Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.14/0100-4.14.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.14/0100-4.14.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3027 - (show annotations) (download)
    Tue Nov 28 13:16:13 2017 UTC (6 years, 5 months ago) by niro
    File size: 46365 byte(s) 
    -linux-4.14.1
    1 diff --git a/Makefile b/Makefile
    2 index ccd981892ef2..01f9df1af256 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,9 +1,9 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 4
    8 PATCHLEVEL = 14
    9 -SUBLEVEL = 0
    10 +SUBLEVEL = 1
    11 EXTRAVERSION =
    12 -NAME = Fearless Coyote
    13 +NAME = Petit Gorille
    14
    15 # *DOCUMENTATION*
    16 # To see a list of typical targets execute "make help"
    17 diff --git a/arch/sparc/include/asm/cmpxchg_32.h b/arch/sparc/include/asm/cmpxchg_32.h
    18 index 3e3823db303e..c73b5a3ab7b9 100644
    19 --- a/arch/sparc/include/asm/cmpxchg_32.h
    20 +++ b/arch/sparc/include/asm/cmpxchg_32.h
    21 @@ -63,6 +63,9 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
    22 (unsigned long)_n_, sizeof(*(ptr))); \
    23 })
    24
    25 +u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new);
    26 +#define cmpxchg64(ptr, old, new) __cmpxchg_u64(ptr, old, new)
    27 +
    28 #include <asm-generic/cmpxchg-local.h>
    29
    30 /*
    31 diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
    32 index e25d25b0a34b..b361702ef52a 100644
    33 --- a/arch/sparc/include/asm/mmu_context_64.h
    34 +++ b/arch/sparc/include/asm/mmu_context_64.h
    35 @@ -8,9 +8,11 @@
    36
    37 #include <linux/spinlock.h>
    38 #include <linux/mm_types.h>
    39 +#include <linux/smp.h>
    40
    41 #include <asm/spitfire.h>
    42 #include <asm-generic/mm_hooks.h>
    43 +#include <asm/percpu.h>
    44
    45 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
    46 {
    47 diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
    48 index 25b6abdb3908..522a677e050d 100644
    49 --- a/arch/sparc/include/asm/tsb.h
    50 +++ b/arch/sparc/include/asm/tsb.h
    51 @@ -217,7 +217,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    52 sllx REG2, 32, REG2; \
    53 andcc REG1, REG2, %g0; \
    54 be,pt %xcc, 700f; \
    55 - sethi %hi(0x1ffc0000), REG2; \
    56 + sethi %hi(0xffe00000), REG2; \
    57 sllx REG2, 1, REG2; \
    58 brgez,pn REG1, FAIL_LABEL; \
    59 andn REG1, REG2, REG1; \
    60 diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
    61 index 5010df497387..465a901a0ada 100644
    62 --- a/arch/sparc/lib/atomic32.c
    63 +++ b/arch/sparc/lib/atomic32.c
    64 @@ -173,6 +173,20 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
    65 }
    66 EXPORT_SYMBOL(__cmpxchg_u32);
    67
    68 +u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new)
    69 +{
    70 + unsigned long flags;
    71 + u64 prev;
    72 +
    73 + spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
    74 + if ((prev = *ptr) == old)
    75 + *ptr = new;
    76 + spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
    77 +
    78 + return prev;
    79 +}
    80 +EXPORT_SYMBOL(__cmpxchg_u64);
    81 +
    82 unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
    83 {
    84 unsigned long flags;
    85 diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
    86 index 87cc9ab7a13c..4b8187639c2d 100644
    87 --- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
