4.13.12-300.fc27.gnu

28 files changed, 628 insertions, 27 deletions

diff --git a/freed-ora/current/f27/0001-usb-usbtest-fix-NULL-pointer-dereference.patch b/freed-ora/current/f27/0001-usb-usbtest-fix-NULL-pointer-dereference.patch
new file mode 100644
index 000000000..acc03ec7d
--- /dev/null
+++ b/freed-ora/current/f27/0001-usb-usbtest-fix-NULL-pointer-dereference.patch
@@ -0,0 +1,41 @@
+From 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 29 Sep 2017 10:54:24 -0400
+Subject: [PATCH] usb: usbtest: fix NULL pointer dereference
+
+If the usbtest driver encounters a device with an IN bulk endpoint but
+no OUT bulk endpoint, it will try to dereference a NULL pointer
+(out->desc.bEndpointAddress).  The problem can be solved by adding a
+missing test.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+---
+ drivers/usb/misc/usbtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 113e38bfe0ef..b3fc602b2e24 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
+ 			return tmp;
+ 	}
+
+-	if (in) {
++	if (in)
+ 		dev->in_pipe = usb_rcvbulkpipe(udev,
+ 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
++	if (out)
+ 		dev->out_pipe = usb_sndbulkpipe(udev,
+ 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+-	}
++
+ 	if (iso_in) {
+ 		dev->iso_in = &iso_in->desc;
+ 		dev->in_iso_pipe = usb_rcvisocpipe(udev,
+-- 
+2.13.6
+
diff --git a/freed-ora/current/f27/1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch b/freed-ora/current/f27/1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch
new file mode 100644
index 000000000..ca079af42
--- /dev/null
+++ b/freed-ora/current/f27/1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch
@@ -0,0 +1,296 @@
+From patchwork Mon Nov  6 12:31:12 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] kvm: vmx: Reinstate support for CPUs without virtual NMI
+From: Paolo Bonzini <pbonzini@redhat.com>
+X-Patchwork-Id: 10043403
+Message-Id: <1509971473-74491-2-git-send-email-pbonzini@redhat.com>
+To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
+Cc: rkrcmar@redhat.com, stable@vger.kernel.org
+Date: Mon,  6 Nov 2017 13:31:12 +0100
+
+This is more or less a revert of commit 2c82878b0cb3 ("KVM: VMX: require
+virtual NMI support", 2017-03-27); it turns out that Core 2 Duo machines
+only had virtual NMIs in some SKUs.
+
+The revert is not trivial because in the meanwhile there have been several
+fixes to nested NMI injection.  Therefore, the entire vNMI state is moved
+to struct loaded_vmcs.
+
+Another change compared to before the patch is a simplification here:
+
+       if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked &&
+           !(is_guest_mode(vcpu) && nested_cpu_has_virtual_nmis(
+                                       get_vmcs12(vcpu))))) {
+
+The final condition here is always true (because nested_cpu_has_virtual_nmis
+is always false) and is removed.
+
+Fixes: 2c82878b0cb38fd516fd612c67852a6bbf282003
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1490803
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ arch/x86/kvm/vmx.c | 150 +++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 106 insertions(+), 44 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e6c8ffa84968..d6b3b12ae1e2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -202,6 +202,10 @@ struct loaded_vmcs {
+ 	bool nmi_known_unmasked;
+ 	unsigned long vmcs_host_cr3;	/* May not match real cr3 */
+ 	unsigned long vmcs_host_cr4;	/* May not match real cr4 */
++	/* Support for vnmi-less CPUs */
++	int soft_vnmi_blocked;
++	ktime_t entry_time;
++	s64 vnmi_blocked_time;
+ 	struct list_head loaded_vmcss_on_cpu_link;
+ };
+ 
+@@ -1291,6 +1295,11 @@ static inline bool cpu_has_vmx_invpcid(void)
+ 		SECONDARY_EXEC_ENABLE_INVPCID;
+ }
+ 
++static inline bool cpu_has_virtual_nmis(void)
++{
++	return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
+ static inline bool cpu_has_vmx_wbinvd_exit(void)
+ {
+ 	return vmcs_config.cpu_based_2nd_exec_ctrl &
+@@ -1348,11 +1357,6 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+ 		(vmcs12->secondary_vm_exec_control & bit);
+ }
+ 
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+-	return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+ static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+ {
+ 	return vmcs12->pin_based_vm_exec_control &
+@@ -3712,9 +3716,9 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 				&_vmexit_control) < 0)
+ 		return -EIO;
+ 
+-	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING |
+-		PIN_BASED_VIRTUAL_NMIS;
