Up to four checks could be repeated by the ufx_usb_probe() function
during error handling even if the relevant properties can be determined
for the involved variables before by source code analysis.

* Return directly after a call of the function "kzalloc" failed
  at the beginning.

* Adjust jump targets so that extra checks can be omitted at the end.

* Delete initialisations for the variables "info" and "retval"
  which became unnecessary with this refactoring.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Cc: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

* Return an error code without storing it in an intermediate variable.

* Delete the label "error" and local variable "retval"
  which became unnecessary with this refactoring.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Cc: Bernie Thompson <bernie@plugable.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Omit an extra message for a memory allocation failure in this function.

This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Cc: Helge Deller <deller@gmx.de>
Cc: "James E. J. Bottomley" <jejb@parisc-linux.org>
Cc: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Replace an error code for the indication of a memory allocation failure
in this function.

Fixes: 1da177e4 ("Linux-2.6.12-rc2: Initial git repository build")
Suggested-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Cc: Helge Deller <deller@gmx.de>
Cc: "James E. J. Bottomley" <jejb@parisc-linux.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Assign true or false to boolean variables instead of an integer value.

This issue was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Cc: Paul Mackerras <paulus@samba.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

There is a missing indentation following an if statement, fix this.

Detected by Coccinelle:
drivers/video/fbdev/aty/mach64_ct.c:183:2-15: code aligned with
following code on line 184
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

In preparation to enabling -Wvla, remove VLA usage.

Also, fixed as part of the directive to remove all VLAs from
the kernel: https://lkml.org/lkml/2018/3/7/621Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Cast _pitch_ to u64 in order to give the compiler complete information
about the proper arithmetic to use. Notice that this variable is
being used in a context that expects an expression of type u64
(64 bits, unsigned).

The expression pitch * var->yres_virtual is currently being evaluated
using 32-bit arithmetic and the result of the operation is being stored
into variable mem, which is a variable of type u64. Based on that,
chances are there is a potential integer overflow as a result of the
operation.

Addresses-Coverity-ID: 200655 ("Unintentional integer overflow")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Since introduction of of_display_timings_exist() function in commit
cc3f414c ("video: add of helper for display timings/videomode") it
didn't attract any users, and the function has no potential, because
of_get_display_timings() covers its functionality and does more.

Drop the unused exported function from the kernel.
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

The function offb_destroy did not deallocate the color map leaving some
memory around after destruction. Call the color map deallocate function to
remove the memory leak.

Handle another case where color map should have been deallocated during an
error code path.

Fix memory leaks reported by kmemleak:

# dmesg
...
[ 1884.719941] kmemleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xde3d9000 (size 512):
  comm "swapper", pid 1, jiffies 4294892827 (age 1906.784s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 aa aa aa aa aa aa aa aa  ................
    55 55 55 55 55 55 55 55 ff ff ff ff ff ff ff ff  UUUUUUUU........
  backtrace:
    [<f1433400>] fb_alloc_cmap_gfp+0x54/0x15c
    [<cb6b409b>] offb_init_nodriver+0x8e8/0xa3c
    [<b5a1c019>] offb_init+0xd0/0x164
    [<322f82a3>] do_one_initcall+0x4c/0x178
    [<b592db9f>] kernel_init_freeable+0x138/0x1cc
    [<2a17fa0e>] kernel_init+0x24/0x118
    [<4079749a>] ret_from_kernel_thread+0x5c/0x64
unreferenced object 0xde3d9200 (size 512):
  comm "swapper", pid 1, jiffies 4294892827 (age 1906.784s)
  hex dump (first 32 bytes):
    00 00 00 00 aa aa aa aa 00 00 00 00 55 55 aa aa  ............UU..
    55 55 55 55 ff ff ff ff 55 55 55 55 ff ff ff ff  UUUU....UUUU....
  backtrace:
    [<4bf3594d>] fb_alloc_cmap_gfp+0x6c/0x15c
    [<cb6b409b>] offb_init_nodriver+0x8e8/0xa3c
    [<b5a1c019>] offb_init+0xd0/0x164
    [<322f82a3>] do_one_initcall+0x4c/0x178
    [<b592db9f>] kernel_init_freeable+0x138/0x1cc
    [<2a17fa0e>] kernel_init+0x24/0x118
    [<4079749a>] ret_from_kernel_thread+0x5c/0x64
unreferenced object 0xde3d9600 (size 512):
  comm "swapper", pid 1, jiffies 4294892827 (age 1906.784s)
  hex dump (first 32 bytes):
    00 00 aa aa 00 00 aa aa 00 00 aa aa 00 00 aa aa  ................
    55 55 ff ff 55 55 ff ff 55 55 ff ff 55 55 ff ff  UU..UU..UU..UU..
  backtrace:
    [<23a3ea03>] fb_alloc_cmap_gfp+0x84/0x15c
    [<cb6b409b>] offb_init_nodriver+0x8e8/0xa3c
    [<b5a1c019>] offb_init+0xd0/0x164
    [<322f82a3>] do_one_initcall+0x4c/0x178
    [<b592db9f>] kernel_init_freeable+0x138/0x1cc
    [<2a17fa0e>] kernel_init+0x24/0x118
    [<4079749a>] ret_from_kernel_thread+0x5c/0x64
Signed-off-by: Mathieu Malaterre <malat@debian.org>
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

