CHROMIUM: Merge 'v4.14.91' into chromeos-4.14

Merge of v4.14.91 into chromeos-4.14

Changelog:
----------------------------------------------------------------
Aaro Koskinen (1):
      MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310

Adamski, Krzysztof (Nokia - PL/Wroclaw) (1):
      i2c: axxia: properly handle master timeout

Alek Du (1):
      mmc: sdhci: fix the timeout check window for clock and reset

Alexey Khoroshilov (1):
      mac80211_hwsim: fix module init error paths for netlink

Anderson Luiz Alves (1):
      mv88e6060: disable hardware level MAC learning

Andrea Arcangeli (1):
      userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered

Bart Van Assche (1):
      ib_srpt: Fix a use-after-free in __srpt_close_all_ch()

Brian Norris (1):
      Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"

Cathy Avery (1):
      scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload

Cfir Cohen (1):
      KVM: Fix UAF in nested posted interrupt processing

Chad Austin (1):
      fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS

Chen-Yu Tsai (1):
      pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11

Chris Cole (1):
      ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling

Chris Wilson (1):
      drm/i915/execlists: Apply a full mb before execution for Braswell

Christophe Leroy (1):
      gpio: max7301: fix driver for use with CONFIG_VMAP_STACK

Colin Ian King (1):
      x86/mtrr: Don't copy uninitialized gentry fields back to userspace

Dan Carpenter (3):
      clk: mvebu: Off by one bugs in cp110_of_clk_get()
      clk: mmp: Off by one in mmp_clk_add()
      cifs: integer overflow in in SMB2_ioctl()

Daniel Mack (1):
      ASoC: sta32x: set ->component pointer in private struct

Daniel Wang (1):
      Merge remote-tracking branch 'cros/linux/v4.14.91' into merge/chromeos-4.14-v4.14.91

Dave Kleikamp (1):
      nfs: don't dirty kernel pages read by direct-io

David Miller (1):
      bpf: Fix verifier log string check for bad alignment.

Dexuan Cui (1):
      Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels

Eduardo Habkost (1):
      kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs

Emmanuel Grumbach (2):
      mac80211: don't WARN on bad WMM parameters from buggy APs
      iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares

Fred Herard (1):
      scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset

Greg Kroah-Hartman (2):
      Linux 4.14.90
      Linux 4.14.91

Gustavo A. R. Silva (1):
      drm/ioctl: Fix Spectre v1 vulnerabilities

Hans de Goede (2):
      i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
      gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers

Hui Peng (1):
      USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data

Ido Schimmel (1):
      mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl

Ihab Zhaika (1):
      iwlwifi: add new cards for 9560, 9462, 9461 and killer series

Ilan Peer (1):
      mac80211: Fix condition validating WMM IE

Ingo Molnar (1):
      timer/debug: Change /proc/timer_list from 0444 to 0400

Israel Rukshin (1):
      nvmet-rdma: fix response use after free

Ivan Delalande (1):
      proc/sysctl: don't return ENOMEM on lookup when a table is unregistering

Jeff Moyer (1):
      aio: fix spectre gadget in lookup_ioctx

Jens Axboe (3):
      elevator: lookup mq vs non-mq elevators
      block: break discard submissions into the user defined size
      scsi: sd: use mempool for discard special page

Jiri Olsa (1):
      perf record: Synthesize features before events in pipe mode

Jose Abreu (1):
      ARC: io.h: Implement reads{x}()/writes{x}()

Jozsef Kadlecsik (1):
      netfilter: ipset: Fix wraparound in hash:*net* types

Juha-Matti Tilli (1):
      libata: whitelist all SAMSUNG MZ7KM* solid-state disks

Junwei Zhang (1):
      drm/amdgpu: update SMC firmware image for polaris10 variants

Jörgen Storvist (4):
      USB: serial: option: add GosunCn ZTE WeLink ME3630
      USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
      USB: serial: option: add Fibocom NL668 series
      USB: serial: option: add Telit LN940 series

Lubomir Rintel (1):
      ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt

Lyude Paul (1):
      drm/nouveau/kms: Fix memory leak in nv50_mstm_del()

Masahiro Yamada (3):
      x86/build: Fix compiler support check for CONFIG_RETPOLINE
      i2c: uniphier: fix violation of tLOW requirement for Fast-mode
      i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode

Mathias Nyman (1):
      xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only

Michael J. Ruhl (1):
      IB/hfi1: Remove race conditions in user_sdma send path

Mike Snitzer (2):
      dm thin: send event about thin-pool state change _after_ making it
      dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty()

Mikulas Patocka (1):
      block: fix infinite loop if the device loses discard capability

Nicolas Saenz Julienne (2):
      ethernet: fman: fix wrong of_node_put() in probe function
      USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd

Nicolas Schichan (1):
      bpf, arm: fix emit_ldx_r and emit_mov_i using TMP_REG_1

Paul E. McKenney (1):
      locking: Remove smp_read_barrier_depends() from queued_spin_lock_slowpath()

Peter Zijlstra (2):
      locking/qspinlock: Re-order code
      locking/qspinlock, x86: Provide liveness guarantee

