Pull sound fixes from Takashi Iwai:
 "The only core change is the fix for possible memory corruption by ALSA
  ctl API since 4.14 kernel due to a thinko.

  The rest are all device-specific: in addition to the usual suspects
  (HD-audio and USB-audio fixups), a few LPE HDMI audio fixes came in at
  this time"

* tag 'sound-4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: x86: Fix potential crash at error path
  ALSA: x86: Fix missing spinlock and mutex initializations
  ALSA: control: Fix memory corruption risk in snd_ctl_elem_read
  ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
  ALSA: usb-audio: Add a quirck for B&W PX headphones
  ALSA: hda: Add a power_save blacklist
  ALSA: x86: hdmi: Add single_port option for compatible behavior

Pull pin control fixes from Linus Walleij:
 "Two smallish pin control fixes: one actual code fix for the Meson and
  a MAINTAINERS update.

  Summary:

   - fix a pin group on the Meson

   - assign maintainers for Freescale/NXP pin controllers"

* tag 'pinctrl-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  MAINTAINERS: add Freescale pin controllers
  pinctrl: meson-axg: adjust uart_ao_b pin group naming

Pull GPIO fixes from Linus Walleij:
 "Fix up device tree properties readout caused by my own refactorings"

* tag 'gpio-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: Handle deferred probing in of_find_gpio() properly
  gpiolib: Keep returning EPROBE_DEFER when we should

Pull ARM SoC fixes from Arnd Bergmann:
 "This is the first set of bugfixes for ARM SoCs, fixing a couple of
  stability problems, mostly on TI OMAP and Rockchips platforms:

   - OMAP2 hwmod clocks must be enabled in the correct order

   - OMAP3 Wakeup from resume through PRM IRQ was unreliable

   - one regression on OMAP5 caused by a kexec fix

   - Rockchip ethernet needs some settings for stable operation on
     Rock64

   - Rockchip based Chrombook Plus needs another clock setting for
     stable display suspend/resume

   - Rockchip based phyCORE-RK3288 was able to run at an invalid CPU
     clock frequency

   - Rockchip MMC link was sometimes unreliable

   - multiple fixes to avoid crashes in the Broadcom STB DPFE driver

  Other minor changes include:

   - Devicetree fixes for incorrect hardware description (rockchip,
     omap, Gemini, amlogic)

   - some MAINTAINER file updates to correct email and git addresses

   - some fixes addressing 'make W=1' dtc warnings (broadcom, amlogic,
     cavium, qualcomm, hisilicon, zx)

   - fixes for LTO-compilation (orion, davinci, clps711x)

   - one fix for an incorrect Kconfig errata selection

   - a memory leak in the OMAP timer driver

   - a kernel data leak in OMAP1 debugfs files"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (38 commits)
  MAINTAINERS: update entries for ARM/STM32
  ARM: dts: bcm283x: Move arm-pmu out of soc node
  ARM: dts: bcm283x: Fix unit address of local_intc
  ARM: dts: NSP: Fix amount of RAM on BCM958625HR
  ARM: dts: Set D-Link DNS-313 SATA to muxmode 0
  ARM: omap2: set CONFIG_LIRC=y in defconfig
  ARM: dts: imx6dl: Include correct dtsi file for Engicam i.CoreM6 DualLite/Solo RQS
  memory: brcmstb: dpfe: support new way of passing data from the DCPU
  memory: brcmstb: dpfe: fix type declaration of variable "ret"
  memory: brcmstb: dpfe: properly mask vendor error bits
  ARM: BCM: dts: Remove leading 0x and 0s from bindings notation
  ARM: orion: fix orion_ge00_switch_board_info initialization
  ARM: davinci: mark spi_board_info arrays as const
  ARM: clps711x: mark clps711x_compat as const
  arm: zx: dts: Remove leading 0x and 0s from bindings notation
  arm64: dts: Remove leading 0x and 0s from bindings notation
  arm64: dts: cavium: fix PCI bus dtc warnings
  MAINTAINERS: ARM: at91: update my email address
  soc: imx: gpc: de-register power domains only if initialized
  ARM: dts: rockchip: Fix DWMMC clocks
  ...

Merge tag 'riscv-for-linus-4.16-rc4_smp_mb' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux

Pull RISC-V fix from Palmer Dabbelt:
 "This week we have a single fix: replacing smp_mb() with __smp_mb().

