linux-selinux 4.17.11-1 update

7 files changed, 24 insertions, 559 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 0846159fe57e..aa03b0e932fb 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = linux-selinux
-	pkgver = 4.17.3
+	pkgver = 4.17.11
 	pkgrel = 1
 	url = https://www.kernel.org/
 	arch = x86_64
@@ -10,31 +10,21 @@ pkgbase = linux-selinux
 	makedepends = inetutils
 	makedepends = bc
 	makedepends = libelf
+	makedepends = git
 	options = !strip
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.17.tar.xz
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.17.tar.sign
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.17.3.xz
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.17.3.sign
+	source = archlinux-linux::git+https://github.com/archlinux/linux?signed#tag=v4.17.11-arch1
 	source = config
 	source = 60-linux.hook
 	source = 90-linux.hook
 	source = linux.preset
-	source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-	source = 0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch
-	source = 0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
-	sha256sums = 9faa1dd896eaea961dc6e886697c0b3301277102e5bc976b2758f9a62d3ccd13
+	validpgpkeys = 8218F88849AAC522E94CF470A5E9288C4FA415FA
 	sha256sums = SKIP
-	sha256sums = 01d5cc024dcfed615f84fd83be9c248261d8fc2c062520d38397cead6857b596
-	sha256sums = SKIP
-	sha256sums = 31173333cbf61fb5528ef730d79413f15149ef58ae1c5fe564f396f374f5259d
+	sha256sums = 89d8eab13081ff754f88460102556419026df61e2c4deae991dfc705f70971fa
 	sha256sums = ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21
 	sha256sums = 75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919
 	sha256sums = ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65
-	sha256sums = e3c08f9b91611186e5ec579187ecea2a0143e5c2dc7ffc30ac6ea6e2b6d130fd
-	sha256sums = 5403dead9161344b2c01027526146a250147680f4a2d32a54d40c55fc1becc8a
-	sha256sums = d55e7de60b12bca26ded4c1bb8eb5860a9092374914a201a0f6a0ed2849d099f
 
 pkgname = linux-selinux
 	pkgdesc = The Linux-selinux kernel and modules
diff --git a/.gitignore b/.gitignore
index d9e4c6eed265..77d5897a7ff7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
+/archlinux-linux/
 /config.last
 /linux.install.pkg
diff --git a/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
deleted file mode 100644
index ef2a8aa685c8..000000000000
--- a/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 9a5adbc45b1c7d43fe4b27936f2a6939660617a1 Mon Sep 17 00:00:00 2001
-Message-Id: <9a5adbc45b1c7d43fe4b27936f2a6939660617a1.1528777685.git.jan.steffens@gmail.com>
-From: Serge Hallyn <serge.hallyn@canonical.com>
-Date: Fri, 31 May 2013 19:12:12 +0100
-Subject: [PATCH 1/3] add sysctl to disallow unprivileged CLONE_NEWUSER by
- default
-
-Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
-[bwh: Remove unneeded binary sysctl bits]
-Signed-off-by: Daniel Micay <danielmicay@gmail.com>
----
- kernel/fork.c           | 15 +++++++++++++++
- kernel/sysctl.c         | 12 ++++++++++++
- kernel/user_namespace.c |  3 +++
- 3 files changed, 30 insertions(+)
-
-diff --git a/kernel/fork.c b/kernel/fork.c
-index a5d21c42acfc..675eb3f3a1d1 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -103,6 +103,11 @@
- 
- #define CREATE_TRACE_POINTS
- #include <trace/events/task.h>
-+#ifdef CONFIG_USER_NS
-+extern int unprivileged_userns_clone;
-+#else
-+#define unprivileged_userns_clone 0
-+#endif
- 
- /*
-  * Minimum number of threads to boot the kernel
-@@ -1592,6 +1597,10 @@ static __latent_entropy struct task_struct *copy_process(
- 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
- 		return ERR_PTR(-EINVAL);
- 
-+	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
-+		if (!capable(CAP_SYS_ADMIN))
-+			return ERR_PTR(-EPERM);
-+
- 	/*
- 	 * Thread groups must share signals as well, and detached threads
- 	 * can only be started up within the thread group.