When the linux kernel is build with (typical kernel ship with Debian
installer):

CONFIG_FB=y
CONFIG_FB_OF=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_FB_RADEON=m

The offb driver takes precedence over module radeonfb. It is then
impossible to load the module, error reported is:

[   96.551486] radeonfb 0000:00:10.0: enabling device (0006 -> 0007)
[   96.551526] radeonfb 0000:00:10.0: BAR 0: can't reserve [mem 0x98000000-0x9fffffff pref]
[   96.551531] radeonfb (0000:00:10.0): cannot request region 0.
[   96.551545] radeonfb: probe of 0000:00:10.0 failed with error -16

This patch reproduce the behavior of the module radeon, so as to make it
possible to load radeonfb when offb is first loaded, see
commit a56f7428 ("drm/radeon: Add early unregister of firmware fb's").
Signed-off-by: Mathieu Malaterre <malat@debian.org>
Link: https://bugs.debian.org/826629#57
Link: https://bugzilla.kernel.org/show_bug.cgi?id=119741Suggested-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

The FB_I810_I2C symbol previously had a blank help text, which was
removed in e9829ac4 ("video: fbdev: kconfig: Remove blank help
text").

Give it a proper help text, derived from commit 74f6ae84 ("[PATCH]
i810fb: Add > i2c/DDC support").
Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: "Luis R . Rodriguez" <mcgrof@kernel.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Paul Bolle <pebolle@tiscali.nl>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Hans de Goede <j.w.r.degoede@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

The AVR32 symbol was removed in commit 26202873 ("avr32: remove
support for AVR32 architecture").
Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: LEROY Christophe <christophe.leroy@c-s.fr>
Cc: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Replace const variable with already defined constant.
Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Cc: Bernie Thompson <bernie@plugable.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Driver generates lots of alignment trap exceptions on ARM.
Fix that by replacing typecasting of odd addresses with
byte shifting and remove uneccessary typecasting.
Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Cc: Bernie Thompson <bernie@plugable.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Use GPIO descriptors instead of relying on the old method.
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Building with LTO enabled reveals some functions whose prototypes
in the header are different from the definition:

drivers/video/fbdev/sis/sis_main.h:765:0: error: type of 'SiS_SetCH70xxANDOR' does not match original declaration [-Werror=lto-type-mismatch]
 extern void  SiS_SetCH70xxANDOR(struct SiS_Private *SiS_Pr, unsigned short reg,

drivers/video/fbdev/sis/init301.c:8937:0: note: type mismatch in parameter 4
 SiS_SetCH70xxANDOR(struct SiS_Private *SiS_Pr, unsigned short reg,

drivers/video/fbdev/sis/init301.c:8937:0: note: type 'short unsigned int' should match type 'unsigned char'
drivers/video/fbdev/sis/init301.c:8937:0: note: 'SiS_SetCH70xxANDOR' was previously declared here

The root cause appears to be the way that header files are used in this
driver, where they contain both static variable and declarations for
symbols in other files.

To clean that up, I'm changing all mixed headers to only contain
declarations the way we normally do in C, or contain only static
variables, and move the rest to a more appropriate place.  Once that
is done, the headers can be included in the other files as well, and
guarantee that the prototypes match.

There are a few headers that now only contain static variables, and
I'm leaving those alone here as the patch is already too big. These
could be trivially moved into the respective .c files.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Nicolas Pitre <nico@linaro.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

SH_LCD_MIPI_DSI is unused since commit 18b6562c ("fbdev: sh_mipi_dsi:
remove driver") so no need to keep it.

Fixes: 18b6562c ("fbdev: sh_mipi_dsi: remove driver")
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
sbusfb_ioctl_helper().

