The patch 6e8edf8a: "drm/exynos: Fix suspend/resume support" introduced
a new code in suspend/resume paths. However it unconditionally dereference
drm_dev pointer, which might be NULL if suspend/resume happens before
Exynos DRM driver components bind. This patch fixes this issue.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Fixes: 6e8edf8a "drm/exynos: Fix suspend/resume support"
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Merge tag 'drm-intel-fixes-2017-10-11' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

drm/i915 fixes for 4.14-rc5:

Three fixes for stable:

- Use crtc_state_is_legacy_gamma in intel_color_check (Maarten)
- Read timings from the correct transcoder (Ville).
- Fix HDMI on BSW (Jani).

Other fixes:

- eDP fixes (Manasi)
- Silence compiler warnings (Chris)
- Order two completing nop_submit_request (Chris)

* tag 'drm-intel-fixes-2017-10-11' of git://anongit.freedesktop.org/drm/drm-intel:
  drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX channel
  drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get()
  drm/i915: Order two completing nop_submit_request
  drm/i915: Silence compiler warning for hsw_power_well_enable()
  drm/i915: Use crtc_state_is_legacy_gamma in intel_color_check
  drm/i915/edp: Increase the T12 delay quirk to 1300ms
  drm/i915/edp: Get the Panel Power Off timestamp after panel is off

bunch of msm fixes

* 'msm-fixes-4.14-rc4' of git://people.freedesktop.org/~robclark/linux:
  drm/msm: fix _NO_IMPLICIT fencing case
  drm/msm: fix error path cleanup
  drm/msm/mdp5: Remove extra pm_runtime_put call in mdp5_crtc_cursor_set()
  drm/msm/dsi: Use correct pm_runtime_put variant during host_init
  drm/msm: fix return value check in _msm_gem_kernel_new()
  drm/msm: use proper memory barriers for updating tail/head
  drm/msm/mdp5: add missing max size for 8x74 v1

drm/imx: i.MX5 regression fix and i.MX6QP PRE/PRG stability fixes

- Disable channel burst locking on IPUv3EX (i.MX51) and IPUv3M (i.MX53).
  This fixes a regression introduced by commit 790cb4c7 ("drm/imx: lock
  scanout transfers for consecutive bursts").
- Give PRG a head start. Waiting for both double buffers to fill up before
  enabling the IPU improves startup reliability.
- Avoid PRE control register updates during unsafe window, workaround for
  ERR009624.

* tag 'imx-drm-fixes-2017-10-12' of git://git.pengutronix.de/git/pza/linux:
  gpu: ipu-v3: pre: implement workaround for ERR009624
  gpu: ipu-v3: prg: wait for double buffers to be filled on channel startup
  gpu: ipu-v3: Allow channel burst locking on i.MX6 only

single amdgpu regression fix.

* 'drm-fixes-4.14' of git://people.freedesktop.org/~agd5f/linux:
  drm/amdgpu: fix placement flags in amdgpu_ttm_bind

We need to call reservation_object_reserve_shared() in both cases, but
this wasn't happening in the _NO_IMPLICIT submit case.

Fixes: f0a42bb5 ("drm/msm: submit support for in-fences")
Reported-by: NJordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

If we fail to attach iommu, gpu->aspace could be IS_ERR()..
Signed-off-by: NRob Clark <robdclark@gmail.com>

While converting mdp5_enable/disable() calls to pm_runtime_get/put() API,
an extra call to pm_runtime_put_autosuspend() crept in
mdp5_crtc_cursor_set(). This results in calling the suspend handler
twice, and therefore clk_disables twice, which isn't a nice thing to do.

Fixes: d68fe15b (drm/msm/mdp5: Use runtime PM get/put API instead ...)
Reported-by: NStanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

The DSI runtime PM suspend/resume callbacks check whether
msm_host->cfg_hnd is non-NULL before trying to enable the bus clocks.
This is done to accommodate early calls to these functions that may
happen before the bus clocks are even initialized.