-@@ -2386,6 +2395,12 @@ int ksys_unshare(unsigned long unshare_flags)
- 	if (unshare_flags & CLONE_NEWNS)
- 		unshare_flags |= CLONE_FS;
- 
-+	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
-+		err = -EPERM;
-+		if (!capable(CAP_SYS_ADMIN))
-+			goto bad_unshare_out;
-+	}
-+
- 	err = check_unshare_flags(unshare_flags);
- 	if (err)
- 		goto bad_unshare_out;
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index 6a78cf70761d..35a1d24282f4 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -105,6 +105,9 @@ extern int core_uses_pid;
- extern char core_pattern[];
- extern unsigned int core_pipe_limit;
- #endif
-+#ifdef CONFIG_USER_NS
-+extern int unprivileged_userns_clone;
-+#endif
- extern int pid_max;
- extern int pid_max_min, pid_max_max;
- extern int percpu_pagelist_fraction;
-@@ -519,6 +522,15 @@ static struct ctl_table kern_table[] = {
- 		.proc_handler	= proc_dointvec,
- 	},
- #endif
-+#ifdef CONFIG_USER_NS
-+	{
-+		.procname	= "unprivileged_userns_clone",
-+		.data		= &unprivileged_userns_clone,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0644,
-+		.proc_handler	= proc_dointvec,
-+	},
-+#endif
- #ifdef CONFIG_PROC_SYSCTL
- 	{
- 		.procname	= "tainted",
-diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
-index 246d4d4ce5c7..f64432b45cec 100644
---- a/kernel/user_namespace.c
-+++ b/kernel/user_namespace.c
-@@ -26,6 +26,9 @@
- #include <linux/bsearch.h>
- #include <linux/sort.h>
- 
-+/* sysctl */
-+int unprivileged_userns_clone;
-+
- static struct kmem_cache *user_ns_cachep __read_mostly;
- static DEFINE_MUTEX(userns_state_mutex);
- 
--- 
-2.17.1
-
diff --git a/0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch b/0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch
deleted file mode 100644
index 8d44c5532a8b..000000000000
--- a/0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From 6cc33158e691a70111672a6105c7a37e66e6d3c3 Mon Sep 17 00:00:00 2001
-Message-Id: <6cc33158e691a70111672a6105c7a37e66e6d3c3.1528777685.git.jan.steffens@gmail.com>
-In-Reply-To: <9a5adbc45b1c7d43fe4b27936f2a6939660617a1.1528777685.git.jan.steffens@gmail.com>
-References: <9a5adbc45b1c7d43fe4b27936f2a6939660617a1.1528777685.git.jan.steffens@gmail.com>
-From: Jani Nikula <jani.nikula@intel.com>
-Date: Wed, 16 May 2018 11:01:10 +0300
-Subject: [PATCH 2/3] Revert "drm/i915/edp: Allow alternate fixed mode for eDP
- if available."
-
-This reverts commit dc911f5bd8aacfcf8aabd5c26c88e04c837a938e.
-
-Per the report, no matter what display mode you select with xrandr, the
-i915 driver will always select the alternate fixed mode. For the
-reporter this means that the display will always run at 40Hz which is
-quite annoying. This may be due to the mode comparison.
-
-But there are some other potential issues. The choice of alt_fixed_mode
-seems dubious. It's the first non-preferred mode, but there are no
-guarantees that the only difference would be refresh rate. Similarly,
-there may be more than one preferred mode in the probed modes list, and
-the commit changes the preferred mode selection to choose the last one
-on the list instead of the first.
-
-(Note that the probed modes list is the raw, unfiltered, unsorted list
-of modes from drm_add_edid_modes(), not the pretty result after a
-drm_helper_probe_single_connector_modes() call.)
-
-Finally, we already have eerily similar code in place to find the
-downclock mode for DRRS that seems like could be reused here.
-
-Back to the drawing board.
-
-Note: This is a hand-crafted revert due to conflicts. If it fails to
-backport, please just try reverting the original commit directly.
-
-Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105469
-Reported-by: Rune Petersen <rune@megahurts.dk>
-Reported-by: Mark Spencer <n7u4722r35@ynzlx.anonbox.net>
-Fixes: dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for eDP if available.")
