+- { "mps_tcam", &mps_tcam_debugfs_fops, S_IRUSR, 0 },
+- { "rss", &rss_debugfs_fops, S_IRUSR, 0 },
+- { "rss_config", &rss_config_debugfs_fops, S_IRUSR, 0 },
+- { "rss_key", &rss_key_debugfs_fops, S_IRUSR, 0 },
+- { "rss_pf_config", &rss_pf_config_debugfs_fops, S_IRUSR, 0 },
+- { "rss_vf_config", &rss_vf_config_debugfs_fops, S_IRUSR, 0 },
+- { "sge_qinfo", &sge_qinfo_debugfs_fops, S_IRUSR, 0 },
+- { "ibq_tp0", &cim_ibq_fops, S_IRUSR, 0 },
+- { "ibq_tp1", &cim_ibq_fops, S_IRUSR, 1 },
+- { "ibq_ulp", &cim_ibq_fops, S_IRUSR, 2 },
+- { "ibq_sge0", &cim_ibq_fops, S_IRUSR, 3 },
+- { "ibq_sge1", &cim_ibq_fops, S_IRUSR, 4 },
+- { "ibq_ncsi", &cim_ibq_fops, S_IRUSR, 5 },
+- { "obq_ulp0", &cim_obq_fops, S_IRUSR, 0 },
+- { "obq_ulp1", &cim_obq_fops, S_IRUSR, 1 },
+- { "obq_ulp2", &cim_obq_fops, S_IRUSR, 2 },
+- { "obq_ulp3", &cim_obq_fops, S_IRUSR, 3 },
+- { "obq_sge", &cim_obq_fops, S_IRUSR, 4 },
+- { "obq_ncsi", &cim_obq_fops, S_IRUSR, 5 },
+- { "tp_la", &tp_la_fops, S_IRUSR, 0 },
+- { "ulprx_la", &ulprx_la_fops, S_IRUSR, 0 },
+- { "sensors", &sensors_debugfs_fops, S_IRUSR, 0 },
+- { "pm_stats", &pm_stats_debugfs_fops, S_IRUSR, 0 },
+- { "tx_rate", &tx_rate_debugfs_fops, S_IRUSR, 0 },
+- { "cctrl", &cctrl_tbl_debugfs_fops, S_IRUSR, 0 },
++ { "cim_la", &cim_la_fops, 0400, 0 },
++ { "cim_pif_la", &cim_pif_la_fops, 0400, 0 },
++ { "cim_ma_la", &cim_ma_la_fops, 0400, 0 },
++ { "cim_qcfg", &cim_qcfg_fops, 0400, 0 },
++ { "clk", &clk_debugfs_fops, 0400, 0 },
++ { "devlog", &devlog_fops, 0400, 0 },
++ { "mboxlog", &mboxlog_fops, 0400, 0 },
++ { "mbox0", &mbox_debugfs_fops, 0600, 0 },
++ { "mbox1", &mbox_debugfs_fops, 0600, 1 },
++ { "mbox2", &mbox_debugfs_fops, 0600, 2 },
++ { "mbox3", &mbox_debugfs_fops, 0600, 3 },
++ { "mbox4", &mbox_debugfs_fops, 0600, 4 },
++ { "mbox5", &mbox_debugfs_fops, 0600, 5 },
++ { "mbox6", &mbox_debugfs_fops, 0600, 6 },
++ { "mbox7", &mbox_debugfs_fops, 0600, 7 },
++ { "trace0", &mps_trc_debugfs_fops, 0600, 0 },
++ { "trace1", &mps_trc_debugfs_fops, 0600, 1 },
++ { "trace2", &mps_trc_debugfs_fops, 0600, 2 },
++ { "trace3", &mps_trc_debugfs_fops, 0600, 3 },
++ { "l2t", &t4_l2t_fops, 0400, 0},
++ { "mps_tcam", &mps_tcam_debugfs_fops, 0400, 0 },
++ { "rss", &rss_debugfs_fops, 0400, 0 },
++ { "rss_config", &rss_config_debugfs_fops, 0400, 0 },
++ { "rss_key", &rss_key_debugfs_fops, 0400, 0 },
++ { "rss_pf_config", &rss_pf_config_debugfs_fops, 0400, 0 },
++ { "rss_vf_config", &rss_vf_config_debugfs_fops, 0400, 0 },
++ { "sge_qinfo", &sge_qinfo_debugfs_fops, 0400, 0 },
++ { "ibq_tp0", &cim_ibq_fops, 0400, 0 },
++ { "ibq_tp1", &cim_ibq_fops, 0400, 1 },
++ { "ibq_ulp", &cim_ibq_fops, 0400, 2 },
++ { "ibq_sge0", &cim_ibq_fops, 0400, 3 },
++ { "ibq_sge1", &cim_ibq_fops, 0400, 4 },
++ { "ibq_ncsi", &cim_ibq_fops, 0400, 5 },
++ { "obq_ulp0", &cim_obq_fops, 0400, 0 },
++ { "obq_ulp1", &cim_obq_fops, 0400, 1 },
++ { "obq_ulp2", &cim_obq_fops, 0400, 2 },
++ { "obq_ulp3", &cim_obq_fops, 0400, 3 },
++ { "obq_sge", &cim_obq_fops, 0400, 4 },
++ { "obq_ncsi", &cim_obq_fops, 0400, 5 },
++ { "tp_la", &tp_la_fops, 0400, 0 },
++ { "ulprx_la", &ulprx_la_fops, 0400, 0 },
++ { "sensors", &sensors_debugfs_fops, 0400, 0 },
++ { "pm_stats", &pm_stats_debugfs_fops, 0400, 0 },
++ { "tx_rate", &tx_rate_debugfs_fops, 0400, 0 },
++ { "cctrl", &cctrl_tbl_debugfs_fops, 0400, 0 },
+ #if IS_ENABLED(CONFIG_IPV6)
+- { "clip_tbl", &clip_tbl_debugfs_fops, S_IRUSR, 0 },
++ { "clip_tbl", &clip_tbl_debugfs_fops, 0400, 0 },
+ #endif
+- { "tids", &tid_info_debugfs_fops, S_IRUSR, 0},
+- { "blocked_fl", &blocked_fl_fops, S_IRUSR | S_IWUSR, 0 },
+- { "meminfo", &meminfo_fops, S_IRUSR, 0 },
+- { "crypto", &chcr_stats_debugfs_fops, S_IRUSR, 0 },
++ { "tids", &tid_info_debugfs_fops, 0400, 0},
++ { "blocked_fl", &blocked_fl_fops, 0600, 0 },
++ { "meminfo", &meminfo_fops, 0400, 0 },
++ { "crypto", &chcr_stats_debugfs_fops, 0400, 0 },
+ };
+
+ /* Debug FS nodes common to all T5 and later adapters.
+ */
+ static struct t4_debugfs_entry t5_debugfs_files[] = {
+- { "obq_sge_rx_q0", &cim_obq_fops, S_IRUSR, 6 },
+- { "obq_sge_rx_q1", &cim_obq_fops, S_IRUSR, 7 },
++ { "obq_sge_rx_q0", &cim_obq_fops, 0400, 6 },
++ { "obq_sge_rx_q1", &cim_obq_fops, 0400, 7 },
+ };
+
+ add_debugfs_files(adap,
+@@ -3035,11 +3035,11 @@ int t4_setup_debugfs(struct adapter *ada
+ }
+ }
+
+- de = debugfs_create_file_size("flash", S_IRUSR, adap->debugfs_root, adap,
++ de = debugfs_create_file_size("flash", 0400, adap->debugfs_root, adap,
+ &flash_debugfs_fops, adap->params.sf_size);
+- debugfs_create_bool("use_backdoor", S_IWUSR | S_IRUSR,
++ debugfs_create_bool("use_backdoor", 0600,
+ adap->debugfs_root, &adap->use_bd);
+- debugfs_create_bool("trace_rss", S_IWUSR | S_IRUSR,
++ debugfs_create_bool("trace_rss", 0600,
+ adap->debugfs_root, &adap->trace_rss);
+
+ return 0;
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+@@ -2373,11 +2373,11 @@ struct cxgb4vf_debugfs_entry {
+ };
+
+ static struct cxgb4vf_debugfs_entry debugfs_files[] = {
+- { "mboxlog", S_IRUGO, &mboxlog_fops },
+- { "sge_qinfo", S_IRUGO, &sge_qinfo_debugfs_fops },
+- { "sge_qstats", S_IRUGO, &sge_qstats_proc_fops },
+- { "resources", S_IRUGO, &resources_proc_fops },
+- { "interfaces", S_IRUGO, &interfaces_proc_fops },
++ { "mboxlog", 0444, &mboxlog_fops },
++ { "sge_qinfo", 0444, &sge_qinfo_debugfs_fops },
++ { "sge_qstats", 0444, &sge_qstats_proc_fops },
++ { "resources", 0444, &resources_proc_fops },
++ { "interfaces", 0444, &interfaces_proc_fops },
+ };
+
+ /*
+--- a/drivers/net/ethernet/ec_bhf.c
++++ b/drivers/net/ethernet/ec_bhf.c
+@@ -602,7 +602,7 @@ static struct pci_driver pci_driver = {
+ };
+ module_pci_driver(pci_driver);
+
+-module_param(polling_frequency, long, S_IRUGO);
++module_param(polling_frequency, long, 0444);
+ MODULE_PARM_DESC(polling_frequency, "Polling timer frequency in ns");
+
+ MODULE_LICENSE("GPL");
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -34,11 +34,11 @@ MODULE_LICENSE("GPL");
+ * Use sysfs method to enable/disable VFs.
+ */
+ static unsigned int num_vfs;
+-module_param(num_vfs, uint, S_IRUGO);
++module_param(num_vfs, uint, 0444);
+ MODULE_PARM_DESC(num_vfs, "Number of PCI VFs to initialize");
+
+ static ushort rx_frag_size = 2048;
+-module_param(rx_frag_size, ushort, S_IRUGO);
++module_param(rx_frag_size, ushort, 0444);
+ MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
+
+ /* Per-module error detection/recovery workq shared across all functions.
+@@ -5790,7 +5790,7 @@ static ssize_t be_hwmon_show_temp(struct
+ adapter->hwmon_info.be_on_die_temp * 1000);
+ }
+
+-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
++static SENSOR_DEVICE_ATTR(temp1_input, 0444,
+ be_hwmon_show_temp, NULL, 1);
+
+ static struct attribute *be_hwmon_attrs[] = {
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2903,8 +2903,7 @@ static ssize_t ehea_show_port_id(struct
+ return sprintf(buf, "%d", port->logical_port_id);
+ }
+
+-static DEVICE_ATTR(log_port_id, S_IRUSR | S_IRGRP | S_IROTH, ehea_show_port_id,
+- NULL);
++static DEVICE_ATTR(log_port_id, 0444, ehea_show_port_id, NULL);
+
+ static void logical_port_release(struct device *dev)
+ {
+@@ -3236,8 +3235,8 @@ static ssize_t ehea_remove_port(struct d
+ return (ssize_t) count;
+ }
+
+-static DEVICE_ATTR(probe_port, S_IWUSR, NULL, ehea_probe_port);
+-static DEVICE_ATTR(remove_port, S_IWUSR, NULL, ehea_remove_port);
++static DEVICE_ATTR(probe_port, 0200, NULL, ehea_probe_port);
++static DEVICE_ATTR(remove_port, 0200, NULL, ehea_remove_port);
+
+ static int ehea_create_device_sysfs(struct platform_device *dev)
+ {
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -82,7 +82,7 @@ module_param(rx_flush, uint, 0644);
+ MODULE_PARM_DESC(rx_flush, "Flush receive buffers before use");
+
+ static bool old_large_send __read_mostly;
+-module_param(old_large_send, bool, S_IRUGO);
++module_param(old_large_send, bool, 0444);
+ MODULE_PARM_DESC(old_large_send,
+ "Use old large send method on firmware that supports the new method");
+
+--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
++++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
+@@ -147,7 +147,7 @@ static int igb_add_hwmon_attr(struct igb
+ &adapter->hw.mac.thermal_sensor_data.sensor[offset];
+ igb_attr->hw = &adapter->hw;
+ igb_attr->dev_attr.store = NULL;
+- igb_attr->dev_attr.attr.mode = S_IRUGO;
++ igb_attr->dev_attr.attr.mode = 0444;
+ igb_attr->dev_attr.attr.name = igb_attr->name;
+ sysfs_attr_init(&igb_attr->dev_attr.attr);
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
+@@ -146,7 +146,7 @@ static int ixgbe_add_hwmon_attr(struct i
+ &adapter->hw.mac.thermal_sensor_data.sensor[offset];
+ ixgbe_attr->hw = &adapter->hw;
+ ixgbe_attr->dev_attr.store = NULL;
+- ixgbe_attr->dev_attr.attr.mode = S_IRUGO;
++ ixgbe_attr->dev_attr.attr.mode = 0444;
+ ixgbe_attr->dev_attr.attr.name = ixgbe_attr->name;
+ sysfs_attr_init(&ixgbe_attr->dev_attr.attr);
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -4533,8 +4533,8 @@ MODULE_DESCRIPTION("Marvell NETA Etherne
+ MODULE_AUTHOR("Rami Rosen <rosenr@marvell.com>, Thomas Petazzoni <thomas.petazzoni@free-electrons.com>");
+ MODULE_LICENSE("GPL");
+
+-module_param(rxq_number, int, S_IRUGO);
+-module_param(txq_number, int, S_IRUGO);
++module_param(rxq_number, int, 0444);
++module_param(txq_number, int, 0444);
+
+-module_param(rxq_def, int, S_IRUGO);
+-module_param(rx_copybreak, int, S_IRUGO | S_IWUSR);
++module_param(rxq_def, int, 0444);
++module_param(rx_copybreak, int, 0644);
+--- a/drivers/net/ethernet/marvell/skge.c
++++ b/drivers/net/ethernet/marvell/skge.c
+@@ -3783,7 +3783,7 @@ static int skge_device_event(struct noti
+ break;
+
+ case NETDEV_UP:
+- d = debugfs_create_file(dev->name, S_IRUGO,
++ d = debugfs_create_file(dev->name, 0444,
+ skge_debug, dev,
+ &skge_debug_fops);
+ if (!d || IS_ERR(d))
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -4667,7 +4667,7 @@ static int sky2_device_event(struct noti
+ break;
+
+ case NETDEV_UP:
+- sky2->debugfs = debugfs_create_file(dev->name, S_IRUGO,
++ sky2->debugfs = debugfs_create_file(dev->name, 0444,
+ sky2_debug, dev,
+ &sky2_debug_fops);
+ if (IS_ERR(sky2->debugfs))
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -2993,10 +2993,10 @@ static int mlx4_init_port_info(struct ml
+
+ sprintf(info->dev_name, "mlx4_port%d", port);
+ info->port_attr.attr.name = info->dev_name;
+- if (mlx4_is_mfunc(dev))
+- info->port_attr.attr.mode = S_IRUGO;
+- else {
+- info->port_attr.attr.mode = S_IRUGO | S_IWUSR;
++ if (mlx4_is_mfunc(dev)) {
++ info->port_attr.attr.mode = 0444;
++ } else {
++ info->port_attr.attr.mode = 0644;
+ info->port_attr.store = set_port_type;
+ }
+ info->port_attr.show = show_port_type;
+@@ -3011,10 +3011,10 @@ static int mlx4_init_port_info(struct ml
+
+ sprintf(info->dev_mtu_name, "mlx4_port%d_mtu", port);
+ info->port_mtu_attr.attr.name = info->dev_mtu_name;
+- if (mlx4_is_mfunc(dev))
+- info->port_mtu_attr.attr.mode = S_IRUGO;
+- else {
+- info->port_mtu_attr.attr.mode = S_IRUGO | S_IWUSR;
++ if (mlx4_is_mfunc(dev)) {
++ info->port_mtu_attr.attr.mode = 0444;
++ } else {
++ info->port_mtu_attr.attr.mode = 0644;
+ info->port_mtu_attr.store = set_port_ib_mtu;
+ }
+ info->port_mtu_attr.show = show_port_ib_mtu;
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+@@ -218,32 +218,32 @@ static void mlxsw_hwmon_attr_add(struct
+ switch (attr_type) {
+ case MLXSW_HWMON_ATTR_TYPE_TEMP:
+ mlxsw_hwmon_attr->dev_attr.show = mlxsw_hwmon_temp_show;
+- mlxsw_hwmon_attr->dev_attr.attr.mode = S_IRUGO;