+-	opt = PIN_BASED_POSTED_INTR | PIN_BASED_VMX_PREEMPTION_TIMER;
++	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++	opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++		 PIN_BASED_VMX_PREEMPTION_TIMER;
+ 	if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+ 				&_pin_based_exec_control) < 0)
+ 		return -EIO;
+@@ -5669,7 +5673,8 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ 
+ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ {
+-	if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++	if (!cpu_has_virtual_nmis() ||
++	    vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+ 		enable_irq_window(vcpu);
+ 		return;
+ 	}
+@@ -5709,6 +5714,19 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
++	if (!cpu_has_virtual_nmis()) {
++		/*
++		 * Tracking the NMI-blocked state in software is built upon
++		 * finding the next open IRQ window. This, in turn, depends on
++		 * well-behaving guests: They have to keep IRQs disabled at
++		 * least as long as the NMI handler runs. Otherwise we may
++		 * cause NMI nesting, maybe breaking the guest. But as this is
++		 * highly unlikely, we can live with the residual risk.
++		 */
++		vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++		vmx->loaded_vmcs->vnmi_blocked_time = 0;
++	}
++
+ 	++vcpu->stat.nmi_injections;
+ 	vmx->loaded_vmcs->nmi_known_unmasked = false;
+ 
+@@ -5727,6 +5745,8 @@ static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	bool masked;
+ 
++	if (!cpu_has_virtual_nmis())
++		return vmx->loaded_vmcs->soft_vnmi_blocked;
+ 	if (vmx->loaded_vmcs->nmi_known_unmasked)
+ 		return false;
+ 	masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+@@ -5738,13 +5758,20 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+-	vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+-	if (masked)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+-				GUEST_INTR_STATE_NMI);
++	if (!cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++			vmx->loaded_vmcs->vnmi_blocked_time = 0;
++		}
++	} else {
++		vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++		if (masked)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++					GUEST_INTR_STATE_NMI);
++	}
+ }
+ 
+ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+@@ -5752,6 +5779,10 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+ 	if (to_vmx(vcpu)->nested.nested_run_pending)
+ 		return 0;
+ 
++	if (!cpu_has_virtual_nmis() &&
++	    to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++		return 0;
++
+ 	return	!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ 		  (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+ 		   | GUEST_INTR_STATE_NMI));
+@@ -6479,6 +6510,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
+ 	 * AAK134, BY25.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+ 
+@@ -6965,7 +6997,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
+ 	}
+ 
+ 	/* Create a new VMCS */
+-	item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
++	item = kzalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
+ 	if (!item)
+ 		return NULL;
+ 	item->vmcs02.vmcs = alloc_vmcs();
+@@ -7982,6 +8014,7 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)
+ 	 * "blocked by NMI" bit has to be set before next VM entry.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ 				GUEST_INTR_STATE_NMI);
+@@ -8826,6 +8859,25 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ 		return 0;
+ 	}
+ 
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked)) {
++		if (vmx_interrupt_allowed(vcpu)) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		} else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++			   vcpu->arch.nmi_pending) {
++			/*
++			 * This CPU don't support us in finding the end of an
++			 * NMI-blocked window if the guest runs with IRQs
++			 * disabled. So we pull the trigger after 1 s of
++			 * futile waiting, but inform the user about this.
++			 */
++			printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++			       "state on VCPU %d after 1 s timeout\n",
++			       __func__, vcpu->vcpu_id);
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		}
++	}
++
+ 	if (exit_reason < kvm_vmx_max_exit_handlers
+ 	    && kvm_vmx_exit_handlers[exit_reason])
+ 		return kvm_vmx_exit_handlers[exit_reason](vcpu);
+@@ -9108,33 +9160,38 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+ 
+ 	idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ 
+-	if (vmx->loaded_vmcs->nmi_known_unmasked)
+-		return;
+-	/*
+-	 * Can't use vmx->exit_intr_info since we're not sure what
+-	 * the exit reason is.