-Cc: Clint Taylor <clinton.a.taylor@intel.com>
-Cc: David Weinehall <david.weinehall@linux.intel.com>
-Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
-Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
-Cc: Jani Nikula <jani.nikula@intel.com>
-Cc: Chris Wilson <chris@chris-wilson.co.uk>
-Cc: Jim Bride <jim.bride@linux.intel.com>
-Cc: Jani Nikula <jani.nikula@linux.intel.com>
-Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
-Cc: intel-gfx@lists.freedesktop.org
-Cc: <stable@vger.kernel.org> # v4.14+
-Signed-off-by: Jani Nikula <jani.nikula@intel.com>
-Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20180516080110.22770-1-jani.nikula@intel.com
----
- drivers/gpu/drm/i915/intel_dp.c    | 38 ++++--------------------------
- drivers/gpu/drm/i915/intel_drv.h   |  2 --
- drivers/gpu/drm/i915/intel_dsi.c   |  2 +-
- drivers/gpu/drm/i915/intel_dvo.c   |  2 +-
- drivers/gpu/drm/i915/intel_lvds.c  |  3 +--
- drivers/gpu/drm/i915/intel_panel.c |  6 -----
- 6 files changed, 8 insertions(+), 45 deletions(-)
-
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index b7b4cfdeb974..48cb8df5ae97 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -1671,23 +1671,6 @@ static int intel_dp_compute_bpp(struct intel_dp *intel_dp,
- 	return bpp;
- }
- 
--static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1,
--				       struct drm_display_mode *m2)
--{
--	bool bres = false;
--
--	if (m1 && m2)
--		bres = (m1->hdisplay == m2->hdisplay &&
--			m1->hsync_start == m2->hsync_start &&
--			m1->hsync_end == m2->hsync_end &&
--			m1->htotal == m2->htotal &&
--			m1->vdisplay == m2->vdisplay &&
--			m1->vsync_start == m2->vsync_start &&
--			m1->vsync_end == m2->vsync_end &&
--			m1->vtotal == m2->vtotal);
--	return bres;
--}
--
- bool
- intel_dp_compute_config(struct intel_encoder *encoder,
- 			struct intel_crtc_state *pipe_config,
-@@ -1734,16 +1717,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
- 		pipe_config->has_audio = intel_conn_state->force_audio == HDMI_AUDIO_ON;
- 
- 	if (intel_dp_is_edp(intel_dp) && intel_connector->panel.fixed_mode) {
--		struct drm_display_mode *panel_mode =
--			intel_connector->panel.alt_fixed_mode;
--		struct drm_display_mode *req_mode = &pipe_config->base.mode;
--
--		if (!intel_edp_compare_alt_mode(req_mode, panel_mode))
--			panel_mode = intel_connector->panel.fixed_mode;
--
--		drm_mode_debug_printmodeline(panel_mode);
--
--		intel_fixed_panel_mode(panel_mode, adjusted_mode);
-+		intel_fixed_panel_mode(intel_connector->panel.fixed_mode,
-+				       adjusted_mode);
- 
- 		if (INTEL_GEN(dev_priv) >= 9) {
- 			int ret;
-@@ -6121,7 +6096,6 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
- 	struct drm_i915_private *dev_priv = to_i915(dev);
- 	struct drm_connector *connector = &intel_connector->base;
- 	struct drm_display_mode *fixed_mode = NULL;
--	struct drm_display_mode *alt_fixed_mode = NULL;
- 	struct drm_display_mode *downclock_mode = NULL;
- 	bool has_dpcd;
- 	struct drm_display_mode *scan;
-@@ -6176,14 +6150,13 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
- 	}
- 	intel_connector->edid = edid;
- 
--	/* prefer fixed mode from EDID if available, save an alt mode also */
-+	/* prefer fixed mode from EDID if available */
- 	list_for_each_entry(scan, &connector->probed_modes, head) {
- 		if ((scan->type & DRM_MODE_TYPE_PREFERRED)) {
- 			fixed_mode = drm_mode_duplicate(dev, scan);
- 			downclock_mode = intel_dp_drrs_init(
- 						intel_connector, fixed_mode);
--		} else if (!alt_fixed_mode) {