'index' is defined as an int in sbusfb_ioctl_helper().
We retrieve this from the user:
if (get_user(index, &c->index) ||
    __get_user(count, &c->count) ||
    __get_user(ured, &c->red) ||
    __get_user(ugreen, &c->green) ||
    __get_user(ublue, &c->blue))
       return -EFAULT;

and then we use 'index' in the following way:
red = cmap->red[index + i] >> 8;
green = cmap->green[index + i] >> 8;
blue = cmap->blue[index + i] >> 8;

This is a classic information leak vulnerability. 'index' should be
an unsigned int, given its usage above.

This patch is straight-forward; it changes 'index' to unsigned int
in two switch-cases: FBIOGETCMAP_SPARC && FBIOPUTCMAP_SPARC.

This patch fixes CVE-2018-6412.
Signed-off-by: Peter Malone <peter.malone@gmail.com>
Acked-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

Merge tag 'v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into fbdev-for-next

Linux 4.16-rc4

Pull x86 fixes from Thomas Gleixner:
 "A small set of fixes for x86:

   - Add missing instruction suffixes to assembly code so it can be
     compiled by newer GAS versions without warnings.

   - Switch refcount WARN exceptions to UD2 as we did in general

   - Make the reboot on Intel Edison platforms work

   - A small documentation update so text and sample command match"

* 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Documentation, x86, resctrl: Make text and sample command match
  x86/platform/intel-mid: Handle Intel Edison reboot correctly
  x86/asm: Add instruction suffixes to bitops
  x86/entry/64: Add instruction suffix
  x86/refcounts: Switch to UD2 for exceptions

Pull x86/pti fixes from Thomas Gleixner:
 "Three fixes related to melted spectrum:

   - Sync the cpu_entry_area page table to initial_page_table on 32 bit.

     Otherwise suspend/resume fails because resume uses
     initial_page_table and triggers a triple fault when accessing the
     cpu entry area.

   - Zero the SPEC_CTL MRS on XEN before suspend to address a
     shortcoming in the hypervisor.

   - Fix another switch table detection issue in objtool"

* 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table
  objtool: Fix another switch table detection issue
  x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend

Pull timer fixes from Thomas Gleixner:
 "A small set of fixes from the timer departement:

   - Add a missing timer wheel clock forward when migrating timers off a
     unplugged CPU to prevent operating on a stale clock base and
     missing timer deadlines.

   - Use the proper shift count to extract data from a register value to
     prevent evaluating unrelated bits

   - Make the error return check in the FSL timer driver work correctly.
     Checking an unsigned variable for less than zero does not really
     work well.

   - Clarify the confusing comments in the ARC timer code"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timers: Forward timer base before migrating timers
  clocksource/drivers/arc_timer: Update some comments
  clocksource/drivers/mips-gic-timer: Use correct shift count to extract data
  clocksource/drivers/fsl_ftm_timer: Fix error return checking

Pull irq fixlet from Thomas Gleixner:
 "Just a documentation update for the missing device tree property of
  the R-Car M3N interrupt controller"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  dt-bindings/irqchip/renesas-irqc: Document R-Car M3-N support

Pull btrfs fixes from David Sterba:

 - when NR_CPUS is large, a SRCU structure can significantly inflate
   size of the main filesystem structure that would not be possible to
   allocate by kmalloc, so the kvalloc fallback is used

 - improved error handling

 - fix endiannes when printing some filesystem attributes via sysfs,
   this is could happen when a filesystem is moved between different
   endianity hosts

 - send fixes: the NO_HOLE mode should not send a write operation for a
   file hole

 - fix log replay for for special files followed by file hardlinks

 - fix log replay failure after unlink and link combination

 - fix max chunk size calculation for DUP allocation

* tag 'for-4.16-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  Btrfs: fix log replay failure after unlink and link combination
  Btrfs: fix log replay failure after linking special file and fsync
  Btrfs: send, fix issuing write op when processing hole in no data mode
  btrfs: use proper endianness accessors for super_copy
  btrfs: alloc_chunk: fix DUP stripe size handling
  btrfs: Handle btrfs_set_extent_delalloc failure in relocate_file_extent_cluster
  btrfs: handle failure of add_pending_csums
  btrfs: use kvzalloc to allocate btrfs_fs_info

Pull i2c fixes from Wolfram Sang:
 "A driver fix and a documentation fix (which makes dependency handling
  for the next cycle easier)"

* 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: octeon: Prevent error message on bus error
  dt-bindings: at24: sort manufacturers alphabetically

Pull libnvdimm fixes from Dan Williams:
 "A 4.16 regression fix, three fixes for -stable, and a cleanup fix:

   - During the merge window support for the new ACPI NVDIMM Platform
     Capabilities structure disabled support for "deep flush", a
     force-unit- access like mechanism for persistent memory. Restore
     that mechanism.