++ mlxsw_hwmon_attr->dev_attr.attr.mode = 0444;
+ snprintf(mlxsw_hwmon_attr->name, sizeof(mlxsw_hwmon_attr->name),
+ "temp%u_input", num + 1);
+ break;
+ case MLXSW_HWMON_ATTR_TYPE_TEMP_MAX:
+ mlxsw_hwmon_attr->dev_attr.show = mlxsw_hwmon_temp_max_show;
+- mlxsw_hwmon_attr->dev_attr.attr.mode = S_IRUGO;
++ mlxsw_hwmon_attr->dev_attr.attr.mode = 0444;
+ snprintf(mlxsw_hwmon_attr->name, sizeof(mlxsw_hwmon_attr->name),
+ "temp%u_highest", num + 1);
+ break;
+ case MLXSW_HWMON_ATTR_TYPE_TEMP_RST:
+ mlxsw_hwmon_attr->dev_attr.store = mlxsw_hwmon_temp_rst_store;
+- mlxsw_hwmon_attr->dev_attr.attr.mode = S_IWUSR;
++ mlxsw_hwmon_attr->dev_attr.attr.mode = 0200;
+ snprintf(mlxsw_hwmon_attr->name, sizeof(mlxsw_hwmon_attr->name),
+ "temp%u_reset_history", num + 1);
+ break;
+ case MLXSW_HWMON_ATTR_TYPE_FAN_RPM:
+ mlxsw_hwmon_attr->dev_attr.show = mlxsw_hwmon_fan_rpm_show;
+- mlxsw_hwmon_attr->dev_attr.attr.mode = S_IRUGO;
++ mlxsw_hwmon_attr->dev_attr.attr.mode = 0444;
+ snprintf(mlxsw_hwmon_attr->name, sizeof(mlxsw_hwmon_attr->name),
+ "fan%u_input", num + 1);
+ break;
+ case MLXSW_HWMON_ATTR_TYPE_PWM:
+ mlxsw_hwmon_attr->dev_attr.show = mlxsw_hwmon_pwm_show;
+ mlxsw_hwmon_attr->dev_attr.store = mlxsw_hwmon_pwm_store;
+- mlxsw_hwmon_attr->dev_attr.attr.mode = S_IWUSR | S_IRUGO;
++ mlxsw_hwmon_attr->dev_attr.attr.mode = 0644;
+ snprintf(mlxsw_hwmon_attr->name, sizeof(mlxsw_hwmon_attr->name),
+ "pwm%u", num + 1);
+ break;
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -266,7 +266,7 @@ MODULE_FIRMWARE("myri10ge_rss_eth_z8e.da
+
+ /* Careful: must be accessed under kernel_param_lock() */
+ static char *myri10ge_fw_name = NULL;
+-module_param(myri10ge_fw_name, charp, S_IRUGO | S_IWUSR);
++module_param(myri10ge_fw_name, charp, 0644);
+ MODULE_PARM_DESC(myri10ge_fw_name, "Firmware image name");
+
+ #define MYRI10GE_MAX_BOARDS 8
+@@ -277,49 +277,49 @@ module_param_array_named(myri10ge_fw_nam
+ MODULE_PARM_DESC(myri10ge_fw_names, "Firmware image names per board");
+
+ static int myri10ge_ecrc_enable = 1;
+-module_param(myri10ge_ecrc_enable, int, S_IRUGO);
++module_param(myri10ge_ecrc_enable, int, 0444);
+ MODULE_PARM_DESC(myri10ge_ecrc_enable, "Enable Extended CRC on PCI-E");
+
+ static int myri10ge_small_bytes = -1; /* -1 == auto */
+-module_param(myri10ge_small_bytes, int, S_IRUGO | S_IWUSR);
++module_param(myri10ge_small_bytes, int, 0644);
+ MODULE_PARM_DESC(myri10ge_small_bytes, "Threshold of small packets");
+
+ static int myri10ge_msi = 1; /* enable msi by default */
+-module_param(myri10ge_msi, int, S_IRUGO | S_IWUSR);
++module_param(myri10ge_msi, int, 0644);
+ MODULE_PARM_DESC(myri10ge_msi, "Enable Message Signalled Interrupts");
+
+ static int myri10ge_intr_coal_delay = 75;
+-module_param(myri10ge_intr_coal_delay, int, S_IRUGO);
++module_param(myri10ge_intr_coal_delay, int, 0444);
+ MODULE_PARM_DESC(myri10ge_intr_coal_delay, "Interrupt coalescing delay");
+
+ static int myri10ge_flow_control = 1;
+-module_param(myri10ge_flow_control, int, S_IRUGO);
++module_param(myri10ge_flow_control, int, 0444);
+ MODULE_PARM_DESC(myri10ge_flow_control, "Pause parameter");
+
+ static int myri10ge_deassert_wait = 1;
+-module_param(myri10ge_deassert_wait, int, S_IRUGO | S_IWUSR);
++module_param(myri10ge_deassert_wait, int, 0644);
+ MODULE_PARM_DESC(myri10ge_deassert_wait,
+ "Wait when deasserting legacy interrupts");
+
+ static int myri10ge_force_firmware = 0;
+-module_param(myri10ge_force_firmware, int, S_IRUGO);
++module_param(myri10ge_force_firmware, int, 0444);
+ MODULE_PARM_DESC(myri10ge_force_firmware,
+ "Force firmware to assume aligned completions");
+
+ static int myri10ge_initial_mtu = MYRI10GE_MAX_ETHER_MTU - ETH_HLEN;
+-module_param(myri10ge_initial_mtu, int, S_IRUGO);
++module_param(myri10ge_initial_mtu, int, 0444);
+ MODULE_PARM_DESC(myri10ge_initial_mtu, "Initial MTU");
+
+ static int myri10ge_napi_weight = 64;
+-module_param(myri10ge_napi_weight, int, S_IRUGO);
++module_param(myri10ge_napi_weight, int, 0444);
+ MODULE_PARM_DESC(myri10ge_napi_weight, "Set NAPI weight");
+
+ static int myri10ge_watchdog_timeout = 1;
+-module_param(myri10ge_watchdog_timeout, int, S_IRUGO);
++module_param(myri10ge_watchdog_timeout, int, 0444);
+ MODULE_PARM_DESC(myri10ge_watchdog_timeout, "Set watchdog timeout");
+
+ static int myri10ge_max_irq_loops = 1048576;
+-module_param(myri10ge_max_irq_loops, int, S_IRUGO);
++module_param(myri10ge_max_irq_loops, int, 0444);
+ MODULE_PARM_DESC(myri10ge_max_irq_loops,
+ "Set stuck legacy IRQ detection threshold");
+
+@@ -330,21 +330,21 @@ module_param(myri10ge_debug, int, 0);
+ MODULE_PARM_DESC(myri10ge_debug, "Debug level (0=none,...,16=all)");
+
+ static int myri10ge_fill_thresh = 256;
+-module_param(myri10ge_fill_thresh, int, S_IRUGO | S_IWUSR);
++module_param(myri10ge_fill_thresh, int, 0644);
+ MODULE_PARM_DESC(myri10ge_fill_thresh, "Number of empty rx slots allowed");
+
+ static int myri10ge_reset_recover = 1;
+
+ static int myri10ge_max_slices = 1;
+-module_param(myri10ge_max_slices, int, S_IRUGO);
++module_param(myri10ge_max_slices, int, 0444);
+ MODULE_PARM_DESC(myri10ge_max_slices, "Max tx/rx queues");
+
+ static int myri10ge_rss_hash = MXGEFW_RSS_HASH_TYPE_SRC_DST_PORT;
+-module_param(myri10ge_rss_hash, int, S_IRUGO);
++module_param(myri10ge_rss_hash, int, 0444);
+ MODULE_PARM_DESC(myri10ge_rss_hash, "Type of RSS hashing to do");
+
+ static int myri10ge_dca = 1;
+-module_param(myri10ge_dca, int, S_IRUGO);
++module_param(myri10ge_dca, int, 0444);
+ MODULE_PARM_DESC(myri10ge_dca, "Enable DCA if possible");
+
+ #define MYRI10GE_FW_OFFSET 1024*1024
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c
+@@ -231,15 +231,15 @@ void nfp_net_debugfs_vnic_add(struct nfp
+
+ for (i = 0; i < min(nn->max_rx_rings, nn->max_r_vecs); i++) {
+ sprintf(name, "%d", i);
+- debugfs_create_file(name, S_IRUSR, rx,
++ debugfs_create_file(name, 0400, rx,
+ &nn->r_vecs[i], &nfp_rx_q_fops);
+- debugfs_create_file(name, S_IRUSR, xdp,
++ debugfs_create_file(name, 0400, xdp,
+ &nn->r_vecs[i], &nfp_xdp_q_fops);
+ }
+
+ for (i = 0; i < min(nn->max_tx_rings, nn->max_r_vecs); i++) {
+ sprintf(name, "%d", i);
+- debugfs_create_file(name, S_IRUSR, tx,
++ debugfs_create_file(name, 0400, tx,
+ &nn->r_vecs[i], &nfp_tx_q_fops);
+ }
+ }
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+@@ -2829,9 +2829,9 @@ netxen_show_bridged_mode(struct device *
+ }
+
+ static const struct device_attribute dev_attr_bridged_mode = {
+- .attr = {.name = "bridged_mode", .mode = (S_IRUGO | S_IWUSR)},
+- .show = netxen_show_bridged_mode,
+- .store = netxen_store_bridged_mode,
++ .attr = { .name = "bridged_mode", .mode = 0644 },
++ .show = netxen_show_bridged_mode,
++ .store = netxen_store_bridged_mode,
+ };
+
+ static ssize_t
+@@ -2861,7 +2861,7 @@ netxen_show_diag_mode(struct device *dev
+ }
+
+ static const struct device_attribute dev_attr_diag_mode = {
+- .attr = {.name = "diag_mode", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "diag_mode", .mode = 0644 },
+ .show = netxen_show_diag_mode,
+ .store = netxen_store_diag_mode,
+ };
+@@ -3006,14 +3006,14 @@ static ssize_t netxen_sysfs_write_mem(st
+
+
+ static const struct bin_attribute bin_attr_crb = {
+- .attr = {.name = "crb", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "crb", .mode = 0644 },
+ .size = 0,
+ .read = netxen_sysfs_read_crb,
+ .write = netxen_sysfs_write_crb,
+ };
+
+ static const struct bin_attribute bin_attr_mem = {
+- .attr = {.name = "mem", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "mem", .mode = 0644 },
+ .size = 0,
+ .read = netxen_sysfs_read_mem,
+ .write = netxen_sysfs_write_mem,
+@@ -3142,7 +3142,7 @@ out:
+ }
+
+ static const struct bin_attribute bin_attr_dimm = {
+- .attr = { .name = "dimm", .mode = (S_IRUGO | S_IWUSR) },
++ .attr = { .name = "dimm", .mode = 0644 },
+ .size = sizeof(struct netxen_dimm_cfg),
+ .read = netxen_sysfs_read_dimm,
+ };
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+@@ -1175,81 +1175,81 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
+ }
+
+ static const struct device_attribute dev_attr_bridged_mode = {
+- .attr = {.name = "bridged_mode", .mode = (S_IRUGO | S_IWUSR)},
+- .show = qlcnic_show_bridged_mode,
+- .store = qlcnic_store_bridged_mode,
++ .attr = { .name = "bridged_mode", .mode = 0644 },
++ .show = qlcnic_show_bridged_mode,
++ .store = qlcnic_store_bridged_mode,
+ };
+
+ static const struct device_attribute dev_attr_diag_mode = {
+- .attr = {.name = "diag_mode", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "diag_mode", .mode = 0644 },
+ .show = qlcnic_show_diag_mode,
+ .store = qlcnic_store_diag_mode,
+ };
+
+ static const struct device_attribute dev_attr_beacon = {
+- .attr = {.name = "beacon", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "beacon", .mode = 0644 },
+ .show = qlcnic_show_beacon,
+ .store = qlcnic_store_beacon,
+ };
+
+ static const struct bin_attribute bin_attr_crb = {
+- .attr = {.name = "crb", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "crb", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_crb,
+ .write = qlcnic_sysfs_write_crb,
+ };
+
+ static const struct bin_attribute bin_attr_mem = {
+- .attr = {.name = "mem", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "mem", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_mem,
+ .write = qlcnic_sysfs_write_mem,
+ };
+
+ static const struct bin_attribute bin_attr_npar_config = {
+- .attr = {.name = "npar_config", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "npar_config", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_npar_config,
+ .write = qlcnic_sysfs_write_npar_config,
+ };
+
+ static const struct bin_attribute bin_attr_pci_config = {
+- .attr = {.name = "pci_config", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "pci_config", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_pci_config,
+ .write = NULL,
+ };
+
+ static const struct bin_attribute bin_attr_port_stats = {
+- .attr = {.name = "port_stats", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "port_stats", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_get_port_stats,
+ .write = qlcnic_sysfs_clear_port_stats,
+ };
+
+ static const struct bin_attribute bin_attr_esw_stats = {
+- .attr = {.name = "esw_stats", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "esw_stats", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_get_esw_stats,
+ .write = qlcnic_sysfs_clear_esw_stats,
+ };
+
+ static const struct bin_attribute bin_attr_esw_config = {
+- .attr = {.name = "esw_config", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "esw_config", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_esw_config,
+ .write = qlcnic_sysfs_write_esw_config,
+ };
+
+ static const struct bin_attribute bin_attr_pm_config = {
+- .attr = {.name = "pm_config", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "pm_config", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_sysfs_read_pm_config,
+ .write = qlcnic_sysfs_write_pm_config,
+ };
+
+ static const struct bin_attribute bin_attr_flash = {
+- .attr = {.name = "flash", .mode = (S_IRUGO | S_IWUSR)},
++ .attr = { .name = "flash", .mode = 0644 },
+ .size = 0,
+ .read = qlcnic_83xx_sysfs_flash_read_handler,
+ .write = qlcnic_83xx_sysfs_flash_write_handler,
+@@ -1276,7 +1276,7 @@ static ssize_t qlcnic_hwmon_show_temp(st
+ }
+
+ /* hwmon-sysfs attributes */
+-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
++static SENSOR_DEVICE_ATTR(temp1_input, 0444,
+ qlcnic_hwmon_show_temp, NULL, 1);
+
+ static struct attribute *qlcnic_hwmon_attrs[] = {