--			alt_fixed_mode = drm_mode_duplicate(dev, scan);
-+			break;
- 		}
- 	}
- 
-@@ -6220,8 +6193,7 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
- 			      pipe_name(pipe));
- 	}
- 
--	intel_panel_init(&intel_connector->panel, fixed_mode, alt_fixed_mode,
--			 downclock_mode);
-+	intel_panel_init(&intel_connector->panel, fixed_mode, downclock_mode);
- 	intel_connector->panel.backlight.power = intel_edp_backlight_power;
- 	intel_panel_setup_backlight(connector, pipe);
- 
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index a80fbad9be0f..7f3e83f17adb 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -269,7 +269,6 @@ struct intel_encoder {
- 
- struct intel_panel {
- 	struct drm_display_mode *fixed_mode;
--	struct drm_display_mode *alt_fixed_mode;
- 	struct drm_display_mode *downclock_mode;
- 
- 	/* backlight */
-@@ -1820,7 +1819,6 @@ void intel_overlay_reset(struct drm_i915_private *dev_priv);
- /* intel_panel.c */
- int intel_panel_init(struct intel_panel *panel,
- 		     struct drm_display_mode *fixed_mode,
--		     struct drm_display_mode *alt_fixed_mode,
- 		     struct drm_display_mode *downclock_mode);
- void intel_panel_fini(struct intel_panel *panel);
- void intel_fixed_panel_mode(const struct drm_display_mode *fixed_mode,
-diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
-index 51a1d6868b1e..cf39ca90d887 100644
---- a/drivers/gpu/drm/i915/intel_dsi.c
-+++ b/drivers/gpu/drm/i915/intel_dsi.c
-@@ -1846,7 +1846,7 @@ void intel_dsi_init(struct drm_i915_private *dev_priv)
- 	connector->display_info.width_mm = fixed_mode->width_mm;
- 	connector->display_info.height_mm = fixed_mode->height_mm;
- 
--	intel_panel_init(&intel_connector->panel, fixed_mode, NULL, NULL);
-+	intel_panel_init(&intel_connector->panel, fixed_mode, NULL);
- 	intel_panel_setup_backlight(connector, INVALID_PIPE);
- 
- 	intel_dsi_add_properties(intel_connector);
-diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
-index eb0c559b2715..a70d767313aa 100644
---- a/drivers/gpu/drm/i915/intel_dvo.c
-+++ b/drivers/gpu/drm/i915/intel_dvo.c
-@@ -536,7 +536,7 @@ void intel_dvo_init(struct drm_i915_private *dev_priv)
- 			 */
- 			intel_panel_init(&intel_connector->panel,
- 					 intel_dvo_get_current_mode(intel_encoder),
--					 NULL, NULL);
-+					 NULL);
- 			intel_dvo->panel_wants_dither = true;
- 		}
- 
-diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
-index e125d16a1aa7..d278f24ba6ae 100644
---- a/drivers/gpu/drm/i915/intel_lvds.c
-+++ b/drivers/gpu/drm/i915/intel_lvds.c
-@@ -1175,8 +1175,7 @@ void intel_lvds_init(struct drm_i915_private *dev_priv)
- out:
- 	mutex_unlock(&dev->mode_config.mutex);
- 
--	intel_panel_init(&intel_connector->panel, fixed_mode, NULL,
--			 downclock_mode);
-+	intel_panel_init(&intel_connector->panel, fixed_mode, downclock_mode);
- 	intel_panel_setup_backlight(connector, INVALID_PIPE);
- 
- 	lvds_encoder->is_dual_link = compute_is_dual_link_lvds(lvds_encoder);
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index 41d00b1603e3..b443278e569c 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -1928,30 +1928,24 @@ intel_panel_init_backlight_funcs(struct intel_panel *panel)
- 
- int intel_panel_init(struct intel_panel *panel,
- 		     struct drm_display_mode *fixed_mode,
--		     struct drm_display_mode *alt_fixed_mode,
- 		     struct drm_display_mode *downclock_mode)
- {
- 	intel_panel_init_backlight_funcs(panel);
- 
- 	panel->fixed_mode = fixed_mode;
--	panel->alt_fixed_mode = alt_fixed_mode;
- 	panel->downclock_mode = downclock_mode;
- 
- 	return 0;
- }
- 
