The hid descriptor identifies the length and type of subordinate
descriptors for a device. If the received hid descriptor is smaller than
the size of the struct hid_descriptor, it is possible to cause
out-of-bounds.

In addition, if bNumDescriptors of the hid descriptor have an incorrect
value, this can also cause out-of-bounds while approaching hdesc->desc[n].

So check the size of hid descriptor and bNumDescriptors.

	BUG: KASAN: slab-out-of-bounds in usbhid_parse+0x9b1/0xa20
	Read of size 1 at addr ffff88006c5f8edf by task kworker/1:2/1261

	CPU: 1 PID: 1261 Comm: kworker/1:2 Not tainted
	4.14.0-rc1-42251-gebb2c243 #169
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
	Workqueue: usb_hub_wq hub_event
	Call Trace:
	__dump_stack lib/dump_stack.c:16
	dump_stack+0x292/0x395 lib/dump_stack.c:52
	print_address_description+0x78/0x280 mm/kasan/report.c:252
	kasan_report_error mm/kasan/report.c:351
	kasan_report+0x22f/0x340 mm/kasan/report.c:409
	__asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
	usbhid_parse+0x9b1/0xa20 drivers/hid/usbhid/hid-core.c:1004
	hid_add_device+0x16b/0xb30 drivers/hid/hid-core.c:2944
	usbhid_probe+0xc28/0x1100 drivers/hid/usbhid/hid-core.c:1369
	usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
	really_probe drivers/base/dd.c:413
	driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
	__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
	bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
	__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
	device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
	bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
	device_add+0xd0b/0x1660 drivers/base/core.c:1835
	usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
	generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
	usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
	really_probe drivers/base/dd.c:413
	driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
	__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
	bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
	__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
	device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
	bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
	device_add+0xd0b/0x1660 drivers/base/core.c:1835
	usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
	hub_port_connect drivers/usb/core/hub.c:4903
	hub_port_connect_change drivers/usb/core/hub.c:5009
	port_event drivers/usb/core/hub.c:5115
	hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
	process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
	worker_thread+0x221/0x1850 kernel/workqueue.c:2253
	kthread+0x3a1/0x470 kernel/kthread.c:231
	ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Cc: stable@vger.kernel.org
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

This reverts commit fcaa4a07.

As noted by Masaki [1], 0x120A + trackpoint will not be used in mass
production machines, so remove the ID accordingly.

[1] http://www.spinics.net/lists/linux-input/msg53222.htmlSigned-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

We should not try to bring HID device out of full power state before
calling hid_hw_close(), so that transport driver operates on powered up
device (making this inverse of the opening sequence).
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The wacom_get_hdev_data function is used to find and return a reference to
the "other half" of a Wacom device (i.e., the touch device associated with
a pen, or vice-versa). To ensure these references are properly accounted
for, the function is supposed to automatically increment the refcount before
returning. This was not done, however, for devices which have pen & touch
on different interfaces of the same USB device. This can lead to a WARNING
("refcount_t: underflow; use-after-free") when removing the module or device
as we call kref_put() more times than kref_get(). Triggering an "actual" use-
after-free would be difficult since both devices will disappear nearly-
simultaneously. To silence this warning and prevent the potential error, we
need to increment the refcount for all cases within wacom_get_hdev_data.

Fixes: 41372d5d ("HID: wacom: Augment 'oVid' and 'oPid' with heuristics for HID_GENERIC")
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The tool ID information sent in ABS_MISC is expected to be reset to 0
when a tool leaves proximity. Not doing this can cause problems if a
tool is removed and then re-introduced. Kernel event filtering will
prevent the (identical) ABS_MISC event from being sent when the tool
re-enters proxmity. This can cause userspace to not properly set the
tool ID.

Fixes: f85c9dc6 ("HID: wacom: generic: Support tool ID and additional tool types")
Cc: stable # v4.10 <stable@vger.kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The latest generation of pro devices (MobileStudio Pro, 2nd-gen Intuos
Pro, Cintiq Pro) send a serial number of '0' whenever the pen is too far
away for reliable communication. Userspace defines that a serial number
of '0' is invalid, so we need to be careful not to actually forward
this value. Additionally, since EMR ISDv4 devices do not support serial
numbers or tool IDs, we'd like to not send these events if they aren't
necessary.

The existing code achieves these goals by adding a check for a non-zero
serial number within the wacom_wac_pen_report function. The MSC_SERIAL
and ABS_MISC events are only sent if the serial number is non-zero. This
code fails, however when the pen for a pro device leaves proximity. When
the pen leaves prox and the tablet sends a serial of 0, wacom_wac_pen_event
dutifully clears the serial number. When wacom_wac_pen_report is called,
it does not send either the MSC_SERIAL of the exiting tool nor an ABS_MISC
event.