+-	 */
+-	exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-	unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+-	vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+-	/*
+-	 * SDM 3: 27.7.1.2 (September 2008)
+-	 * Re-set bit "block by NMI" before VM entry if vmexit caused by
+-	 * a guest IRET fault.
+-	 * SDM 3: 23.2.2 (September 2008)
+-	 * Bit 12 is undefined in any of the following cases:
+-	 *  If the VM exit sets the valid bit in the IDT-vectoring
+-	 *   information field.
+-	 *  If the VM exit is due to a double fault.
+-	 */
+-	if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+-	    vector != DF_VECTOR && !idtv_info_valid)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmx->loaded_vmcs->nmi_known_unmasked =
+-			!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+-			  & GUEST_INTR_STATE_NMI);
++	if (cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->nmi_known_unmasked)
++			return;
++		/*
++		 * Can't use vmx->exit_intr_info since we're not sure what
++		 * the exit reason is.
++		 */
++		exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++		unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++		vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++		/*
++		 * SDM 3: 27.7.1.2 (September 2008)
++		 * Re-set bit "block by NMI" before VM entry if vmexit caused by
++		 * a guest IRET fault.
++		 * SDM 3: 23.2.2 (September 2008)
++		 * Bit 12 is undefined in any of the following cases:
++		 *  If the VM exit sets the valid bit in the IDT-vectoring
++		 *   information field.
++		 *  If the VM exit is due to a double fault.
++		 */
++		if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++		    vector != DF_VECTOR && !idtv_info_valid)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmx->loaded_vmcs->nmi_known_unmasked =
++				!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++				  & GUEST_INTR_STATE_NMI);
++	} else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->vnmi_blocked_time +=
++			ktime_to_ns(ktime_sub(ktime_get(),
++					      vmx->loaded_vmcs->entry_time));
+ }
+ 
+ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+@@ -9251,6 +9308,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	unsigned long debugctlmsr, cr3, cr4;
+ 
++	/* Record the guest's net vcpu time for enforced NMI injections. */
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->entry_time = ktime_get();
++
+ 	/* Don't enter VMX if guest state is invalid, let the exit handler
+ 	   start emulation until we arrive back to a valid state */
+ 	if (vmx->emulation_required)
diff --git a/freed-ora/current/f27/CVE-2017-16538.patch b/freed-ora/current/f27/CVE-2017-16538.patch
new file mode 100644
index 000000000..e9cf4b054
--- /dev/null
+++ b/freed-ora/current/f27/CVE-2017-16538.patch
@@ -0,0 +1,166 @@
+From patchwork Tue Sep 26 21:10:20 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm
+ start.
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44566
+Message-Id: <20170926211021.11036-1-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:20 +0100
+
+Warm start has no check as whether a genuine device has
+connected and proceeds to next execution path.
+
+Check device should read 0x47 at offset of 2 on USB descriptor read
+and it is the amount requested of 6 bytes.
+
+Fix for
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access as
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 5e320fa4a795..992f2011a6ba 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -494,18 +494,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
+ 
+ static int lme2510_return_status(struct dvb_usb_device *d)
+ {
+-	int ret = 0;
++	int ret;
+ 	u8 *data;
+ 
+-	data = kzalloc(10, GFP_KERNEL);
++	data = kzalloc(6, GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
+-	ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
+-			0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
+-	info("Firmware Status: %x (%x)", ret , data[2]);
++	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
++			      0x06, 0x80, 0x0302, 0x00,
++			      data, 0x6, 200);
++	if (ret != 6)
++		ret = -EINVAL;
++	else
++		ret = data[2];
++
++	info("Firmware Status: %6ph", data);
+ 
+-	ret = (ret < 0) ? -ENODEV : data[2];
+ 	kfree(data);
+ 	return ret;
+ }
+@@ -1189,6 +1194,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d)
+ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ {
+ 	struct lme2510_state *st = d->priv;
++	int status;
+ 
+ 	usb_reset_configuration(d->udev);
+ 
+@@ -1197,12 +1203,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
+ 
+ 	st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
+ 
+-	if (lme2510_return_status(d) == 0x44) {
++	status = lme2510_return_status(d);
++	if (status == 0x44) {
+ 		*name = lme_firmware_switch(d, 0);
+ 		return COLD;
+ 	}
+ 
+-	return 0;
++	if (status != 0x47)
++		return -EINVAL;
++
++	return WARM;
+ }
+ 
+ static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
+From patchwork Tue Sep 26 21:10:21 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to
+ dm04_lme2510_tuner
+From: Malcolm Priestley <tvboxspy@gmail.com>
+X-Patchwork-Id: 44567
+Message-Id: <20170926211021.11036-2-tvboxspy@gmail.com>
+To: linux-media@vger.kernel.org
+Cc: Andrey Konovalov <andreyknvl@google.com>,
+ Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 26 Sep 2017 22:10:21 +0100
+
+When the tuner was split from m88rs2000 the attach function is in wrong
+place.