  We were the only architecture with smp_mb() and it appears to just be
  clearly wrong, so I think this is a pretty safe patch for an RC"

* tag 'riscv-for-linus-4.16-rc4_smp_mb' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux:
  riscv/barrier: Define __smp_{mb,rmb,wmb}

Pull "Broadcom drivers fixes for 4.16" from Florian Fainelli:

This pull request contains Broadcom SoCs drivers fixes for 4.16, please
pull the following:

- Markus provides two minor fixes to the Broadcom STB DPFE driver, one
  to properly mask bits, and a second one to use the correct type. The
  third commit is a consequence of a newer DFPE firmware which would
  unfortunately crash without appropriate kernel changes.

* tag 'arm-soc/for-4.16/drivers-fixes' of https://github.com/Broadcom/stblinux:
  memory: brcmstb: dpfe: support new way of passing data from the DCPU
  memory: brcmstb: dpfe: fix type declaration of variable "ret"
  memory: brcmstb: dpfe: properly mask vendor error bits

Pull "Broadcom devicetree fixes for 4.16" from Florian Fainelli:

This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
4.16, please pull the following:

- Mathieu fixes leading 0x and 0's from bindings and Device Tree source
  files, he has done this treewide and most of his changes are already in
  4.16

- Stefan provides two changes to the BCM283x DTS files in order to fix
  DTC warnings

- Florian fixes the amount of RAM on the BCM958625HR reference board to
  properly limit to what is initialized by the bootloader

* tag 'arm-soc/for-4.16/devicetree-fixes' of https://github.com/Broadcom/stblinux:
  ARM: dts: bcm283x: Move arm-pmu out of soc node
  ARM: dts: bcm283x: Fix unit address of local_intc
  ARM: dts: NSP: Fix amount of RAM on BCM958625HR
  ARM: BCM: dts: Remove leading 0x and 0s from bindings notation

Changes old git repository to the maintained one and adds more patterns.
Signed-off-by: NAlexandre Torgue <alexandre.torgue@st.com>
Acked-by: NMaxime Coquelin <mcoquelin.stm32@gmail.com>
Signed-off-by: NArnd Bergmann <arnd@arndb.de>

Merge tag 'imx-fixes-4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes

Pull "i.MX fixes for 4.16" from Shawn Guo:

 - Fix i.MX GPC driver to remove power domains only when they are
   initialized in imx_gpc_probe().
 - Fix the broken Engicam i.CoreM6 DualLite/Solo RQS board DT to include
   imx6dl.dtsi instead of imx6q.dtsi.

* tag 'imx-fixes-4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  ARM: dts: imx6dl: Include correct dtsi file for Engicam i.CoreM6 DualLite/Solo RQS
  soc: imx: gpc: de-register power domains only if initialized

Merge tag 'linux-kselftest-4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest fixes from Shuah Khan:
 "Fixes for various problems in test output, compile errors, and missing
  configs"

* tag 'linux-kselftest-4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests: vm: update .gitignore with new test
  selftests: memory-hotplug: silence test command echo
  selftests/futex: Fix line continuation in Makefile
  selftests: memfd: add config fragment for fuse
  selftests: pstore: Adding config fragment CONFIG_PSTORE_RAM=m
  selftests/android: Fix line continuation in Makefile
  selftest/vDSO: fix O=
  selftests: sync: missing CFLAGS while compiling

Pull xfs fixes from Darrick Wong:

 - fix some compiler warnings

 - fix block reservations for transactions created during log recovery

 - fix resource leaks when respecifying mount options

* tag 'xfs-4.16-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix potential memory leak in mount option parsing
  xfs: reserve blocks for refcount / rmap log item recovery
  xfs: use memset to initialize xfs_scrub_agfl_info

Pull dma-mapping fix from Christoph Hellwig:
 "A single fix for a memory leak regression in the dma-debug code"

* tag 'dma-mapping-4.16-3' of git://git.infradead.org/users/hch/dma-mapping:
  dma-debug: fix memory leak in debug_dma_alloc_coherent

Pull DeviceTree fixes from Rob Herring:

 - update i.MX thermal binding example to use current binding, not the
   deprecated one

 - move arm-charlcd to auxdisplay/

 - fix misspelling of "debounce-interval"

* tag 'devicetree-fixes-for-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  dt-bindings: power: Fix "debounce-interval" property misspelling
  auxdisplay: Move arm-charlcd binding to correct folder
  dt-bindings: thermal: imx: update the binding to new method

When LPE audio driver gets some error at probing, it may lead to a
crash because of canceling the pending work in hdmi_lpe_audio_free(),
since some of ports might be still not initialized.