Calling pm_runtime_put_autosuspend() in dsi_host_init() can result in
racy behaviour since msm_host->cfg_hnd is set very soon after. If the
suspend callback happens too late, we end up trying to disable clocks
that were never enabled, resulting in a bunch of WARN_ON splats.

Use pm_runtime_put_sync() so that the suspend callback is called
immediately.
Reported-by: NNicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

In case of error, the function msm_gem_get_vaddr() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check should
be replaced with IS_ERR().

Fixes: 8223286d ("drm/msm: Add a helper function for in-kernel
buffer allocations")
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: NRob Clark <robdclark@gmail.com>

Fixes intermittent corruption of cmdstream dump.
Signed-off-by: NRob Clark <robdclark@gmail.com>

This should have same max width as v2.
Signed-off-by: NRob Clark <robdclark@gmail.com>

Otherwise we lose the NO_EVICT flag and can try to evict pinned BOs.
Signed-off-by: NChristian König <christian.koenig@amd.com>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Core Changes:
- sync_file: Fix race in SYNC_IOC_FILE_INFO (John)
- atomic_helper: Give up reference taken in suspend helper (Jeffy)

Cc: John Einar Reitan <john.reitan@arm.com>
Cc: Jeffy Chen <jeffy.chen@rock-chips.com>

* tag 'drm-misc-fixes-2017-10-11' of git://anongit.freedesktop.org/drm/drm-misc:
  sync_file: Return consistent status in SYNC_IOC_FILE_INFO
  drm/atomic: Unref duplicated drm_atomic_state in drm_atomic_helper_resume()

While technically CHV isn't DDI, we do look at the VBT based DDI port
info for HDMI DDC pin and DP AUX channel. (We call these "alternate",
but they're really just something that aren't platform defaults.)

In commit e4ab73a1 ("drm/i915: Respect alternate_ddc_pin for all DDI
ports") Ville writes, "IIRC there may be CHV system that might actually
need this."

I'm not sure why there couldn't be even more platforms that need this,
but start conservative, and parse the info for CHV in addition to DDI.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100553Reported-by: NMarek Wilczewski <mw@3cte.pl>
Cc: stable@vger.kernel.org
Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/d0815082cb98487618429b62414854137049b888.1506586821.git.jani.nikula@intel.com
(cherry picked from commit 348e4058)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

The PRE has a bug where a software write to the CTRL register can block
the setting of the ENABLE bit by the hardware in auto repeat mode. When
this happens the PRE will fail to handle new jobs. To work around this
software must not write to CTRL register when the PRE store engine is
inside the unsafe window, where a hardware update to the ENABLE bit
may happen.
Signed-off-by: NLucas Stach <l.stach@pengutronix.de>
[p.zabel@pengutronix.de: rebased before PRE tiled prefetch support]
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>

Wait for both double buffer to be filled when first starting a channel.
This makes channel startup a lot more reliable, probably because it allows
the internal state machine to settle before the requests from the IPU are
coming in.
Signed-off-by: NLucas Stach <l.stach@pengutronix.de>
[p.zabel@pengutronix.de: rebased before switch to runtime PM]
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>

The IDMAC_LOCK_EN registers on i.MX51 have a different layout, and on
i.MX53 enabling the lock feature causes bursts to get lost. Restrict
enabling the burst lock feature to i.MX6.
Reported-by: NPatrick Brünn <P.Bruenn@beckhoff.com>
Fixes: 790cb4c7 ("drm/imx: lock scanout transfers for consecutive bursts")
Tested-by: NPatrick Brünn <P.Bruenn@beckhoff.com>
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>

intel_crtc->config->cpu_transcoder isn't yet filled out when
intel_crtc_mode_get() gets called during output probing, so we should
not use it there. Instead intel_crtc_mode_get() figures out the correct
transcoder on its own, and that's what we should use.