+
+Move to dm04_lme2510_tuner to trap errors on failure and removing
+a call to lme_coldreset.
+
+Prevents driver starting up without any tuner connected.
+
+Fixes to trap for ts2020 fail.
+LME2510(C): FE Found M88RS2000
+ts2020: probe of 0-0060 failed with error -11
+...
+LME2510(C): TUN Found RS2000 tuner
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] PREEMPT SMP KASAN
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 992f2011a6ba..be26c029546b 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -1076,8 +1076,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap)
+ 
+ 		if (adap->fe[0]) {
+ 			info("FE Found M88RS2000");
+-			dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,
+-					&d->i2c_adap);
+ 			st->i2c_tuner_gate_w = 5;
+ 			st->i2c_tuner_gate_r = 5;
+ 			st->i2c_tuner_addr = 0x60;
+@@ -1143,17 +1141,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap)
+ 			ret = st->tuner_config;
+ 		break;
+ 	case TUNER_RS2000:
+-		ret = st->tuner_config;
++		if (dvb_attach(ts2020_attach, adap->fe[0],
++			       &ts2020_config, &d->i2c_adap))
++			ret = st->tuner_config;
+ 		break;
+ 	default:
+ 		break;
+ 	}
+ 
+-	if (ret)
++	if (ret) {
+ 		info("TUN Found %s tuner", tun_msg[ret]);
+-	else {
+-		info("TUN No tuner found --- resetting device");
+-		lme_coldreset(d);
++	} else {
++		info("TUN No tuner found");
+ 		return -ENODEV;
+ 	}
+ 
diff --git a/freed-ora/current/f27/baseconfig/CONFIG_LEDS_IS31FL32XX b/freed-ora/current/f27/baseconfig/CONFIG_LEDS_IS31FL32XX
index bc726f797..343dc4dd8 100644
--- a/freed-ora/current/f27/baseconfig/CONFIG_LEDS_IS31FL32XX
+++ b/freed-ora/current/f27/baseconfig/CONFIG_LEDS_IS31FL32XX
@@ -1 +1 @@
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
diff --git a/freed-ora/current/f27/kernel-aarch64-debug.config b/freed-ora/current/f27/kernel-aarch64-debug.config
index 8e8a13bd6..e49ebd4f3 100644
--- a/freed-ora/current/f27/kernel-aarch64-debug.config
+++ b/freed-ora/current/f27/kernel-aarch64-debug.config
@@ -2680,7 +2680,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-aarch64.config b/freed-ora/current/f27/kernel-aarch64.config
index d6e621cef..a3d0383aa 100644
--- a/freed-ora/current/f27/kernel-aarch64.config
+++ b/freed-ora/current/f27/kernel-aarch64.config
@@ -2661,7 +2661,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-armv7hl-debug.config b/freed-ora/current/f27/kernel-armv7hl-debug.config
index bf8fc1e67..210a9ac9f 100644
--- a/freed-ora/current/f27/kernel-armv7hl-debug.config
+++ b/freed-ora/current/f27/kernel-armv7hl-debug.config
@@ -2856,7 +2856,7 @@ CONFIG_LEDS_DAC124S085=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config b/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
index e4281887e..aff8aa225 100644
--- a/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
+++ b/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
@@ -2722,7 +2722,7 @@ CONFIG_LEDS_DAC124S085=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-armv7hl-lpae.config b/freed-ora/current/f27/kernel-armv7hl-lpae.config
index 3ef0b74e0..f7abb6ba8 100644
--- a/freed-ora/current/f27/kernel-armv7hl-lpae.config
+++ b/freed-ora/current/f27/kernel-armv7hl-lpae.config
@@ -2703,7 +2703,7 @@ CONFIG_LEDS_DAC124S085=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-armv7hl.config b/freed-ora/current/f27/kernel-armv7hl.config
index 79f3d5c0c..e1e2d2d9d 100644
--- a/freed-ora/current/f27/kernel-armv7hl.config