This patch prevents the wacom_wac_pen_event function from clearing an
already-set serial number. This ensures that we have the serial number
handy when exiting proximity, but requires us to manually clear it
afterwards to ensure the driver does not send stale data (e.g. when
switching between AES pens that report a serial nubmer of 0 for the
first few fully in-proximity packets).

Fixes: f85c9dc6 ("HID: wacom: generic: Support tool ID and additional tool types")
Cc: stable # v4.10 <stable@vger.kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The buffer allocation is not currently accounting for an extra byte for
the report id. This can cause an out of bounds access in function
i2c_hid_set_or_send_report() with reportID > 15.

Cc: stable@vger.kernel.org
Signed-off-by: Adrian Salido <salidoa@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

So it looks like that suspend/resume has actually always been broken on
hid-rmi. The fact it worked was a rather silly coincidence that was
relying on the HID device to already be opened upon resume. This means
that so long as anything was reading the /dev/input/eventX node for for
an RMI device, it would suspend and resume correctly. As well, if
nothing happened to be keeping the HID device away it would shut off,
then the RMI driver would get confused on resume when it stopped
responding and explode.

So, call hid_hw_open() in rmi_post_resume() so we make sure that the
device is alive before we try talking to it.

This fixes RMI device suspend/resume over HID.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=196851
[jkosina@suse.cz: removed useless hunk that was zero-initializing 'ret']
Signed-off-by: Lyude <lyude@redhat.com>
Cc: Andrew Duggan <aduggan@synaptics.com>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

This patch adds ALPS PTP sticks with pid/device id 0x120A to the list of
devices supported by hid-multitouch.
Signed-off-by: Shrirang Bagul <shrirang.bagul@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

On the 2nd generation Lenovo Tablet only clickpad is working; the
trackpoint and three mouse buttons do not work.

hid_multitouch must export all inputs in order to get trackpoint and
buttons to function.
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The MobileStudio Pro, Cintiq Pro, and 2nd-gen Intuos Pro devices use a
different coordinate system for their touchring and pen twist than prior
devices. Prior devices had zero aligned to the tablet's left and would
increase clockwise. Userspace expects data from the kernel to be in this
old coordinate space, so adjustments are necessary.

While the coordinate system for pen twist is formally defined by the HID
standard, no such definition existed for the touchring at the time these
tablets were introduced. Future tablets are expected to report touchring
data using the same "zero-up clockwise-increasing" coordinate system
defined for twist.

Fixes: 50066a04 ("HID: wacom: generic: Add support for height, tilt, and twist usages")
Fixes: 4922cd26 ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface")
Fixes: 60a22186 ("HID: wacom: generic: add support for touchring")
Cc: stable@vger.kernel.org # 4.10, 4.11
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The wacom driver's IRQ handler for Bluetooth reports from the 2nd-gen
Intuos Pro does not correctly process negative numbers. Values for
tilt and rotation (which can go negative) are instead interpreted as
unsigned and so jump to very large values when the data should be
negative. This commit properly casts the data to ensure we report
negative numbers when necessary.

Fixes: 4922cd26 ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface")
Cc: stable@vger.kernel.org # v4.11
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Some laptops have system-control buttons (e.g. KEY_SLEEP) on the same
interface as a hid-multitouch touch-pad.

This commit fixes these buttons not working.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The Ideacom 6680 touchscreen is found in the Dell Latitude 2100. It
has two USB descriptors, the first of which has two input reports. The
HID_QUIRK_MULTI_INPUT quirk is needed to keep the correct maximum
value for ABS_X/ABS_Y (8191 instead of 65535).
Signed-off-by: Nicholas Bishop <nbishop@neverware.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Commit a50aac71 introduces 'led.groups' and adds EKR support
for these groups. However, unlike the other devices with LEDs,
the EKR's LEDs are read-only and we shouldn't attempt to control
them in wacom_led_control().

See bug: https://sourceforge.net/p/linuxwacom/bugs/342/

Fixes: a50aac71 ("HID: wacom: leds: dynamically allocate LED groups")
Cc: stable <stable@vger.kernel.org>     # 4.9
Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Cintiq 12 has 10 expresskey buttons. The bit shift for the last
two buttons were off by 5.