+--- a/drivers/net/ethernet/qualcomm/qca_debug.c
++++ b/drivers/net/ethernet/qualcomm/qca_debug.c
+@@ -151,7 +151,7 @@ qcaspi_init_device_debugfs(struct qcaspi
+ dev_name(&qca->net_dev->dev));
+ return;
+ }
+- debugfs_create_file("info", S_IFREG | S_IRUGO, device_root, qca,
++ debugfs_create_file("info", S_IFREG | 0444, device_root, qca,
+ &qcaspi_info_ops);
+ }
+
+--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
++++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+@@ -57,9 +57,9 @@
+ static int debug = -1;
+ static int eee_timer = SXGBE_DEFAULT_LPI_TIMER;
+
+-module_param(eee_timer, int, S_IRUGO | S_IWUSR);
++module_param(eee_timer, int, 0644);
+
+-module_param(debug, int, S_IRUGO | S_IWUSR);
++module_param(debug, int, 0644);
+ static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
+ NETIF_MSG_LINK | NETIF_MSG_IFUP |
+ NETIF_MSG_IFDOWN | NETIF_MSG_TIMER);
+--- a/drivers/net/ethernet/sfc/mcdi_mon.c
++++ b/drivers/net/ethernet/sfc/mcdi_mon.c
+@@ -298,7 +298,7 @@ efx_mcdi_mon_add_attr(struct efx_nic *ef
+ attr->limit_value = limit_value;
+ sysfs_attr_init(&attr->dev_attr.attr);
+ attr->dev_attr.attr.name = attr->name;
+- attr->dev_attr.attr.mode = S_IRUGO;
++ attr->dev_attr.attr.mode = 0444;
+ attr->dev_attr.show = reader;
+ hwmon->group.attrs[hwmon->n_attrs++] = &attr->dev_attr.attr;
+ }
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -57,36 +57,36 @@
+ /* Module parameters */
+ #define TX_TIMEO 5000
+ static int watchdog = TX_TIMEO;
+-module_param(watchdog, int, S_IRUGO | S_IWUSR);
++module_param(watchdog, int, 0644);
+ MODULE_PARM_DESC(watchdog, "Transmit timeout in milliseconds (default 5s)");
+
+ static int debug = -1;
+-module_param(debug, int, S_IRUGO | S_IWUSR);
++module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Message Level (-1: default, 0: no output, 16: all)");
+
+ static int phyaddr = -1;
+-module_param(phyaddr, int, S_IRUGO);
++module_param(phyaddr, int, 0444);
+ MODULE_PARM_DESC(phyaddr, "Physical device address");
+
+ #define STMMAC_TX_THRESH (DMA_TX_SIZE / 4)
+ #define STMMAC_RX_THRESH (DMA_RX_SIZE / 4)
+
+ static int flow_ctrl = FLOW_OFF;
+-module_param(flow_ctrl, int, S_IRUGO | S_IWUSR);
++module_param(flow_ctrl, int, 0644);
+ MODULE_PARM_DESC(flow_ctrl, "Flow control ability [on/off]");
+
+ static int pause = PAUSE_TIME;
+-module_param(pause, int, S_IRUGO | S_IWUSR);
++module_param(pause, int, 0644);
+ MODULE_PARM_DESC(pause, "Flow Control Pause Time");
+
+ #define TC_DEFAULT 64
+ static int tc = TC_DEFAULT;
+-module_param(tc, int, S_IRUGO | S_IWUSR);
++module_param(tc, int, 0644);
+ MODULE_PARM_DESC(tc, "DMA threshold control value");
+
+ #define DEFAULT_BUFSIZE 1536
+ static int buf_sz = DEFAULT_BUFSIZE;
+-module_param(buf_sz, int, S_IRUGO | S_IWUSR);
++module_param(buf_sz, int, 0644);
+ MODULE_PARM_DESC(buf_sz, "DMA buffer size");
+
+ #define STMMAC_RX_COPYBREAK 256
+@@ -97,7 +97,7 @@ static const u32 default_msg_level = (NE
+
+ #define STMMAC_DEFAULT_LPI_TIMER 1000
+ static int eee_timer = STMMAC_DEFAULT_LPI_TIMER;
+-module_param(eee_timer, int, S_IRUGO | S_IWUSR);
++module_param(eee_timer, int, 0644);
+ MODULE_PARM_DESC(eee_timer, "LPI tx expiration time in msec");
+ #define STMMAC_LPI_T(x) (jiffies + msecs_to_jiffies(x))
+
+@@ -105,7 +105,7 @@ MODULE_PARM_DESC(eee_timer, "LPI tx expi
+ * but allow user to force to use the chain instead of the ring
+ */
+ static unsigned int chain_mode;
+-module_param(chain_mode, int, S_IRUGO);
++module_param(chain_mode, int, 0444);
+ MODULE_PARM_DESC(chain_mode, "To use chain instead of ring mode");
+
+ static irqreturn_t stmmac_interrupt(int irq, void *dev_id);
+@@ -3912,7 +3912,7 @@ static int stmmac_init_fs(struct net_dev
+
+ /* Entry to report DMA RX/TX rings */
+ priv->dbgfs_rings_status =
+- debugfs_create_file("descriptors_status", S_IRUGO,
++ debugfs_create_file("descriptors_status", 0444,
+ priv->dbgfs_dir, dev,
+ &stmmac_rings_status_fops);
+
+@@ -3924,9 +3924,9 @@ static int stmmac_init_fs(struct net_dev
+ }
+
+ /* Entry to report the DMA HW features */
+- priv->dbgfs_dma_cap = debugfs_create_file("dma_cap", S_IRUGO,
+- priv->dbgfs_dir,
+- dev, &stmmac_dma_cap_fops);
++ priv->dbgfs_dma_cap = debugfs_create_file("dma_cap", 0444,
++ priv->dbgfs_dir,
++ dev, &stmmac_dma_cap_fops);
+
+ if (!priv->dbgfs_dma_cap || IS_ERR(priv->dbgfs_dma_cap)) {
+ netdev_err(priv->dev, "ERROR creating stmmac MMC debugfs file\n");
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -9442,11 +9442,11 @@ static ssize_t show_num_ports(struct dev
+ }
+
+ static struct device_attribute niu_parent_attributes[] = {
+- __ATTR(port_phy, S_IRUGO, show_port_phy, NULL),
+- __ATTR(plat_type, S_IRUGO, show_plat_type, NULL),
+- __ATTR(rxchan_per_port, S_IRUGO, show_rxchan_per_port, NULL),
+- __ATTR(txchan_per_port, S_IRUGO, show_txchan_per_port, NULL),
+- __ATTR(num_ports, S_IRUGO, show_num_ports, NULL),
++ __ATTR(port_phy, 0444, show_port_phy, NULL),
++ __ATTR(plat_type, 0444, show_plat_type, NULL),
++ __ATTR(rxchan_per_port, 0444, show_rxchan_per_port, NULL),
++ __ATTR(txchan_per_port, 0444, show_txchan_per_port, NULL),
++ __ATTR(num_ports, 0444, show_num_ports, NULL),
+ {}
+ };
+
diff --git a/patches.drivers/gpio-No-NULL-owner b/patches.drivers/gpio-No-NULL-owner
new file mode 100644
index 0000000000..733ae7e0f0
--- /dev/null
+++ b/patches.drivers/gpio-No-NULL-owner
@@ -0,0 +1,49 @@
+From 7d18f0a14aa6a0d6bad39111c1fb655f07f71d59 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 16 Jan 2018 08:29:50 +0100
+Subject: [PATCH] gpio: No NULL owner
+Git-commit: 7d18f0a14aa6a0d6bad39111c1fb655f07f71d59
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+Sometimes a GPIO is fetched with NULL as parent device, and
+that is just fine. So under these circumstances, avoid using
+dev_name() to provide a name for the GPIO line.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index bf083bc58d30..4092b8601c4e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3623,6 +3623,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
+ struct gpio_desc *desc = NULL;
+ int status;
+ enum gpio_lookup_flags lookupflags = 0;
++ /* Maybe we have a device name, maybe not */
++ const char *devname = dev ? dev_name(dev) : "?";
+
+ dev_dbg(dev, "GPIO lookup for consumer %s\n", con_id);
+
+@@ -3651,8 +3653,11 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
+ return desc;
+ }
+
+- /* If a connection label was passed use that, else use the device name as label */
+- status = gpiod_request(desc, con_id ? con_id : dev_name(dev));
++ /*
++ * If a connection label was passed use that, else attempt to use
++ * the device name as label
++ */
++ status = gpiod_request(desc, con_id ? con_id : devname);
+ if (status < 0)
+ return ERR_PTR(status);
+
+--
+2.17.1
+
diff --git a/patches.drivers/gpio-fix-aspeed_gpio-unmask-irq b/patches.drivers/gpio-fix-aspeed_gpio-unmask-irq
new file mode 100644
index 0000000000..2f3d20cd0b
--- /dev/null
+++ b/patches.drivers/gpio-fix-aspeed_gpio-unmask-irq
@@ -0,0 +1,36 @@
+From f241632fd087d3d9fbd5450f4d8c8604badd8348 Mon Sep 17 00:00:00 2001
+From: Govert Overgaauw <govert.overgaauw@prodrive-technologies.com>
+Date: Fri, 6 Apr 2018 14:41:35 +0200
+Subject: [PATCH] gpio: fix aspeed_gpio unmask irq
+Git-commit: f241632fd087d3d9fbd5450f4d8c8604badd8348
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+The unmask function disables all interrupts in a bank when unmasking an
+interrupt. Only disable the given interrupt.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Govert Overgaauw <govert.overgaauw@prodrive-technologies.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-aspeed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 77e485557498..6f693b7d5220 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -384,7 +384,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set)
+ if (set)
+ reg |= bit;
+ else
+- reg &= bit;
++ reg &= ~bit;
+ iowrite32(reg, addr);
+
+ spin_unlock_irqrestore(&gpio->lock, flags);
+--
+2.17.1
+
diff --git a/patches.drivers/mac80211-Adjust-SAE-authentication-timeout b/patches.drivers/mac80211-Adjust-SAE-authentication-timeout
new file mode 100644
index 0000000000..af26d5a173
--- /dev/null
+++ b/patches.drivers/mac80211-Adjust-SAE-authentication-timeout
@@ -0,0 +1,81 @@
+From 407879b690ba3a6bf29be896d02dad63463bd1c0 Mon Sep 17 00:00:00 2001
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Fri, 20 Apr 2018 13:49:20 +0300
+Subject: [PATCH] mac80211: Adjust SAE authentication timeout
+Git-commit: 407879b690ba3a6bf29be896d02dad63463bd1c0
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+The IEEE P802.11-REVmd D1.0 specification updated the SAE authentication
+timeout to be 2000 milliseconds (see dot11RSNASAERetransPeriod). Update
+the SAE timeout setting accordingly.
+
+While at it, reduce some code duplication in the timeout configuration.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/mlme.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 6fe72ef182a1..233068756502 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -36,6 +36,7 @@
+ #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
+ #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2)
+ #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10)
++#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2)
+ #define IEEE80211_AUTH_MAX_TRIES 3
+ #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
+ #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
+@@ -3814,16 +3815,19 @@ static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
+ tx_flags);
+
+ if (tx_flags == 0) {
+- auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+- auth_data->timeout_started = true;
+- run_again(sdata, auth_data->timeout);
++ if (auth_data->algorithm == WLAN_AUTH_SAE)
++ auth_data->timeout = jiffies +
++ IEEE80211_AUTH_TIMEOUT_SAE;
++ else
++ auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+ } else {
+ auth_data->timeout =
+ round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+- auth_data->timeout_started = true;
+- run_again(sdata, auth_data->timeout);
+ }
+
++ auth_data->timeout_started = true;
++ run_again(sdata, auth_data->timeout);
++
+ return 0;
+ }
+
+@@ -3894,8 +3898,15 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
+ ifmgd->status_received = false;
+ if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
+ if (status_acked) {
+- ifmgd->auth_data->timeout =
+- jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
++ if (ifmgd->auth_data->algorithm ==
++ WLAN_AUTH_SAE)
++ ifmgd->auth_data->timeout =
++ jiffies +
++ IEEE80211_AUTH_TIMEOUT_SAE;
++ else
++ ifmgd->auth_data->timeout =
++ jiffies +
++ IEEE80211_AUTH_TIMEOUT_SHORT;
+ run_again(sdata, ifmgd->auth_data->timeout);
+ } else {
+ ifmgd->auth_data->timeout = jiffies - 1;
+--
+2.17.1
+
diff --git a/patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead b/patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead
new file mode 100644
index 0000000000..63e8176181
--- /dev/null
+++ b/patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead
@@ -0,0 +1,63 @@
+From 914eac248d876f9c00cd1792ffec3d182c863f13 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Fri, 20 Apr 2018 13:49:19 +0300
+Subject: [PATCH] mac80211: use timeout from the AddBA response instead of the request
+Git-commit: 914eac248d876f9c00cd1792ffec3d182c863f13
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+2016 spec, section 10.24.2 specifies that the block ack
+timeout in the ADD BA request is advisory.
