Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.14/0100-4.14.1-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-4.14/0100-4.14.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3027 - (hide annotations) (download)
    Tue Nov 28 13:16:13 2017 UTC (6 years, 5 months ago) by niro
    File size: 46365 byte(s) 
    -linux-4.14.1
    1 niro 3027 diff --git a/Makefile b/Makefile
    2     index ccd981892ef2..01f9df1af256 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,9 +1,9 @@
    6     # SPDX-License-Identifier: GPL-2.0
    7     VERSION = 4
    8     PATCHLEVEL = 14
    9     -SUBLEVEL = 0
    10     +SUBLEVEL = 1
    11     EXTRAVERSION =
    12     -NAME = Fearless Coyote
    13     +NAME = Petit Gorille
    14    
    15     # *DOCUMENTATION*
    16     # To see a list of typical targets execute "make help"
    17     diff --git a/arch/sparc/include/asm/cmpxchg_32.h b/arch/sparc/include/asm/cmpxchg_32.h
    18     index 3e3823db303e..c73b5a3ab7b9 100644
    19     --- a/arch/sparc/include/asm/cmpxchg_32.h
    20     +++ b/arch/sparc/include/asm/cmpxchg_32.h
    21     @@ -63,6 +63,9 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
    22     (unsigned long)_n_, sizeof(*(ptr))); \
    23     })
    24    
    25     +u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new);
    26     +#define cmpxchg64(ptr, old, new) __cmpxchg_u64(ptr, old, new)
    27     +
    28     #include <asm-generic/cmpxchg-local.h>
    29    
    30     /*
    31     diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
    32     index e25d25b0a34b..b361702ef52a 100644
    33     --- a/arch/sparc/include/asm/mmu_context_64.h
    34     +++ b/arch/sparc/include/asm/mmu_context_64.h
    35     @@ -8,9 +8,11 @@
    36    
    37     #include <linux/spinlock.h>
    38     #include <linux/mm_types.h>
    39     +#include <linux/smp.h>
    40    
    41     #include <asm/spitfire.h>
    42     #include <asm-generic/mm_hooks.h>
    43     +#include <asm/percpu.h>
    44    
    45     static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
    46     {
    47     diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
    48     index 25b6abdb3908..522a677e050d 100644
    49     --- a/arch/sparc/include/asm/tsb.h
    50     +++ b/arch/sparc/include/asm/tsb.h
    51     @@ -217,7 +217,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    52     sllx REG2, 32, REG2; \
    53     andcc REG1, REG2, %g0; \
    54     be,pt %xcc, 700f; \
    55     - sethi %hi(0x1ffc0000), REG2; \
    56     + sethi %hi(0xffe00000), REG2; \
    57     sllx REG2, 1, REG2; \
    58     brgez,pn REG1, FAIL_LABEL; \
    59     andn REG1, REG2, REG1; \
    60     diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
    61     index 5010df497387..465a901a0ada 100644
    62     --- a/arch/sparc/lib/atomic32.c
    63     +++ b/arch/sparc/lib/atomic32.c
    64     @@ -173,6 +173,20 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
    65     }
    66     EXPORT_SYMBOL(__cmpxchg_u32);
    67    
    68     +u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new)
    69     +{
    70     + unsigned long flags;
    71     + u64 prev;
    72     +
    73     + spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
    74     + if ((prev = *ptr) == old)
    75     + *ptr = new;
    76     + spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
    77     +
    78     + return prev;
    79     +}
    80     +EXPORT_SYMBOL(__cmpxchg_u64);
    81     +
    82     unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
    83     {
    84     unsigned long flags;
    85     diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
    86     index 87cc9ab7a13c..4b8187639c2d 100644
    87     --- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
    88     +++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
    89     @@ -245,6 +245,9 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
    90    
    91     if (m->status & MCI_STATUS_UC) {
    92    
    93     + if (ctx == IN_KERNEL)
    94     + return MCE_PANIC_SEVERITY;
    95     +
    96     /*
    97     * On older systems where overflow_recov flag is not present, we
    98     * should simply panic if an error overflow occurs. If
    99     @@ -255,10 +258,6 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
    100     if (mce_flags.smca)
    101     return mce_severity_amd_smca(m, ctx);
    102    
    103     - /* software can try to contain */
    104     - if (!(m->mcgstatus & MCG_STATUS_RIPV) && (ctx == IN_KERNEL))
    105     - return MCE_PANIC_SEVERITY;
    106     -
    107     /* kill current process */
    108     return MCE_AR_SEVERITY;
    109     } else {
    110     diff --git a/crypto/dh.c b/crypto/dh.c
    111     index b1032a5c1bfa..aadaf36fb56f 100644
    112     --- a/crypto/dh.c
    113     +++ b/crypto/dh.c
    114     @@ -21,19 +21,12 @@ struct dh_ctx {
    115     MPI xa;
    116     };
    117    
    118     -static inline void dh_clear_params(struct dh_ctx *ctx)
    119     +static void dh_clear_ctx(struct dh_ctx *ctx)
    120     {
    121     mpi_free(ctx->p);
    122     mpi_free(ctx->g);
    123     - ctx->p = NULL;
    124     - ctx->g = NULL;
    125     -}
    126     -
    127     -static void dh_free_ctx(struct dh_ctx *ctx)
    128     -{
    129     - dh_clear_params(ctx);
    130     mpi_free(ctx->xa);
    131     - ctx->xa = NULL;
    132     + memset(ctx, 0, sizeof(*ctx));
    133     }
    134    
    135     /*
    136     @@ -71,10 +64,8 @@ static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
    137     return -EINVAL;
    138    
    139     ctx->g = mpi_read_raw_data(params->g, params->g_size);
    140     - if (!ctx->g) {
    141     - mpi_free(ctx->p);
    142     + if (!ctx->g)
    143     return -EINVAL;
    144     - }
    145    
    146     return 0;
    147     }
    148     @@ -86,21 +77,23 @@ static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
    149     struct dh params;
    150    
    151     /* Free the old MPI key if any */
    152     - dh_free_ctx(ctx);
    153     + dh_clear_ctx(ctx);
    154    
    155     if (crypto_dh_decode_key(buf, len, &params) < 0)
    156     - return -EINVAL;
    157     + goto err_clear_ctx;
    158    
    159     if (dh_set_params(ctx, &params) < 0)
    160     - return -EINVAL;
    161     + goto err_clear_ctx;
    162    
    163     ctx->xa = mpi_read_raw_data(params.key, params.key_size);
    164     - if (!ctx->xa) {
    165     - dh_clear_params(ctx);
    166     - return -EINVAL;
    167     - }
    168     + if (!ctx->xa)
    169     + goto err_clear_ctx;
    170    
    171     return 0;
    172     +
    173     +err_clear_ctx:
    174     + dh_clear_ctx(ctx);
    175     + return -EINVAL;
    176     }
    177    
    178     static int dh_compute_value(struct kpp_request *req)
    179     @@ -158,7 +151,7 @@ static void dh_exit_tfm(struct crypto_kpp *tfm)
    180     {
    181     struct dh_ctx *ctx = dh_get_ctx(tfm);
    182    
    183     - dh_free_ctx(ctx);
    184     + dh_clear_ctx(ctx);
    185     }
    186    
    187     static struct kpp_alg dh = {
    188     diff --git a/crypto/dh_helper.c b/crypto/dh_helper.c
    189     index 8ba8a3f82620..7f00c771fe8d 100644
    190     --- a/crypto/dh_helper.c
    191     +++ b/crypto/dh_helper.c
    192     @@ -83,6 +83,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
    193     if (secret.len != crypto_dh_key_len(params))
    194     return -EINVAL;
    195    
    196     + /*
    197     + * Don't permit the buffer for 'key' or 'g' to be larger than 'p', since
    198     + * some drivers assume otherwise.