Fixes: c7f0522a ("HID: wacom: Slim down wacom_intuos_pad processing")
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Matthieu Robin <matthieu@macolu.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Pull HID update from Jiri Kosina:

 - Wacom driver fixes/updates (device name generation improvements,
   touch ring status support) from Jason Gerecke

 - T100 touchpad support from Hans de Goede

 - support for batteries driven by HID input reports, from Dmitry
   Torokhov

 - Arnd pointed out that driver_lock semaphore is superfluous, as driver
   core already provides all the necessary concurency protection.
   Removal patch from Binoy Jayan

 - logical minimum numbering improvements in sensor-hub driver, from
   Srinivas Pandruvada

 - support for Microsoft Win8 Wireless Radio Controls extensions from
   João Paulo Rechi Vita

 - assorted small fixes and device ID additions

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (28 commits)
  HID: prodikeys: constify snd_rawmidi_ops structures
  HID: sensor: constify platform_device_id
  HID: input: throttle battery uevents
  HID: usbmouse: constify usb_device_id and fix space before '[' error
  HID: usbkbd: constify usb_device_id and fix space before '[' error.
  HID: hid-sensor-hub: Force logical minimum to 1 for power and report state
  HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage
  HID: asus: Add T100CHI bluetooth keyboard dock touchpad support
  HID: ntrig: constify attribute_group structures.
  HID: logitech-hidpp: constify attribute_group structures.
  HID: sensor: constify attribute_group structures.
  HID: multitouch: constify attribute_group structures.
  HID: multitouch: use proper symbolic constant for 0xff310076 application
  HID: multitouch: Support Asus T304UA media keys
  HID: multitouch: Support HID_GD_WIRELESS_RADIO_CTLS
  HID: input: optionally use device id in battery name
  HID: input: map digitizer battery usage
  HID: Remove the semaphore driver_lock
  HID: wacom: add USB_HID dependency
  HID: add ALWAYS_POLL quirk for Logitech 0xc077
  ...

Pull GPIO updates from Linus Walleij:
 "This is the bulk of the GPIO changes for the v4.14 cycle.

  Not so much changes this time, phew. David Daney and Bartosz
  Golaszewski did all the really interesting work in infrastructure
  improvement across GPIO and IRQ core, hats off for them and to tglx
  and Marc Z for general help with these patch sets.

  Core changes:

   - Allow the GPIO irqchip to allocate IRQs dynamically. This is an
     important change on systems where only a restricted number of IRQs,
     lesser than the number of GPIO lines, can be utilized. Now we can
     allocate these on a first-come-first-served basis instead of
     hogging up valuable IRQ lines.

   - Serious fix-up of the kerneldoc documentation and inclusion into
     the kerneldoc builds.

   - Pulled in the IRQ simulator from the IRQ core tree and use this in
     the GPIO mockup driver for exhaustive testing of interrupt
     abilities.

  New drivers:

   - New driver for ThunderX and OCTEON-TX. This is especially
     interesting as it picks up improvements from the IRQ core that
     allow us to handle fasteoi ACKs upwards in a hierarchy when there
     are IRQ flag latches on several levels in a hierarchy. Very
     interesting work here.

   - New subdriver for Renesas R-Car r8a7745 (RZ/G1E).

  Misc:

   - Several fixes and improvements for Xilinx Zynq GPIO.

   - Support an enablement GPIO for the 74x164 GPIO.

   - Switch a bunch of chips to use devres to allocate irq descriptors.

   - A bunch of constification fixes"

* tag 'gpio-v4.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (63 commits)
  gpio: mockup: remove unused variable gc
  gpio: pl061: constify amba_id
  Revert "gpiolib: request the gpio before querying its direction"
  gpio: twl6040: remove unneeded forward declaration
  gpio: zevio: make gpio_chip const
  gpio: add gpio_add_lookup_tables() to add several tables at once
  gpio: rcar: Add r8a7745 (RZ/G1E) support
  gpio: brcmstb: check return value of gpiochip_irqchip_add()
  MAINTAINERS: Add entry for THUNDERX GPIO Driver.
  gpio: Add gpio driver support for ThunderX and OCTEON-TX
  gpio: mockup: use irq_sim
  gpio: mxs: use devres for irq generic chip
  gpio: mxc: use devres for irq generic chip
  gpio: pch: use devres for irq generic chip
  gpio: ml-ioh: use devres for irq generic chip
  gpio: sta2x11: use devres for irq generic chip
  gpio: sta2x11: disallow unbinding the driver
  gpio: mxs: disallow unbinding the driver
  gpio: mxc: disallow unbinding the driver
  gpio: aspeed: Remove reference to clock name in debounce warning message
  ...

Pull pin control updates from Linus Walleij:
 "This is the big bulk of pin control changes for the v4.14 kernel.
  There are just a few bigger changes (new drivers mostly) and then a
  lot of small patches all over the place.

  Core changes:
   - Decision to wrap the sleep mode of the Spreadtrum and in the future
     others into a specially tagged state. The generic DT bindings and
     the new Spreadtrum driver conforms to this. Others should be moved
     over if possible.

  New drivers:
   - Spreadtrum SoCs especially the SC9860 SoC.
   - Storlink/Cortina Gemini 3512 and 3516 SoCs.