+
+That means we should check the value in the response and
+act upon it (same as buffer size).
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/agg-tx.c | 4 ++++
+ net/mac80211/tx.c | 3 ++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -8,6 +8,7 @@
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -987,6 +988,9 @@ void ieee80211_process_addba_resp(struct
+
+ sta->ampdu_mlme.addba_req_num[tid] = 0;
+
++ tid_tx->timeout =
++ le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
++
+ if (tid_tx->timeout) {
+ mod_timer(&tid_tx->session_timer,
+ TU_TO_EXP_TIME(tid_tx->timeout));
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4,6 +4,7 @@
+ * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -1138,7 +1139,7 @@ static bool ieee80211_tx_prep_agg(struct
+ }
+
+ /* reset session timer */
+- if (reset_agg_timer && tid_tx->timeout)
++ if (reset_agg_timer)
+ tid_tx->last_tx = jiffies;
+
+ return queued;
diff --git a/patches.drivers/staging-wilc1000-Fix-bssid-buffer-offset-in-Txq b/patches.drivers/staging-wilc1000-Fix-bssid-buffer-offset-in-Txq
new file mode 100644
index 0000000000..c9547ce4f6
--- /dev/null
+++ b/patches.drivers/staging-wilc1000-Fix-bssid-buffer-offset-in-Txq
@@ -0,0 +1,39 @@
+From 1bbf6a6d4091affb27ec0a19d7aa7887ce72f610 Mon Sep 17 00:00:00 2001
+From: Aditya Shankar <aditya.shankar@microchip.com>
+Date: Fri, 3 Nov 2017 14:26:27 +0530
+Subject: [PATCH] staging: wilc1000: Fix bssid buffer offset in Txq
+Git-commit: 1bbf6a6d4091affb27ec0a19d7aa7887ce72f610
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+Commit 46949b48568b ("staging: wilc1000: New cfg packet
+format in handle_set_wfi_drv_handler") updated the frame
+format sent from host to the firmware. The code to update
+the bssid offset in the new frame was part of a second
+patch in the series which did not make it in and thus
+causes connection problems after associating to an AP.
+
+This fix adds the proper offset of the bssid value in the
+Tx queue buffer to fix the connection issues.
+
+Fixes: 46949b48568b ("staging: wilc1000: New cfg packet format in handle_set_wfi_drv_handler")
+Cc: stable@vger.kernel.org
+Signed-off-by: Aditya Shankar <Aditya.Shankar@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/wilc1000/wilc_wlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/wilc1000/wilc_wlan.c
++++ b/drivers/staging/wilc1000/wilc_wlan.c
+@@ -714,7 +714,7 @@ int wilc_wlan_handle_txq(struct net_devi
+ char *bssid = ((struct tx_complete_data *)(tqe->priv))->bssid;
+
+ buffer_offset = ETH_ETHERNET_HDR_OFFSET;
+- memcpy(&txb[offset + 4], bssid, 6);
++ memcpy(&txb[offset + 8], bssid, 6);
+ } else {
+ buffer_offset = HOST_HDR_OFFSET;
+ }
diff --git a/patches.fixes/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch b/patches.fixes/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
new file mode 100644
index 0000000000..b7c8115253
--- /dev/null
+++ b/patches.fixes/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
@@ -0,0 +1,281 @@
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 24 May 2018 02:32:53 +0200
+Subject: bpf: properly enforce index mask to prevent out-of-bounds speculation
+Patch-mainline: v4.17-rc7
+Git-commit: c93552c443ebc63b14e26e46d2e76941c88e0d71
+References: bsc#1098425
+
+While reviewing the verifier code, I recently noticed that the
+following two program variants in relation to tail calls can be
+loaded.
+
+Variant 1:
+
+ # bpftool p d x i 15
+ 0: (15) if r1 == 0x0 goto pc+3
+ 1: (18) r2 = map[id:5]
+ 3: (05) goto pc+2
+ 4: (18) r2 = map[id:6]
+ 6: (b7) r3 = 7
+ 7: (35) if r3 >= 0xa0 goto pc+2
+ 8: (54) (u32) r3 &= (u32) 255
+ 9: (85) call bpf_tail_call#12
+ 10: (b7) r0 = 1
+ 11: (95) exit
+
+ # bpftool m s i 5
+ 5: prog_array flags 0x0
+ key 4B value 4B max_entries 4 memlock 4096B
+ # bpftool m s i 6
+ 6: prog_array flags 0x0
+ key 4B value 4B max_entries 160 memlock 4096B
+
+Variant 2:
+
+ # bpftool p d x i 20
+ 0: (15) if r1 == 0x0 goto pc+3
+ 1: (18) r2 = map[id:8]
+ 3: (05) goto pc+2
+ 4: (18) r2 = map[id:7]
+ 6: (b7) r3 = 7
+ 7: (35) if r3 >= 0x4 goto pc+2
+ 8: (54) (u32) r3 &= (u32) 3
+ 9: (85) call bpf_tail_call#12
+ 10: (b7) r0 = 1
+ 11: (95) exit
+
+ # bpftool m s i 8
+ 8: prog_array flags 0x0
+ key 4B value 4B max_entries 160 memlock 4096B
+ # bpftool m s i 7
+ 7: prog_array flags 0x0
+ key 4B value 4B max_entries 4 memlock 4096B
+
+In both cases the index masking inserted by the verifier in order
+to control out of bounds speculation from a CPU via b2157399cc98
+("bpf: prevent out-of-bounds speculation") seems to be incorrect
+in what it is enforcing. In the 1st variant, the mask is applied
+from the map with the significantly larger number of entries where
+we would allow to a certain degree out of bounds speculation for
+the smaller map, and in the 2nd variant where the mask is applied
+from the map with the smaller number of entries, we get buggy
+behavior since we truncate the index of the larger map.
+
+The original intent from commit b2157399cc98 is to reject such
+occasions where two or more different tail call maps are used
+in the same tail call helper invocation. However, the check on
+the BPF_MAP_PTR_POISON is never hit since we never poisoned the
+saved pointer in the first place! We do this explicitly for map
+lookups but in case of tail calls we basically used the tail
+call map in insn_aux_data that was processed in the most recent
+path which the verifier walked. Thus any prior path that stored
+a pointer in insn_aux_data at the helper location was always
+overridden.
+
+Fix it by moving the map pointer poison logic into a small helper
+that covers both BPF helpers with the same logic. After that in
+fixup_bpf_calls() the poison check is then hit for tail calls
+and the program rejected. Latter only happens in unprivileged
+case since this is the *only* occasion where a rewrite needs to
+happen, and where such rewrite is specific to the map (max_entries,
+index_mask). In the privileged case the rewrite is generic for
+the insn->imm / insn->code update so multiple maps from different
+paths can be handled just fine since all the remaining logic
+happens in the instruction processing itself. This is similar
+to the case of map lookups: in case there is a collision of
+maps in fixup_bpf_calls() we must skip the inlined rewrite since
+this will turn the generic instruction sequence into a non-
+generic one. Thus the patch_call_imm will simply update the
+insn->imm location where the bpf_map_lookup_elem() will later
+take care of the dispatch. Given we need this 'poison' state
+as a check, the information of whether a map is an unpriv_array
+gets lost, so enforcing it prior to that needs an additional
+state. In general this check is needed since there are some
+complex and tail call intensive BPF programs out there where
+LLVM tends to generate such code occasionally. We therefore
+convert the map_ptr rather into map_state to store all this
+w/o extra memory overhead, and the bit whether one of the maps
+involved in the collision was from an unpriv_array thus needs
+to be retained as well there.
+
+Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Gary Lin <glin@suse.com>
+---
+ include/linux/bpf_verifier.h | 2 -
+ kernel/bpf/verifier.c | 86 ++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 65 insertions(+), 23 deletions(-)
+
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -112,7 +112,7 @@ struct bpf_verifier_state_list {
+ struct bpf_insn_aux_data {
+ union {
+ enum bpf_reg_type ptr_type; /* pointer type for load/store insns */
+- struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */
++ unsigned long map_state; /* pointer/poison value for maps */
+ };
+ int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+ bool seen; /* this insn was processed by the verifier */
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -154,7 +154,29 @@ struct bpf_verifier_stack_elem {
+ #define BPF_COMPLEXITY_LIMIT_INSNS 131072
+ #define BPF_COMPLEXITY_LIMIT_STACK 1024
+
+-#define BPF_MAP_PTR_POISON ((void *)0xeB9F + POISON_POINTER_DELTA)
++#define BPF_MAP_PTR_UNPRIV 1UL
++#define BPF_MAP_PTR_POISON ((void *)((0xeB9FUL << 1) + \
++ POISON_POINTER_DELTA))
++#define BPF_MAP_PTR(X) ((struct bpf_map *)((X) & ~BPF_MAP_PTR_UNPRIV))
++
++static bool bpf_map_ptr_poisoned(const struct bpf_insn_aux_data *aux)
++{
++ return BPF_MAP_PTR(aux->map_state) == BPF_MAP_PTR_POISON;
++}
++
++static bool bpf_map_ptr_unpriv(const struct bpf_insn_aux_data *aux)
++{
++ return aux->map_state & BPF_MAP_PTR_UNPRIV;
++}
++
++static void bpf_map_ptr_store(struct bpf_insn_aux_data *aux,
++ const struct bpf_map *map, bool unpriv)
++{
++ BUILD_BUG_ON((unsigned long)BPF_MAP_PTR_POISON & BPF_MAP_PTR_UNPRIV);
++ unpriv |= bpf_map_ptr_unpriv(aux);
++ aux->map_state = (unsigned long)map |
++ (unpriv ? BPF_MAP_PTR_UNPRIV : 0UL);
++}
+
+ struct bpf_call_arg_meta {
+ struct bpf_map *map_ptr;
+@@ -1624,6 +1646,29 @@ static void clear_all_pkt_pointers(struc
+ }
+ }
+
++static int
++record_func_map(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,
++ int func_id, int insn_idx)
++{
++ struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];
++
++ if (func_id != BPF_FUNC_tail_call &&
++ func_id != BPF_FUNC_map_lookup_elem)
++ return 0;
++ if (meta->map_ptr == NULL) {
++ verbose(env, "kernel subsystem misconfigured verifier\n");
++ return -EINVAL;
++ }
++
++ if (!BPF_MAP_PTR(aux->map_state))
++ bpf_map_ptr_store(aux, meta->map_ptr,
++ meta->map_ptr->unpriv_array);
++ else if (BPF_MAP_PTR(aux->map_state) != meta->map_ptr)
++ bpf_map_ptr_store(aux, BPF_MAP_PTR_POISON,
++ meta->map_ptr->unpriv_array);
++ return 0;
++}
++
+ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
+ {
+ const struct bpf_func_proto *fn = NULL;
+@@ -1682,13 +1727,6 @@ static int check_call(struct bpf_verifie
+ err = check_func_arg(env, BPF_REG_2, fn->arg2_type, &meta);
+ if (err)
+ return err;
+- if (func_id == BPF_FUNC_tail_call) {
+- if (meta.map_ptr == NULL) {
+- verbose(env, "verifier bug\n");
+- return -EINVAL;
+- }
+- env->insn_aux_data[insn_idx].map_ptr = meta.map_ptr;
+- }
+ err = check_func_arg(env, BPF_REG_3, fn->arg3_type, &meta);
+ if (err)
+ return err;
+@@ -1699,6 +1737,10 @@ static int check_call(struct bpf_verifie
+ if (err)
+ return err;
+
++ err = record_func_map(env, &meta, func_id, insn_idx);
++ if (err)
++ return err;
++
+ /* Mark slots with STACK_MISC in case of raw mode, stack offset
+ * is inferred from register state.
+ */
+@@ -1723,8 +1765,6 @@ static int check_call(struct bpf_verifie
+ } else if (fn->ret_type == RET_VOID) {
+ regs[BPF_REG_0].type = NOT_INIT;
+ } else if (fn->ret_type == RET_PTR_TO_MAP_VALUE_OR_NULL) {
+- struct bpf_insn_aux_data *insn_aux;
+-
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+@@ -1740,11 +1780,6 @@ static int check_call(struct bpf_verifie
+ }
+ regs[BPF_REG_0].map_ptr = meta.map_ptr;
+ regs[BPF_REG_0].id = ++env->id_gen;
+- insn_aux = &env->insn_aux_data[insn_idx];
+- if (!insn_aux->map_ptr)
+- insn_aux->map_ptr = meta.map_ptr;
+- else if (insn_aux->map_ptr != meta.map_ptr)
+- insn_aux->map_ptr = BPF_MAP_PTR_POISON;
+ } else {
+ verbose(env, "unknown return type %d of func %s#%d\n",
+ fn->ret_type, func_id_name(func_id), func_id);
+@@ -4307,6 +4342,7 @@ static int fixup_bpf_calls(struct bpf_ve
+ struct bpf_insn *insn = prog->insnsi;
+ const struct bpf_func_proto *fn;
+ const int insn_cnt = prog->len;
++ struct bpf_insn_aux_data *aux;
+ struct bpf_insn insn_buf[16];
+ struct bpf_prog *new_prog;
+ struct bpf_map *map_ptr;
+@@ -4355,19 +4391,22 @@ static int fixup_bpf_calls(struct bpf_ve
+ insn->imm = 0;
+ insn->code = BPF_JMP | BPF_TAIL_CALL;
+
++ aux = &env->insn_aux_data[i + delta];
++ if (!bpf_map_ptr_unpriv(aux))
++ continue;
++
+ /* instead of changing every JIT dealing with tail_call
+ * emit two extra insns:
+ * if (index >= max_entries) goto out;
+ * index &= array->index_mask;
+ * to avoid out-of-bounds cpu speculation
+ */
+- map_ptr = env->insn_aux_data[i + delta].map_ptr;
+- if (map_ptr == BPF_MAP_PTR_POISON) {
++ if (bpf_map_ptr_poisoned(aux)) {
+ verbose(env, "tail_call abusing map_ptr\n");
+ return -EINVAL;
+ }
+- if (!map_ptr->unpriv_array)
+- continue;
++
++ map_ptr = BPF_MAP_PTR(aux->map_state);
+ insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3,
+ map_ptr->max_entries, 2);
+ insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3,
+@@ -4391,9 +4430,12 @@ static int fixup_bpf_calls(struct bpf_ve
+ */
+ if (ebpf_jit_enabled() && BITS_PER_LONG == 64 &&
+ insn->imm == BPF_FUNC_map_lookup_elem) {
+- map_ptr = env->insn_aux_data[i + delta].map_ptr;
+- if (map_ptr == BPF_MAP_PTR_POISON ||
+- !map_ptr->ops->map_gen_lookup)
++ aux = &env->insn_aux_data[i + delta];
++ if (bpf_map_ptr_poisoned(aux))
++ goto patch_call_imm;
++
++ map_ptr = BPF_MAP_PTR(aux->map_state);
++ if (!map_ptr->ops->map_gen_lookup)
+ goto patch_call_imm;
+
+ cnt = map_ptr->ops->map_gen_lookup(map_ptr, insn_buf);
diff --git a/patches.fixes/ceph-fix-alignment-of-rasize.patch b/patches.fixes/ceph-fix-alignment-of-rasize.patch
new file mode 100644
index 0000000000..8e3e5c17e6
--- /dev/null
+++ b/patches.fixes/ceph-fix-alignment-of-rasize.patch
@@ -0,0 +1,35 @@
+From: Chengguang Xu <cgxu519@gmx.com>
+Date: Wed, 30 May 2018 10:13:11 +0800
+Subject: ceph: fix alignment of rasize
+Git-commit: c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7
+Patch-mainline: v4.18-rc1
+References: bsc#1098236
+
+On currently logic:
+when I specify rasize=0~1 then it will be 4096.