+++ b/freed-ora/current/f27/kernel-armv7hl.config
@@ -2837,7 +2837,7 @@ CONFIG_LEDS_DAC124S085=m
 CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_GPIO_REGISTER=y
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-i686-PAE.config b/freed-ora/current/f27/kernel-i686-PAE.config
index 53be68fae..ae8fdb707 100644
--- a/freed-ora/current/f27/kernel-i686-PAE.config
+++ b/freed-ora/current/f27/kernel-i686-PAE.config
@@ -2577,7 +2577,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-i686-PAEdebug.config b/freed-ora/current/f27/kernel-i686-PAEdebug.config
index c78c3de50..3182a7d64 100644
--- a/freed-ora/current/f27/kernel-i686-PAEdebug.config
+++ b/freed-ora/current/f27/kernel-i686-PAEdebug.config
@@ -2597,7 +2597,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-i686-debug.config b/freed-ora/current/f27/kernel-i686-debug.config
index 182cc43cc..b048a57a9 100644
--- a/freed-ora/current/f27/kernel-i686-debug.config
+++ b/freed-ora/current/f27/kernel-i686-debug.config
@@ -2597,7 +2597,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-i686.config b/freed-ora/current/f27/kernel-i686.config
index 75efea842..3235ce5e3 100644
--- a/freed-ora/current/f27/kernel-i686.config
+++ b/freed-ora/current/f27/kernel-i686.config
@@ -2577,7 +2577,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-ppc64-debug.config b/freed-ora/current/f27/kernel-ppc64-debug.config
index 6260aeb18..e558f496c 100644
--- a/freed-ora/current/f27/kernel-ppc64-debug.config
+++ b/freed-ora/current/f27/kernel-ppc64-debug.config
@@ -2448,7 +2448,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-ppc64.config b/freed-ora/current/f27/kernel-ppc64.config
index 7f093b40c..08395da34 100644
--- a/freed-ora/current/f27/kernel-ppc64.config
+++ b/freed-ora/current/f27/kernel-ppc64.config
@@ -2428,7 +2428,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-ppc64le-debug.config b/freed-ora/current/f27/kernel-ppc64le-debug.config
index c335135bb..7f9aa4759 100644
--- a/freed-ora/current/f27/kernel-ppc64le-debug.config
+++ b/freed-ora/current/f27/kernel-ppc64le-debug.config
@@ -2393,7 +2393,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-ppc64le.config b/freed-ora/current/f27/kernel-ppc64le.config
index faecfdd5a..0dd69d9cd 100644
--- a/freed-ora/current/f27/kernel-ppc64le.config
+++ b/freed-ora/current/f27/kernel-ppc64le.config
@@ -2373,7 +2373,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-s390x-debug.config b/freed-ora/current/f27/kernel-s390x-debug.config
index 70dc58dde..e9ca4b2b1 100644
--- a/freed-ora/current/f27/kernel-s390x-debug.config
+++ b/freed-ora/current/f27/kernel-s390x-debug.config
@@ -2334,7 +2334,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-s390x.config b/freed-ora/current/f27/kernel-s390x.config
index 65cb29663..6455734e9 100644
--- a/freed-ora/current/f27/kernel-s390x.config
+++ b/freed-ora/current/f27/kernel-s390x.config
@@ -2314,7 +2314,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_DAC124S085 is not set
 # CONFIG_LEDS_GPIO is not set
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-x86_64-debug.config b/freed-ora/current/f27/kernel-x86_64-debug.config
index b6440f056..24e8ccdbf 100644
--- a/freed-ora/current/f27/kernel-x86_64-debug.config
+++ b/freed-ora/current/f27/kernel-x86_64-debug.config
@@ -2647,7 +2647,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel-x86_64.config b/freed-ora/current/f27/kernel-x86_64.config
index 56e587454..e8e46588a 100644