  New subdrivers:
   - Intel Denverton subdriver.
   - Intel Cannon Lake subdriver.
   - Intel Lewisburg subdriver.
   - Allwinner sunxi: R40 subdriver for A10.
   - Socionext uniphier PXs3 subdriver.
   - Rockchip RK3128 subdriver.
   - Renesas SH-PFC R8A77995 subdriver.

  Miscellaneous:
   - Qualcomm APQ8064 can handle general purpose clock muxing.
   - Mediatek MT7623 PCIe mux data fixed up.
   - Intel GPIO IRQs are disabled during suspend.
   - Several fixes and addtions to Renesas r8a7796.
   - Qualcomm SPMI GPIO supports dtest route and LV/MV subtype.
   - Input schmitt trigger support in Rockchip RV1108.
   - Aspeed G4 and G5 USB host/device pin control control added.
   - Qualcomm IPQ4019 has matured with a few missing pin groups and
     control bits put in place.
   - Lots of constification, this is the latest in cocinelle fixes"

* tag 'pinctrl-v4.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (147 commits)
  Revert "pinctrl: sunxi: Don't enforce bias disable (for now)"
  pinctrl: uniphier: fix members of rmii group for Pro4
  pinctrl: Delete an error message
  pinctrl: core: Delete an error message
  pinctrl: intel: Read back TX buffer state
  pinctrl: rockchip: Add rv1108 recalculated iomux support
  pinctrl: intel: Decrease indentation in intel_gpio_set()
  pinctrl: rza1: Remove suffix from gpiochip label
  pinctrl: qcom: spmi-gpio: Correct power_source range check
  pinctrl: freescale: make mxs_regs const
  pinctrl: aspeed: Rework strap register write logic for the AST2500
  pinctrl: rza1: off by one in rza1_parse_gpiochip()
  pinctrl: qcom: General Purpose clocks for apq8064
  pinctrl: sprd: Add Spreadtrum pin control driver
  dt-bindings: pinctrl: Add DT bindings for Spreadtrum SC9860
  pinctrl: Add sleep related state to indicate sleep related configs
  pinctrl: mediatek: update PCIe mux data for MT7623
  pinctrl: intel: Add Intel Lewisburg GPIO support
  pinctrl: intel: Add Intel Cannon Lake PCH-H pin controller support
  pinctrl: aspeed: Fix ast2500 strap register write logic
  ...

Pull regulator updates from Mark Brown:
 "This is an extremely quiet release for the regulator subsystem, it's
  all fairly minor fixes and cleanups plus a few new drivers and ddevice
  ID additions:

   - Support for MediaTek MT6380, Ricoh RC5T619 and ST Voltage Reference
     Buffers"

* tag 'regulator-v4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (24 commits)
  regulator: Add support for stm32-vrefbuf
  regulator: Add STM32 Voltage Reference Buffer
  regulator: pv88090: Exception handling for out of bounds
  regulator: da9063: Return an error code on probe failure
  regulator: rn5t618: add RC5T619 PMIC support
  regulator: ltc3589: constify i2c_device_id
  regulator: fan53555: fix I2C device ids
  regulator: add fixes with MT6397 dt-bindings shouldn't reference driver
  regulator: add fixes with MT6323 dt-bindings shouldn't reference driver
  regulator: add fixes with MT6311 dt-bindings shouldn't reference driver
  regulator: Add document for MediaTek MT6380 regulator
  regulator: mt6380: Add support for MT6380
  regulator: pwm-regulator: Remove unneeded gpiod NULL check
  regulator: core: fix a possible race in disable_work handling
  regulator: fan53555: Use of_device_get_match_data() to simplify probe
  regulator: of: regulator_of_get_init_data() missing of_node_get()
  regulator: pwm-regulator: fix example syntax
  regulator: Convert to using %pOF instead of full_name
  regulator: cpcap: Add OF mode mapping
  regulator: cpcap: Fix standby mode
  ...

Pull spi updates from Mark Brown:
 "A fairly quiet release for the SPI subsystem:

   - Move to using IDR for allocating bus numbers

   - Modernisation of the ep93xx driver, removing a lot of open coding
     and using the framework more

   - The tools have been moved to use the standard tools build system
     and an install target added (there will be a fairly trivial
     conflict with tip resulting from the changes in the main tools
     Makefile)

   - A refactoring of the Qualcomm QUP driver which enables new variants
     to be supported

   - Explicit support for the Freescale i.MX53 and i.MX6 SPI, Renesas
     R-Car H3 and Rockchip RV1108 controllers"