If the BIOS boots LVDS on pipe B, intel_crtc_mode_get() would actually
end up reading the timings from pipe A instead (since PIPE_A==0),
which clearly isn't what we want.

It looks to me like this may have been broken by
commit eccb140b ("drm/i915: hw state readout&check support for cpu_transcoder")
as that one removed the early initialization of cpu_transcoder from
intel_crtc_init().

Cc: stable@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: Rob Kramer <rob@solution-space.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reported-by: NRob Kramer <rob@solution-space.com>
Fixes: eccb140b ("drm/i915: hw state readout&check support for cpu_transcoder")
References: https://lists.freedesktop.org/archives/dri-devel/2016-April/104142.htmlSigned-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: NChris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/1459525046-19425-1-git-send-email-ville.syrjala@linux.intel.com
(cherry picked from commit e30a154b)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

If two nop's (requests in-flight following a wedged device) complete at
the same time, the global_seqno value written to the HWSP is undefined
as the two threads are not serialized.

v2: Use irqsafe spinlock. We expect the callback may be called from
inside another irq spinlock, so we can't unconditionally restore irqs.

Fixes: ce1135c7 ("drm/i915: Complete requests in nop_submit_request")
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171006115617.18432-1-chris@chris-wilson.co.uk
(cherry picked from commit 8d550824)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

Not all compilers are able to determine that pg is guarded by wait_fuses
and so may think that pg is used uninitialized.
Reported-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Fixes: b2891eb2 ("drm/i915/hsw+: Add has_fuses power well attribute")
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171002100416.25865-1-chris@chris-wilson.co.ukReviewed-by: NImre Deak <imre.deak@intel.com>
(cherry picked from commit 320671f9)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

crtc_state_is_legacy_gamma also checks for CTM, which was missing from
intel_color_check. By using the same condition for commit and check
we reduce the chance of mismatches.

This was spotted by KASAN while trying to rework kms_color igt test.