+when I specify rasize=2~4097 then it will be 8192.
+
+Make it the same as rsize & wsize.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index a8e8e2629fb4..b4ff1392e333 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -271,7 +271,7 @@ static int parse_fsopt_token(char *c, void *private)
+ case Opt_rasize:
+ if (intval < 0)
+ return -EINVAL;
+- fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE);
++ fsopt->rasize = ALIGN(intval, PAGE_SIZE);
+ break;
+ case Opt_caps_wanted_delay_min:
+ if (intval < 1)
+
diff --git a/patches.fixes/ceph-fix-use-after-free-in-ceph_statfs.patch b/patches.fixes/ceph-fix-use-after-free-in-ceph_statfs.patch
new file mode 100644
index 0000000000..1b2409f8b0
--- /dev/null
+++ b/patches.fixes/ceph-fix-use-after-free-in-ceph_statfs.patch
@@ -0,0 +1,109 @@
+From: Luis Henriques <lhenriques@suse.com>
+Date: Mon, 28 May 2018 18:37:40 +0100
+Subject: ceph: fix use-after-free in ceph_statfs()
+Git-commit: 73fb0949cf246b212ff63d692a0ec88db954bb35
+Patch-mainline: v4.18-rc1
+References: bsc#1098236
+
+KASAN found an UAF in ceph_statfs. This was a one-off bug but looking at
+the code it looks like the monmap access needs to be protected as it can
+be modified while we're accessing it. Fix this by protecting the access
+with the monc->mutex.
+
+ BUG: KASAN: use-after-free in ceph_statfs+0x21d/0x2c0
+ Read of size 8 at addr ffff88006844f2e0 by task trinity-c5/304
+
+ CPU: 0 PID: 304 Comm: trinity-c5 Not tainted 4.17.0-rc6+ #172
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
+ Call Trace:
+ dump_stack+0xa5/0x11b
+ ? show_regs_print_info+0x5/0x5
+ ? kmsg_dump_rewind+0x118/0x118
+ ? ceph_statfs+0x21d/0x2c0
+ print_address_description+0x73/0x2b0
+ ? ceph_statfs+0x21d/0x2c0
+ kasan_report+0x243/0x360
+ ceph_statfs+0x21d/0x2c0
+ ? ceph_umount_begin+0x80/0x80
+ ? kmem_cache_alloc+0xdf/0x1a0
+ statfs_by_dentry+0x79/0xb0
+ vfs_statfs+0x28/0x110
+ user_statfs+0x8c/0xe0
+ ? vfs_statfs+0x110/0x110
+ ? __fdget_raw+0x10/0x10
+ __se_sys_statfs+0x5d/0xa0
+ ? user_statfs+0xe0/0xe0
+ ? mutex_unlock+0x1d/0x40
+ ? __x64_sys_statfs+0x20/0x30
+ do_syscall_64+0xee/0x290
+ ? syscall_return_slowpath+0x1c0/0x1c0
+ ? page_fault+0x1e/0x30
+ ? syscall_return_slowpath+0x13c/0x1c0
+ ? prepare_exit_to_usermode+0xdb/0x140
+ ? syscall_trace_enter+0x330/0x330
+ ? __put_user_4+0x1c/0x30
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ Allocated by task 130:
+ __kmalloc+0x124/0x210
+ ceph_monmap_decode+0x1c1/0x400
+ dispatch+0x113/0xd20
+ ceph_con_workfn+0xa7e/0x44e0
+ process_one_work+0x5f0/0xa30
+ worker_thread+0x184/0xa70
+ kthread+0x1a0/0x1c0
+ ret_from_fork+0x35/0x40
+
+ Freed by task 130:
+ kfree+0xb8/0x210
+ dispatch+0x15a/0xd20
+ ceph_con_workfn+0xa7e/0x44e0
+ process_one_work+0x5f0/0xa30
+ worker_thread+0x184/0xa70
+ kthread+0x1a0/0x1c0
+ ret_from_fork+0x35/0x40
+
+Signed-off-by: Luis Henriques <lhenriques@suse.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+---
+ fs/ceph/super.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index cad046aa4fd0..a8e8e2629fb4 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -45,7 +45,7 @@ static void ceph_put_super(struct super_block *s)
+ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+ {
+ struct ceph_fs_client *fsc = ceph_inode_to_client(d_inode(dentry));
+- struct ceph_monmap *monmap = fsc->client->monc.monmap;
++ struct ceph_mon_client *monc = &fsc->client->monc;
+ struct ceph_statfs st;
+ u64 fsid;
+ int err;
+@@ -58,7 +58,7 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+ }
+
+ dout("statfs\n");
+- err = ceph_monc_do_statfs(&fsc->client->monc, data_pool, &st);
++ err = ceph_monc_do_statfs(monc, data_pool, &st);
+ if (err < 0)
+ return err;
+
+@@ -94,8 +94,11 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+ buf->f_namelen = NAME_MAX;
+
+ /* Must convert the fsid, for consistent values across arches */
+- fsid = le64_to_cpu(*(__le64 *)(&monmap->fsid)) ^
+- le64_to_cpu(*((__le64 *)&monmap->fsid + 1));
++ mutex_lock(&monc->mutex);
++ fsid = le64_to_cpu(*(__le64 *)(&monc->monmap->fsid)) ^
++ le64_to_cpu(*((__le64 *)&monc->monmap->fsid + 1));
++ mutex_unlock(&monc->mutex);
++
+ buf->f_fsid.val[0] = fsid & 0xffffffff;
+ buf->f_fsid.val[1] = fsid >> 32;
+
+
diff --git a/patches.fixes/ceph-fix-wrong-check-for-the-case-of-updating-link-count.patch b/patches.fixes/ceph-fix-wrong-check-for-the-case-of-updating-link-count.patch
new file mode 100644
index 0000000000..9d8ef807f9
--- /dev/null
+++ b/patches.fixes/ceph-fix-wrong-check-for-the-case-of-updating-link-count.patch
@@ -0,0 +1,41 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Fri, 25 May 2018 11:22:56 +0800
+Subject: ceph: fix wrong check for the case of updating link count
+Git-commit: fa466743a9fc6e4a24ef22285fb384f9ef4a2edb
+Patch-mainline: v4.18-rc1
+References: bsc#1098236
+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/caps.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3044,7 +3044,6 @@ static void handle_cap_grant(struct ceph
+ int used, wanted, dirty;
+ u64 size = le64_to_cpu(grant->size);
+ u64 max_size = le64_to_cpu(grant->max_size);
+- struct timespec mtime, atime, ctime;
+ int check_caps = 0;
+ bool wake = false;
+ bool writeback = false;
+@@ -3109,7 +3108,7 @@ static void handle_cap_grant(struct ceph
+ from_kgid(&init_user_ns, inode->i_gid));
+ }
+
+- if ((newcaps & CEPH_CAP_AUTH_SHARED) &&
++ if ((newcaps & CEPH_CAP_LINK_SHARED) &&
+ (issued & CEPH_CAP_LINK_EXCL) == 0) {
+ set_nlink(inode, le32_to_cpu(grant->nlink));
+ if (inode->i_nlink == 0 &&
+@@ -3133,6 +3132,7 @@ static void handle_cap_grant(struct ceph
+ }
+
+ if (newcaps & CEPH_CAP_ANY_RD) {
++ struct timespec mtime, atime, ctime;
+ /* ctime/mtime/atime? */
+ ceph_decode_timespec(&mtime, &grant->mtime);
+ ceph_decode_timespec(&atime, &grant->atime);
diff --git a/patches.fixes/ceph-prevent-i_version-from-going-back.patch b/patches.fixes/ceph-prevent-i_version-from-going-back.patch
new file mode 100644
index 0000000000..9167b765e2
--- /dev/null
+++ b/patches.fixes/ceph-prevent-i_version-from-going-back.patch
@@ -0,0 +1,28 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Sat, 26 May 2018 16:54:39 +0800
+Subject: ceph: prevent i_version from going back
+Git-commit: aae1a442f8eac6d5442ee479df66d278c73a6ecc
+Patch-mainline: v4.18-rc1
+References: bsc#1098236
+
+inode info from non-auth can be stale.
+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -869,7 +869,8 @@ static int fill_inode(struct inode *inod
+ }
+
+ /* finally update i_version */
+- ci->i_version = le64_to_cpu(info->version);
++ if (le64_to_cpu(info->version) > ci->i_version)
++ ci->i_version = le64_to_cpu(info->version);
+
+ inode->i_mapping->a_ops = &ceph_aops;
+
diff --git a/patches.fixes/ceph-support-file-lock-on-directory.patch b/patches.fixes/ceph-support-file-lock-on-directory.patch
new file mode 100644
index 0000000000..a0a4c63c82
--- /dev/null
+++ b/patches.fixes/ceph-support-file-lock-on-directory.patch
@@ -0,0 +1,29 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Tue, 15 May 2018 11:30:43 +0800
+Subject: ceph: support file lock on directory
+Git-commit: 597817ddbbf27af5986d1f3df20390b2738411c6
+Patch-mainline: v4.18-rc1
+References: bsc#1098236
+
+Link: http://tracker.ceph.com/issues/24028
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 1a78dd6f8bf2..036ac0f3a393 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1486,6 +1486,8 @@ const struct file_operations ceph_dir_fops = {
+ .release = ceph_release,
+ .unlocked_ioctl = ceph_ioctl,
+ .fsync = ceph_fsync,
++ .lock = ceph_lock,
++ .flock = ceph_flock,
+ };
+
+ const struct file_operations ceph_snapdir_fops = {
+
diff --git a/patches.fixes/f2fs-fix-a-panic-caused-by-null-flush_cmd_control.patch b/patches.fixes/f2fs-fix-a-panic-caused-by-null-flush_cmd_control.patch
new file mode 100644
index 0000000000..e5ed350a39
--- /dev/null
+++ b/patches.fixes/f2fs-fix-a-panic-caused-by-null-flush_cmd_control.patch
@@ -0,0 +1,47 @@
+From: Yunlei He <heyunlei@huawei.com>
+Date: Thu, 1 Jun 2017 16:43:51 +0800
+Subject: f2fs: fix a panic caused by NULL flush_cmd_control
+Git-commit: d4fdf8ba0e5808ba9ad6b44337783bd9935e0982
+Patch-mainline: v4.13-rc1
+References: bsc#1086400
+
+Mount fs with option noflush_merge, boot failed for illegal address
+fcc in function f2fs_issue_flush:
+
+ if (!test_opt(sbi, FLUSH_MERGE)) {
+ ret = submit_flush_wait(sbi);
+ atomic_inc(&fcc->issued_flush); -> Here, fcc illegal
+ return ret;
+ }
+
+Signed-off-by: Yunlei He <heyunlei@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/f2fs/segment.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index de6738b82745..c1026b78cdfc 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -566,6 +566,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
+ init_waitqueue_head(&fcc->flush_wait_queue);
+ init_llist_head(&fcc->issue_list);
+ SM_I(sbi)->fcc_info = fcc;
++ if (!test_opt(sbi, FLUSH_MERGE))
++ return err;
++
+ init_thread:
+ fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
+ "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
+@@ -3240,7 +3243,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
+
+ INIT_LIST_HEAD(&sm_info->sit_entry_set);
+
+- if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
++ if (!f2fs_readonly(sbi->sb)) {
+ err = create_flush_cmd_control(sbi);
+ if (err)
+ return err;
+
diff --git a/patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch b/patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch
new file mode 100644
index 0000000000..2279194f90
--- /dev/null
+++ b/patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch
@@ -0,0 +1,44 @@
+From: Shankara Pailoor <shankarapailoor@gmail.com>
+Date: Tue, 5 Jun 2018 08:33:27 -0500
+Subject: jfs: Fix inconsistency between memory allocation and ea_buf->max_size
+Git-commit: 92d34134193e5b129dc24f8d79cb9196626e8d7a
+Patch-mainline: v4.19 or v4.18-rc2 (next release)
+References: bsc#1097234, CVE-2018-12233
+
+The code is assuming the buffer is max_size length, but we weren't
+allocating enough space for it.
+
+Signed-off-by: Shankara Pailoor <shankarapailoor@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/jfs/xattr.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
+index c60f3d32ee91..a6797986b625 100644
+--- a/fs/jfs/xattr.c
++++ b/fs/jfs/xattr.c
+@@ -491,15 +491,17 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
+ if (size > PSIZE) {
+ /*
+ * To keep the rest of the code simple. Allocate a
+- * contiguous buffer to work with
++ * contiguous buffer to work with. Make the buffer large
++ * enough to make use of the whole extent.