    199     + */
    200     + if (params->key_size > params->p_size ||
    201     + params->g_size > params->p_size)
    202     + return -EINVAL;
    203     +
    204     /* Don't allocate memory. Set pointers to data within
    205     * the given buffer
    206     */
    207     @@ -90,6 +98,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
    208     params->p = (void *)(ptr + params->key_size);
    209     params->g = (void *)(ptr + params->key_size + params->p_size);
    210    
    211     + /*
    212     + * Don't permit 'p' to be 0. It's not a prime number, and it's subject
    213     + * to corner cases such as 'mod 0' being undefined or
    214     + * crypto_kpp_maxsize() returning 0.
    215     + */
    216     + if (memchr_inv(params->p, 0, params->p_size) == NULL)
    217     + return -EINVAL;
    218     +
    219     return 0;
    220     }
    221     EXPORT_SYMBOL_GPL(crypto_dh_decode_key);
    222     diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
    223     index 8685c7e4debd..ee52c355bee0 100644
    224     --- a/drivers/crypto/bcm/cipher.c
    225     +++ b/drivers/crypto/bcm/cipher.c
    226     @@ -256,6 +256,44 @@ spu_ablkcipher_tx_sg_create(struct brcm_message *mssg,
    227     return 0;
    228     }
    229    
    230     +static int mailbox_send_message(struct brcm_message *mssg, u32 flags,
    231     + u8 chan_idx)
    232     +{
    233     + int err;
    234     + int retry_cnt = 0;
    235     + struct device *dev = &(iproc_priv.pdev->dev);
    236     +
    237     + err = mbox_send_message(iproc_priv.mbox[chan_idx], mssg);
    238     + if (flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    239     + while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    240     + /*
    241     + * Mailbox queue is full. Since MAY_SLEEP is set, assume
    242     + * not in atomic context and we can wait and try again.
    243     + */
    244     + retry_cnt++;
    245     + usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    246     + err = mbox_send_message(iproc_priv.mbox[chan_idx],
    247     + mssg);
    248     + atomic_inc(&iproc_priv.mb_no_spc);
    249     + }
    250     + }
    251     + if (err < 0) {
    252     + atomic_inc(&iproc_priv.mb_send_fail);
    253     + return err;
    254     + }
    255     +
    256     + /* Check error returned by mailbox controller */
    257     + err = mssg->error;
    258     + if (unlikely(err < 0)) {
    259     + dev_err(dev, "message error %d", err);
    260     + /* Signal txdone for mailbox channel */
    261     + }
    262     +
    263     + /* Signal txdone for mailbox channel */
    264     + mbox_client_txdone(iproc_priv.mbox[chan_idx], err);
    265     + return err;
    266     +}
    267     +
    268     /**
    269     * handle_ablkcipher_req() - Submit as much of a block cipher request as fits in
    270     * a single SPU request message, starting at the current position in the request
    271     @@ -293,7 +331,6 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
    272     u32 pad_len; /* total length of all padding */
    273     bool update_key = false;
    274     struct brcm_message *mssg; /* mailbox message */
    275     - int retry_cnt = 0;
    276    
    277     /* number of entries in src and dst sg in mailbox message. */
    278     u8 rx_frag_num = 2; /* response header and STATUS */
    279     @@ -462,24 +499,9 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
    280     if (err)
    281     return err;
    282    
    283     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    284     - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    285     - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    286     - /*
    287     - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    288     - * not in atomic context and we can wait and try again.
    289     - */
    290     - retry_cnt++;
    291     - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    292     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    293     - mssg);
    294     - atomic_inc(&iproc_priv.mb_no_spc);
    295     - }
    296     - }
    297     - if (unlikely(err < 0)) {
    298     - atomic_inc(&iproc_priv.mb_send_fail);
    299     + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    300     + if (unlikely(err < 0))
    301     return err;
    302     - }
    303    
    304     return -EINPROGRESS;
    305     }
    306     @@ -710,7 +732,6 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
    307     u32 spu_hdr_len;
    308     unsigned int digestsize;
    309     u16 rem = 0;
    310     - int retry_cnt = 0;
    311    
    312     /*
    313     * number of entries in src and dst sg. Always includes SPU msg header.
    314     @@ -904,24 +925,10 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
    315     if (err)
    316     return err;
    317    
    318     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    319     - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    320     - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    321     - /*
    322     - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    323     - * not in atomic context and we can wait and try again.
    324     - */
    325     - retry_cnt++;
    326     - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    327     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    328     - mssg);
    329     - atomic_inc(&iproc_priv.mb_no_spc);
    330     - }
    331     - }
    332     - if (err < 0) {
    333     - atomic_inc(&iproc_priv.mb_send_fail);
    334     + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    335     + if (unlikely(err < 0))
    336     return err;
    337     - }
    338     +
    339     return -EINPROGRESS;
    340     }
    341    
    342     @@ -1320,7 +1327,6 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
    343     int assoc_nents = 0;
    344     bool incl_icv = false;
    345     unsigned int digestsize = ctx->digestsize;
    346     - int retry_cnt = 0;
    347    
    348     /* number of entries in src and dst sg. Always includes SPU msg header.
    349     */
    350     @@ -1558,24 +1564,9 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
    351     if (err)
    352     return err;
    353    
    354     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    355     - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    356     - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    357     - /*
    358     - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    359     - * not in atomic context and we can wait and try again.
    360     - */
    361     - retry_cnt++;
    362     - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    363     - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    364     - mssg);
    365     - atomic_inc(&iproc_priv.mb_no_spc);
    366     - }
    367     - }
    368     - if (err < 0) {
    369     - atomic_inc(&iproc_priv.mb_send_fail);
    370     + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    371     + if (unlikely(err < 0))
    372     return err;
    373     - }
    374    
    375     return -EINPROGRESS;
    376     }
    377     @@ -4537,7 +4528,7 @@ static int spu_mb_init(struct device *dev)
    378     mcl->dev = dev;
    379     mcl->tx_block = false;
    380     mcl->tx_tout = 0;
    381     - mcl->knows_txdone = false;
    382     + mcl->knows_txdone = true;
    383     mcl->rx_callback = spu_rx_callback;
    384     mcl->tx_done = NULL;
    385    
    386     diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
    387     index 34ff53290b03..47edc7fbf91f 100644
    388     --- a/drivers/dma/dmatest.c
    389     +++ b/drivers/dma/dmatest.c
    390     @@ -702,6 +702,7 @@ static int dmatest_func(void *data)
    391     * free it this time?" dancing. For now, just
    392     * leave it dangling.