    88 +++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
    89 @@ -245,6 +245,9 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
    90
    91 if (m->status & MCI_STATUS_UC) {
    92
    93 + if (ctx == IN_KERNEL)
    94 + return MCE_PANIC_SEVERITY;
    95 +
    96 /*
    97 * On older systems where overflow_recov flag is not present, we
    98 * should simply panic if an error overflow occurs. If
    99 @@ -255,10 +258,6 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
    100 if (mce_flags.smca)
    101 return mce_severity_amd_smca(m, ctx);
    102
    103 - /* software can try to contain */
    104 - if (!(m->mcgstatus & MCG_STATUS_RIPV) && (ctx == IN_KERNEL))
    105 - return MCE_PANIC_SEVERITY;
    106 -
    107 /* kill current process */
    108 return MCE_AR_SEVERITY;
    109 } else {
    110 diff --git a/crypto/dh.c b/crypto/dh.c
    111 index b1032a5c1bfa..aadaf36fb56f 100644
    112 --- a/crypto/dh.c
    113 +++ b/crypto/dh.c
    114 @@ -21,19 +21,12 @@ struct dh_ctx {
    115 MPI xa;
    116 };
    117
    118 -static inline void dh_clear_params(struct dh_ctx *ctx)
    119 +static void dh_clear_ctx(struct dh_ctx *ctx)
    120 {
    121 mpi_free(ctx->p);
    122 mpi_free(ctx->g);
    123 - ctx->p = NULL;
    124 - ctx->g = NULL;
    125 -}
    126 -
    127 -static void dh_free_ctx(struct dh_ctx *ctx)
    128 -{
    129 - dh_clear_params(ctx);
    130 mpi_free(ctx->xa);
    131 - ctx->xa = NULL;
    132 + memset(ctx, 0, sizeof(*ctx));
    133 }
    134
    135 /*
    136 @@ -71,10 +64,8 @@ static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
    137 return -EINVAL;
    138
    139 ctx->g = mpi_read_raw_data(params->g, params->g_size);
    140 - if (!ctx->g) {
    141 - mpi_free(ctx->p);
    142 + if (!ctx->g)
    143 return -EINVAL;
    144 - }
    145
    146 return 0;
    147 }
    148 @@ -86,21 +77,23 @@ static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
    149 struct dh params;
    150
    151 /* Free the old MPI key if any */
    152 - dh_free_ctx(ctx);
    153 + dh_clear_ctx(ctx);
    154
    155 if (crypto_dh_decode_key(buf, len, &params) < 0)
    156 - return -EINVAL;
    157 + goto err_clear_ctx;
    158
    159 if (dh_set_params(ctx, &params) < 0)
    160 - return -EINVAL;
    161 + goto err_clear_ctx;
    162
    163 ctx->xa = mpi_read_raw_data(params.key, params.key_size);
    164 - if (!ctx->xa) {
    165 - dh_clear_params(ctx);
    166 - return -EINVAL;
    167 - }
    168 + if (!ctx->xa)
    169 + goto err_clear_ctx;
    170
    171 return 0;
    172 +
    173 +err_clear_ctx:
    174 + dh_clear_ctx(ctx);
    175 + return -EINVAL;
    176 }
    177
    178 static int dh_compute_value(struct kpp_request *req)
    179 @@ -158,7 +151,7 @@ static void dh_exit_tfm(struct crypto_kpp *tfm)
    180 {
    181 struct dh_ctx *ctx = dh_get_ctx(tfm);
    182
    183 - dh_free_ctx(ctx);
    184 + dh_clear_ctx(ctx);
    185 }
    186
    187 static struct kpp_alg dh = {
    188 diff --git a/crypto/dh_helper.c b/crypto/dh_helper.c
    189 index 8ba8a3f82620..7f00c771fe8d 100644
    190 --- a/crypto/dh_helper.c
    191 +++ b/crypto/dh_helper.c
    192 @@ -83,6 +83,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
    193 if (secret.len != crypto_dh_key_len(params))
    194 return -EINVAL;
    195
    196 + /*
    197 + * Don't permit the buffer for 'key' or 'g' to be larger than 'p', since
    198 + * some drivers assume otherwise.