* tag 'spi-v4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (71 commits)
  spi: spi-falcon: drop check of boot select
  spi: imx: fix use of native chip-selects with devicetree
  spi: pl022: constify amba_id
  spi: imx: fix little-endian build
  spi: omap: Allocate bus number from spi framework
  spi: Kernel coding style fixes
  spi: imx: dynamic burst length adjust for PIO mode
  spi: Pick spi bus number from Linux idr or spi alias
  spi: rockchip: configure CTRLR1 according to size and data frame
  spi: altera: Consolidate TX/RX data register access
  spi: altera: Switch to SPI core transfer queue management
  spi: rockchip: add compatible string for rv1108 spi
  spi: qup: fix 64-bit build warning
  spi: qup: hide warning for uninitialized variable
  spi: spi-ep93xx: use the default master transfer queueing mechanism
  spi: spi-ep93xx: remove private data 'current_msg'
  spi: spi-ep93xx: pass the spi_master pointer around
  spi: spi-ep93xx: absorb the interrupt enable/disable helpers
  spi: spi-ep93xx: add spi master prepare_transfer_hardware()
  spi: spi-ep93xx: use 32-bit read/write for all registers
  ...

Pull EDAC updates from Borislav Petkov:

 - pnd2_edac: A minimal sideband driver (Tony Luck)

 - small-ish cleanups and fixes all over the place

* tag 'edac_for_4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
  EDAC, mce_amd: Get rid of local var in amd_filter_mce()
  EDAC, mce_amd: Get rid of most struct cpuinfo_x86 uses
  EDAC, mce_amd: Rename decode_smca_errors() to decode_smca_error()
  EDAC: Make device_type const
  EDAC, pnd2: Properly toggle hidden state for P2SB PCI device
  EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR
  EDAC, pnd2: Mask off the lower four bits of a BAR
  EDAC, thunderx: Fix error handling path in thunderx_lmc_probe()
  EDAC, altera: Fix error handling path in altr_edac_device_probe()
  EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake
  EDAC, sb_edac: Classify memory mirroring modes
  EDAC, cpc925, ppc4xx: Convert to using %pOF instead of full_name
  EDAC: Get rid of mci->mod_ver
  EDAC: Constify attribute_group structures
  EDAC, mce_amd: Use cpu_to_node() to find the node ID

Pull char/misc driver updates from Greg KH:
 "Here is the big char/misc driver update for 4.14-rc1.

  Lots of different stuff in here, it's been an active development cycle
  for some reason. Highlights are:

   - updated binder driver, this brings binder up to date with what
     shipped in the Android O release, plus some more changes that
     happened since then that are in the Android development trees.

   - coresight updates and fixes

   - mux driver file renames to be a bit "nicer"

   - intel_th driver updates

   - normal set of hyper-v updates and changes

   - small fpga subsystem and driver updates

   - lots of const code changes all over the driver trees

   - extcon driver updates

   - fmc driver subsystem upadates

   - w1 subsystem minor reworks and new features and drivers added

   - spmi driver updates

  Plus a smattering of other minor driver updates and fixes.

  All of these have been in linux-next with no reported issues for a
  while"

* tag 'char-misc-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (244 commits)
  ANDROID: binder: don't queue async transactions to thread.
  ANDROID: binder: don't enqueue death notifications to thread todo.
  ANDROID: binder: Don't BUG_ON(!spin_is_locked()).
  ANDROID: binder: Add BINDER_GET_NODE_DEBUG_INFO ioctl
  ANDROID: binder: push new transactions to waiting threads.
  ANDROID: binder: remove proc waitqueue
  android: binder: Add page usage in binder stats
  android: binder: fixup crash introduced by moving buffer hdr
  drivers: w1: add hwmon temp support for w1_therm
  drivers: w1: refactor w1_slave_show to make the temp reading functionality separate
  drivers: w1: add hwmon support structures
  eeprom: idt_89hpesx: Support both ACPI and OF probing
  mcb: Fix an error handling path in 'chameleon_parse_cells()'
  MCB: add support for SC31 to mcb-lpc
  mux: make device_type const
  char: virtio: constify attribute_group structures.
  Documentation/ABI: document the nvmem sysfs files
  lkdtm: fix spelling mistake: "incremeted" -> "incremented"
  perf: cs-etm: Fix ETMv4 CONFIGR entry in perf.data file
  nvmem: include linux/err.h from header
  ...

Merge tag 'driver-core-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core update from Greg KH:
 "Here is the "big" driver core update for 4.14-rc1.

  It's really not all that big, the largest thing here being some
  firmware tests to help ensure that that crazy api is working properly.

  There's also a new uevent for when a driver is bound or unbound from a
  device, fixing a hole in the driver model that's been there since the
  very beginning. Many thanks to Dmitry for being persistent and
  pointing out how wrong I was about this all along :)

  Patches for the new uevents are already in the systemd tree, if people
  want to play around with them.