    393     */
    394     + WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
    395     dmaengine_unmap_put(um);
    396     result("test timed out", total_tests, src_off, dst_off,
    397     len, 0);
    398     diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
    399     index dc0591654011..6241fa787d66 100644
    400     --- a/drivers/edac/sb_edac.c
    401     +++ b/drivers/edac/sb_edac.c
    402     @@ -462,6 +462,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
    403     static const struct pci_id_descr pci_dev_descr_ibridge[] = {
    404     /* Processor Home Agent */
    405     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0, 0, IMC0) },
    406     + { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1, 1, IMC1) },
    407    
    408     /* Memory controller */
    409     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA, 0, IMC0) },
    410     @@ -472,7 +473,6 @@ static const struct pci_id_descr pci_dev_descr_ibridge[] = {
    411     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TAD3, 0, IMC0) },
    412    
    413     /* Optional, mode 2HA */
    414     - { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1, 1, IMC1) },
    415     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TA, 1, IMC1) },
    416     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_RAS, 1, IMC1) },
    417     { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TAD0, 1, IMC1) },
    418     @@ -2291,6 +2291,13 @@ static int sbridge_get_onedevice(struct pci_dev **prev,
    419     next_imc:
    420     sbridge_dev = get_sbridge_dev(bus, dev_descr->dom, multi_bus, sbridge_dev);
    421     if (!sbridge_dev) {
    422     + /* If the HA1 wasn't found, don't create EDAC second memory controller */
    423     + if (dev_descr->dom == IMC1 && devno != 1) {
    424     + edac_dbg(0, "Skip IMC1: %04x:%04x (since HA1 was absent)\n",
    425     + PCI_VENDOR_ID_INTEL, dev_descr->dev_id);
    426     + pci_dev_put(pdev);
    427     + return 0;
    428     + }
    429    
    430     if (dev_descr->dom == SOCK)
    431     goto out_imc;
    432     diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
    433     index 374301fcbc86..8c7a0ce147a1 100644
    434     --- a/drivers/hid/Kconfig
    435     +++ b/drivers/hid/Kconfig
    436     @@ -230,7 +230,7 @@ config HID_CMEDIA
    437    
    438     config HID_CP2112
    439     tristate "Silicon Labs CP2112 HID USB-to-SMBus Bridge support"
    440     - depends on USB_HID && I2C && GPIOLIB
    441     + depends on USB_HID && HIDRAW && I2C && GPIOLIB
    442     select GPIOLIB_IRQCHIP
    443     ---help---
    444     Support for Silicon Labs CP2112 HID USB to SMBus Master Bridge.
    445     diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
    446     index 8a03654048bf..feb62fd4dfc3 100644
    447     --- a/drivers/hid/wacom_wac.h
    448     +++ b/drivers/hid/wacom_wac.h
    449     @@ -166,6 +166,7 @@
    450     ((f)->physical == HID_DG_PEN) || \
    451     ((f)->application == HID_DG_PEN) || \
    452     ((f)->application == HID_DG_DIGITIZER) || \
    453     + ((f)->application == WACOM_HID_WD_PEN) || \
    454     ((f)->application == WACOM_HID_WD_DIGITIZER) || \
    455     ((f)->application == WACOM_HID_G9_PEN) || \
    456     ((f)->application == WACOM_HID_G11_PEN))
    457     diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
    458     index 7b3f31cc63d2..0c46155a8e9d 100644
    459     --- a/drivers/media/rc/imon.c
    460     +++ b/drivers/media/rc/imon.c
    461     @@ -2517,6 +2517,11 @@ static int imon_probe(struct usb_interface *interface,
    462     mutex_lock(&driver_lock);
    463    
    464     first_if = usb_ifnum_to_if(usbdev, 0);
    465     + if (!first_if) {
    466     + ret = -ENODEV;
    467     + goto fail;
    468     + }
    469     +
    470     first_if_ctx = usb_get_intfdata(first_if);
    471    
    472     if (ifnum == 0) {
    473     diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
    474     index 6020170fe99a..92098c1b78e5 100644
    475     --- a/drivers/media/usb/dvb-usb/dib0700_devices.c
    476     +++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
    477     @@ -291,7 +291,7 @@ static int stk7700P2_frontend_attach(struct dvb_usb_adapter *adap)
    478     stk7700d_dib7000p_mt2266_config)
    479     != 0) {
    480     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    481     - dvb_detach(&state->dib7000p_ops);
    482     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    483     return -ENODEV;
    484     }
    485     }
    486     @@ -325,7 +325,7 @@ static int stk7700d_frontend_attach(struct dvb_usb_adapter *adap)
    487     stk7700d_dib7000p_mt2266_config)
    488     != 0) {
    489     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    490     - dvb_detach(&state->dib7000p_ops);
    491     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    492     return -ENODEV;
    493     }
    494     }
    495     @@ -478,7 +478,7 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap)
    496     &stk7700ph_dib7700_xc3028_config) != 0) {
    497     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    498     __func__);
    499     - dvb_detach(&state->dib7000p_ops);
    500     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    501     return -ENODEV;
    502     }
    503    
    504     @@ -1010,7 +1010,7 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
    505     &dib7070p_dib7000p_config) != 0) {
    506     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    507     __func__);
    508     - dvb_detach(&state->dib7000p_ops);
    509     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    510     return -ENODEV;
    511     }
    512    
    513     @@ -1068,7 +1068,7 @@ static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
    514     &dib7770p_dib7000p_config) != 0) {
    515     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    516     __func__);
    517     - dvb_detach(&state->dib7000p_ops);
    518     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    519     return -ENODEV;
    520     }
    521    
    522     @@ -3056,7 +3056,7 @@ static int nim7090_frontend_attach(struct dvb_usb_adapter *adap)
    523    
    524     if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x10, &nim7090_dib7000p_config) != 0) {
    525     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    526     - dvb_detach(&state->dib7000p_ops);
    527     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    528     return -ENODEV;
    529     }
    530     adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, 0x80, &nim7090_dib7000p_config);
    531     @@ -3109,7 +3109,7 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
    532     /* initialize IC 0 */
    533     if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, &tfe7090pvr_dib7000p_config[0]) != 0) {
    534     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    535     - dvb_detach(&state->dib7000p_ops);
    536     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    537     return -ENODEV;
    538     }
    539    
    540     @@ -3139,7 +3139,7 @@ static int tfe7090pvr_frontend1_attach(struct dvb_usb_adapter *adap)
    541     i2c = state->dib7000p_ops.get_i2c_master(adap->dev->adapter[0].fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_6_7, 1);
    542     if (state->dib7000p_ops.i2c_enumeration(i2c, 1, 0x10, &tfe7090pvr_dib7000p_config[1]) != 0) {
    543     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    544     - dvb_detach(&state->dib7000p_ops);
    545     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    546     return -ENODEV;
    547     }
    548    
    549     @@ -3214,7 +3214,7 @@ static int tfe7790p_frontend_attach(struct dvb_usb_adapter *adap)
    550     1, 0x10, &tfe7790p_dib7000p_config) != 0) {
    551     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    552     __func__);
    553     - dvb_detach(&state->dib7000p_ops);
    554     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    555     return -ENODEV;
    556     }
    557     adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap,
    558     @@ -3309,7 +3309,7 @@ static int stk7070pd_frontend_attach0(struct dvb_usb_adapter *adap)
    559     stk7070pd_dib7000p_config) != 0) {