    199 + */
    200 + if (params->key_size > params->p_size ||
    201 + params->g_size > params->p_size)
    202 + return -EINVAL;
    203 +
    204 /* Don't allocate memory. Set pointers to data within
    205 * the given buffer
    206 */
    207 @@ -90,6 +98,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
    208 params->p = (void *)(ptr + params->key_size);
    209 params->g = (void *)(ptr + params->key_size + params->p_size);
    210
    211 + /*
    212 + * Don't permit 'p' to be 0. It's not a prime number, and it's subject
    213 + * to corner cases such as 'mod 0' being undefined or
    214 + * crypto_kpp_maxsize() returning 0.
    215 + */
    216 + if (memchr_inv(params->p, 0, params->p_size) == NULL)
    217 + return -EINVAL;
    218 +
    219 return 0;
    220 }
    221 EXPORT_SYMBOL_GPL(crypto_dh_decode_key);
    222 diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
    223 index 8685c7e4debd..ee52c355bee0 100644
    224 --- a/drivers/crypto/bcm/cipher.c
    225 +++ b/drivers/crypto/bcm/cipher.c
    226 @@ -256,6 +256,44 @@ spu_ablkcipher_tx_sg_create(struct brcm_message *mssg,
    227 return 0;
    228 }
    229
    230 +static int mailbox_send_message(struct brcm_message *mssg, u32 flags,
    231 + u8 chan_idx)
    232 +{
    233 + int err;
    234 + int retry_cnt = 0;
    235 + struct device *dev = &(iproc_priv.pdev->dev);
    236 +
    237 + err = mbox_send_message(iproc_priv.mbox[chan_idx], mssg);
    238 + if (flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    239 + while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    240 + /*
    241 + * Mailbox queue is full. Since MAY_SLEEP is set, assume
    242 + * not in atomic context and we can wait and try again.
    243 + */
    244 + retry_cnt++;
    245 + usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    246 + err = mbox_send_message(iproc_priv.mbox[chan_idx],
    247 + mssg);
    248 + atomic_inc(&iproc_priv.mb_no_spc);
    249 + }
    250 + }
    251 + if (err < 0) {
    252 + atomic_inc(&iproc_priv.mb_send_fail);
    253 + return err;
    254 + }
    255 +
    256 + /* Check error returned by mailbox controller */
    257 + err = mssg->error;
    258 + if (unlikely(err < 0)) {
    259 + dev_err(dev, "message error %d", err);
    260 + /* Signal txdone for mailbox channel */
    261 + }
    262 +
    263 + /* Signal txdone for mailbox channel */
    264 + mbox_client_txdone(iproc_priv.mbox[chan_idx], err);
    265 + return err;
    266 +}
    267 +
    268 /**
    269 * handle_ablkcipher_req() - Submit as much of a block cipher request as fits in
    270 * a single SPU request message, starting at the current position in the request
    271 @@ -293,7 +331,6 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
    272 u32 pad_len; /* total length of all padding */
    273 bool update_key = false;
    274 struct brcm_message *mssg; /* mailbox message */
    275 - int retry_cnt = 0;
    276
    277 /* number of entries in src and dst sg in mailbox message. */
    278 u8 rx_frag_num = 2; /* response header and STATUS */
    279 @@ -462,24 +499,9 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
    280 if (err)
    281 return err;
    282
    283 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    284 - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    285 - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    286 - /*
    287 - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    288 - * not in atomic context and we can wait and try again.
    289 - */
    290 - retry_cnt++;
    291 - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    292 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    293 - mssg);
    294 - atomic_inc(&iproc_priv.mb_no_spc);
    295 - }
    296 - }
    297 - if (unlikely(err < 0)) {
    298 - atomic_inc(&iproc_priv.mb_send_fail);
    299 + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    300 + if (unlikely(err < 0))
    301 return err;
    302 - }
    303
    304 return -EINPROGRESS;
    305 }
    306 @@ -710,7 +732,6 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
    307 u32 spu_hdr_len;
    308 unsigned int digestsize;
    309 u16 rem = 0;
    310 - int retry_cnt = 0;
    311
    312 /*
    313 * number of entries in src and dst sg. Always includes SPU msg header.