For assuring the proper free of each port, initialize all ports at the
beginning of the probe.

Fixes: b4eb0d52 ("ALSA: x86: Split snd_intelhad into card and PCM specific structures")
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The commit change for supporting the multiple ports moved involved
some code shuffling, and there the initializations of spinlock and
mutex in snd_intelhad object were dropped mistakenly.

This patch adds the missing initializations again for each port.

Fixes: b4eb0d52 ("ALSA: x86: Split snd_intelhad into card and PCM specific structures")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The patch "ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE
operations" introduced a potential for kernel memory corruption due
to an incorrect if statement allowing non-readable controls to fall
through and call the get function. For TLV controls a driver can omit
SNDRV_CTL_ELEM_ACCESS_READ to ensure that only the TLV get function
can be called. Instead the normal get() can be invoked unexpectedly
and as the driver expects that this will only be called for controls
<= 512 bytes, potentially try to copy >512 bytes into the 512 byte
return array, so corrupting kernel memory.

The problem is an attempt to refactor the snd_ctl_elem_read function
to invert the logic so that it conditionally aborted if the control
is unreadable instead of conditionally executing. But the if statement
wasn't inverted correctly.

The correct inversion of

    if (a && !b)

is
    if (!a || b)

Fixes: becf9e5d ("ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE operations")
Signed-off-by: NRichard Fitzgerald <rf@opensource.cirrus.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The ARM PMU doesn't have a reg address, so fix the following DTC warning
(requires W=1):
Node /soc/arm-pmu missing or empty reg/ranges property
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>

This patch fixes the following DTC warning (requires W=1):
Node /soc/local_intc simple-bus unit address format error, expected "40000000"
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>

Jon attempted to fix the amount of RAM on the BCM958625HR in commit
c53beb47 ("ARM: dts: NSP: Correct RAM amount for BCM958625HR board")
but it seems like we tripped over some poorly documented schematics.

The top-level page of the schematics says the board has 2GB, but when
you end-up scrolling to page 6, you see two chips of 4GBit (512MB) but
what the bootloader really initializes only 512MB, any attempt to use
more than that results in data aborts. Fix this again back to 512MB.

Fixes: c53beb47 ("ARM: dts: NSP: Correct RAM amount for BCM958625HR board")
Acked-by: NJon Mason <jon.mason@broadcom.com>
Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>

Merge branch 'fixes-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull seccomp fix from James Morris:
 "This disables the seccomp samples when cross compiling.

  We've seen too many build issues here, so it's best to just disable
  it, especially since they're just the samples"

* 'fixes-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  samples/seccomp: do not compile when cross compiled

Merge tag 'seccomp-v4.16-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into fixes-v4.16-rc4

- do not build samples when cross compiling (Michal Hocko)

From Kees: "This disables the seccomp samples when cross compiling. We're seen too many build issues here, so
it's best to just disable it, especially since they're just the samples."

Merge branch 'fixes-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull tpm fixes from James Morris:
 "Bugfixes for TPM, from Jeremy Boone, via Jarkko Sakkinen"

* 'fixes-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  tpm: fix potential buffer overruns caused by bit glitches on the bus
  tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
  tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
  tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
  tpm_tis: fix potential buffer overruns caused by bit glitches on the bus

of_get_named_gpiod_flags() used directly in of_find_gpio() or indirectly
through of_find_spi_gpio() or of_find_regulator_gpio() can return
-EPROBE_DEFER. This gets overwritten by the subsequent of_find_*_gpio()
calls.

This patch fixes this by trying of_find_spi_gpio() or
of_find_regulator_gpio() only if deferred probing was not requested by
the previous of_get_named_gpiod_flags() call.

Fixes: 6a537d48 ("gpio: of: Support regulator nonstandard GPIO properties")
Fixes: c8582339 ("gpio: of: Support SPI nonstandard GPIO properties")
Signed-off-by: NChen-Yu Tsai <wens@csie.org>
[Augmented to fit with Maxime's patch]
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>

Commits c8582339 ("gpio: of: Support SPI nonstandard GPIO properties")
and 6a537d48 ("gpio: of: Support regulator nonstandard GPIO
properties") have introduced a regression in the way error codes from
of_get_named_gpiod_flags are handled.

Previously, those errors codes were returned immediately, but the two
commits mentioned above are now overwriting the error pointer, meaning that
whatever value has been returned will be dropped in favor of whatever the
two new functions will return.