    560     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    561     __func__);
    562     - dvb_detach(&state->dib7000p_ops);
    563     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    564     return -ENODEV;
    565     }
    566    
    567     @@ -3384,7 +3384,7 @@ static int novatd_frontend_attach(struct dvb_usb_adapter *adap)
    568     stk7070pd_dib7000p_config) != 0) {
    569     err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    570     __func__);
    571     - dvb_detach(&state->dib7000p_ops);
    572     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    573     return -ENODEV;
    574     }
    575     }
    576     @@ -3620,7 +3620,7 @@ static int pctv340e_frontend_attach(struct dvb_usb_adapter *adap)
    577    
    578     if (state->dib7000p_ops.dib7000pc_detection(&adap->dev->i2c_adap) == 0) {
    579     /* Demodulator not found for some reason? */
    580     - dvb_detach(&state->dib7000p_ops);
    581     + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    582     return -ENODEV;
    583     }
    584    
    585     diff --git a/drivers/platform/x86/peaq-wmi.c b/drivers/platform/x86/peaq-wmi.c
    586     index bc98ef95514a..2da48ecc90c1 100644
    587     --- a/drivers/platform/x86/peaq-wmi.c
    588     +++ b/drivers/platform/x86/peaq-wmi.c
    589     @@ -8,6 +8,7 @@
    590     */
    591    
    592     #include <linux/acpi.h>
    593     +#include <linux/dmi.h>
    594     #include <linux/input-polldev.h>
    595     #include <linux/kernel.h>
    596     #include <linux/module.h>
    597     @@ -64,8 +65,23 @@ static void peaq_wmi_poll(struct input_polled_dev *dev)
    598     }
    599     }
    600    
    601     +/* Some other devices (Shuttle XS35) use the same WMI GUID for other purposes */
    602     +static const struct dmi_system_id peaq_dmi_table[] = {
    603     + {
    604     + .matches = {
    605     + DMI_MATCH(DMI_SYS_VENDOR, "PEAQ"),
    606     + DMI_MATCH(DMI_PRODUCT_NAME, "PEAQ PMM C1010 MD99187"),
    607     + },
    608     + },
    609     + {}
    610     +};
    611     +
    612     static int __init peaq_wmi_init(void)
    613     {
    614     + /* WMI GUID is not unique, also check for a DMI match */
    615     + if (!dmi_check_system(peaq_dmi_table))
    616     + return -ENODEV;
    617     +
    618     if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
    619     return -ENODEV;
    620    
    621     @@ -86,6 +102,9 @@ static int __init peaq_wmi_init(void)
    622    
    623     static void __exit peaq_wmi_exit(void)
    624     {
    625     + if (!dmi_check_system(peaq_dmi_table))
    626     + return;
    627     +
    628     if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
    629     return;
    630    
    631     diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
    632     index 5dcc9bf1c5bc..e3242a0925a6 100644
    633     --- a/drivers/rpmsg/qcom_glink_native.c
    634     +++ b/drivers/rpmsg/qcom_glink_native.c
    635     @@ -1616,3 +1616,6 @@ void qcom_glink_native_unregister(struct qcom_glink *glink)
    636     device_unregister(glink->dev);
    637     }
    638     EXPORT_SYMBOL_GPL(qcom_glink_native_unregister);
    639     +
    640     +MODULE_DESCRIPTION("Qualcomm GLINK driver");
    641     +MODULE_LICENSE("GPL v2");
    642     diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
    643     index e8b5a5e21b2e..3ff0ee88c467 100644
    644     --- a/drivers/spi/spi.c
    645     +++ b/drivers/spi/spi.c
    646     @@ -2245,11 +2245,12 @@ static int __unregister(struct device *dev, void *null)
    647     void spi_unregister_controller(struct spi_controller *ctlr)
    648     {
    649     struct spi_controller *found;
    650     + int id = ctlr->bus_num;
    651     int dummy;
    652    
    653     /* First make sure that this controller was ever added */
    654     mutex_lock(&board_lock);
    655     - found = idr_find(&spi_master_idr, ctlr->bus_num);
    656     + found = idr_find(&spi_master_idr, id);
    657     mutex_unlock(&board_lock);
    658     if (found != ctlr) {
    659     dev_dbg(&ctlr->dev,
    660     @@ -2269,7 +2270,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
    661     device_unregister(&ctlr->dev);
    662     /* free bus id */
    663     mutex_lock(&board_lock);
    664     - idr_remove(&spi_master_idr, ctlr->bus_num);
    665     + idr_remove(&spi_master_idr, id);
    666     mutex_unlock(&board_lock);
    667     }
    668     EXPORT_SYMBOL_GPL(spi_unregister_controller);
    669     diff --git a/drivers/staging/ccree/cc_lli_defs.h b/drivers/staging/ccree/cc_lli_defs.h
    670     index 851d3907167e..a9c417b07b04 100644
    671     --- a/drivers/staging/ccree/cc_lli_defs.h
    672     +++ b/drivers/staging/ccree/cc_lli_defs.h
    673     @@ -59,7 +59,7 @@ static inline void cc_lli_set_addr(u32 *lli_p, dma_addr_t addr)
    674     lli_p[LLI_WORD0_OFFSET] = (addr & U32_MAX);
    675     #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
    676     lli_p[LLI_WORD1_OFFSET] &= ~LLI_HADDR_MASK;
    677     - lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 16));
    678     + lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 32));
    679     #endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT */
    680     }
    681    
    682     diff --git a/drivers/staging/greybus/spilib.c b/drivers/staging/greybus/spilib.c
    683     index e97b19148497..1e7321a1404c 100644
    684     --- a/drivers/staging/greybus/spilib.c
    685     +++ b/drivers/staging/greybus/spilib.c
    686     @@ -544,11 +544,14 @@ int gb_spilib_master_init(struct gb_connection *connection, struct device *dev,
    687    
    688     return 0;
    689    
    690     -exit_spi_unregister:
    691     - spi_unregister_master(master);
    692     exit_spi_put:
    693     spi_master_put(master);
    694    
    695     + return ret;
    696     +
    697     +exit_spi_unregister:
    698     + spi_unregister_master(master);
    699     +
    700     return ret;
    701     }
    702     EXPORT_SYMBOL_GPL(gb_spilib_master_init);
    703     @@ -558,7 +561,6 @@ void gb_spilib_master_exit(struct gb_connection *connection)
    704     struct spi_master *master = gb_connection_get_data(connection);
    705    
    706     spi_unregister_master(master);
    707     - spi_master_put(master);
    708     }
    709     EXPORT_SYMBOL_GPL(gb_spilib_master_exit);
    710    
    711     diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
    712     index 3fd5f4102b36..afb9dadc1cfe 100644
    713     --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
    714     +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
    715     @@ -259,10 +259,12 @@ static int recvframe_chkmic(struct adapter *adapter,
    716     }
    717    
    718     /* icv_len included the mic code */
    719     - datalen = precvframe->pkt->len-prxattrib->hdrlen - 8;
    720     + datalen = precvframe->pkt->len-prxattrib->hdrlen -
    721     + prxattrib->iv_len-prxattrib->icv_len-8;
    722     pframe = precvframe->pkt->data;
    723     - payload = pframe+prxattrib->hdrlen;
    724     + payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
    725    
    726     + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
    727     rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
    728     (unsigned char)prxattrib->priority); /* care the length of the data */
    729    
    730     @@ -407,15 +409,9 @@ static struct recv_frame *decryptor(struct adapter *padapter,
    731     default:
    732     break;
    733     }
    734     - if (res != _FAIL) {
    735     - memmove(precv_frame->pkt->data + precv_frame->attrib.iv_len, precv_frame->pkt->data, precv_frame->attrib.hdrlen);
    736     - skb_pull(precv_frame->pkt, precv_frame->attrib.iv_len);
    737     - skb_trim(precv_frame->pkt, precv_frame->pkt->len - precv_frame->attrib.icv_len);
    738     - }
    739     } else if (prxattrib->bdecrypted == 1 && prxattrib->encrypt > 0 &&
    740     - (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_)) {
    741     - psecuritypriv->hw_decrypted = true;
    742     - }
    743     + (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_))
    744     + psecuritypriv->hw_decrypted = true;
    745    
    746     if (res == _FAIL) {
    747     rtw_free_recvframe(return_packet, &padapter->recvpriv.free_recv_queue);