    314 @@ -904,24 +925,10 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
    315 if (err)
    316 return err;
    317
    318 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    319 - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    320 - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    321 - /*
    322 - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    323 - * not in atomic context and we can wait and try again.
    324 - */
    325 - retry_cnt++;
    326 - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    327 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    328 - mssg);
    329 - atomic_inc(&iproc_priv.mb_no_spc);
    330 - }
    331 - }
    332 - if (err < 0) {
    333 - atomic_inc(&iproc_priv.mb_send_fail);
    334 + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    335 + if (unlikely(err < 0))
    336 return err;
    337 - }
    338 +
    339 return -EINPROGRESS;
    340 }
    341
    342 @@ -1320,7 +1327,6 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
    343 int assoc_nents = 0;
    344 bool incl_icv = false;
    345 unsigned int digestsize = ctx->digestsize;
    346 - int retry_cnt = 0;
    347
    348 /* number of entries in src and dst sg. Always includes SPU msg header.
    349 */
    350 @@ -1558,24 +1564,9 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
    351 if (err)
    352 return err;
    353
    354 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
    355 - if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
    356 - while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
    357 - /*
    358 - * Mailbox queue is full. Since MAY_SLEEP is set, assume
    359 - * not in atomic context and we can wait and try again.
    360 - */
    361 - retry_cnt++;
    362 - usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
    363 - err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
    364 - mssg);
    365 - atomic_inc(&iproc_priv.mb_no_spc);
    366 - }
    367 - }
    368 - if (err < 0) {
    369 - atomic_inc(&iproc_priv.mb_send_fail);
    370 + err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
    371 + if (unlikely(err < 0))
    372 return err;
    373 - }
    374
    375 return -EINPROGRESS;
    376 }
    377 @@ -4537,7 +4528,7 @@ static int spu_mb_init(struct device *dev)
    378 mcl->dev = dev;
    379 mcl->tx_block = false;
    380 mcl->tx_tout = 0;
    381 - mcl->knows_txdone = false;
    382 + mcl->knows_txdone = true;
    383 mcl->rx_callback = spu_rx_callback;
    384 mcl->tx_done = NULL;
    385
    386 diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
    387 index 34ff53290b03..47edc7fbf91f 100644
    388 --- a/drivers/dma/dmatest.c
    389 +++ b/drivers/dma/dmatest.c
    390 @@ -702,6 +702,7 @@ static int dmatest_func(void *data)
    391 * free it this time?" dancing. For now, just
    392 * leave it dangling.
    393 */
    394 + WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
    395 dmaengine_unmap_put(um);
    396 result("test timed out", total_tests, src_off, dst_off,
    397 len, 0);
    398 diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
    399 index dc0591654011..6241fa787d66 100644
    400 --- a/drivers/edac/sb_edac.c
    401 +++ b/drivers/edac/sb_edac.c
    402 @@ -462,6 +462,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
    403 static const struct pci_id_descr pci_dev_descr_ibridge[] = {
    404 /* Processor Home Agent */
    405 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0, 0, IMC0) },
    406 + { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1, 1, IMC1) },
    407
    408 /* Memory controller */
    409 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA, 0, IMC0) },
    410 @@ -472,7 +473,6 @@ static const struct pci_id_descr pci_dev_descr_ibridge[] = {
    411 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TAD3, 0, IMC0) },
    412
    413 /* Optional, mode 2HA */
    414 - { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1, 1, IMC1) },
    415 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TA, 1, IMC1) },
    416 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_RAS, 1, IMC1) },
    417 { PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TAD0, 1, IMC1) },
    418 @@ -2291,6 +2291,13 @@ static int sbridge_get_onedevice(struct pci_dev **prev,
    419 next_imc:
    420 sbridge_dev = get_sbridge_dev(bus, dev_descr->dom, multi_bus, sbridge_dev);
    421 if (!sbridge_dev) {
    422 + /* If the HA1 wasn't found, don't create EDAC second memory controller */
    423 + if (dev_descr->dom == IMC1 && devno != 1) {
    424 + edac_dbg(0, "Skip IMC1: %04x:%04x (since HA1 was absent)\n",
    425 + PCI_VENDOR_ID_INTEL, dev_descr->dev_id);
    426 + pci_dev_put(pdev);
    427 + return 0;
    428 + }
    429
    430 if (dev_descr->dom == SOCK)
    431 goto out_imc;
    432 diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
    433 index 374301fcbc86..8c7a0ce147a1 100644
    434 --- a/drivers/hid/Kconfig
    435 +++ b/drivers/hid/Kconfig
    436 @@ -230,7 +230,7 @@ config HID_CMEDIA
    437
    438 config HID_CP2112
    439 tristate "Silicon Labs CP2112 HID USB-to-SMBus Bridge support"