- void intel_panel_fini(struct intel_panel *panel)
- {
- 	struct intel_connector *intel_connector =
- 		container_of(panel, struct intel_connector, panel);
- 
- 	if (panel->fixed_mode)
- 		drm_mode_destroy(intel_connector->base.dev, panel->fixed_mode);
- 
--	if (panel->alt_fixed_mode)
--		drm_mode_destroy(intel_connector->base.dev,
--				panel->alt_fixed_mode);
--
- 	if (panel->downclock_mode)
- 		drm_mode_destroy(intel_connector->base.dev,
- 				panel->downclock_mode);
--- 
-2.17.1
-
diff --git a/0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch b/0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch
deleted file mode 100644
index b4db2ad36a1e..000000000000
--- a/0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From 1e45a10dbea00f3a9ead21a9b3d25ad00021261d Mon Sep 17 00:00:00 2001
-Message-Id: <1e45a10dbea00f3a9ead21a9b3d25ad00021261d.1528777685.git.jan.steffens@gmail.com>
-In-Reply-To: <9a5adbc45b1c7d43fe4b27936f2a6939660617a1.1528777685.git.jan.steffens@gmail.com>
-References: <9a5adbc45b1c7d43fe4b27936f2a6939660617a1.1528777685.git.jan.steffens@gmail.com>
-From: Mika Westerberg <mika.westerberg@linux.intel.com>
-Date: Tue, 22 May 2018 14:16:50 +0300
-Subject: [PATCH 3/3] ACPI / watchdog: Prefer iTCO_wdt always when WDAT table
- uses RTC SRAM
-
-After we added quirk for Lenovo Z50-70 it turns out there are at least
-two more systems where WDAT table includes instructions accessing RTC
-SRAM. Instead of quirking each system separately, look for such
-instructions in the table and automatically prefer iTCO_wdt if found.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=199033
-Reported-by: Arnold Guy <aurnoldg@gmail.com>
-Reported-by: Alois Nespor <nespor@fssp.cz>
-Reported-by: Yury Pakin <zxwarior@gmail.com>
-Reported-by: Ihor Chyhin <ihorchyhin@ukr.net>
-Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
-Acked-by: Guenter Roeck <linux@roeck-us.net>
----
- drivers/acpi/acpi_watchdog.c | 72 ++++++++++++++++++++++--------------
- 1 file changed, 45 insertions(+), 27 deletions(-)
-
-diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
-index 4bde16fb97d8..95600309ce42 100644
---- a/drivers/acpi/acpi_watchdog.c
-+++ b/drivers/acpi/acpi_watchdog.c
-@@ -12,54 +12,72 @@
- #define pr_fmt(fmt) "ACPI: watchdog: " fmt
- 
- #include <linux/acpi.h>
--#include <linux/dmi.h>
- #include <linux/ioport.h>
- #include <linux/platform_device.h>
- 
- #include "internal.h"
- 
--static const struct dmi_system_id acpi_watchdog_skip[] = {
--	{
--		/*
--		 * On Lenovo Z50-70 there are two issues with the WDAT
--		 * table. First some of the instructions use RTC SRAM
--		 * to store persistent information. This does not work well
--		 * with Linux RTC driver. Second, more important thing is
--		 * that the instructions do not actually reset the system.
--		 *
--		 * On this particular system iTCO_wdt seems to work just
--		 * fine so we prefer that over WDAT for now.
--		 *
--		 * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
--		 */
--		.ident = "Lenovo Z50-70",
--		.matches = {
--			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--			DMI_MATCH(DMI_PRODUCT_NAME, "20354"),
--			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"),
--		},
--	},
--	{}
--};
-+#ifdef CONFIG_RTC_MC146818_LIB
-+#include <linux/mc146818rtc.h>
-+
-+/*
-+ * There are several systems where the WDAT table is accessing RTC SRAM to
-+ * store persistent information. This does not work well with the Linux RTC
-+ * driver so on those systems we skip WDAT driver and prefer iTCO_wdt
-+ * instead.