This might not be a big deal except for EPROBE_DEFER, on which GPIOlib
customers will depend on, and that will now be returned as an hard error
which means that they will not probe anymore, instead of gently deferring
their probe.

Since EPROBE_DEFER basically means that we have found a valid property but
there was no GPIO controller registered to handle it, fix this issues by
returning it as soon as we encounter it.

Fixes: c8582339 ("gpio: of: Support SPI nonstandard GPIO properties")
Fixes: 6a537d48 ("gpio: of: Support regulator nonstandard GPIO properties")
Signed-off-by: NMaxime Ripard <maxime.ripard@bootlin.com>
[Fold in fix to the fix]
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  If a bit does
flip it could cause an overrun if it's in one of the size parameters,
so sanity check that we're not overrunning the provided buffer when
doing a memcpy().
Signed-off-by: NJeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJames Morris <james.morris@microsoft.com>

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: NJeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJames Morris <james.morris@microsoft.com>

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: NJeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJames Morris <james.morris@microsoft.com>

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: NJeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJames Morris <james.morris@microsoft.com>

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: NJeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Tested-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: NJames Morris <james.morris@microsoft.com>

Update .gitignore with new test.
Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>

Silence the following command being printed while running test.

./mem-on-off-test.sh -r 2 && echo "selftests: memory-hotplug [PASS]" ||
echo "selftests: memory-hotplug [FAIL]"
Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>

The Makefile lacks a couple of line continuation backslashes
in an `if' clause, which produces an error when make versions
prior to 4.x are used for building the tests.

  $ make
  make[1]: Entering directory `/[...]/linux/tools/testing/selftests/futex'
  /bin/sh: -c: line 5: syntax error: unexpected end of file
  make[1]: *** [all] Error 1
  make[1]: Leaving directory `/[...]/linux/tools/testing/selftests/futex'
  make: *** [all] Error 2
Signed-off-by: NDaniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>

Pull idr fixes from Matthew Wilcox:
 "One test-suite build fix for you and one run-time regression fix.

  The regression fix includes new tests to make sure they don't pop back
  up."

* 'idr-2018-02-06' of git://git.infradead.org/users/willy/linux-dax:
  idr: Fix handling of IDs above INT_MAX
  radix tree test suite: Fix build

This stops the driver from trying to probe the ATA slave
interface. The vendor code enables the slave interface
but the driver in the vendor tree does not make use of
it.

Setting it to muxmode 0 disables the slave interface:
the hardware only has the master interface connected
to the one harddrive slot anyways.

Without this change booting takes excessive time, so it
is very annoying to end users.

Fixes: dd5c0561 ("ARM: dts: Add basic devicetree for D-Link DNS-313")
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NArnd Bergmann <arnd@arndb.de>

The CONFIG_LIRC symbol has changed from 'tristate' to 'bool, so we now
get a warning for omap2plus_defconfig:

arch/arm/configs/omap2plus_defconfig:322:warning: symbol value 'm' invalid for LIRC

This changes the file to mark the symbol as built-in to get rid of the
warning.

Fixes: a60d64b1 ("media: lirc: lirc interface should not be a raw decoder")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>

Khalid reported that the kernel selftests are currently failing:

selftests: test_bpf.sh
========================================
test_bpf: [FAIL]
not ok 1..8 selftests:  test_bpf.sh [FAIL]

He bisected it to 6ce711f2 ("idr: Make
1-based IDRs more efficient").

The root cause is doing a signed comparison in idr_alloc_u32() instead
of an unsigned comparison.  I went looking for any similar problems and
found a couple (which would each result in the failure to warn in two
situations that aren't supposed to happen).

I knocked up a few test-cases to prove that I was right and added them
to the test-suite.
Reported-by: NKhalid Aziz <khalid.aziz@oracle.com>
Tested-by: NKhalid Aziz <khalid.aziz@oracle.com>
Signed-off-by: NMatthew Wilcox <mawilcox@microsoft.com>

Pull EDAC fix from Borislav Petkov:
 "sb_edac: Prevent memory corruption on KNL (from Anna Karbownik)"

* tag 'edac_fixes_for_4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
  EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL

When specifying string type mount option (e.g., logdev)
several times in a mount, current option parsing may
cause memory leak. Hence, call kfree for previous one
in this case.
Signed-off-by: NChengguang Xu <cgxu519@icloud.com>
Reviewed-by: NEric Sandeen <sandeen@redhat.com>
Reviewed-by: NDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: NDarrick J. Wong <darrick.wong@oracle.com>

Pull x86 fixes from Thomas Gleixner:
 "Yet another pile of melted spectrum related changes:

   - sanitize the array_index_nospec protection mechanism: Remove the
     overengineered array_index_nospec_mask_check() magic and allow
     const-qualified types as index to avoid temporary storage in a
     non-const local variable.