    440 - depends on USB_HID && I2C && GPIOLIB
    441 + depends on USB_HID && HIDRAW && I2C && GPIOLIB
    442 select GPIOLIB_IRQCHIP
    443 ---help---
    444 Support for Silicon Labs CP2112 HID USB to SMBus Master Bridge.
    445 diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
    446 index 8a03654048bf..feb62fd4dfc3 100644
    447 --- a/drivers/hid/wacom_wac.h
    448 +++ b/drivers/hid/wacom_wac.h
    449 @@ -166,6 +166,7 @@
    450 ((f)->physical == HID_DG_PEN) || \
    451 ((f)->application == HID_DG_PEN) || \
    452 ((f)->application == HID_DG_DIGITIZER) || \
    453 + ((f)->application == WACOM_HID_WD_PEN) || \
    454 ((f)->application == WACOM_HID_WD_DIGITIZER) || \
    455 ((f)->application == WACOM_HID_G9_PEN) || \
    456 ((f)->application == WACOM_HID_G11_PEN))
    457 diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
    458 index 7b3f31cc63d2..0c46155a8e9d 100644
    459 --- a/drivers/media/rc/imon.c
    460 +++ b/drivers/media/rc/imon.c
    461 @@ -2517,6 +2517,11 @@ static int imon_probe(struct usb_interface *interface,
    462 mutex_lock(&driver_lock);
    463
    464 first_if = usb_ifnum_to_if(usbdev, 0);
    465 + if (!first_if) {
    466 + ret = -ENODEV;
    467 + goto fail;
    468 + }
    469 +
    470 first_if_ctx = usb_get_intfdata(first_if);
    471
    472 if (ifnum == 0) {
    473 diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
    474 index 6020170fe99a..92098c1b78e5 100644
    475 --- a/drivers/media/usb/dvb-usb/dib0700_devices.c
    476 +++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
    477 @@ -291,7 +291,7 @@ static int stk7700P2_frontend_attach(struct dvb_usb_adapter *adap)
    478 stk7700d_dib7000p_mt2266_config)
    479 != 0) {
    480 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    481 - dvb_detach(&state->dib7000p_ops);
    482 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    483 return -ENODEV;
    484 }
    485 }
    486 @@ -325,7 +325,7 @@ static int stk7700d_frontend_attach(struct dvb_usb_adapter *adap)
    487 stk7700d_dib7000p_mt2266_config)
    488 != 0) {
    489 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    490 - dvb_detach(&state->dib7000p_ops);
    491 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    492 return -ENODEV;
    493 }
    494 }
    495 @@ -478,7 +478,7 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap)
    496 &stk7700ph_dib7700_xc3028_config) != 0) {
    497 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    498 __func__);
    499 - dvb_detach(&state->dib7000p_ops);
    500 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    501 return -ENODEV;
    502 }
    503
    504 @@ -1010,7 +1010,7 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
    505 &dib7070p_dib7000p_config) != 0) {
    506 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    507 __func__);
    508 - dvb_detach(&state->dib7000p_ops);
    509 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    510 return -ENODEV;
    511 }
    512
    513 @@ -1068,7 +1068,7 @@ static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
    514 &dib7770p_dib7000p_config) != 0) {
    515 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    516 __func__);
    517 - dvb_detach(&state->dib7000p_ops);
    518 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    519 return -ENODEV;
    520 }
    521
    522 @@ -3056,7 +3056,7 @@ static int nim7090_frontend_attach(struct dvb_usb_adapter *adap)
    523