-+ *
-+ * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
-+ */
-+static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat)
-+{
-+	const struct acpi_wdat_entry *entries;
-+	int i;
-+
-+	entries = (struct acpi_wdat_entry *)(wdat + 1);
-+	for (i = 0; i < wdat->entries; i++) {
-+		const struct acpi_generic_address *gas;
-+
-+		gas = &entries[i].register_region;
-+		if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
-+			switch (gas->address) {
-+			case RTC_PORT(0):
-+			case RTC_PORT(1):
-+			case RTC_PORT(2):
-+			case RTC_PORT(3):
-+				return true;
-+			}
-+		}
-+	}
-+
-+	return false;
-+}
-+#else
-+static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat)
-+{
-+	return false;
-+}
-+#endif
- 
- static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
- {
- 	const struct acpi_table_wdat *wdat = NULL;
- 	acpi_status status;
- 
- 	if (acpi_disabled)
- 		return NULL;
- 
--	if (dmi_check_system(acpi_watchdog_skip))
--		return NULL;
--
- 	status = acpi_get_table(ACPI_SIG_WDAT, 0,
- 				(struct acpi_table_header **)&wdat);
- 	if (ACPI_FAILURE(status)) {
- 		/* It is fine if there is no WDAT */
- 		return NULL;
- 	}
- 
-+	if (acpi_watchdog_uses_rtc(wdat)) {
-+		pr_info("Skipping WDAT on this system because it uses RTC SRAM\n");
-+		return NULL;
-+	}
-+
- 	return wdat;
- }
- 
--- 
-2.17.1
-
diff --git a/PKGBUILD b/PKGBUILD
index 4ffcdaf5a503..c169a1b44a3f 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,4 +1,5 @@
 # $Id$
+# Maintainer: Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
 # Maintainer: Tobias Powalowski <tpowa@archlinux.org>
 # Maintainer: Thomas Baechler <thomas@archlinux.org>
 # SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
@@ -7,89 +8,41 @@
 # If you want to help keep it up to date, please open a Pull Request there.
 
 pkgbase=linux-selinux
-_srcname=linux-4.17
-pkgver=4.17.3
+pkgver=4.17.11
 pkgrel=1
 arch=('x86_64')
 url="https://www.kernel.org/"
 license=('GPL2')
-makedepends=('xmlto' 'kmod' 'inetutils' 'bc' 'libelf')
+makedepends=('xmlto' 'kmod' 'inetutils' 'bc' 'libelf' 'git')
 options=('!strip')
+_srcname=archlinux-linux
 groups=(selinux)
 source=(
-  https://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.{xz,sign}
-  https://www.kernel.org/pub/linux/kernel/v4.x/patch-${pkgver}.{xz,sign}
+  "$_srcname::git+https://github.com/archlinux/linux?signed#tag=v$pkgver-arch${pkgrel%%.*}"
   config         # the main kernel config file
   60-linux.hook  # pacman hook for depmod
   90-linux.hook  # pacman hook for initramfs regeneration
   linux.preset   # standard config files for mkinitcpio ramdisk
-  0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-  0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch
-  0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch
 )
 validpgpkeys=(
   'ABAF11C65A2970B130ABE3C479BE3E4300411886'  # Linus Torvalds
   '647F28654894E3BD457199BE38DBBDC86092693E'  # Greg Kroah-Hartman
+  '8218F88849AAC522E94CF470A5E9288C4FA415FA'  # Jan Alexander Steffens (heftig)
 )
-sha256sums=('9faa1dd896eaea961dc6e886697c0b3301277102e5bc976b2758f9a62d3ccd13'
-            'SKIP'
-            '01d5cc024dcfed615f84fd83be9c248261d8fc2c062520d38397cead6857b596'
-            'SKIP'
-            '31173333cbf61fb5528ef730d79413f15149ef58ae1c5fe564f396f374f5259d'
+sha256sums=('SKIP'
+            '89d8eab13081ff754f88460102556419026df61e2c4deae991dfc705f70971fa'
             'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21'
             '75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919'
-            'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65'
-            'e3c08f9b91611186e5ec579187ecea2a0143e5c2dc7ffc30ac6ea6e2b6d130fd'
-            '5403dead9161344b2c01027526146a250147680f4a2d32a54d40c55fc1becc8a'
-            'd55e7de60b12bca26ded4c1bb8eb5860a9092374914a201a0f6a0ed2849d099f')
+            'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65')
 
 _kernelname=${pkgbase#linux}
-: ${_kernelname:=-ARCH}
+: ${_kernelname:=-arch}
 
 prepare() {
   cd ${_srcname}
-
-  # add upstream patch
-  patch -p1 -i ../patch-${pkgver}
-
-  # add latest fixes from stable queue, if needed
-  # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
-
-  # disable USER_NS for non-root users by default
-  patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-
-  # https://bugs.archlinux.org/task/56711
-  patch -Np1 -i ../0002-Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-e.patch
-
-  # https://bugs.archlinux.org/task/56780
-  patch -Np1 -i ../0003-ACPI-watchdog-Prefer-iTCO_wdt-always-when-WDAT-table.patch
-
-  cat ../config - >.config <<END
-CONFIG_LOCALVERSION="${_kernelname}"
-CONFIG_LOCALVERSION_AUTO=n
-END
-
-  # set extraversion to pkgrel and empty localversion
-  sed -e "/^EXTRAVERSION =/s/=.*/= -${pkgrel}/" \
-      -e "/^EXTRAVERSION =/aLOCALVERSION =" \
-      -i Makefile
-
-  # don't run depmod on 'make install'. We'll do this ourselves in packaging
-  sed -i '2iexit 0' scripts/depmod.sh
-
-  # get kernel version
-  make prepare
-
-  # load configuration
-  # Configure the kernel. Replace the line below with one of your choice.