--- a/freed-ora/current/f27/kernel-x86_64.config
+++ b/freed-ora/current/f27/kernel-x86_64.config
@@ -2627,7 +2627,7 @@ CONFIG_LEDS_CLEVO_MAIL=m
 # CONFIG_LEDS_GPIO is not set
 CONFIG_LEDS_INTEL_SS4200=m
 # CONFIG_LEDS_IS31FL319X is not set
-# CONFIG_LEDS_IS31FL32XX is not set
+CONFIG_LEDS_IS31FL32XX=m
 # CONFIG_LEDS_KTD2692 is not set
 CONFIG_LEDS_LM3530=m
 # CONFIG_LEDS_LM355x is not set
diff --git a/freed-ora/current/f27/kernel.spec b/freed-ora/current/f27/kernel.spec
index 21f8c0295..d932f7dcd 100644
--- a/freed-ora/current/f27/kernel.spec
+++ b/freed-ora/current/f27/kernel.spec
@@ -92,7 +92,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 11
+%define stable_update 12
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -756,6 +756,19 @@ Patch633: net-mlxsw-reg-Add-high-and-low-temperature-thresholds.patch
 # Included in 4.14, backport requested on kernel@
 Patch634: selinux-Generalize-support-for-NNP-nosuid-SELinux-do.patch
 
+# rhbz 1509461
+Patch635: v3-1-2-Input-synaptics-rmi4---RMI4-can-also-use-SMBUS-version-3.patch
+Patch636: v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch
+
+# rhbz 1490803
+Patch637: 1-2-kvm-vmx-Reinstate-support-for-CPUs-without-virtual-NMI.patch
+
+# CVE-2017-16532 rhbz 1510835 1510854
+Patch638: 0001-usb-usbtest-fix-NULL-pointer-dereference.patch
+
+# CVE-2017-16538 rhbz 1510826 1510854
+Patch639: CVE-2017-16538.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2406,6 +2419,20 @@ fi
 #
 #
 %changelog
+* Thu Nov  9 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.13.12-gnu.
+
+* Wed Nov 08 2017 Jeremy Cline <jeremy@jcline.org> - 4.13.12-300
+- Linux v4.13.12
+
+* Wed Nov 08 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix CVE-2017-16532 (rhbz 1510835 1510854)
+- Fix CVE-2017-16538 (rhbz 1510826 1510854)
+
+* Mon Nov 06 2017 Laura Abbott <labbott@redhat.com>
+- Patches for ThinkPad X1 Carbon Gen5 Touchpad (rhbz 1509461)
+- Fix for KVM regression on some machines (rhbz 1490803)
+
 * Thu Nov  2 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.13.11-gnu.
 
diff --git a/freed-ora/current/f27/patch-4.13-gnu-4.13.11-gnu.xz.sign b/freed-ora/current/f27/patch-4.13-gnu-4.13.11-gnu.xz.sign
deleted file mode 100644
index 34205af3f..000000000
--- a/freed-ora/current/f27/patch-4.13-gnu-4.13.11-gnu.xz.sign
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWfuokwAKCRC8t8+Hfn1H
-p6xLAKCeeI+jBuO5qRkM+UPnpuomm2Vn5wCfWeAVTZOSC8qv1spFcepfdu+3xkM=
-=KHsh
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f27/patch-4.13-gnu-4.13.12-gnu.xz.sign b/freed-ora/current/f27/patch-4.13-gnu-4.13.12-gnu.xz.sign
new file mode 100644
index 000000000..2008b822b
--- /dev/null
+++ b/freed-ora/current/f27/patch-4.13-gnu-4.13.12-gnu.xz.sign
@@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWgQjBwAKCRC8t8+Hfn1H
+p6TmAKCBmYjDjf4YVp3/1Kn0K1IPGJJDugCeOXjRbfCpvnvIK/Hdm/PxRcKEU+I=
+=+nhL
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f27/sources b/freed-ora/current/f27/sources
index 03c80ff47..6745e43f1 100644
--- a/freed-ora/current/f27/sources
+++ b/freed-ora/current/f27/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-libre-4.13-gnu.tar.xz) = 9ad6866c68f29f7e4f8b53d0b857f9b3c7f6abd0054460675c76f3100db34a77c2777d7f4191831008b532cb2ab6f686d8c4f457a4d005226c73f90937963518
 SHA512 (perf-man-4.13.tar.gz) = 9bcc2cd8e56ec583ed2d8e0b0c88e7a94035a1915e40b3177bb02d6c0f10ddd4df9b097b1f5af59efc624226b613e240ddba8ddc2156f3682f992d5455fc5c03