    524 if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x10, &nim7090_dib7000p_config) != 0) {
    525 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    526 - dvb_detach(&state->dib7000p_ops);
    527 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    528 return -ENODEV;
    529 }
    530 adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, 0x80, &nim7090_dib7000p_config);
    531 @@ -3109,7 +3109,7 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
    532 /* initialize IC 0 */
    533 if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, &tfe7090pvr_dib7000p_config[0]) != 0) {
    534 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    535 - dvb_detach(&state->dib7000p_ops);
    536 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    537 return -ENODEV;
    538 }
    539
    540 @@ -3139,7 +3139,7 @@ static int tfe7090pvr_frontend1_attach(struct dvb_usb_adapter *adap)
    541 i2c = state->dib7000p_ops.get_i2c_master(adap->dev->adapter[0].fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_6_7, 1);
    542 if (state->dib7000p_ops.i2c_enumeration(i2c, 1, 0x10, &tfe7090pvr_dib7000p_config[1]) != 0) {
    543 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__);
    544 - dvb_detach(&state->dib7000p_ops);
    545 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    546 return -ENODEV;
    547 }
    548
    549 @@ -3214,7 +3214,7 @@ static int tfe7790p_frontend_attach(struct dvb_usb_adapter *adap)
    550 1, 0x10, &tfe7790p_dib7000p_config) != 0) {
    551 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    552 __func__);
    553 - dvb_detach(&state->dib7000p_ops);
    554 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    555 return -ENODEV;
    556 }
    557 adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap,
    558 @@ -3309,7 +3309,7 @@ static int stk7070pd_frontend_attach0(struct dvb_usb_adapter *adap)
    559 stk7070pd_dib7000p_config) != 0) {
    560 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    561 __func__);
    562 - dvb_detach(&state->dib7000p_ops);
    563 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    564 return -ENODEV;
    565 }
    566
    567 @@ -3384,7 +3384,7 @@ static int novatd_frontend_attach(struct dvb_usb_adapter *adap)
    568 stk7070pd_dib7000p_config) != 0) {
    569 err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n",
    570 __func__);
    571 - dvb_detach(&state->dib7000p_ops);
    572 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    573 return -ENODEV;
    574 }
    575 }
    576 @@ -3620,7 +3620,7 @@ static int pctv340e_frontend_attach(struct dvb_usb_adapter *adap)
    577
    578 if (state->dib7000p_ops.dib7000pc_detection(&adap->dev->i2c_adap) == 0) {
    579 /* Demodulator not found for some reason? */
    580 - dvb_detach(&state->dib7000p_ops);
    581 + dvb_detach(state->dib7000p_ops.set_wbd_ref);
    582 return -ENODEV;
    583 }
    584
    585 diff --git a/drivers/platform/x86/peaq-wmi.c b/drivers/platform/x86/peaq-wmi.c
    586 index bc98ef95514a..2da48ecc90c1 100644
    587 --- a/drivers/platform/x86/peaq-wmi.c
    588 +++ b/drivers/platform/x86/peaq-wmi.c
    589 @@ -8,6 +8,7 @@
    590 */
    591
    592 #include <linux/acpi.h>
    593 +#include <linux/dmi.h>
    594 #include <linux/input-polldev.h>
    595 #include <linux/kernel.h>
    596 #include <linux/module.h>
    597 @@ -64,8 +65,23 @@ static void peaq_wmi_poll(struct input_polled_dev *dev)
    598 }
    599 }
    600
    601 +/* Some other devices (Shuttle XS35) use the same WMI GUID for other purposes */