+ */
+- ea_buf->xattr = kmalloc(size, GFP_KERNEL);
++ ea_buf->max_size = (size + sb->s_blocksize - 1) &
++ ~(sb->s_blocksize - 1);
++
++ ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL);
+ if (ea_buf->xattr == NULL)
+ return -ENOMEM;
+
+ ea_buf->flag = EA_MALLOC;
+- ea_buf->max_size = (size + sb->s_blocksize - 1) &
+- ~(sb->s_blocksize - 1);
+
+ if (ea_size == 0)
+ return 0;
+
diff --git a/patches.fixes/mm-swap-fix-false-error-message-in-_swp_swapcount.patch b/patches.fixes/mm-swap-fix-false-error-message-in-_swp_swapcount.patch
new file mode 100644
index 0000000000..7e1819b9eb
--- /dev/null
+++ b/patches.fixes/mm-swap-fix-false-error-message-in-_swp_swapcount.patch
@@ -0,0 +1,89 @@
+From: Huang Ying <huang.ying.caritas@gmail.com>
+Date: Wed, 15 Nov 2017 17:33:15 -0800
+Subject: mm, swap: fix false error message in __swp_swapcount()
+Git-commit: e9a6effa500526e2a19d5ad042cb758b55b1ef93
+Patch-mainline: v4.15-rc1
+References: VM Functionality, bsc#1098043
+
+[ Backport contains parts of 0bcac06f27d7528591c27ac2b093ccd71c5d0168 that
+ introduce swp_swap_info() ]
+
+When a page fault occurs for a swap entry, the physical swap readahead
+(not the VMA base swap readahead) may readahead several swap entries
+after the fault swap entry. The readahead algorithm calculates some of
+the swap entries to readahead via increasing the offset of the fault
+swap entry without checking whether they are beyond the end of the swap
+device and it relys on the __swp_swapcount() and swapcache_prepare() to
+check it. Although __swp_swapcount() checks for the swap entry passed
+in, it will complain with the error message as follow for the expected
+invalid swap entry. This may make the end users confused.
+
+ swap_info_get: Bad swap offset entry 0200f8a7
+
+To fix the false error message, the swap entry checking is added in
+swapin_readahead() to avoid to pass the out-of-bound swap entries and
+the swap entry reserved for the swap header to __swp_swapcount() and
+swapcache_prepare().
+
+Link: http://lkml.kernel.org/r/20171102054225.22897-1-ying.huang@intel.com
+Fixes: e8c26ab60598 ("mm/swap: skip readahead for unreferenced swap slots")
+Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
+Reported-by: Christian Kujau <lists@nerdbynature.de>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Suggested-by: Minchan Kim <minchan@kernel.org>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org> [4.11+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+---
+ include/linux/swap.h | 1 +
+ mm/swap_state.c | 3 +++
+ mm/swapfile.c | 5 +++++
+ 3 files changed, 9 insertions(+)
+
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -427,6 +427,7 @@ extern int page_swapcount(struct page *)
+ extern int __swp_swapcount(swp_entry_t entry);
+ extern int swp_swapcount(swp_entry_t entry);
+ extern struct swap_info_struct *page_swap_info(struct page *);
++extern struct swap_info_struct *swp_swap_info(swp_entry_t entry);
+ extern bool reuse_swap_page(struct page *, int *);
+ extern int try_to_free_swap(struct page *);
+ struct backing_dev_info;
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -500,6 +500,7 @@ struct page *swapin_readahead(swp_entry_
+ unsigned long offset = entry_offset;
+ unsigned long start_offset, end_offset;
+ unsigned long mask;
++ struct swap_info_struct *si = swp_swap_info(entry);
+ struct blk_plug plug;
+
+ mask = swapin_nr_pages(offset) - 1;
+@@ -511,6 +512,8 @@ struct page *swapin_readahead(swp_entry_
+ end_offset = offset | mask;
+ if (!start_offset) /* First page is swap header. */
+ start_offset++;
++ if (end_offset >= si->max)
++ end_offset = si->max - 1;
+
+ blk_start_plug(&plug);
+ for (offset = start_offset; offset <= end_offset ; offset++) {
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -3065,6 +3065,11 @@ int swapcache_prepare(swp_entry_t entry)
+ return __swap_duplicate(entry, SWAP_HAS_CACHE);
+ }
+
++struct swap_info_struct *swp_swap_info(swp_entry_t entry)
++{
++ return swap_info[swp_type(entry)];
++}
++
+ struct swap_info_struct *page_swap_info(struct page *page)
+ {
+ swp_entry_t swap = { .val = page_private(page) };
diff --git a/patches.fixes/xen-dont-print-error-message-in-case-og-missing-xenstore-entry.patch b/patches.fixes/xen-dont-print-error-message-in-case-og-missing-xenstore-entry.patch
new file mode 100644
index 0000000000..67b658b175
--- /dev/null
+++ b/patches.fixes/xen-dont-print-error-message-in-case-og-missing-xenstore-entry.patch
@@ -0,0 +1,45 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 30 May 2017 20:52:26 +0200
+Patch-mainline: 4.13
+Git-commit: 4e93b6481c87ea5afde944a32b4908357ec58992
+References: bnc#1065600
+Subject: xen: don't print error message in case of missing Xenstore entry
+
+When registering for the Xenstore watch of the node control/sysrq the
+handler will be called at once. Don't issue an error message if the
+Xenstore node isn't there, as it will be created only when an event
+is being triggered.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ drivers/xen/manage.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index c1ec8ee..60cf71f 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -277,8 +277,16 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
+ err = xenbus_transaction_start(&xbt);
+ if (err)
+ return;
+- if (xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key) < 0) {
+- pr_err("Unable to read sysrq code in control/sysrq\n");
++ err = xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key);
++ if (err < 0) {
++ /*
++ * The Xenstore watch fires directly after registering it and
++ * after a suspend/resume cycle. So ENOENT is no error but
++ * might happen in those cases.
++ */
++ if (err != -ENOENT)
++ pr_err("Error %d reading sysrq code in control/sysrq\n",
++ err);
+ xenbus_transaction_end(xbt, 1);
+ return;
+ }
+--
+cgit v1.1
+
diff --git a/patches.kabi/bpf-prevent-memory-disambiguation-attack.patch b/patches.kabi/bpf-prevent-memory-disambiguation-attack.patch
index 5a692eec02..f6d8e5e307 100644
--- a/patches.kabi/bpf-prevent-memory-disambiguation-attack.patch
+++ b/patches.kabi/bpf-prevent-memory-disambiguation-attack.patch
@@ -11,7 +11,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -115,8 +115,10 @@ struct bpf_insn_aux_data {
- struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */
+ unsigned long map_state; /* pointer/poison value for maps */
};
int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
- int sanitize_stack_off; /* stack slot to be cleared */
diff --git a/patches.kabi/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch b/patches.kabi/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
new file mode 100644
index 0000000000..54bdd7fa64
--- /dev/null
+++ b/patches.kabi/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
@@ -0,0 +1,25 @@
+From: Gary Lin <glin@suse.com>
+Subject: [PATCH] kabi: add struct bpf_map back
+Patch-mainline: No, SUSE-specific
+References: References: bsc#1098425
+
+Signed-off-by: Gary Lin <glin@suse.com>
+
+---
+ include/linux/bpf_verifier.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -112,7 +112,11 @@ struct bpf_verifier_state_list {
+ struct bpf_insn_aux_data {
+ union {
+ enum bpf_reg_type ptr_type; /* pointer type for load/store insns */
++#ifndef __GENKSYMS__
+ unsigned long map_state; /* pointer/poison value for maps */
++#else
++ struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */
++#endif
+ };
+ int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+ bool seen; /* this insn was processed by the verifier */
diff --git a/patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch b/patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch
new file mode 100644
index 0000000000..346c3658a4
--- /dev/null
+++ b/patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch
@@ -0,0 +1,170 @@
+From 5ed57eeec83f8e851029df9ebbe679f9d15c30a8 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dbueso@suse.de>
+Date: Thu, 17 May 2018 12:17:19 -0700
+Subject: [PATCH] kvm: Introduce nopvspin kernel parameter
+Patch-mainline: never, SUSE specific
+References: bsc#1056427
+
+This adds a is a SLE specific feature to disable paravirtual
+spinlocks in favor of the bare metal behavior under specific 1:1
+cpu to vcpu mappings.
+
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 4 ++++
+ arch/x86/include/asm/qspinlock.h | 11 +++++++++-
+ arch/x86/kernel/kvm.c | 29 +++++++++++++++++++++++++
+ arch/x86/kernel/paravirt.c | 8 +++++++
+ arch/x86/kernel/smpboot.c | 2 ++
+ 5 files changed, 53 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 2fce2a81eadc..1eaa4f204457 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1886,6 +1886,10 @@
+ feature (tagged TLBs) on capable Intel chips.
+ Default is 1 (enabled)
+
++ kvm_nopvspin [X86,KVM]
++ Disables the paravirtualized spinlock slowpath
++ optimizations for KVM.
++
+ l2cr= [PPC]
+
+ l3cr= [PPC]
+diff --git a/arch/x86/include/asm/qspinlock.h b/arch/x86/include/asm/qspinlock.h
+index 48a706f641f2..308dfd0714c7 100644
+--- a/arch/x86/include/asm/qspinlock.h
++++ b/arch/x86/include/asm/qspinlock.h
+@@ -1,6 +1,7 @@
+ #ifndef _ASM_X86_QSPINLOCK_H
+ #define _ASM_X86_QSPINLOCK_H
+
++#include <linux/jump_label.h>
+ #include <asm/cpufeature.h>
+ #include <asm-generic/qspinlock_types.h>
+ #include <asm/paravirt.h>
+@@ -46,10 +47,14 @@ static inline void queued_spin_unlock(struct qspinlock *lock)
+ #endif
+
+ #ifdef CONFIG_PARAVIRT
++DECLARE_STATIC_KEY_TRUE(virt_spin_lock_key);
++
++void native_pv_lock_init(void) __init;
++
+ #define virt_spin_lock virt_spin_lock
+ static inline bool virt_spin_lock(struct qspinlock *lock)
+ {
+- if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
++ if (!static_branch_likely(&virt_spin_lock_key))
+ return false;
+
+ /*
+@@ -65,6 +70,10 @@ static inline bool virt_spin_lock(struct qspinlock *lock)
+
+ return true;
+ }
++#else
++static inline void native_pv_lock_init(void)
++{
++}
+ #endif /* CONFIG_PARAVIRT */
+
+ #include <asm-generic/qspinlock.h>
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 1fce20274e44..876aa6df42e4 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -47,6 +47,22 @@
+ #include <asm/hypervisor.h>
+ #include <asm/kvm_guest.h>
+
++/*
++ * SLE-specific.
++ *
++ * Allow disabling of PV spinlock in kernel command line (kernel param).
++ * Similar idea to what Xen does. Upstream, however, uses a different
++ * approach such that hypervisor admins can pass the VM_HINTS_DEDICATED
++ * via qemu.
++ */
++static bool kvm_pvspin = true;
++static __init int kvm_parse_nopvspin(char *arg)
++{
++ kvm_pvspin = false;
++ return 0;
++}
++early_param("kvm_nopvspin", kvm_parse_nopvspin);
++
+ static int kvmapf = 1;
+
+ static int parse_no_kvmapf(char *arg)
+@@ -454,6 +470,13 @@ static void __init sev_map_percpu_data(void)
+ }
+
+ #ifdef CONFIG_SMP
++static void __init kvm_smp_prepare_cpus(unsigned int max_cpus)
++{
++ native_smp_prepare_cpus(max_cpus);
++ if (!kvm_pvspin)
++ static_branch_disable(&virt_spin_lock_key);
++}
++
+ static void __init kvm_smp_prepare_boot_cpu(void)
+ {
+ /*
+@@ -524,6 +547,7 @@ void __init kvm_guest_init(void)
+ kvm_setup_vsyscall_timeinfo();
+
+ #ifdef CONFIG_SMP
++ smp_ops.smp_prepare_cpus = kvm_smp_prepare_cpus;
+ smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
+ if (cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/kvm:online",
+ kvm_cpu_online, kvm_cpu_down_prepare) < 0)
+@@ -680,6 +704,11 @@ void __init kvm_spinlock_init(void)
+ if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+ return;
+
++ if (!kvm_pvspin) {
++ printk(KERN_INFO "KVM: disabled paravirtual spinlock\n");
++ return;
++ }
++
+ __pv_init_lock_hash();
+ pv_lock_ops.queued_spin_lock_slowpath = __pv_queued_spin_lock_slowpath;
+ pv_lock_ops.queued_spin_unlock = PV_CALLEE_SAVE(__pv_queued_spin_unlock);
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index 63d4e63342bf..1d9f2b4f4edb 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -115,6 +115,14 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target,
+ return 5;
+ }
+
++DEFINE_STATIC_KEY_TRUE(virt_spin_lock_key);
++
++void __init native_pv_lock_init(void)
++{
++ if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
++ static_branch_disable(&virt_spin_lock_key);
++}
++
+ /* Neat trick to map patch type back to the call within the
+ * corresponding structure. */
+ static void *get_call_destination(u8 type)
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index c82eb787f3e0..0de7c9bcef85 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1281,6 +1281,8 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
+ pr_info("CPU0: ");
+ print_cpu_info(&cpu_data(0));
+
++ native_pv_lock_init();
++
+ uv_system_init();
+
+ set_mtrr_aps_delayed_init();
+--
+2.13.6
+
diff --git a/patches.suse/bpf-prevent-memory-disambiguation-attack.patch b/patches.suse/bpf-prevent-memory-disambiguation-attack.patch
index 6ec86dc6de..bf3762b935 100644
--- a/patches.suse/bpf-prevent-memory-disambiguation-attack.patch
+++ b/patches.suse/bpf-prevent-memory-disambiguation-attack.patch
@@ -36,7 +36,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -115,6 +115,7 @@ struct bpf_insn_aux_data {
- struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */
+ unsigned long map_state; /* pointer/poison value for maps */
};
int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+ int sanitize_stack_off; /* stack slot to be cleared */
@@ -45,7 +45,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
-@@ -658,7 +658,7 @@ static bool is_spillable_regtype(enum bp
+@@ -680,7 +680,7 @@ static bool is_spillable_regtype(enum bp
*/
static int check_stack_write(struct bpf_verifier_env *env,
struct bpf_verifier_state *state, int off,
@@ -54,7 +54,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
{
int i, slot = -off - 1, spi = slot / BPF_REG_SIZE, err;
-@@ -689,8 +689,33 @@ static int check_stack_write(struct bpf_
+@@ -711,8 +711,33 @@ static int check_stack_write(struct bpf_
state->stack[spi].spilled_ptr = state->regs[value_regno];
state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
@@ -89,7 +89,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
} else {
/* regular write of data into stack */
state->stack[spi].spilled_ptr = (struct bpf_reg_state) {};
-@@ -1181,7 +1206,7 @@ static int check_mem_access(struct bpf_v
+@@ -1203,7 +1228,7 @@ static int check_mem_access(struct bpf_v
if (t == BPF_WRITE)
err = check_stack_write(env, state, off, size,
@@ -98,7 +98,7 @@ Signed-off-by: Jiri Kosina <jkosina@suse.cz>
else
err = check_stack_read(env, state, off, size,
value_regno);
-@@ -4232,6 +4257,34 @@ static int convert_ctx_accesses(struct b
+@@ -4267,6 +4292,34 @@ static int convert_ctx_accesses(struct b
else
continue;
diff --git a/patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch b/patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch
new file mode 100644
index 0000000000..b9e524ac3f
--- /dev/null
+++ b/patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch
@@ -0,0 +1,75 @@
+From f9f063cb82f41932ff1fba2acd01e643d2c2eaed Mon Sep 17 00:00:00 2001
+From: ethanwu <ethanwu@synology.com>
+Date: Sun, 29 Apr 2018 15:59:42 +0800
+Subject: [PATCH] btrfs: Take trans lock before access running trans in
+ check_delayed_ref
+Git-commit: 998ac6d21cfd6efd58f5edf420bae8839dda9f2a
+Patch-mainline: v4.17-rc6
+References: bsc#1097105
+
+In preivous patch:
+Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist
+We avoid starting btrfs transaction and get this information from
+fs_info->running_transaction directly.