[   72.008660] ==================================================================
[   72.009326] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.3+0x15c/0x360 [i915]
[   72.009519] Read of size 2 at addr ffff880220216e50 by task kms_color/1158
[   72.009900] CPU: 2 PID: 1158 Comm: kms_color Tainted: G     U  W 4.14.0-rc3-patser+ #5281
[   72.009921] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
[   72.009941] Call Trace:
[   72.009968]  dump_stack+0xc5/0x151
[   72.009996]  ? _atomic_dec_and_lock+0x10f/0x10f
[   72.010024]  ? show_regs_print_info+0x3c/0x3c
[   72.010072]  print_address_description+0x7f/0x240
[   72.010108]  kasan_report+0x216/0x370
[   72.010308]  ? bdw_load_gamma_lut.isra.3+0x15c/0x360 [i915]
[   72.010349]  __asan_load2+0x74/0x80
[   72.010552]  bdw_load_gamma_lut.isra.3+0x15c/0x360 [i915]
[   72.010772]  broadwell_load_luts+0x1f0/0x300 [i915]
[   72.010997]  intel_color_load_luts+0x36/0x40 [i915]
[   72.011205]  intel_begin_crtc_commit+0xa1/0x310 [i915]
[   72.011283]  drm_atomic_helper_commit_planes_on_crtc+0xa6/0x320 [drm_kms_helper]
[   72.011316]  ? wait_for_completion_io+0x460/0x460
[   72.011524]  intel_update_crtc+0xe3/0x100 [i915]
[   72.011720]  skl_update_crtcs+0x360/0x3f0 [i915]
[   72.011945]  ? intel_update_crtcs+0xf0/0xf0 [i915]
[   72.012010]  ? drm_atomic_helper_wait_for_dependencies+0x3d9/0x400 [drm_kms_helper]
[   72.012231]  intel_atomic_commit_tail+0x8db/0x1500 [i915]
[   72.012273]  ? __lock_is_held+0x9c/0xc0
[   72.012494]  ? skl_update_crtcs+0x3f0/0x3f0 [i915]
[   72.012518]  ? find_next_bit+0xb/0x10
[   72.012544]  ? cpumask_next+0x1a/0x20
[   72.012745]  ? i915_sw_fence_complete+0x9d/0xe0 [i915]
[   72.012938]  ? __i915_sw_fence_complete+0x5d0/0x5d0 [i915]
[   72.013176]  intel_atomic_commit+0x528/0x570 [i915]
[   72.013280]  ? drm_atomic_get_property+0xc00/0xc00 [drm]
[   72.013466]  ? intel_atomic_commit_tail+0x1500/0x1500 [i915]
[   72.013496]  ? kmem_cache_alloc_trace+0x266/0x280
[   72.013714]  ? intel_atomic_commit_tail+0x1500/0x1500 [i915]
[   72.013812]  drm_atomic_commit+0x77/0x80 [drm]
[   72.013911]  set_property_atomic+0x14a/0x210 [drm]
[   72.014015]  ? drm_object_property_get_value+0x70/0x70 [drm]
[   72.014080]  ? mutex_unlock+0xd/0x10
[   72.014292]  ? intel_atomic_commit_tail+0x1500/0x1500 [i915]
[   72.014379]  drm_mode_obj_set_property_ioctl+0x1cf/0x310 [drm]
[   72.014481]  ? drm_mode_obj_find_prop_id+0xa0/0xa0 [drm]
[   72.014510]  ? lock_release+0x6c0/0x6c0
[   72.014602]  ? drm_is_current_master+0x46/0x60 [drm]
[   72.014706]  drm_ioctl_kernel+0x148/0x1d0 [drm]
[   72.014799]  ? drm_mode_obj_find_prop_id+0xa0/0xa0 [drm]
[   72.014898]  ? drm_ioctl_permit+0x100/0x100 [drm]
[   72.014936]  ? kasan_check_write+0x14/0x20
[   72.015039]  drm_ioctl+0x441/0x660 [drm]
[   72.015129]  ? drm_mode_obj_find_prop_id+0xa0/0xa0 [drm]
[   72.015235]  ? drm_getstats+0x20/0x20 [drm]
[   72.015287]  ? ___might_sleep+0x159/0x340
[   72.015311]  ? find_held_lock+0xcf/0xf0
[   72.015341]  ? __schedule_bug+0x110/0x110
[   72.015405]  do_vfs_ioctl+0xa88/0xb10
[   72.015449]  ? ioctl_preallocate+0x1a0/0x1a0
[   72.015487]  ? selinux_capable+0x20/0x20
[   72.015525]  ? rcu_dynticks_momentary_idle+0x40/0x40
[   72.015607]  SyS_ioctl+0x4e/0x80
[   72.015647]  entry_SYSCALL_64_fastpath+0x18/0xad
[   72.015670] RIP: 0033:0x7ff74a3d04d7
[   72.015691] RSP: 002b:00007ffc594bec08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   72.015734] RAX: ffffffffffffffda RBX: ffffffff8718f54a RCX: 00007ff74a3d04d7
[   72.015756] RDX: 00007ffc594bec40 RSI: 00000000c01864ba RDI: 0000000000000003
[   72.015777] RBP: ffff880211c0ff98 R08: 0000000000000086 R09: 0000000000000000
[   72.015799] R10: 00007ff74a691b58 R11: 0000000000000246 R12: 0000000000000355
[   72.015821] R13: 00000000ff00eb00 R14: 0000000000000a00 R15: 00007ff746082000
[   72.015857]  ? trace_hardirqs_off_caller+0xfa/0x110
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171005141520.23990-1-maarten.lankhorst@linux.intel.com
[mlankhorst: s/crtc_state_is_legacy/&_gamma/ (danvet)]
Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Fixes: 82cf435b ("drm/i915: Implement color management on bdw/skl/bxt/kbl")
Cc: <stable@vger.kernel.org> # v4.7+
(cherry picked from commit 0c3767b2)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

For this specific PCI device, the eDP panel requires a higher panel
power cycle delay of 1300ms where the minimum spec requirement of panel
power cycle delay is 500ms. This fix in combination with correct
timestamp at which we get the panel power off time fixes the dP AUX CH
timeouts seen on various IGT tests.