Radu Rendec (1):
      powerpc/msi: Fix NULL pointer access in teardown code

Richard Weinberger (2):
      ubifs: Fix directory size calculation for symlinks
      ubifs: Handle re-linking of inodes correctly while recovery

Robin Murphy (1):
      arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing

Roman Gushchin (1):
      mm: don't miss the last page because of round-off error

Russell King (1):
      mmc: omap_hsmmc: fix DMA API warning

Saeed Mahameed (1):
      net/mlx4_en: Fix build break when CONFIG_INET is off

Sam Bobroff (1):
      drm/ast: Fix connector leak during driver unload

Sean Paul (1):
      drm/msm: Grab a vblank reference when waiting for commit_done

Sergey Senozhatsky (1):
      panic: avoid deadlocks in re-entrant console drivers

Stefan Hajnoczi (1):
      vhost/vsock: fix reset orphans race with close timeout

Steve French (1):
      cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)

Steven Rostedt (VMware) (3):
      tracing: Fix memory leak in set_trigger_filter()
      tracing: Fix memory leak of instance function hash filters
      locking/qspinlock: Fix build for anonymous union in older GCC compilers

Teika Kazura (1):
      Input: synaptics - enable SMBus for HP 15-ay000

Thomas Gleixner (1):
      posix-timers: Fix division by zero bug

Toni Peltonen (1):
      bonding: fix 802.3ad state sent to partner when unbinding slave

Tony Lindgren (1):
      Input: omap-keypad - fix keyboard debounce configuration

Tore Anderson (1):
      USB: serial: option: add HP lt4132

Trent Piepho (1):
      rtc: snvs: Add timeouts to avoid kernel lockups

Trond Myklebust (1):
      SUNRPC: Fix a potential race in xprt_connect()

Ulf Hansson (3):
      mmc: core: Reset HPI enabled state during re-init and in case of errors
      mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support
      mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl

Uwe Kleine-König (2):
      spi: imx: add a device specific prepare_message callback
      spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook.

Vitaly Kuznetsov (1):
      Input: hyper-v - fix wakeup from suspend-to-idle

Vladimir Murzin (1):
      ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart

Wen Yang (1):
      drm/msm: Fix error return checking

Will Deacon (7):
      locking/qspinlock: Ensure node is initialised before updating prev->next
      locking/qspinlock: Bound spinning on pending->locked transition in slowpath
      locking/qspinlock: Merge 'struct __qspinlock' into 'struct qspinlock'
      locking/qspinlock: Remove unbounded cmpxchg() loop from locking slowpath
      locking/qspinlock: Remove duplicate clear_pending() function from PV code
      locking/qspinlock: Kill cmpxchg() loop when claiming lock from head of queue
      locking/qspinlock/x86: Increase _Q_PENDING_LOOPS upper bound

Yangtao Li (4):
      sbus: char: add of_node_put()
      drivers/sbus/char: add of_node_put()
      drivers/tty: add missing of_node_put()
      ide: pmac: add of_node_put()

YiFei Zhu (1):
      x86/earlyprintk/efi: Fix infinite loop on some screen widths