-SHA512 (patch-4.13-gnu-4.13.11-gnu.xz) = fccf85e95c1c78c68876190aef5ad047971fede93d2cee47abfdfe009e76a374e15a89cee6ac4a68ab4dd90a43c7ec977ec21064a96445e177b7bce62ef2f528
+SHA512 (patch-4.13-gnu-4.13.12-gnu.xz) = 4a2363e4ff6a3d3752f2b830357fa0d22dcd2830ca39d6546d8edf3fb0c84f7d54129866fce765f8a82e39622489b61fa850dd547e3414281b877b3e7334b089
diff --git a/freed-ora/current/f27/v3-1-2-Input-synaptics-rmi4---RMI4-can-also-use-SMBUS-version-3.patch b/freed-ora/current/f27/v3-1-2-Input-synaptics-rmi4---RMI4-can-also-use-SMBUS-version-3.patch
new file mode 100644
index 000000000..5a8825793
--- /dev/null
+++ b/freed-ora/current/f27/v3-1-2-Input-synaptics-rmi4---RMI4-can-also-use-SMBUS-version-3.patch
@@ -0,0 +1,42 @@
+From patchwork Sun Nov  5 17:09:50 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [v3,1/2] Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
+From: Yiannis Marangos <yiannis.marangos@gmail.com>
+X-Patchwork-Id: 10042385
+Message-Id: <20171105170951.20261-2-yiannis.marangos@gmail.com>
+To: linux-input@vger.kernel.org, dmitry.torokhov@gmail.com
+Cc: Yiannis Marangos <yiannis.marangos@gmail.com>
+Date: Sun,  5 Nov 2017 19:09:50 +0200
+
+Some synaptics devices such as LEN0073 use SMBUS version 3.
+
+Signed-off-by: Yiannis Marangos <yiannis.marangos@gmail.com>
+Acked-by: Benjamin Tissoires <benjamion.tissoires@redhat.com>
+---
+ drivers/input/rmi4/rmi_smbus.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
+index 225025a0940c..b6ccf39c6a7b 100644
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -312,7 +312,7 @@ static int rmi_smb_probe(struct i2c_client *client,
+ 	rmi_smb->xport.dev = &client->dev;
+ 	rmi_smb->xport.pdata = *pdata;
+ 	rmi_smb->xport.pdata.irq = client->irq;
+-	rmi_smb->xport.proto_name = "smb2";
++	rmi_smb->xport.proto_name = "smb";
+ 	rmi_smb->xport.ops = &rmi_smb_ops;
+ 
+ 	smbus_version = rmi_smb_get_version(rmi_smb);
+@@ -322,7 +322,7 @@ static int rmi_smb_probe(struct i2c_client *client,
+ 	rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
+ 		smbus_version);
+ 
+-	if (smbus_version != 2) {
++	if (smbus_version != 2 && smbus_version != 3) {
+ 		dev_err(&client->dev, "Unrecognized SMB version %d\n",
+ 				smbus_version);
+ 		return -ENODEV;
diff --git a/freed-ora/current/f27/v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch b/freed-ora/current/f27/v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch
new file mode 100644
index 000000000..a37b15ec7
--- /dev/null
+++ b/freed-ora/current/f27/v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch
@@ -0,0 +1,29 @@
+From patchwork Sun Nov  5 17:09:51 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [v3,2/2] Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
+From: Yiannis Marangos <yiannis.marangos@gmail.com>
+X-Patchwork-Id: 10042387
+Message-Id: <20171105170951.20261-3-yiannis.marangos@gmail.com>
+To: linux-input@vger.kernel.org, dmitry.torokhov@gmail.com
+Cc: Yiannis Marangos <yiannis.marangos@gmail.com>
+Date: Sun,  5 Nov 2017 19:09:51 +0200
+
+Signed-off-by: Yiannis Marangos <yiannis.marangos@gmail.com>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index ee5466a374bf..b3c683a84d3f 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -172,6 +172,7 @@ static const char * const smbus_pnp_ids[] = {
+ 	"LEN0048", /* X1 Carbon 3 */
+ 	"LEN0046", /* X250 */
+ 	"LEN004a", /* W541 */
++	"LEN0073", /* X1 Carbon 5 */
+ 	"LEN200f", /* T450s */
+ 	NULL
+ };