   - make the microcode loader more robust by properly propagating error
     codes. Provide information about new feature bits after micro code
     was updated so administrators can act upon.

   - optimizations of the entry ASM code which reduce code footprint and
     make the code simpler and faster.

   - fix the {pmd,pud}_{set,clear}_flags() implementations to work
     properly on paravirt kernels by removing the address translation
     operations.

   - revert the harmful vmexit_fill_RSB() optimization

   - use IBRS around firmware calls

   - teach objtool about retpolines and add annotations for indirect
     jumps and calls.

   - explicitly disable jumplabel patching in __init code and handle
     patching failures properly instead of silently ignoring them.

   - remove indirect paravirt calls for writing the speculation control
     MSR as these calls are obviously proving the same attack vector
     which is tried to be mitigated.

   - a few small fixes which address build issues with recent compiler
     and assembler versions"

* 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (38 commits)
  KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
  KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
  objtool, retpolines: Integrate objtool with retpoline support more closely
  x86/entry/64: Simplify ENCODE_FRAME_POINTER
  extable: Make init_kernel_text() global
  jump_label: Warn on failed jump_label patching attempt
  jump_label: Explicitly disable jump labels in __init code
  x86/entry/64: Open-code switch_to_thread_stack()
  x86/entry/64: Move ASM_CLAC to interrupt_entry()
  x86/entry/64: Remove 'interrupt' macro
  x86/entry/64: Move the switch_to_thread_stack() call to interrupt_entry()
  x86/entry/64: Move ENTER_IRQ_STACK from interrupt macro to interrupt_entry
  x86/entry/64: Move PUSH_AND_CLEAR_REGS from interrupt macro to helper function
  x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
  objtool: Add module specific retpoline rules
  objtool: Add retpoline validation
  objtool: Use existing global variables for options
  x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
  x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
  x86/paravirt, objtool: Annotate indirect calls
  ...

Pull KVM fixes from Paolo Bonzini:
 "s390:
   - optimization for the exitless interrupt support that was merged in 4.16-rc1
   - improve the branch prediction blocking for nested KVM
   - replace some jump tables with switch statements to improve expoline performance
   - fixes for multiple epoch facility

  ARM:
   - fix the interaction of userspace irqchip VMs with in-kernel irqchip VMs
   - make sure we can build 32-bit KVM/ARM with gcc-8.

  x86:
   - fixes for AMD SEV
   - fixes for Intel nested VMX, emulated UMIP and a dump_stack() on VM startup
   - fixes for async page fault migration
   - small optimization to PV TLB flush (new in 4.16-rc1)
   - syzkaller fixes

  Generic:
   - compiler warning fixes
   - syzkaller fixes
   - more improvements to the kvm_stat tool

  Two more small Spectre fixes are going to reach you via Ingo"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (40 commits)
  KVM: SVM: Fix SEV LAUNCH_SECRET command
  KVM: SVM: install RSM intercept
  KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command
  include: psp-sev: Capitalize invalid length enum
  crypto: ccp: Fix sparse, use plain integer as NULL pointer
  KVM: X86: Avoid traversing all the cpus for pv tlb flush when steal time is disabled
  x86/kvm: Make parse_no_xxx __init for kvm
  KVM: x86: fix backward migration with async_PF
  kvm: fix warning for non-x86 builds
  kvm: fix warning for CONFIG_HAVE_KVM_EVENTFD builds
  tools/kvm_stat: print 'Total' line for multiple events only
  tools/kvm_stat: group child events indented after parent
  tools/kvm_stat: separate drilldown and fields filtering
  tools/kvm_stat: eliminate extra guest/pid selection dialog
  tools/kvm_stat: mark private methods as such
  tools/kvm_stat: fix debugfs handling
  tools/kvm_stat: print error on invalid regex
  tools/kvm_stat: fix crash when filtering out all non-child trace events
  tools/kvm_stat: avoid 'is' for equality checks
  tools/kvm_stat: use a more pythonic way to iterate over dictionaries
  ...