  Otherwise just a number of other small api changes and updates here,
  nothing major. All of these patches have been in linux-next for a
  while with no reported issues"

* tag 'driver-core-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (28 commits)
  driver core: bus: Fix a potential double free
  Do not disable driver and bus shutdown hook when class shutdown hook is set.
  base: topology: constify attribute_group structures.
  base: Convert to using %pOF instead of full_name
  kernfs: Clarify lockdep name for kn->count
  fbdev: uvesafb: remove DRIVER_ATTR() usage
  xen: xen-pciback: remove DRIVER_ATTR() usage
  driver core: Document struct device:dma_ops
  mod_devicetable: Remove excess description from structured comment
  test_firmware: add batched firmware tests
  firmware: enable a debug print for batched requests
  firmware: define pr_fmt
  firmware: send -EINTR on signal abort on fallback mechanism
  test_firmware: add test case for SIGCHLD on sync fallback
  initcall_debug: add deferred probe times
  Input: axp20x-pek - switch to using devm_device_add_group()
  Input: synaptics_rmi4 - use devm_device_add_group() for attributes in F01
  Input: gpio_keys - use devm_device_add_group() for attributes
  driver core: add devm_device_add_group() and friends
  driver core: add device_{add|remove}_group() helpers
  ...

Pull staging/IIO driver updates from Greg KH:
 "Here is the big staging and IIO driver update for 4.14-rc1.

  Lots of staging driver fixes and cleanups, including some reorginizing
  of the lustre header files to try to impose some sanity on what is,
  and what is not, the uapi for that filesystem.

  There are some tty core changes in here as well, as the speakup
  drivers need them, and that's ok with me, they are sane and the
  speakup code is getting nicer because of it.

  There is also the addition of the obiligatory new wifi driver, just
  because it has been a release or two since we added our last one...

  Other than that, lots and lots of small coding style fixes, as usual.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (612 commits)
  staging:rtl8188eu:core Fix remove unneccessary else block
  staging: typec: fusb302: make structure fusb302_psy_desc static
  staging: unisys: visorbus: make two functions static
  staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
  staging: r8822be: Simplify deinit_priv()
  staging: r8822be: Remove some dead code
  staging: vboxvideo: Use CONFIG_DRM_KMS_FB_HELPER to check for fbdefio availability
  staging:rtl8188eu Fix comparison to NULL
  staging: rts5208: rename mmc_ddr_tunning_rx_cmd to mmc_ddr_tuning_rx_cmd
  Staging: Pi433: style fix - tabs and spaces
  staging: pi433: fix spelling mistake: "preample" -> "preamble"
  staging:rtl8188eu:core Fix Code Indent
  staging: typec: fusb302: Export current-limit through a power_supply class dev
  staging: typec: fusb302: Add support for USB2 charger detection through extcon
  staging: typec: fusb302: Use client->irq as irq if set
  staging: typec: fusb302: Get max snk mv/ma/mw from device-properties
  staging: typec: fusb302: Set max supply voltage to 5V
  staging: typec: tcpm: Add get_current_limit tcpc_dev callback
  staging:rtl8188eu Use __func__ instead of function name
  staging: lustre: coding style fixes found by checkpatch.pl
  ...

Pull tty/serial updates from Greg KH:
 "Here is the big tty/serial driver update for 4.14-rc1.

  Well, not all that big, just a number of small serial driver fixes,
  and a new serial driver. Also in here are some much needed goldfish
  tty driver (emulator) fixes to try to get that codebase under control.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (94 commits)
  tty: goldfish: Implement support for kernel 'earlycon' parameter
  tty: goldfish: Use streaming DMA for r/w operations on Ranchu platforms
  tty: goldfish: Refactor constants to better reflect their nature
  serial: 8250_port: Remove useless NULL checks
  earlycon: initialise baud field of earlycon device structure
  tty: hvcs: make ktermios const
  pty: show associative slave of ptmx in fdinfo
  tty: n_gsm: Add compat_ioctl
  tty: hvcs: constify vio_device_id
  tty: hvc_vio: constify vio_device_id
  tty: mips_ejtag_fdc: constify mips_cdmm_device_id
  Introduce 8250_men_mcb
  mcb: introduce mcb_get_resource()
  serial: imx: Avoid post-PIO cleanup if TX DMA is started
  tty: serial: imx: disable irq after suspend
  serial: 8250_uniphier: add suspend/resume support
  serial: 8250_uniphier: use CHAR register for canary to detect power-off
  serial: 8250_uniphier: fix serial port index in private data
  serial: 8250: of: Add new port type for MediaTek BTIF controller on MT7622/23 SoC
  dt-bindings: serial: 8250: Add MediaTek BTIF controller bindings
  ...

Pull USB/PHY driver updates from Greg KH:
 "Here is the large USB and PHY driver update for 4.14-rc1.