Fixes: c99a259b ("drm/i915/edp: Add a T12 panel delay quirk to fix
DP AUX CH timeouts")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101144
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101518
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
Signed-off-by: NManasi Navare <manasi.d.navare@intel.com>
Acked-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1507073845-13420-2-git-send-email-manasi.d.navare@intel.com
(cherry picked from commit c02b8fb4)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

Kernel stores the time in jiffies at which the eDP panel is turned
off. This should be obtained after the panel is off (after the
wait_panel_off). When we next attempt to turn the panel on, we use the
difference between the timestamp at which we want to turn the panel on
and timestamp at which panel was turned off to ensure that this is equal
to panel power cycle delay and if not we wait for the remaining
time. Not waiting for the panel power cycle delay can cause the panel to
not turn on giving rise to AUX timeouts for the attempted AUX
transactions.

v2:
* Separate lines for bugzilla (Jani Nikula)
* Suggested by tag (Daniel Vetter)

Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: stable@vger.kernel.org
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101518
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101144Suggested-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NManasi Navare <manasi.d.navare@intel.com>
Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: NJani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1507135706-17147-1-git-send-email-manasi.d.navare@intel.com
(cherry picked from commit cbacf02e)
Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>

sync_file_ioctl_fence_info has a race between filling the status
of the underlying fences and the overall status of the sync_file.
If fence transitions in the time frame between its sync_fill_fence_info
and the later dma_fence_is_signaled for the sync_file, the returned
information is inconsistent showing non-signaled underlying fences but
an overall signaled state.

This patch changes sync_file_ioctl_fence_info to track what has been
encoded and using that as the overall sync_file status.
Tested-by: NVamsidhar Reddy Gaddam <vamsidhar.gaddam@arm.com>
Signed-off-by: NJohn Einar Reitan <john.reitan@arm.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171009134936.27219-1-john.reitan@arm.com

Kmemleak reported memory leak after suspend and resume:
unreferenced object 0xffffffc0e31d8880 (size 128):
  comm "bash", pid 181, jiffies 4294763583 (age 24.694s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 20 a2 eb c0 ff ff ff  ......... ......
    01 00 00 00 00 00 00 00 80 87 1d e3 c0 ff ff ff  ................
  backtrace:
    [<ffffffc00034bb64>] __save_stack_trace+0x48/0x6c
    [<ffffffc00034c244>] create_object+0x138/0x254
    [<ffffffc0009dd218>] kmemleak_alloc+0x58/0x8c
    [<ffffffc000346de4>] kmem_cache_alloc_trace+0x188/0x254
    [<ffffffc0005af4c0>] drm_atomic_state_alloc+0x3c/0x88
    [<ffffffc000591f0c>] drm_atomic_helper_duplicate_state+0x28/0x158
    [<ffffffc000592098>] drm_atomic_helper_suspend+0x5c/0xf0

Problem here is that we are duplicating the drm_atomic_state in
drm_atomic_helper_suspend(), but not unreference it in the resume path.

Fixes: 14942760 ("drm/atomic-helper: Implement subsystem-level suspend/resume")
Signed-off-by: NJeffy Chen <jeffy.chen@rock-chips.com>
Reviewed-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171009064641.15174-1-jeffy.chen@rock-chips.com
Fixes: 0853695c ("drm: Add reference counting to drm_atomic_state")
Cc: <stable@vger.kernel.org> # v4.10+
(cherry picked from commit 6d281b1f)

Pull SCSI fixes from James Bottomley:

 - a couple of serious fixes: use after free and blacklist for WRITE
   SAME

 - one error leg fix: write_pending failure

 - one user experience problem: do not override max_sectors_kb

 - one minor unused function removal

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ibmvscsis: Fix write_pending failure path
  scsi: libiscsi: Remove iscsi_destroy_session
  scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown
  scsi: sd: Do not override max_sectors_kb sysfs setting
  scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP

Pull i2c fixes from Wolfram Sang:
 "I2C has three driver fixes for the newly introduced drivers and one ID
  addition for the i801 driver"

* 'i2c/for-current-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: i2c-stm32f7: make structure stm32f7_setup static const
  i2c: ensure termination of *_device_id tables
  i2c: i801: Add support for Intel Cedar Fork
  i2c: stm32f7: fix setup structure

Pull MMC fixes from Ulf Hansson:
 "MMC core:

   - Fix driver strength selection when selecting hs400es

   - Delete bounce buffer handling:

     This change fixes a problem related to how bounce buffers are being
     allocated. However, instead of trying to fix that, let's just
     remove the mmc bounce buffer code altogether, as it has practically
     no use.

  MMC host:

   - meson-gx: A couple of fixes related to clock/phase/tuning

   - sdhci-xenon: Fix clock resource by adding an optional bus clock"

* tag 'mmc-v4.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-xenon: Fix clock resource by adding an optional bus clock
  mmc: meson-gx: include tx phase in the tuning process
  mmc: meson-gx: fix rx phase reset
  mmc: meson-gx: make sure the clock is rounded down
  mmc: Delete bounce buffer handling
  mmc: core: add driver strength selection when selecting hs400es

Merge tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fix from Guenter Roeck:
 "Fix up error path in xgene driver"

* tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()'

Pull clk fixes from Stephen Boyd:

 - build fix to export the clk_bulk_prepare() symbol

 - suspend fix for Samsung Exynos SoCs where we need to keep clks on
   across suspend

 - two critical clk markings for clks that shouldn't ever turn off on
   Rockchip SoCs

 - a fix for a copy-paste mistake on Rockchip rk3128 causing some clks
   to touch the same bit and trample over one another

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
  clk: Export clk_bulk_prepare()
  clk: rockchip: add sclk_timer5 as critical clock on rk3128
  clk: rockchip: fix up rk3128 pvtm and mipi_24m gate regs error
  clk: rockchip: add pclk_pmu as critical clock on rk3128

Pull ARC udpates from Vineet Gupta:

 - updates for various platforms

 - boot log updates for upcoming HS48 family of cores (dual issue)

* tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: [plat-hsdk]: Add reset controller node to manage ethernet reset
  ARC: [plat-hsdk]: Temporary fix to set CPU frequency to 1GHz
  ARC: fix allnoconfig build warning
  ARCv2: boot log: identify HS48 cores (dual issue)
  ARC: boot log: decontaminate ARCv2 ISA_CONFIG register
  arc: remove redundant UTS_MACHINE define in arch/arc/Makefile
  ARC: [plat-eznps] Update platform maintainer as Noam left
  ARC: [plat-hsdk] use actual clk driver to manage cpu clk
  ARC: [*defconfig] Reenable soft lock-up detector
  ARC: [plat-axs10x] sdio: Temporary fix of sdio ciu frequency
  ARC: [plat-hsdk] sdio: Temporary fix of sdio ciu frequency
  ARC: [plat-axs103] Add temporary quirk to reset ethernet IP

Pull xfs fixes from Darrick Wong:

 - fix a race between overlapping copy on write aio

 - fix cow fork swapping when we defragment reflinked files

* tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: handle racy AIO in xfs_reflink_end_cow
  xfs: always swap the cow forks when swapping extents

Pull block fixes from Jens Axboe:
 "A collection of fixes for this series. This contains:

   - NVMe pull request from Christoph, one uuid attribute fix, and one
     fix for the controller memory buffer address for remapped BARs.

   - use-after-free fix for bsg, from Benjamin Block.

   - bcache race/use-after-free fix for a list traversal, fixing a
     regression in this merge window. From Coly Li.