 Makefile                                           |   2 +-
 arch/arc/include/asm/io.h                          |  72 ++++++++
 arch/arm/mach-mmp/cputype.h                        |   6 +-
 arch/arm/mm/cache-v7.S                             |   8 +-
 arch/arm/mm/cache-v7m.S                            |  14 +-
 arch/arm/net/bpf_jit_32.c                          |   2 +-
 arch/arm64/mm/dma-mapping.c                        |   2 +-
 arch/powerpc/kernel/msi.c                          |   7 +-
 arch/x86/Makefile                                  |  10 +-
 arch/x86/include/asm/msr-index.h                   |   1 +
 arch/x86/include/asm/qspinlock.h                   |  25 ++-
 arch/x86/include/asm/qspinlock_paravirt.h          |   3 +-
 arch/x86/kernel/cpu/mtrr/if.c                      |   2 +
 arch/x86/kvm/vmx.c                                 |   2 +
 arch/x86/kvm/x86.c                                 |   2 +
 arch/x86/platform/efi/early_printk.c               |   2 +-
 block/blk-lib.c                                    |  22 ++-
 block/elevator.c                                   |  44 +++--
 drivers/ata/libata-core.c                          |   1 +
 drivers/clk/mmp/clk.c                              |   2 +-
 drivers/clk/mvebu/cp110-system-controller.c        |   4 +-
 drivers/gpio/gpio-max7301.c                        |  12 +-
 drivers/gpio/gpiolib-acpi.c                        | 144 ++++++++-------
 drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c            |   3 +-
 drivers/gpu/drm/ast/ast_fb.c                       |   1 +
 drivers/gpu/drm/drm_ioctl.c                        |  10 +-
 drivers/gpu/drm/i915/intel_lrc.c                   |   7 +-
 drivers/gpu/drm/msm/msm_atomic.c                   |   5 +
 drivers/gpu/drm/msm/msm_iommu.c                    |   2 +-
 drivers/gpu/drm/nouveau/nv50_display.c             |   1 +
 drivers/gpu/drm/rockchip/rockchip_drm_drv.c        |   6 -
 drivers/hid/hid-hyperv.c                           |   2 +-
 drivers/hv/vmbus_drv.c                             |  20 +++
 drivers/i2c/busses/i2c-axxia.c                     |  40 +++--
 drivers/i2c/busses/i2c-scmi.c                      |  10 +-
 drivers/i2c/busses/i2c-uniphier-f.c                |  19 +-
 drivers/i2c/busses/i2c-uniphier.c                  |   8 +-
 drivers/ide/pmac.c                                 |   1 +
 drivers/infiniband/hw/hfi1/user_sdma.c             |  24 ++-
 drivers/infiniband/hw/hfi1/user_sdma.h             |   9 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |   4 +-
 drivers/input/keyboard/omap4-keypad.c              |  18 +-
 drivers/input/mouse/synaptics.c                    |   1 +
 drivers/input/serio/hyperv-keyboard.c              |   2 +-
 drivers/md/dm-cache-metadata.c                     |   4 +
 drivers/md/dm-thin.c                               |  68 +++----
 drivers/mmc/core/mmc.c                             |  24 ++-
 drivers/mmc/host/omap.c                            |  11 +-
 drivers/mmc/host/omap_hsmmc.c                      |  12 +-
 drivers/mmc/host/sdhci.c                           |  18 +-
 drivers/net/bonding/bond_3ad.c                     |   3 +
 drivers/net/dsa/mv88e6060.c                        |  10 +-
 drivers/net/ethernet/freescale/fman/fman.c         |   5 +-
 drivers/net/ethernet/mellanox/mlx4/Kconfig         |   2 +-
 .../ethernet/mellanox/mlxsw/spectrum_switchdev.c   |  10 +-
 drivers/net/usb/hso.c                              |  18 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |   9 +
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |  50 ++++++
 drivers/net/wireless/mac80211_hwsim.c              |  12 +-
 drivers/nvme/target/rdma.c                         |   3 +-
 drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c         |   2 +-
 drivers/rtc/rtc-snvs.c                             | 105 +++++++----
 drivers/sbus/char/display7seg.c                    |   1 +
 drivers/sbus/char/envctrl.c                        |   2 +
 drivers/scsi/libiscsi.c                            |   4 +-
 drivers/scsi/sd.c                                  |  23 ++-
 drivers/scsi/vmw_pvscsi.c                          |   4 +-
 drivers/spi/spi-imx.c                              |  91 +++++++---
 drivers/tty/serial/suncore.c                       |   1 +
 drivers/usb/host/xhci-hub.c                        |   3 +-
 drivers/usb/host/xhci.h                            |   4 +-
 drivers/usb/serial/option.c                        |  16 +-
 drivers/vhost/vsock.c                              |  22 ++-
 fs/aio.c                                           |   2 +
 fs/cifs/Kconfig                                    |   2 +-
 fs/cifs/smb2pdu.c                                  |   4 +-
 fs/fuse/dir.c                                      |   2 +-
 fs/fuse/file.c                                     |  21 +--
 fs/fuse/fuse_i.h                                   |   2 +-
 fs/nfs/direct.c                                    |   9 +-
 fs/proc/proc_sysctl.c                              |  13 +-
 fs/ubifs/dir.c                                     |   5 +-
 fs/ubifs/replay.c                                  |  37 ++++
 fs/userfaultfd.c                                   |   3 +-
 include/asm-generic/qspinlock_types.h              |  32 +++-
 include/linux/math64.h                             |   3 +
 kernel/locking/qspinlock.c                         | 195 ++++++++++-----------
 kernel/locking/qspinlock_paravirt.h                |  42 ++---
 kernel/panic.c                                     |   6 +-
 kernel/time/posix-timers.c                         |   5 +-
 kernel/time/timer_list.c                           |   2 +-
 kernel/trace/ftrace.c                              |   1 +
 kernel/trace/trace_events_trigger.c                |   6 +-
 mm/vmscan.c                                        |   6 +-
 net/mac80211/mlme.c                                |   3 +-
 net/netfilter/ipset/ip_set_hash_ipportnet.c        |  26 +--
 net/netfilter/ipset/ip_set_hash_net.c              |   9 +-
 net/netfilter/ipset/ip_set_hash_netiface.c         |   9 +-
 net/netfilter/ipset/ip_set_hash_netnet.c           |  28 +--
 net/netfilter/ipset/ip_set_hash_netport.c          |  19 +-
 net/netfilter/ipset/ip_set_hash_netportnet.c       |  35 ++--
 net/sunrpc/xprt.c                                  |  11 +-
 sound/soc/codecs/sta32x.c                          |   3 +
 tools/perf/builtin-record.c                        |  18 +-
 tools/testing/selftests/bpf/test_verifier.c        |   2 +-
 105 files changed, 1119 insertions(+), 561 deletions(-)

BUG=b:113286496
TEST=Build and test on various affected systems

Change-Id: Iff4efe45fcc98ad9d96103ec708041644e3f21e8
Signed-off-by: Daniel Wang <wonderfly@google.com>