  Not all that exciting, a few new PHY drivers, the usual mess of gadget
  driver updates and fixes, and of course, xhci updates to try to tame
  that beast.

  A number of usb-serial updates and other small fixes all over the USB
  driver tree are in here as well. Full details are in the shortlog.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (171 commits)
  usbip: vhci-hcd: make vhci_hc_driver const
  usb: phy: Avoid unchecked dereference warning
  usb: imx21-hcd: make imx21_hc_driver const
  usb: host: make ehci_fsl_overrides const and __initconst
  dt-bindings: mt8173-mtu3: add generic compatible and rename file
  dt-bindings: mt8173-xhci: add generic compatible and rename file
  usb: xhci-mtk: add generic compatible string
  usbip: auto retry for concurrent attach
  USB: serial: option: simplify 3 D-Link device entries
  USB: serial: option: add support for D-Link DWM-157 C1
  usb: core: usbport: fix "BUG: key not in .data" when lockdep is enabled
  usb: chipidea: usb2: check memory allocation failure
  usb: Add device quirk for Logitech HD Pro Webcam C920-C
  usb: misc: lvstest: add entry to place port in compliance mode
  usb: xhci: Support enabling of compliance mode for xhci 1.1
  usb:xhci:Fix regression when ATI chipsets detected
  usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
  usb: gadget: make snd_pcm_hardware const
  usb: common: use of_property_read_bool()
  USB: core: constify vm_operations_struct
  ...

Pull arm64 updates from Catalin Marinas:

 - VMAP_STACK support, allowing the kernel stacks to be allocated in the
   vmalloc space with a guard page for trapping stack overflows. One of
   the patches introduces THREAD_ALIGN and changes the generic
   alloc_thread_stack_node() to use this instead of THREAD_SIZE (no
   functional change for other architectures)

 - Contiguous PTE hugetlb support re-enabled (after being reverted a
   couple of times). We now have the semantics agreed in the generic mm
   layer together with API improvements so that the architecture code
   can detect between contiguous and non-contiguous huge PTEs

 - Initial support for persistent memory on ARM: DC CVAP instruction
   exposed to user space (HWCAP) and the in-kernel pmem API implemented

 - raid6 improvements for arm64: faster algorithm for the delta syndrome
   and implementation of the recovery routines using Neon

 - FP/SIMD refactoring and removal of support for Neon in interrupt
   context. This is in preparation for full SVE support

 - PTE accessors converted from inline asm to cmpxchg so that we can use
   LSE atomics if available (ARMv8.1)

 - Perf support for Cortex-A35 and A73

 - Non-urgent fixes and cleanups

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (75 commits)
  arm64: cleanup {COMPAT_,}SET_PERSONALITY() macro
  arm64: introduce separated bits for mm_context_t flags
  arm64: hugetlb: Cleanup setup_hugepagesz
  arm64: Re-enable support for contiguous hugepages
  arm64: hugetlb: Override set_huge_swap_pte_at() to support contiguous hugepages
  arm64: hugetlb: Override huge_pte_clear() to support contiguous hugepages
  arm64: hugetlb: Handle swap entries in huge_pte_offset() for contiguous hugepages
  arm64: hugetlb: Add break-before-make logic for contiguous entries
  arm64: hugetlb: Spring clean huge pte accessors
  arm64: hugetlb: Introduce pte_pgprot helper
  arm64: hugetlb: set_huge_pte_at Add WARN_ON on !pte_present
  arm64: kexec: have own crash_smp_send_stop() for crash dump for nonpanic cores
  arm64: dma-mapping: Mark atomic_pool as __ro_after_init
  arm64: dma-mapping: Do not pass data to gen_pool_set_algo()
  arm64: Remove the !CONFIG_ARM64_HW_AFDBM alternative code paths
  arm64: Ignore hardware dirty bit updates in ptep_set_wrprotect()
  arm64: Move PTE_RDONLY bit handling out of set_pte_at()
  kvm: arm64: Convert kvm_set_s2pte_readonly() from inline asm to cmpxchg()
  arm64: Convert pte handling from inline asm to using (cmp)xchg
  arm64: neon/efi: Make EFI fpsimd save/restore variables static
  ...