    748     @@ -456,7 +452,7 @@ static struct recv_frame *portctrl(struct adapter *adapter,
    749    
    750     if (auth_alg == 2) {
    751     /* get ether_type */
    752     - ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
    753     + ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE + pfhdr->attrib.iv_len;
    754     memcpy(&be_tmp, ptr, 2);
    755     ether_type = ntohs(be_tmp);
    756    
    757     @@ -1138,8 +1134,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
    758     }
    759    
    760     if (pattrib->privacy) {
    761     - struct sk_buff *skb = precv_frame->pkt;
    762     -
    763     RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
    764     RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0], IS_MCAST(pattrib->ra)));
    765    
    766     @@ -1148,13 +1142,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
    767     RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n pattrib->encrypt=%d\n", pattrib->encrypt));
    768    
    769     SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
    770     -
    771     - if (pattrib->bdecrypted == 1 && pattrib->encrypt > 0) {
    772     - memmove(skb->data + pattrib->iv_len,
    773     - skb->data, pattrib->hdrlen);
    774     - skb_pull(skb, pattrib->iv_len);
    775     - skb_trim(skb, skb->len - pattrib->icv_len);
    776     - }
    777     } else {
    778     pattrib->encrypt = 0;
    779     pattrib->iv_len = 0;
    780     @@ -1274,7 +1261,6 @@ static int validate_recv_frame(struct adapter *adapter,
    781     * Hence forward the frame to the monitor anyway to preserve the order
    782     * in which frames were received.
    783     */
    784     -
    785     rtl88eu_mon_recv_hook(adapter->pmondev, precv_frame);
    786    
    787     exit:
    788     @@ -1296,8 +1282,11 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
    789     u8 *ptr = precvframe->pkt->data;
    790     struct rx_pkt_attrib *pattrib = &precvframe->attrib;
    791    
    792     - psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen);
    793     - psnap_type = ptr+pattrib->hdrlen + SNAP_SIZE;
    794     + if (pattrib->encrypt)
    795     + skb_trim(precvframe->pkt, precvframe->pkt->len - pattrib->icv_len);
    796     +
    797     + psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
    798     + psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
    799     /* convert hdr + possible LLC headers into Ethernet header */
    800     if ((!memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
    801     (!memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == false) &&
    802     @@ -1310,9 +1299,12 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
    803     bsnaphdr = false;
    804     }
    805    
    806     - rmv_len = pattrib->hdrlen + (bsnaphdr ? SNAP_SIZE : 0);
    807     + rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
    808     len = precvframe->pkt->len - rmv_len;
    809    
    810     + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
    811     + ("\n===pattrib->hdrlen: %x, pattrib->iv_len:%x===\n\n", pattrib->hdrlen, pattrib->iv_len));
    812     +
    813     memcpy(&be_tmp, ptr+rmv_len, 2);
    814     eth_type = ntohs(be_tmp); /* pattrib->ether_type */
    815     pattrib->eth_type = eth_type;
    816     @@ -1337,6 +1329,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    817     struct __queue *defrag_q)
    818     {
    819     struct list_head *plist, *phead;
    820     + u8 wlanhdr_offset;
    821     u8 curfragnum;
    822     struct recv_frame *pfhdr, *pnfhdr;
    823     struct recv_frame *prframe, *pnextrframe;
    824     @@ -1385,7 +1378,12 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    825     /* copy the 2nd~n fragment frame's payload to the first fragment */
    826     /* get the 2nd~last fragment frame's payload */
    827    
    828     - skb_pull(pnextrframe->pkt, pnfhdr->attrib.hdrlen);
    829     + wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
    830     +
    831     + skb_pull(pnextrframe->pkt, wlanhdr_offset);
    832     +
    833     + /* append to first fragment frame's tail (if privacy frame, pull the ICV) */
    834     + skb_trim(prframe->pkt, prframe->pkt->len - pfhdr->attrib.icv_len);
    835    
    836     /* memcpy */
    837     memcpy(skb_tail_pointer(pfhdr->pkt), pnfhdr->pkt->data,
    838     @@ -1393,7 +1391,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    839    
    840     skb_put(prframe->pkt, pnfhdr->pkt->len);
    841    
    842     - pfhdr->attrib.icv_len = 0;
    843     + pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
    844     plist = plist->next;
    845     }
    846    
    847     @@ -1519,6 +1517,11 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
    848     nr_subframes = 0;
    849     pattrib = &prframe->attrib;
    850    
    851     + skb_pull(prframe->pkt, prframe->attrib.hdrlen);
    852     +
    853     + if (prframe->attrib.iv_len > 0)
    854     + skb_pull(prframe->pkt, prframe->attrib.iv_len);
    855     +
    856     a_len = prframe->pkt->len;
    857    
    858     pdata = prframe->pkt->data;
    859     @@ -1887,6 +1890,24 @@ static int process_recv_indicatepkts(struct adapter *padapter,
    860     return retval;
    861     }
    862    
    863     +static int recv_func_prehandle(struct adapter *padapter,
    864     + struct recv_frame *rframe)
    865     +{
    866     + int ret = _SUCCESS;
    867     + struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
    868     +
    869     + /* check the frame crtl field and decache */
    870     + ret = validate_recv_frame(padapter, rframe);
    871     + if (ret != _SUCCESS) {
    872     + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
    873     + rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
    874     + goto exit;
    875     + }
    876     +
    877     +exit:
    878     + return ret;
    879     +}
    880     +
    881     static int recv_func_posthandle(struct adapter *padapter,
    882     struct recv_frame *prframe)
    883     {
    884     @@ -1939,7 +1960,6 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
    885     struct rx_pkt_attrib *prxattrib = &rframe->attrib;
    886     struct security_priv *psecuritypriv = &padapter->securitypriv;
    887     struct mlme_priv *mlmepriv = &padapter->mlmepriv;
    888     - struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
    889    
    890     /* check if need to handle uc_swdec_pending_queue*/
    891     if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey) {
    892     @@ -1951,12 +1971,9 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
    893     }
    894     }
    895    
    896     - /* check the frame crtl field and decache */
    897     - ret = validate_recv_frame(padapter, rframe);
    898     - if (ret != _SUCCESS) {
    899     - RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
    900     - rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
    901     - } else {
    902     + ret = recv_func_prehandle(padapter, rframe);
    903     +
    904     + if (ret == _SUCCESS) {
    905     /* check if need to enqueue into uc_swdec_pending_queue*/
    906     if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
    907     !IS_MCAST(prxattrib->ra) && prxattrib->encrypt > 0 &&
    908     diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
    909     index 37fd52d7364f..225c23fc69dc 100644
    910     --- a/drivers/staging/rtl8188eu/os_dep/mon.c
    911     +++ b/drivers/staging/rtl8188eu/os_dep/mon.c
    912     @@ -66,34 +66,6 @@ static void mon_recv_decrypted(struct net_device *dev, const u8 *data,
    913     netif_rx(skb);
    914     }
    915    
    916     -static void mon_recv_decrypted_recv(struct net_device *dev, const u8 *data,
    917     - int data_len)
    918     -{
    919     - struct sk_buff *skb;
    920     - struct ieee80211_hdr *hdr;
    921     - int hdr_len;
    922     -
    923     - skb = netdev_alloc_skb(dev, data_len);
    924     - if (!skb)
    925     - return;
    926     - memcpy(skb_put(skb, data_len), data, data_len);
    927     -
    928     - /*
    929     - * Frame data is not encrypted. Strip off protection so
    930     - * userspace doesn't think that it is.