+
+When accessing running_transaction in check_delayed_ref, there's a
+chance that current transaction will be freed by commit transaction
+after the NULL pointer check of running_transaction is passed.
+
+After looking all the other places using fs_info->running_transaction,
+they are either protected by trans_lock or holding the transactions.
+
+Fix this by using trans_lock and increasing the use_count.
+
+Fixes: e4c3b2dcd144 ("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist")
+CC: stable@vger.kernel.org # 4.14+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/extent-tree.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 903c919fd249..d55fa1104b9e 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3098,7 +3098,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ struct btrfs_transaction *cur_trans;
+ int ret = 0;
+
++ spin_lock(&root->fs_info->trans_lock);
+ cur_trans = root->fs_info->running_transaction;
++ if (cur_trans)
++ refcount_inc(&cur_trans->use_count);
++ spin_unlock(&root->fs_info->trans_lock);
+ if (!cur_trans)
+ return 0;
+
+@@ -3107,6 +3111,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
+ if (!head) {
+ spin_unlock(&delayed_refs->lock);
++ btrfs_put_transaction(cur_trans);
+ return 0;
+ }
+
+@@ -3123,6 +3128,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ mutex_lock(&head->mutex);
+ mutex_unlock(&head->mutex);
+ btrfs_put_delayed_ref(&head->node);
++ btrfs_put_transaction(cur_trans);
+ return -EAGAIN;
+ }
+ spin_unlock(&delayed_refs->lock);
+@@ -3150,6 +3156,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ }
+ spin_unlock(&head->lock);
+ mutex_unlock(&head->mutex);
++ btrfs_put_transaction(cur_trans);
+ return ret;
+ }
+
+--
+2.7.4
+
diff --git a/patches.suse/btrfs-fix-copy_items-return-value-when-logging-an-inode.patch b/patches.suse/btrfs-fix-copy_items-return-value-when-logging-an-inode.patch
new file mode 100644
index 0000000000..150c30d496
--- /dev/null
+++ b/patches.suse/btrfs-fix-copy_items-return-value-when-logging-an-inode.patch
@@ -0,0 +1,42 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 26 Mar 2018 23:59:12 +0100
+Subject: Btrfs: fix copy_items() return value when logging an inode
+Git-commit: 8434ec46c6e3232cebc25a910363b29f5c617820
+Patch-mainline: v4.17-rc1
+References: bsc#1097105
+
+When logging an inode, at tree-log.c:copy_items(), if we call
+btrfs_next_leaf() at the loop which checks for the need to log holes, we
+need to make sure copy_items() returns the value 1 to its caller and
+not 0 (on success). This is because the path the caller passed was
+released and is now different from what is was before, and the caller
+expects a return value of 0 to mean both success and that the path
+has not changed, while a return value of 1 means both success and
+signals the caller that it can not reuse the path, it has to perform
+another tree search.
+
+Even though this is a case that should not be triggered on normal
+circumstances or very rare at least, its consequences can be very
+unpredictable (especially when replaying a log tree).
+
+Fixes: 16e7549f045d ("Btrfs: incompatible format change to remove hole extents")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/tree-log.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 552582a028a4..70afd1085033 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3968,6 +3968,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ ASSERT(ret == 0);
+ src = src_path->nodes[0];
+ i = 0;
++ need_find_last_extent = true;
+ }
+
+ btrfs_item_key_to_cpu(src, &key, i);
+
diff --git a/patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch b/patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch
new file mode 100644
index 0000000000..69c9cef740
--- /dev/null
+++ b/patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch
@@ -0,0 +1,80 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Fri, 11 May 2018 16:42:42 +0100
+Subject: Btrfs: fix xattr loss after power failure
+Git-commit: 9a8fca62aacc1599fea8e813d01e1955513e4fad
+Patch-mainline: v4.17-rc6
+References: bsc#1097105
+
+If a file has xattrs, we fsync it, to ensure we clear the flags
+BTRFS_INODE_NEEDS_FULL_SYNC and BTRFS_INODE_COPY_EVERYTHING from its
+inode, the current transaction commits and then we fsync it (without
+either of those bits being set in its inode), we end up not logging
+all its xattrs. This results in deleting all xattrs when replying the
+log after a power failure.
+
+Trivial reproducer
+
+ $ mkfs.btrfs -f /dev/sdb
+ $ mount /dev/sdb /mnt
+
+ $ touch /mnt/foobar
+ $ setfattr -n user.xa -v qwerty /mnt/foobar
+ $ xfs_io -c "fsync" /mnt/foobar
+
+ $ sync
+
+ $ xfs_io -c "pwrite -S 0xab 0 64K" /mnt/foobar
+ $ xfs_io -c "fsync" /mnt/foobar
+ <power failure>
+
+ $ mount /dev/sdb /mnt
+ $ getfattr --absolute-names --dump /mnt/foobar
+ <empty output>
+ $
+
+So fix this by making sure all xattrs are logged if we log a file's inode
+item and neither the flags BTRFS_INODE_NEEDS_FULL_SYNC nor
+BTRFS_INODE_COPY_EVERYTHING were set in the inode.
+
+Fixes: 36283bf777d9 ("Btrfs: fix fsync xattr loss in the fast fsync path")
+Cc: <stable@vger.kernel.org> # 4.2+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/tree-log.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 43758e30aa7a..c1509547c762 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4827,6 +4827,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ struct extent_map_tree *em_tree = &inode->extent_tree;
+ u64 logged_isize = 0;
+ bool need_log_inode_item = true;
++ bool xattrs_logged = false;
+
+ path = btrfs_alloc_path();
+ if (!path)
+@@ -5128,6 +5129,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ err = btrfs_log_all_xattrs(trans, root, inode, path, dst_path);
+ if (err)
+ goto out_unlock;
++ xattrs_logged = true;
+ if (max_key.type >= BTRFS_EXTENT_DATA_KEY && !fast_search) {
+ btrfs_release_path(path);
+ btrfs_release_path(dst_path);
+@@ -5140,6 +5142,11 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ btrfs_release_path(dst_path);
+ if (need_log_inode_item) {
+ err = log_inode_item(trans, log, dst_path, inode);
++ if (!err && !xattrs_logged) {
++ err = btrfs_log_all_xattrs(trans, root, inode, path,
++ dst_path);
++ btrfs_release_path(path);
++ }
+ if (err)
+ goto out_unlock;
+ }
+
diff --git a/patches.suse/btrfs-return-error-value-if-create_io_em-failed-in-cow_file_range.patch b/patches.suse/btrfs-return-error-value-if-create_io_em-failed-in-cow_file_range.patch
new file mode 100644
index 0000000000..ebc0615769
--- /dev/null
+++ b/patches.suse/btrfs-return-error-value-if-create_io_em-failed-in-cow_file_range.patch
@@ -0,0 +1,40 @@
+From: Su Yue <suy.fnst@cn.fujitsu.com>
+Date: Wed, 30 May 2018 16:48:56 +0800
+Subject: btrfs: return error value if create_io_em failed in cow_file_range
+Git-commit: 090a127afa8f73e9618d4058d6755f7ec7453dd6
+Patch-mainline: v4.18-rc1
+References: bsc#1097105
+
+In cow_file_range(), create_io_em() may fail, but its return value is
+not recorded. Then return value may be 0 even it failed which is a
+wrong behavior.
+
+Let cow_file_range() return PTR_ERR(em) if create_io_em() failed.
+
+Fixes: 6f9994dbabe5 ("Btrfs: create a helper to create em for IO")
+CC: stable@vger.kernel.org # 4.11+
+Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/inode.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 7148abaf1da3..f81a48c47fe0 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1018,8 +1018,10 @@ static noinline int cow_file_range(struct inode *inode,
+ ram_size, /* ram_bytes */
+ BTRFS_COMPRESS_NONE, /* compress_type */
+ BTRFS_ORDERED_REGULAR /* type */);
+- if (IS_ERR(em))
++ if (IS_ERR(em)) {
++ ret = PTR_ERR(em);
+ goto out_reserve;
++ }
+ free_extent_map(em);
+
+ ret = btrfs_add_ordered_extent(inode, start, ins.objectid,
+
diff --git a/patches.suse/ext4-unsupported-features.patch b/patches.suse/ext4-unsupported-features.patch
index 780a02da9f..6015c6903b 100644
--- a/patches.suse/ext4-unsupported-features.patch
+++ b/patches.suse/ext4-unsupported-features.patch
@@ -62,8 +62,8 @@ Signed-off-by: Jan Kara <jack@suse.cz>
+ if (ext4_allow_unsupported())
+ return 0;
+
-+ ext4_msg(sb, KERN_ERR "Couldn't mount %sbecause of SUSE-unsupported optional feature %s. Load module with allow_unsupported=1.",
-+ description, allow_ro ? "RDWR " : "");
++ ext4_msg(sb, KERN_ERR, "Couldn't mount %sbecause of SUSE-unsupported optional feature %s. Load module with allow_unsupported=1.",
++ allow_ro ? "RDWR " : "", description);
+ return -EINVAL;
+}
+
diff --git a/series.conf b/series.conf
index 865abb58c9..73f462a79a 100644
--- a/series.conf
+++ b/series.conf
@@ -2722,6 +2722,7 @@
patches.suse/x86-kvm-mmu-make-spte-mmio-mask-more-explicit.patch
patches.suse/kvm-x86-mmu-allow-A-D-bits-to-be-disabled-in-an-mmu.patch
patches.suse/x86-kvm-mmu-use-ept-a-d-in-vmcs02-iff-used-in-vmcs12.patch
+ patches.fixes/xen-dont-print-error-message-in-case-og-missing-xenstore-entry.patch
patches.fixes/xen-vcpu-simplify-xen_vcpu-related-code.patch
patches.fixes/xen-support-more-32-vcpus-at-domain-restore.patch
patches.arch/xen-vcpu-handle-xen_vcpu_setup-failure-at-boot.patch
@@ -2875,6 +2876,8 @@
patches.drivers/net-hns-Fix-a-skb-used-after-free-bug.patch
patches.suse/0001-kernel-locking-Fix-compile-error-with-qrwlock.c.patch
patches.suse/0001-lib-raid6-Add-log-of-2-table-for-RAID6-HW-requiring-.patch
+ patches.drivers/Input-xpad-sync-supported-devices-with-360Controller
+ patches.drivers/Input-xpad-sync-supported-devices-with-XBCD
patches.suse/0028-md-raid10-fix-FailFast-test-for-wrong-device.patch
patches.suse/0029-md-raid1-remove-unused-bio-in-sync_request_write.patch
patches.suse/0030-md-change-the-initialization-value-for-a-spare-devic.patch
@@ -3425,6 +3428,7 @@
patches.drivers/0013-char-ipmi-constify-bmc_dev_attr_group-and-bmc_device.patch
patches.suse/Fix-up-over-eager-wait_queue_t-renaming.patch
patches.fixes/f2fs-fix-a-bug-caused-by-null-extent-tree.patch
+ patches.fixes/f2fs-fix-a-panic-caused-by-null-flush_cmd_control.patch
patches.suse/cpufreq-intel_pstate-constify-attribute_group-structures.patch
patches.fixes/mm-hugetlb-return-immediately-for-hugetlb-page-in-__.patch
patches.fixes/mm-make-PR_SET_THP_DISABLE-immediately-active.patch
@@ -7500,6 +7504,7 @@
patches.drivers/rtl8188eu-Fix-a-possible-sleep-in-atomic-bug-in-rtw_
patches.drivers/vt6655-Fix-a-possible-sleep-in-atomic-bug-in-vt6655_
patches.drivers/staging-rtl8188eu-avoid-a-null-dereference-on-pmlmep
+ patches.drivers/staging-wilc1000-Fix-bssid-buffer-offset-in-Txq
patches.drivers/0002-tty-xilinx_uartps-move-to-arch_initcall-for-earlier-.patch
patches.drivers/serial-8250-Preserve-DLD-7-4-for-PORT_XR17V35X
patches.drivers/tty-fix-oops-when-rmmod-8250
@@ -8414,6 +8419,7 @@
patches.fixes/ocfs2-fix-cluster-hang-after-a-node-dies.patch
patches.fixes/ocfs2-should-wait-dio-before-inode-lock-in-ocfs2_set.patch
patches.fixes/ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
+ patches.fixes/mm-swap-fix-false-error-message-in-_swp_swapcount.patch
patches.fixes/mm-page-writeback.c-remove-unused-parameter-from-bal.patch
patches.fixes/0001-mm-drop-migrate-type-checks-from-has_unmovable_pages.patch
patches.fixes/0001-mm-distinguish-CMA-and-MOVABLE-isolation-in-has_unmo.patch
@@ -10762,6 +10768,7 @@
patches.drivers/gpio-ath79-add-missing-MODULE_DESCRIPTION-LICENSE
patches.drivers/gpio-label-descriptors-using-the-device-name
patches.drivers/gpio-stmpe-i2c-transfer-are-forbiden-in-atomic-conte
+ patches.drivers/gpio-No-NULL-owner
patches.drivers/gpio-Fix-kernel-stack-leak-to-userspace
patches.drivers/0003-power-reset-zx-reboot-add-missing-MODULE_DESCRIPTION.patch
patches.drivers/power-supply-ab8500_charger-Fix-an-error-handling-pa
@@ -11571,6 +11578,8 @@
patches.fixes/doc-Change-the-min-default-value-of-tcp_wmem-tcp_rme.patch