   - VFIO like RDMA is yet one more memory registration / pinning
     interface that is incompatible with Filesystem-DAX. Disable long
     term pins of Filesystem-DAX mappings via VFIO.

   - The Filesystem-DAX detection to prevent long terms pins mistakenly
     also disabled Device-DAX pins which are not subject to the same
     block- map collision concerns.

   - Similar to the setup path, softlockup warnings can trigger in the
     shutdown path for large persistent memory namespaces. Teach
     for_each_device_pfn() to perform cond_resched() in all cases.

   - Boaz noticed that the might_sleep() in dax_direct_access() is stale
     as of the v4.15 kernel.

  These have received a build success notification from the 0day robot,
  and the longterm pin fixes have appeared in -next. However, I recently
  rebased the tree to remove some other fixes that need to be reworked
  after review feedback.

* 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  memremap: fix softlockup reports at teardown
  libnvdimm: re-enable deep flush for pmem devices via fsync()
  vfio: disable filesystem-dax page pinning
  dax: fix vma_is_fsdax() helper
  dax: ->direct_access does not sleep anymore

Merge tag 'kbuild-fixes-v4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - suppress sparse warnings about unknown attributes

 - fix typos and stale comments

 - fix build error of arch/sh

 - fix wrong use of ld-option vs cc-ldoption

 - remove redundant GCC_PLUGINS_CFLAGS assignment

 - fix another memory leak of Kconfig

 - fix line number in error messages of Kconfig

 - do not write confusing CONFIG_DEFCONFIG_LIST out to .config

 - add xstrdup() to Kconfig to handle memory shortage errors

 - show also a Debian package name if ncurses is missing

* tag 'kbuild-fixes-v4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  MAINTAINERS: take over Kconfig maintainership
  kconfig: fix line number in recursive inclusion error message
  Coccinelle: memdup: Fix typo in warning messages
  kconfig: Update ncurses package names for menuconfig
  kbuild/kallsyms: trivial typo fix
  kbuild: test --build-id linker flag by ld-option instead of cc-ldoption
  kbuild: drop superfluous GCC_PLUGINS_CFLAGS assignment
  kconfig: Don't leak choice names during parsing
  sh: fix build error for empty CONFIG_BUILTIN_DTB_SOURCE
  kconfig: set SYMBOL_AUTO to the symbol marked with defconfig_list
  kconfig: add xstrdup() helper
  kbuild: disable sparse warnings about unknown attributes
  Makefile: Fix lying comment re. silentoldconfig

Pull media fixes from Mauro Carvalho Chehab:

  - some build fixes with randconfigs

  - an m88ds3103 fix to prevent an OOPS if the chip doesn't provide the
    right version during probe (with can happen if the hardware hangs)

  - a potential out of array bounds reference in tvp5150

  - some fixes and improvements in the DVB memory mapped API (added for
    kernel 4.16)

* tag 'media/v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: vb2: Makefile: place vb2-trace together with vb2-core
  media: Don't let tvp5150_get_vbi() go out of vbi_ram_default array
  media: dvb: update buffer mmaped flags and frame counter
  media: dvb: add continuity error indicators for memory mapped buffers
  media: dmxdev: Fix the logic that enables DMA mmap support
  media: dmxdev: fix error code for invalid ioctls
  media: m88ds3103: don't call a non-initalized function
  media: au0828: add VIDEO_V4L2 dependency
  media: dvb: fix DVB_MMAP dependency
  media: dvb: fix DVB_MMAP symbol name
  media: videobuf2: fix build issues with vb2-trace
  media: videobuf2: Add VIDEOBUF2_V4L2 Kconfig option for VB2 V4L2 part

Pull watchdog fixes from Wim Van Sebroeck:

 - rave-sp: add NVMEM dependency

 - build fixes for i6300esb_wdt, xen_wdt and sp5100_tco

* tag 'linux-watchdog-4.16-fixes-1' of git://www.linux-watchdog.org/linux-watchdog:
  watchdog: sp5100_tco.c: fix potential build failure
  watchdog: xen_wdt: fix potential build failure
  watchdog: i6300esb: fix build failure
  watchdog: rave-sp: add NVMEM dependency

Pull KVM fixes from Radim Krčmář:
 "x86:

   - fix NULL dereference when using userspace lapic

   - optimize spectre v1 mitigations by allowing guests to use LFENCE

   - make microcode revision configurable to prevent guests from
     unnecessarily blacklisting spectre v2 mitigation feature"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: fix vcpu initialization with userspace lapic
  KVM: X86: Allow userspace to define the microcode version
  KVM: X86: Introduce kvm_get_msr_feature()
  KVM: SVM: Add MSR-based feature support for serializing LFENCE
  KVM: x86: Add a framework for supporting MSR-based features

The cond_resched() currently in the setup path needs to be duplicated in
the teardown path. Rather than require each instance of
for_each_device_pfn() to open code the same sequence, embed it in the
helper.