    931     - */
    932     -
    933     - hdr = (struct ieee80211_hdr *)skb->data;
    934     - hdr_len = ieee80211_hdrlen(hdr->frame_control);
    935     -
    936     - if (ieee80211_has_protected(hdr->frame_control))
    937     - hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_PROTECTED);
    938     -
    939     - skb->ip_summed = CHECKSUM_UNNECESSARY;
    940     - skb->protocol = eth_type_trans(skb, dev);
    941     - netif_rx(skb);
    942     -}
    943     -
    944     static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
    945     int data_len)
    946     {
    947     @@ -110,6 +82,7 @@ static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
    948     void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
    949     {
    950     struct rx_pkt_attrib *attr;
    951     + int iv_len, icv_len;
    952     int data_len;
    953     u8 *data;
    954    
    955     @@ -122,8 +95,11 @@ void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
    956     data = frame->pkt->data;
    957     data_len = frame->pkt->len;
    958    
    959     + /* Broadcast and multicast frames don't have attr->{iv,icv}_len set */
    960     + SET_ICE_IV_LEN(iv_len, icv_len, attr->encrypt);
    961     +
    962     if (attr->bdecrypted)
    963     - mon_recv_decrypted_recv(dev, data, data_len);
    964     + mon_recv_decrypted(dev, data, data_len, iv_len, icv_len);
    965     else
    966     mon_recv_encrypted(dev, data, data_len);
    967     }
    968     diff --git a/drivers/staging/sm750fb/ddk750_chip.h b/drivers/staging/sm750fb/ddk750_chip.h
    969     index 09c223f815de..aee82fcaf669 100644
    970     --- a/drivers/staging/sm750fb/ddk750_chip.h
    971     +++ b/drivers/staging/sm750fb/ddk750_chip.h
    972     @@ -18,7 +18,7 @@ static inline u32 peek32(u32 addr)
    973     return readl(addr + mmio750);
    974     }
    975    
    976     -static inline void poke32(u32 data, u32 addr)
    977     +static inline void poke32(u32 addr, u32 data)
    978     {
    979     writel(data, addr + mmio750);
    980     }
    981     diff --git a/drivers/staging/vboxvideo/vbox_drv.h b/drivers/staging/vboxvideo/vbox_drv.h
    982     index 4b9302703b36..eeac4f0cb2c6 100644
    983     --- a/drivers/staging/vboxvideo/vbox_drv.h
    984     +++ b/drivers/staging/vboxvideo/vbox_drv.h
    985     @@ -137,8 +137,8 @@ struct vbox_connector {
    986     char name[32];
    987     struct vbox_crtc *vbox_crtc;
    988     struct {
    989     - u16 width;
    990     - u16 height;
    991     + u32 width;
    992     + u32 height;
    993     bool disconnected;
    994     } mode_hint;
    995     };
    996     @@ -150,8 +150,8 @@ struct vbox_crtc {
    997     unsigned int crtc_id;
    998     u32 fb_offset;
    999     bool cursor_enabled;
    1000     - u16 x_hint;
    1001     - u16 y_hint;
    1002     + u32 x_hint;
    1003     + u32 y_hint;
    1004     };
    1005    
    1006     struct vbox_encoder {
    1007     diff --git a/drivers/staging/vboxvideo/vbox_irq.c b/drivers/staging/vboxvideo/vbox_irq.c
    1008     index 3ca8bec62ac4..74abdf02d9fd 100644
    1009     --- a/drivers/staging/vboxvideo/vbox_irq.c
    1010     +++ b/drivers/staging/vboxvideo/vbox_irq.c
    1011     @@ -150,8 +150,8 @@ static void vbox_update_mode_hints(struct vbox_private *vbox)
    1012    
    1013     disconnected = !(hints->enabled);
    1014     crtc_id = vbox_conn->vbox_crtc->crtc_id;
    1015     - vbox_conn->mode_hint.width = hints->cx & 0x8fff;
    1016     - vbox_conn->mode_hint.height = hints->cy & 0x8fff;
    1017     + vbox_conn->mode_hint.width = hints->cx;
    1018     + vbox_conn->mode_hint.height = hints->cy;
    1019     vbox_conn->vbox_crtc->x_hint = hints->dx;
    1020     vbox_conn->vbox_crtc->y_hint = hints->dy;
    1021     vbox_conn->mode_hint.disconnected = disconnected;
    1022     diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
    1023     index 257a77830410..6f08dc966719 100644
    1024     --- a/drivers/staging/vboxvideo/vbox_mode.c
    1025     +++ b/drivers/staging/vboxvideo/vbox_mode.c
    1026     @@ -553,12 +553,22 @@ static int vbox_get_modes(struct drm_connector *connector)
    1027     ++num_modes;
    1028     }
    1029     vbox_set_edid(connector, preferred_width, preferred_height);
    1030     - drm_object_property_set_value(
    1031     - &connector->base, vbox->dev->mode_config.suggested_x_property,
    1032     - vbox_connector->vbox_crtc->x_hint);
    1033     - drm_object_property_set_value(
    1034     - &connector->base, vbox->dev->mode_config.suggested_y_property,
    1035     - vbox_connector->vbox_crtc->y_hint);
    1036     +
    1037     + if (vbox_connector->vbox_crtc->x_hint != -1)
    1038     + drm_object_property_set_value(&connector->base,
    1039     + vbox->dev->mode_config.suggested_x_property,
    1040     + vbox_connector->vbox_crtc->x_hint);
    1041     + else
    1042     + drm_object_property_set_value(&connector->base,
    1043     + vbox->dev->mode_config.suggested_x_property, 0);
    1044     +
    1045     + if (vbox_connector->vbox_crtc->y_hint != -1)
    1046     + drm_object_property_set_value(&connector->base,
    1047     + vbox->dev->mode_config.suggested_y_property,
    1048     + vbox_connector->vbox_crtc->y_hint);
    1049     + else
    1050     + drm_object_property_set_value(&connector->base,
    1051     + vbox->dev->mode_config.suggested_y_property, 0);
    1052    
    1053     return num_modes;
    1054     }
    1055     @@ -640,9 +650,9 @@ static int vbox_connector_init(struct drm_device *dev,
    1056    
    1057     drm_mode_create_suggested_offset_properties(dev);
    1058     drm_object_attach_property(&connector->base,
    1059     - dev->mode_config.suggested_x_property, -1);
    1060     + dev->mode_config.suggested_x_property, 0);
    1061     drm_object_attach_property(&connector->base,
    1062     - dev->mode_config.suggested_y_property, -1);
    1063     + dev->mode_config.suggested_y_property, 0);
    1064     drm_connector_register(connector);
    1065    
    1066     drm_mode_connector_attach_encoder(connector, encoder);
    1067     diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