-  #make menuconfig # CLI menu for configuration
-  #make nconfig # new CLI menu for configuration
-  #make xconfig # X-based configuration
-  #make oldconfig # using old config from previous kernel version
-  # ... or manually edit .config
-
-  # rewrite configuration
-  yes "" | make config >/dev/null
+  scripts/setlocalversion --save-scmversion
+  cp ../config .config
+  make olddefconfig
 
   # save configuration for later reuse
   cat .config > "${startdir}/config.last"
@@ -97,7 +50,6 @@ END
 
 build() {
   cd ${_srcname}
-
   make bzImage modules
 }
 
@@ -118,7 +70,7 @@ _package() {
   _basekernel=${_basekernel%.*}
 
   mkdir -p "${pkgdir}"/{boot,usr/lib/modules}
-  make INSTALL_MOD_PATH="${pkgdir}/usr" modules_install
+  make INSTALL_MOD_PATH="${pkgdir}/usr" DEPMOD=/doesnt/exist modules_install
   cp arch/x86/boot/bzImage "${pkgdir}/boot/vmlinuz-${pkgbase}"
 
   # make room for external modules
diff --git a/config b/config
index cd3ebffc5e04..936a212ba7f2 100644
--- a/config
+++ b/config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.17.0-1 Kernel Configuration
+# Linux/x86 4.17.11-arch1 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -6296,7 +6296,7 @@ CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH=m
 CONFIG_SND_SOC_INTEL_CHT_BSW_NAU8824_MACH=m
 CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH=m
 CONFIG_SND_SOC_INTEL_BYT_CHT_ES8316_MACH=m
-CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH=m
+# CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH is not set
 CONFIG_SND_SOC_INTEL_SKL_RT286_MACH=m
 CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH=m
 CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH=m
@@ -6819,7 +6819,7 @@ CONFIG_USB_SERIAL_WISHBONE=m
 CONFIG_USB_SERIAL_SSU100=m
 CONFIG_USB_SERIAL_QT2=m
 CONFIG_USB_SERIAL_UPD78F0730=m
-# CONFIG_USB_SERIAL_DEBUG is not set
+CONFIG_USB_SERIAL_DEBUG=m
 
 #
 # USB Miscellaneous drivers
@@ -7387,7 +7387,6 @@ CONFIG_SYNC_FILE=y
 # CONFIG_SW_SYNC is not set
 CONFIG_DCA=m
 CONFIG_AUXDISPLAY=y
-CONFIG_CHARLCD=m
 CONFIG_HD44780=m
 CONFIG_KS0108=m
 CONFIG_KS0108_PORT=0x378
@@ -7400,6 +7399,7 @@ CONFIG_PANEL=m
 CONFIG_PANEL_PARPORT=0
 CONFIG_PANEL_PROFILE=5
 # CONFIG_PANEL_CHANGE_MESSAGE is not set
+CONFIG_CHARLCD=m
 CONFIG_UIO=m
 CONFIG_UIO_CIF=m
 CONFIG_UIO_PDRV_GENIRQ=m
@@ -9346,7 +9346,6 @@ CONFIG_CRYPTO_DES3_EDE_X86_64=m
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_KHAZAD=m
 CONFIG_CRYPTO_SALSA20=m
-CONFIG_CRYPTO_SALSA20_X86_64=m
 CONFIG_CRYPTO_CHACHA20=m
 CONFIG_CRYPTO_CHACHA20_X86_64=m
 CONFIG_CRYPTO_SEED=m