Link: https://github.com/intel/ixpdimm_sw/issues/11
Cc: "Jérôme Glisse" <jglisse@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org>
Fixes: 71389703 ("mm, zone_device: Replace {get, put}_zone_device_page()...")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

Re-enable deep flush so that users always have a way to be sure that a
write makes it all the way out to media. Writes from the PMEM driver
always arrive at the NVDIMM since movnt is used to bypass the cache, and
the driver relies on the ADR (Asynchronous DRAM Refresh) mechanism to
flush write buffers on power failure. The Deep Flush mechanism is there
to explicitly write buffers to protect against (rare) ADR failure.  This
change prevents a regression in deep flush behavior so that applications
can continue to depend on fsync() as a mechanism to trigger deep flush
in the filesystem-DAX case.

Fixes: 06e8ccda ("acpi: nfit: Add support for detect platform CPU cache...")
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

I have recently picked up Kconfig patches to my tree without any
declaration.  Making it official now.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>

Filesystem-DAX is incompatible with 'longterm' page pinning. Without
page cache indirection a DAX mapping maps filesystem blocks directly.
This means that the filesystem must not modify a file's block map while
any page in a mapping is pinned. In order to prevent the situation of
userspace holding of filesystem operations indefinitely, disallow
'longterm' Filesystem-DAX mappings.

RDMA has the same conflict and the plan there is to add a 'with lease'
mechanism to allow the kernel to notify userspace that the mapping is
being torn down for block-map maintenance. Perhaps something similar can
be put in place for vfio.

Note that xfs and ext4 still report:

   "DAX enabled. Warning: EXPERIMENTAL, use at your own risk"

...at mount time, and resolving the dax-dma-vs-truncate problem is one
of the last hurdles to remove that designation.
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: kvm@vger.kernel.org
Cc: <stable@vger.kernel.org>
Reported-by: Haozhong Zhang <haozhong.zhang@intel.com>
Tested-by: Haozhong Zhang <haozhong.zhang@intel.com>
Fixes: d475c634 ("dax,ext2: replace XIP read and write with DAX I/O")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

Pull PCI fixes from Bjorn Helgaas:

 - Update pci.ids location (documentation only) (Randy Dunlap)

 - Fix a crash when BIOS didn't assign a BAR and we try to enlarge it
   (Christian König)

* tag 'pci-v4.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: Allow release of resources that were never assigned
  PCI: Update location of pci.ids file

Pull parisc fixes from Helge Deller:

 - a patch to change the ordering of cache and TLB flushes to hopefully
   fix the random segfaults we very rarely face (by Dave Anglin).

 - a patch to hide the virtual kernel memory layout due to security
   reasons.

 - two small patches to make the kernel run more smoothly under qemu.

* 'parisc-4.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Reduce irq overhead when run in qemu
  parisc: Use cr16 interval timers unconditionally on qemu
  parisc: Check if secondary CPUs want own PDC calls
  parisc: Hide virtual kernel memory layout
  parisc: Fix ordering of cache and TLB flushes

Pull xen fixes from Juergen Gross:
 "Five minor fixes for Xen-specific drivers"

* tag 'for-linus-4.16a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  pvcalls-front: 64-bit align flags
  x86/xen: add tty0 and hvc0 as preferred consoles for dom0
  xen-netfront: Fix hang on device removal
  xen/pirq: fix error path cleanup when binding MSIs
  xen/pvcalls: fix null pointer dereference on map->sock

Pull ceph fixes from Ilya Dryomov:
 "A cap handling fix from Zhi that ensures that metadata writeback isn't
  delayed and three error path memory leak fixups from Chengguang"

* tag 'ceph-for-4.16-rc4' of git://github.com/ceph/ceph-client:
  ceph: fix potential memory leak in init_caches()
  ceph: fix dentry leak when failing to init debugfs
  libceph, ceph: avoid memory leak when specifying same option several times
  ceph: flush dirty caps of unlinked inode ASAP