    1068     index 9addef1f1e12..f49dfa82f1b8 100644
    1069     --- a/drivers/staging/wilc1000/wilc_wlan.c
    1070     +++ b/drivers/staging/wilc1000/wilc_wlan.c
    1071     @@ -714,7 +714,7 @@ int wilc_wlan_handle_txq(struct net_device *dev, u32 *txq_count)
    1072     char *bssid = ((struct tx_complete_data *)(tqe->priv))->bssid;
    1073    
    1074     buffer_offset = ETH_ETHERNET_HDR_OFFSET;
    1075     - memcpy(&txb[offset + 4], bssid, 6);
    1076     + memcpy(&txb[offset + 8], bssid, 6);
    1077     } else {
    1078     buffer_offset = HOST_HDR_OFFSET;
    1079     }
    1080     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    1081     index e9326f31db8d..98c666ef9a57 100644
    1082     --- a/drivers/usb/core/devio.c
    1083     +++ b/drivers/usb/core/devio.c
    1084     @@ -1833,6 +1833,18 @@ static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
    1085     return 0;
    1086     }
    1087    
    1088     +static void compute_isochronous_actual_length(struct urb *urb)
    1089     +{
    1090     + unsigned int i;
    1091     +
    1092     + if (urb->number_of_packets > 0) {
    1093     + urb->actual_length = 0;
    1094     + for (i = 0; i < urb->number_of_packets; i++)
    1095     + urb->actual_length +=
    1096     + urb->iso_frame_desc[i].actual_length;
    1097     + }
    1098     +}
    1099     +
    1100     static int processcompl(struct async *as, void __user * __user *arg)
    1101     {
    1102     struct urb *urb = as->urb;
    1103     @@ -1840,6 +1852,7 @@ static int processcompl(struct async *as, void __user * __user *arg)
    1104     void __user *addr = as->userurb;
    1105     unsigned int i;
    1106    
    1107     + compute_isochronous_actual_length(urb);
    1108     if (as->userbuffer && urb->actual_length) {
    1109     if (copy_urb_data_to_user(as->userbuffer, urb))
    1110     goto err_out;
    1111     @@ -2008,6 +2021,7 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
    1112     void __user *addr = as->userurb;
    1113     unsigned int i;
    1114    
    1115     + compute_isochronous_actual_length(urb);
    1116     if (as->userbuffer && urb->actual_length) {
    1117     if (copy_urb_data_to_user(as->userbuffer, urb))
    1118     return -EFAULT;
    1119     diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    1120     index a6aaf2f193a4..37c418e581fb 100644
    1121     --- a/drivers/usb/core/quirks.c
    1122     +++ b/drivers/usb/core/quirks.c
    1123     @@ -221,6 +221,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1124     /* Corsair Strafe RGB */
    1125     { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
    1126    
    1127     + /* Corsair K70 LUX */
    1128     + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
    1129     +
    1130     /* MIDI keyboard WORLDE MINI */
    1131     { USB_DEVICE(0x1c75, 0x0204), .driver_info =
    1132     USB_QUIRK_CONFIG_INTF_STRINGS },
    1133     diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
    1134     index 2df0f6e613fe..a516cab0bf4a 100644
    1135     --- a/drivers/usb/early/xhci-dbc.h
    1136     +++ b/drivers/usb/early/xhci-dbc.h
    1137     @@ -90,8 +90,8 @@ struct xdbc_context {
    1138    
    1139     #define XDBC_INFO_CONTEXT_SIZE 48
    1140     #define XDBC_MAX_STRING_LENGTH 64
    1141     -#define XDBC_STRING_MANUFACTURER "Linux"
    1142     -#define XDBC_STRING_PRODUCT "Remote GDB"
    1143     +#define XDBC_STRING_MANUFACTURER "Linux Foundation"
    1144     +#define XDBC_STRING_PRODUCT "Linux USB GDB Target"
    1145     #define XDBC_STRING_SERIAL "0001"
    1146    
    1147     struct xdbc_strings {
    1148     @@ -103,7 +103,7 @@ struct xdbc_strings {
    1149    
    1150     #define XDBC_PROTOCOL 1 /* GNU Remote Debug Command Set */
    1151     #define XDBC_VENDOR_ID 0x1d6b /* Linux Foundation 0x1d6b */
    1152     -#define XDBC_PRODUCT_ID 0x0004 /* __le16 idProduct; device 0004 */
    1153     +#define XDBC_PRODUCT_ID 0x0011 /* __le16 idProduct; device 0011 */
    1154     #define XDBC_DEVICE_REV 0x0010 /* 0.10 */
    1155    
    1156     /*
    1157     diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
    1158     index 8b342587f8ad..ef8f7d63a8f0 100644
    1159     --- a/drivers/usb/gadget/function/f_fs.c
    1160     +++ b/drivers/usb/gadget/function/f_fs.c
    1161     @@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data *ffs)
    1162     goto done;
    1163    
    1164     ffs_obj->desc_ready = false;
    1165     + ffs_obj->ffs_data = NULL;
    1166    
    1167     if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
    1168     ffs_obj->ffs_closed_callback)
    1169     diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
    1170     index b2f2e87aed94..91e7e3a166a5 100644
    1171     --- a/drivers/usb/serial/garmin_gps.c
    1172     +++ b/drivers/usb/serial/garmin_gps.c
    1173     @@ -138,6 +138,7 @@ struct garmin_data {
    1174     __u8 privpkt[4*6];
    1175     spinlock_t lock;
    1176     struct list_head pktlist;
    1177     + struct usb_anchor write_urbs;
    1178     };
    1179    
    1180    
    1181     @@ -905,13 +906,19 @@ static int garmin_init_session(struct usb_serial_port *port)
    1182     sizeof(GARMIN_START_SESSION_REQ), 0);
    1183    
    1184     if (status < 0)
    1185     - break;
    1186     + goto err_kill_urbs;
    1187     }
    1188    
    1189     if (status > 0)
    1190     status = 0;
    1191     }
    1192    
    1193     + return status;
    1194     +
    1195     +err_kill_urbs:
    1196     + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1197     + usb_kill_urb(port->interrupt_in_urb);
    1198     +
    1199     return status;
    1200     }
    1201    
    1202     @@ -930,7 +937,6 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port)
    1203     spin_unlock_irqrestore(&garmin_data_p->lock, flags);
    1204    
    1205     /* shutdown any bulk reads that might be going on */
    1206     - usb_kill_urb(port->write_urb);
    1207     usb_kill_urb(port->read_urb);
    1208    
    1209     if (garmin_data_p->state == STATE_RESET)