   - null_blk change configfs dependency change from a 'depends' to a
     'select'. This is a change from this merge window as well. From me.

   - nbd signal fix from Josef, fixing a regression introduced with the
     status code changes.

   - nbd MAINTAINERS mailing list entry update.

   - blk-throttle stall fix from Joseph Qi.

   - blk-mq-debugfs fix from Omar, fixing an issue where we don't
     register the IO scheduler debugfs directory, if the driver is
     loaded with it. Only shows up if you switch through the sysfs
     interface"

* 'for-linus' of git://git.kernel.dk/linux-block:
  bsg-lib: fix use-after-free under memory-pressure
  nvme-pci: Use PCI bus address for data/queues in CMB
  blk-mq-debugfs: fix device sched directory for default scheduler
  null_blk: change configfs dependency to select
  blk-throttle: fix possible io stall when upgrade to max
  MAINTAINERS: update list for NBD
  nbd: fix -ERESTARTSYS handling
  nvme: fix visibility of "uuid" ns attribute
  bcache: use llist_for_each_entry_safe() in __closure_wake_up()

Pull PCI fixes from Bjorn Helgaas:
 "Fix legacy IDE probe issues exposed by recent PCI core IRQ mapping
  changes (Bartlomiej Zolnierkiewicz, Lorenzo Pieralisi)"

* tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  ide: fix IRQ assignment for PCI bus order probing
  ide: pci: free PCI BARs on initialization failure
  ide: free hwif->portdev on hwif_init() failure

Pull arm64 fixes from Catalin Marinas:

 - Bring initialisation of user space undefined instruction handling
   early (core_initcall) since late_initcall() happens after modprobe in
   initramfs is invoked. Similar fix for fpsimd initialisation

 - Increase the kernel stack when KASAN is enabled

 - Bring the PCI ACS enabling earlier via the
   iort_init_platform_devices()

 - Fix misleading data abort address printing (decimal vs hex)

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Ensure fpsimd support is ready before userspace is active
  arm64: Ensure the instruction emulation is ready for userspace
  arm64: Use larger stacks when KASAN is selected
  ACPI/IORT: Fix PCI ACS enablement
  arm64: fix misleading data abort decoding

Pull KVM fixes from Radim Krčmář:

 - fix PPC XIVE interrupt delivery

 - fix x86 RCU breakage from asynchronous page faults when built without
   PREEMPT_COUNT

 - fix x86 build with -frecord-gcc-switches

 - fix x86 build without X86_LOCAL_APIC

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: add X86_LOCAL_APIC dependency
  x86/kvm: Move kvm_fastop_exception to .fixup section
  kvm/x86: Avoid async PF preempting the kernel incorrectly
  KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()

Pull rdma fixes from Doug Ledford:
 "This is a pretty small pull request. Only 6 patches in total. There
  are no outstanding -rc patches on the mailing list after this pull
  request, so only if some new issues are discovered in the remainder of
  the rc cycles will you hear from me again.

  Summary:
   - a fix for iwpm netlink usage
   - a fix for error unwinding in mlx5
   - two fixes to vlan handling in qedr
   - a couple small i40iw fixes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
  i40iw: Fix port number for query QP
  i40iw: Add missing memory barriers
  RDMA/qedr: Parse vlan priority as sl
  RDMA/qedr: Parse VLAN ID correctly and ignore the value of zero
  IB/mlx5: Fix label order in error path handling
  RDMA/iwpm: Properly mark end of NL messages

Pull btrfs fixes from David Sterba:
 "Two more fixes for bugs introduced in 4.13.

  The sector_t problem with 32bit architecture and !LBDAF config seems
  serious but the number of affected deployments is hopefully low.

  The clashing status bits could lead to a confusing in-memory state of
  the whole-filesystem operations if used with the quota override sysfs
  knob"

* 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  Btrfs: fix overlap of fs_info::flags values
  btrfs: avoid overflow when sector_t is 32 bit