patches.fixes/sctp-fix-dst-refcnt-leak-in-sctp_v4_get_dst.patch
patches.drivers/ibmvnic-fix-empty-firmware-version-and-errors-cleanu.patch
+ patches.drivers/be2net-Fix-HW-stall-issue-in-Lancer.patch
+ patches.drivers/be2net-Handle-transmit-completion-errors-in-Lancer.patch
patches.suse/sched-rt-Use-container_of-to-get-root-domain-in-rto_push_irq_work_func.patch
patches.suse/sched-rt-Up-the-root-domain-ref-count-when-passing-it-around-via-IPIs.patch
patches.suse/sched-fair-Remove-unnecessary-parameters-from-wake_affine_idle.patch
@@ -12454,6 +12463,7 @@
patches.drivers/ibmvnic-Harden-TX-RX-pool-cleaning.patch
patches.drivers/ibmvnic-Report-queue-stops-and-restarts-as-debug-out.patch
patches.drivers/ibmvnic-Do-not-attempt-to-login-if-RX-or-TX-queues-a.patch
+ patches.drivers/emulex-benet-Constify-be_misconfig_evt_port_state.patch
patches.drivers/igb-Fix-a-test-with-HWTSTAMP_TX_ON.patch
patches.drivers/net-mlx5e-Fixed-sleeping-inside-atomic-context.patch
patches.drivers/ibmvnic-Clean-up-device-close.patch
@@ -12478,6 +12488,7 @@
patches.drivers/rtlwifi-rtl8192cu-Remove-variable-self-assignment-in
patches.drivers/rtl8187-Fix-NULL-pointer-dereference-in-priv-conf_mu
patches.drivers/mt7601u-let-mac80211-validate-rx-CCMP-PN
+ patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch
patches.drivers/net-mlx5e-Remove-unused-define-MLX5_MPWRQ_STRIDES_PE.patch
patches.drivers/net-mlx5e-Do-not-reset-Receive-Queue-params-on-every.patch
patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy
@@ -12521,6 +12532,7 @@
patches.fixes/xfs-fix-transaction-allocation-deadlock-in-IO-path.patch
patches.fixes/xfs-convert-XFS_AGFL_SIZE-to-a-helper-function.patch
patches.fixes/xfs-detect-agfl-count-corruption-and-reset-agfl.patch
+ patches.suse/btrfs-fix-copy_items-return-value-when-logging-an-inode.patch
patches.fixes/ext4-shutdown-should-not-prevent-get_write_access.patch
patches.fixes/ext4-eliminate-sleep-from-shutdown-ioctl.patch
patches.fixes/ext4-pass-ESHUTDOWN-code-to-jbd2-layer.patch
@@ -12584,6 +12596,7 @@
patches.drivers/ASoC-samsung-odroid-Fix-32000-sample-rate-handling
patches.drivers/ASoC-rockchip-rk3288-hdmi-analog-Select-needed-codec
patches.drivers/ASoC-topology-create-TLV-data-for-dapm-widgets
+ patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref2
patches.drivers/ALSA-pcm-Fix-UAF-at-PCM-release-via-PCM-timer-access
patches.drivers/HID-i2c-hid-fix-size-check-and-type-usage
patches.drivers/Input-i8042-add-Lenovo-ThinkPad-L460-to-i8042-reset-
@@ -12949,10 +12962,13 @@
patches.arch/s390-uprobes-implement-arch_uretprobe_is_alive.patch
patches.arch/s390-dasd-fix-IO-error-for-newly-defined-devices.patch
patches.drivers/ACPI-scan-Initialize-watchdog-before-PNP.patch
+ patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70
patches.drivers/ACPI-button-make-module-loadable-when-booted-in-non-
patches.drivers/ACPI-video-Only-default-only_lcd-to-true-on-Win8-rea
+ patches.drivers/drm-amdkfd-fix-clock-counter-retrieval-for-node-with
patches.drivers/drm-amdgpu-set-COMPUTE_PGM_RSRC1-for-SGPR-VGPR-clear
patches.drivers/drm-msm-Fix-possible-null-dereference-on-failure-of-
+ patches.drivers/drm-msm-dsi-use-correct-enum-in-dsi_get_cmd_fmt
patches.drivers/drm-virtio-fix-vq-wait_event-condition
patches.drivers/drm-i915-audio-set-minimum-CD-clock-to-twice-the-BCL
patches.drivers/drm-i915-Enable-display-WA-1183-from-its-correct-spo
@@ -12992,8 +13008,10 @@
patches.fixes/ext4-fix-bitmap-position-validation.patch
patches.fixes/ext4-add-MODULE_SOFTDEP-to-ensure-crc32c-is-included.patch
patches.fixes/x86-do-not-reserve-crash-kernel-if-booted-on-xen-pv.patch
+ patches.drivers/Input-synaptics-rmi4-fix-an-unchecked-out-of-memory-
patches.drivers/Input-leds-fix-out-of-bound-access
patches.drivers/Input-atmel_mxt_ts-add-touchpad-button-mapping-for-S
+ patches.drivers/Input-atmel_mxt_ts-fix-the-firmware-update
patches.fixes/0001-NET-usb-qmi_wwan-add-support-for-ublox-R410M-PID-0x9.patch
patches.drivers/net-mlx5e-Allow-offloading-ipv4-header-re-write-for-.patch
patches.drivers/net-mlx5-Fix-mlx5_get_vector_affinity-function.patch
@@ -13005,6 +13023,7 @@
patches.drivers/ALSA-dice-fix-kernel-NULL-pointer-dereference-due-to
patches.drivers/ALSA-aloop-Add-missing-cable-lock-to-ctl-API-callbac
patches.drivers/ALSA-pcm-Check-PCM-state-at-xfern-compat-ioctl
+ patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch
patches.suse/0221-bcache-store-disk-name-in-struct-cache-and-struct-ca.patch
patches.suse/0222-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached_dev_er.patch
patches.suse/0223-bcache-count-backing-device-I-O-error-for-writeback-.patch
@@ -13025,6 +13044,7 @@
patches.drivers/drm-vmwgfx-Fix-a-buffer-object-leak
patches.fixes/0001-USB-Accept-bulk-endpoints-with-1024-byte-maxpacket.patch
patches.drivers/platform-x86-asus-wireless-Fix-NULL-pointer-derefere
+ patches.drivers/gpio-fix-aspeed_gpio-unmask-irq
patches.drivers/gpioib-do-not-free-unrequested-descriptors
patches.drivers/gpio-fix-error-path-in-lineevent_create
patches.suse/0228-dm-bufio-fix-buffer-alignment.patch
@@ -13032,6 +13052,10 @@
patches.drivers/drm-i915-Fix-drm-intel_enable_lvds-ERROR-message-in-
patches.drivers/drm-atomic-Clean-old_state-new_state-in-drm_atomic_s
patches.drivers/drm-atomic-Clean-private-obj-old_state-new_state-in-
+ patches.drivers/drm-omap-silence-unititialized-variable-warning
+ patches.drivers/drm-omap-fix-uninitialized-ret-variable
+ patches.drivers/drm-omap-fix-possible-NULL-ref-issue-in-tiler_reserv
+ patches.drivers/drm-omap-handle-alloc-failures-in-omap_connector
patches.drivers/drm-vc4-Fix-scaling-of-uni-planar-formats
patches.drivers/drm-nouveau-Fix-deadlock-in-nv50_mstm_register_conne
patches.fixes/cpufreq-schedutil-Avoid-using-invalid-next_freq.patch
@@ -13047,6 +13071,8 @@
patches.drivers/mac80211-Fix-condition-validating-WMM-IE
patches.drivers/cfg80211-limit-wiphy-names-to-128-bytes
patches.drivers/rfkill-gpio-fix-memory-leak-in-probe-error-path
+ patches.drivers/mac80211-Adjust-SAE-authentication-timeout
+ patches.drivers/mac80211-use-timeout-from-the-AddBA-response-instead
patches.fixes/0001-mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap-v.patch
patches.drivers/nvme-add-quirk-to-force-medium-priority-for-sq-creation.patch
patches.drivers/drm-set-FMODE_UNSIGNED_OFFSET-for-drm-files
@@ -13058,6 +13084,7 @@
patches.drivers/ALSA-usb-mixer-volume-quirk-for-CM102-A-102S
patches.drivers/ALSA-hda-realtek-Clevo-P950ER-ALC1220-Fixup
patches.drivers/drm-Match-sysfs-name-in-link-removal-to-link-creatio
+ patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create
patches.drivers/drm-vmwgfx-Set-dmabuf_size-when-vmw_dmabuf_init-is-s
patches.drivers/drm-i915-userptr-reject-zero-user_size
patches.drivers/drm-i915-execlists-Use-rmb-to-order-CSB-reads
@@ -13073,6 +13100,7 @@
patches.drivers/radix-tree-test-suite-add-item_delete_rcu.patch
patches.drivers/radix-tree-test-suite-multi-order-iteration-race.patch
patches.drivers/radix-tree-fix-multi-order-iteration-race.patch
+ patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch
patches.drivers/cxgb4-Correct-ntuple-mask-validation-for-hash-filter.patch
patches.drivers/net-mlx5-Fix-build-break-when-CONFIG_SMP-n.patch
patches.drivers/ibmvnic-Free-coherent-DMA-memory-if-FW-map-failed.patch
@@ -13092,6 +13120,7 @@
patches.drivers/isdn-eicon-fix-a-missing-check-bug
patches.drivers/cfg80211-further-limit-wiphy-names-to-64-bytes
patches.drivers/ibmvnic-Only-do-H_EOI-for-mobility-events.patch
+ patches.fixes/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
patches.drivers/ibmvnic-Fix-partial-success-login-retries.patch
patches.suse/kernel-sys.c-fix-potential-Spectre-v1-issue.patch
patches.drivers/Input-synaptics-Lenovo-Carbon-X1-Gen5-2017-devices-s
@@ -13109,13 +13138,23 @@
patches.drivers/be2net-Fix-error-detection-logic-for-BE3.patch
patches.drivers/Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames
patches.drivers/nvme-fix-lockdep-warning-in-nvme_mpath_clear_current_path.patch
+ patches.suse/btrfs-return-error-value-if-create_io_em-failed-in-cow_file_range.patch
patches.fixes/0001-dlm-fix-a-clerical-error-when-set-SCTP_NODELAY.patch
patches.fixes/0002-dlm-make-sctp_connect_to_sock-return-in-specified-ti.patch
patches.fixes/0003-dlm-remove-O_NONBLOCK-flag-in-sctp_connect_to_sock.patch
patches.arch/s390-archrandom-rework-arch-random-implementation.patch
patches.arch/s390-zcrypt-fix-cca-and-ep11-cprb-processing-failure-memory-leak.patch
patches.fixes/ext4-Fix-hole-length-detection-in-ext4_ind_map_block.patch
+ patches.drivers/crypto-caam-fix-DMA-mapping-dir-for-generated-IV
+ patches.drivers/crypto-caam-fix-IV-DMA-mapping-and-updating
patches.drivers/crypto-caam-qi-fix-IV-DMA-mapping-and-updating
+ patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer
+ patches.drivers/crypto-omap-sham-fix-memleak
+ patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini
+ patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS
+ patches.drivers/Input-xpad-add-GPD-Win-2-Controller-USB-IDs
+ patches.drivers/Input-goodix-add-new-ACPI-id-for-GPD-Win-2-touch-scr
+ patches.drivers/Input-elan_i2c-add-ELAN0612-Lenovo-v330-14IKB-ACPI-I
patches.drivers/drm-i915-Restore-planes-after-load-detection
patches.drivers/drm-exynos-Allow-DRM_EXYNOS-on-s5pv210
patches.drivers/drm-i915-Don-t-request-a-bug-report-for-unsafe-modul
@@ -13205,11 +13244,19 @@
patches.arch/powerpc-64-Use-barrier_nospec-in-syscall-entry.patch
patches.suse/powerpc-64s-Enhance-the-information-in-cpu_show_spec.patch
patches.fixes/mm-page_alloc-do-not-break-_gfp_thisnode-by-zonelist-reset.patch
+ patches.drivers/0001-raid10-check-bio-in-r10buf_pool_free-to-void-NULL-po.patch
+ patches.drivers/0001-md-fix-two-problems-with-setting-the-re-add-device-s.patch
patches.drivers/scsi-lpfc-fix-wq-cq-creation-for-older-asic-s.patch
patches.drivers/scsi-qla2xxx-Delete-session-for-nport-id-change.patch
patches.drivers/ubi-fastmap-Cancel-work-upon-detach
patches.drivers/drm-i915-Remove-stale-asserts-from-i915_gem_find_act
+ patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
+ patches.fixes/ceph-support-file-lock-on-directory.patch
patches.fixes/ceph-fix-st_nlink-stat-for-directories.patch
+ patches.fixes/ceph-fix-wrong-check-for-the-case-of-updating-link-count.patch
+ patches.fixes/ceph-prevent-i_version-from-going-back.patch
+ patches.fixes/ceph-fix-use-after-free-in-ceph_statfs.patch
+ patches.fixes/ceph-fix-alignment-of-rasize.patch
patches.suse/mremap-Remove-LATENCY_LIMIT-from-mremap-to-reduce-the-number-of-TLB-shootdowns.patch
patches.drivers/ALSA-hda-add-dock-and-led-support-for-HP-EliteBook-830
patches.drivers/ALSA-hda-add-dock-and-led-support-for-HP-ProBook-640-G4
@@ -13219,9 +13266,7 @@
patches.drivers/ALSA-usb-audio-Generic-DSD-detection-for-XMOS-based-
patches.drivers/ALSA-usb-audio-Remove-explicitly-listed-Mytek-device
patches.fixes/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch
-
- # jejb/scsi for-next
- patches.drivers/0001-qla2xxx-Mask-off-Scope-bits-in-retry-delay.patch
+ patches.fixes/jfs-fix-inconsistency-between-memory-allocation-and-ea_buf-max_size.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -13230,6 +13275,10 @@
patches.suse/0004-MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
+
+ # out-of-tree patches
+ patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch
+
########################################################
# end of sorted patches
########################################################
@@ -13921,6 +13970,8 @@
patches.kabi/mm-swap-fix-race-between-swap-count-continuation-operation-kabi.patch
+ patches.kabi/bpf-properly-enforce-index-mask-to-prevent-out-of-bo.patch
+
########################################################
# You'd better have a good reason for adding a patch
# below here.