    1210     @@ -953,7 +959,7 @@ static void garmin_close(struct usb_serial_port *port)
    1211    
    1212     /* shutdown our urbs */
    1213     usb_kill_urb(port->read_urb);
    1214     - usb_kill_urb(port->write_urb);
    1215     + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1216    
    1217     /* keep reset state so we know that we must start a new session */
    1218     if (garmin_data_p->state != STATE_RESET)
    1219     @@ -1037,12 +1043,14 @@ static int garmin_write_bulk(struct usb_serial_port *port,
    1220     }
    1221    
    1222     /* send it down the pipe */
    1223     + usb_anchor_urb(urb, &garmin_data_p->write_urbs);
    1224     status = usb_submit_urb(urb, GFP_ATOMIC);
    1225     if (status) {
    1226     dev_err(&port->dev,
    1227     "%s - usb_submit_urb(write bulk) failed with status = %d\n",
    1228     __func__, status);
    1229     count = status;
    1230     + usb_unanchor_urb(urb);
    1231     kfree(buffer);
    1232     }
    1233    
    1234     @@ -1401,9 +1409,16 @@ static int garmin_port_probe(struct usb_serial_port *port)
    1235     garmin_data_p->state = 0;
    1236     garmin_data_p->flags = 0;
    1237     garmin_data_p->count = 0;
    1238     + init_usb_anchor(&garmin_data_p->write_urbs);
    1239     usb_set_serial_port_data(port, garmin_data_p);
    1240    
    1241     status = garmin_init_session(port);
    1242     + if (status)
    1243     + goto err_free;
    1244     +
    1245     + return 0;
    1246     +err_free:
    1247     + kfree(garmin_data_p);
    1248    
    1249     return status;
    1250     }
    1251     @@ -1413,6 +1428,7 @@ static int garmin_port_remove(struct usb_serial_port *port)
    1252     {
    1253     struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
    1254    
    1255     + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1256     usb_kill_urb(port->interrupt_in_urb);
    1257     del_timer_sync(&garmin_data_p->timer);
    1258     kfree(garmin_data_p);
    1259     diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
    1260     index 14511d6a7d44..3950d44b80f1 100644
    1261     --- a/drivers/usb/serial/metro-usb.c
    1262     +++ b/drivers/usb/serial/metro-usb.c
    1263     @@ -189,7 +189,7 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
    1264     dev_err(&port->dev,
    1265     "%s - failed submitting interrupt in urb, error code=%d\n",
    1266     __func__, result);
    1267     - goto exit;
    1268     + return result;
    1269     }
    1270    
    1271     /* Send activate cmd to device */
    1272     @@ -198,9 +198,14 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
    1273     dev_err(&port->dev,
    1274     "%s - failed to configure device, error code=%d\n",
    1275     __func__, result);
    1276     - goto exit;
    1277     + goto err_kill_urb;
    1278     }
    1279     -exit:
    1280     +
    1281     + return 0;
    1282     +
    1283     +err_kill_urb:
    1284     + usb_kill_urb(port->interrupt_in_urb);
    1285     +
    1286     return result;
    1287     }
    1288    
    1289     diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    1290     index eb9928963a53..9f9d3a904464 100644
    1291     --- a/drivers/usb/serial/qcserial.c
    1292     +++ b/drivers/usb/serial/qcserial.c
    1293     @@ -148,6 +148,7 @@ static const struct usb_device_id id_table[] = {
    1294     {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
    1295     {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC7304/MC7354 */
    1296     {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
    1297     + {DEVICE_SWI(0x1199, 0x901e)}, /* Sierra Wireless EM7355 QDL */
    1298     {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
    1299     {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
    1300     {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */
    1301     diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
    1302     index 12f4c5a91e62..48f285a1ad00 100644
    1303     --- a/drivers/usb/serial/usb_debug.c
    1304     +++ b/drivers/usb/serial/usb_debug.c
    1305     @@ -34,13 +34,13 @@ static const struct usb_device_id id_table[] = {
    1306     };
    1307    
    1308     static const struct usb_device_id dbc_id_table[] = {
    1309     - { USB_DEVICE(0x1d6b, 0x0004) },
    1310     + { USB_DEVICE(0x1d6b, 0x0011) },
    1311     { },
    1312     };
    1313    
    1314     static const struct usb_device_id id_table_combined[] = {
    1315     { USB_DEVICE(0x0525, 0x127a) },
    1316     - { USB_DEVICE(0x1d6b, 0x0004) },
    1317     + { USB_DEVICE(0x1d6b, 0x0011) },
    1318     { },
    1319     };
    1320     MODULE_DEVICE_TABLE(usb, id_table_combined);
    1321     diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
    1322     index 555e43ca846b..7a1cc0e56d2d 100644
    1323     --- a/tools/testing/selftests/x86/protection_keys.c
    1324     +++ b/tools/testing/selftests/x86/protection_keys.c
    1325     @@ -189,17 +189,29 @@ void lots_o_noops_around_write(int *write_to_me)
    1326     #define u64 uint64_t
    1327    
    1328     #ifdef __i386__
    1329     -#define SYS_mprotect_key 380
    1330     -#define SYS_pkey_alloc 381
    1331     -#define SYS_pkey_free 382
    1332     +
    1333     +#ifndef SYS_mprotect_key
    1334     +# define SYS_mprotect_key 380
    1335     +#endif
    1336     +#ifndef SYS_pkey_alloc
    1337     +# define SYS_pkey_alloc 381
    1338     +# define SYS_pkey_free 382
    1339     +#endif
    1340     #define REG_IP_IDX REG_EIP
    1341     #define si_pkey_offset 0x14
    1342     +
    1343     #else
    1344     -#define SYS_mprotect_key 329
    1345     -#define SYS_pkey_alloc 330
    1346     -#define SYS_pkey_free 331
    1347     +
    1348     +#ifndef SYS_mprotect_key
    1349     +# define SYS_mprotect_key 329
    1350     +#endif
    1351     +#ifndef SYS_pkey_alloc
    1352     +# define SYS_pkey_alloc 330
    1353     +# define SYS_pkey_free 331
    1354     +#endif
    1355     #define REG_IP_IDX REG_RIP
    1356     #define si_pkey_offset 0x20
    1357     +
    1358     #endif
    1359    
    1360     void dump_mem(void *dumpme, int len_bytes)