Pull s390 updates from Martin Schwidefsky:
 "The first part of the s390 updates for 4.14:

   - Add machine type 0x3906 for IBM z14

   - Add IBM z14 TLB flushing improvements for KVM guests

   - Exploit the TOD clock epoch extension to provide a continuous TOD
     clock afer 2042/09/17

   - Add NIAI spinlock hints for IBM z14

   - Rework the vmcp driver and use CMA for the respone buffer of z/VM
     CP commands

   - Drop some s390 specific asm headers and use the generic version

   - Add block discard for DASD-FBA devices under z/VM

   - Add average request times to DASD statistics

   - A few of those constify patches which seem to be in vogue right now

   - Cleanup and bug fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (50 commits)
  s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
  s390/dasd: Add discard support for FBA devices
  s390/zcrypt: make CPRBX const
  s390/uaccess: avoid mvcos jump label
  s390/mm: use generic mm_hooks
  s390/facilities: fix typo
  s390/vmcp: simplify vmcp_response_free()
  s390/topology: Remove the unused parent_node() macro
  s390/dasd: Change unsigned long long to unsigned long
  s390/smp: convert cpuhp_setup_state() return code to zero on success
  s390: fix 'novx' early parameter handling
  s390/dasd: add average request times to dasd statistics
  s390/scm: use common completion path
  s390/pci: log changes to uid checking
  s390/vmcp: simplify vmcp_ioctl()
  s390/vmcp: return -ENOTTY for unknown ioctl commands
  s390/vmcp: split vmcp header file and move to uapi
  s390/vmcp: make use of contiguous memory allocator
  s390/cpcmd,vmcp: avoid GFP_DMA allocations
  s390/vmcp: fix uaccess check and avoid undefined behavior
  ...

Pull alpha updates from Matt Turner:
 "This contains some small clean up patches I've neglected, and some
  build improvements from Ben Hutchings"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha:
  alpha: math-emu: Fix modular build
  alpha: Restore symbol versions for symbols exported from assembly
  alpha: defconfig: Cleanup from old Kconfig options
  alpha: use kobj_to_dev()
  alpha: squash lines for immediate return
  alpha: kernel: Use vma_pages()
  alpha: silence a buffer overflow warning
  alpha: marvel: make use of raw_spinlock variants
  alpha: cleanup: remove __NR_sys_epoll_*, leave __NR_epoll_*
  alpha: use generic fb.h

Pull parisc updates from Helge Deller:
 "Major changes include:

   - Full support of the firmware Page Deallocation Table with
     MADV_HWPOISON and MADV_SOFT_OFFLINE. A kernel thread scans
     regularily for new bad memory pages.

   - Full support for self-extracting kernel.

   - Added UBSAN support.

   - Lots of section mismatch fixes across all parisc drivers.

   - Added examples for %pF and %pS usage in printk-formats.txt"

* 'parisc-4.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: (28 commits)
  printk-formats.txt: Add examples for %pF and %pS usage
  parisc: Fix up devices below a PCI-PCI MegaRAID controller bridge
  parisc/core: Fix section mismatches
  parisc/ipmi_si_intf: Fix section mismatches on parisc platform
  parisc/input/hilkbd: Fix section mismatches
  parisc/net/lasi_82596: Fix section mismatches
  parisc/serio: Fix section mismatches in gscps2 and hp_sdc drivers
  parisc: Fix section mismatches in parisc core drivers
  parisc/parport_gsc: Fix section mismatches
  parisc/scsi/lasi700: Fix section mismatches
  parisc/scsi/zalon: Fix section mismatches
  parisc/8250_gsc: Fix section mismatches
  parisc/mux: Fix section mismatches
  parisc/sticore: Fix section mismatches
  parisc/harmony: Fix section mismatches
  parisc: Wire up support for self-extracting kernel
  parisc: Make existing core files reuseable for bootloader
  parisc: Add core code for self-extracting kernel
  parisc: Enable UBSAN support
  parisc/random: Add machine specific randomness
  ...

Pull m68k updates from Geert Uytterhoeven:

  - restore symbol versions for symbols exported from assembly

  - defconfig updates

  - Mac fixes

* tag 'm68k-for-v4.14-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k/mac: Avoid soft-lockup warning after mach_power_off
  m68k/mac: Don't hang waiting for Cuda power-down command
  m68k: Restore symbol versions for symbols exported from assembly
  m68k/defconfig: Update defconfigs for v4.13-rc1

- name generation improvement for Wacom devices from Jason Gerecke
- Kconfig dependency fix for Wacom driver from Arnd Bergmann

- usb_device_id and snd_rawmidi_ops constifications from Julia Lawall
  and Arvind Yadav

- support for media keys on Asus T304UA from João Paulo Rechi Vita
- support for Microsoft Win8 Wireless Radio Controls extensions
  from João Paulo Rechi Vita

Conflicts:
	drivers/hid/hid-ids.h
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

- bring consistency into logical minimum numbering in sensor-hub
  driver, from Srinivas Pandruvada

- Arnd pointed out that driver_lock semaphore is superfluous, as
  driver core already provides all the necessary concurency protection.
  Removal patch from Binoy Jayan

- struct attribute_group constification from Arvind Yadav

- support for batteries driven by HID input reports, from Dmitry Torokhov

- T100 touchpad support from Hans de Goede