    602 +static const struct dmi_system_id peaq_dmi_table[] = {
    603 + {
    604 + .matches = {
    605 + DMI_MATCH(DMI_SYS_VENDOR, "PEAQ"),
    606 + DMI_MATCH(DMI_PRODUCT_NAME, "PEAQ PMM C1010 MD99187"),
    607 + },
    608 + },
    609 + {}
    610 +};
    611 +
    612 static int __init peaq_wmi_init(void)
    613 {
    614 + /* WMI GUID is not unique, also check for a DMI match */
    615 + if (!dmi_check_system(peaq_dmi_table))
    616 + return -ENODEV;
    617 +
    618 if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
    619 return -ENODEV;
    620
    621 @@ -86,6 +102,9 @@ static int __init peaq_wmi_init(void)
    622
    623 static void __exit peaq_wmi_exit(void)
    624 {
    625 + if (!dmi_check_system(peaq_dmi_table))
    626 + return;
    627 +
    628 if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
    629 return;
    630
    631 diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
    632 index 5dcc9bf1c5bc..e3242a0925a6 100644
    633 --- a/drivers/rpmsg/qcom_glink_native.c
    634 +++ b/drivers/rpmsg/qcom_glink_native.c
    635 @@ -1616,3 +1616,6 @@ void qcom_glink_native_unregister(struct qcom_glink *glink)
    636 device_unregister(glink->dev);
    637 }
    638 EXPORT_SYMBOL_GPL(qcom_glink_native_unregister);
    639 +
    640 +MODULE_DESCRIPTION("Qualcomm GLINK driver");
    641 +MODULE_LICENSE("GPL v2");
    642 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
    643 index e8b5a5e21b2e..3ff0ee88c467 100644
    644 --- a/drivers/spi/spi.c
    645 +++ b/drivers/spi/spi.c
    646 @@ -2245,11 +2245,12 @@ static int __unregister(struct device *dev, void *null)
    647 void spi_unregister_controller(struct spi_controller *ctlr)
    648 {
    649 struct spi_controller *found;
    650 + int id = ctlr->bus_num;
    651 int dummy;
    652
    653 /* First make sure that this controller was ever added */
    654 mutex_lock(&board_lock);
    655 - found = idr_find(&spi_master_idr, ctlr->bus_num);
    656 + found = idr_find(&spi_master_idr, id);
    657 mutex_unlock(&board_lock);
    658 if (found != ctlr) {
    659 dev_dbg(&ctlr->dev,
    660 @@ -2269,7 +2270,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
    661 device_unregister(&ctlr->dev);
    662 /* free bus id */
    663 mutex_lock(&board_lock);
    664 - idr_remove(&spi_master_idr, ctlr->bus_num);
    665 + idr_remove(&spi_master_idr, id);
    666 mutex_unlock(&board_lock);
    667 }
    668 EXPORT_SYMBOL_GPL(spi_unregister_controller);
    669 diff --git a/drivers/staging/ccree/cc_lli_defs.h b/drivers/staging/ccree/cc_lli_defs.h
    670 index 851d3907167e..a9c417b07b04 100644
    671 --- a/drivers/staging/ccree/cc_lli_defs.h
    672 +++ b/drivers/staging/ccree/cc_lli_defs.h
    673 @@ -59,7 +59,7 @@ static inline void cc_lli_set_addr(u32 *lli_p, dma_addr_t addr)
    674 lli_p[LLI_WORD0_OFFSET] = (addr & U32_MAX);
    675 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
    676 lli_p[LLI_WORD1_OFFSET] &= ~LLI_HADDR_MASK;
    677 - lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 16));
    678 + lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 32));
    679 #endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT */
    680 }
    681
    682 diff --git a/drivers/staging/greybus/spilib.c b/drivers/staging/greybus/spilib.c
    683 index e97b19148497..1e7321a1404c 100644
    684 --- a/drivers/staging/greybus/spilib.c
    685 +++ b/drivers/staging/greybus/spilib.c
    686 @@ -544,11 +544,14 @@ int gb_spilib_master_init(struct gb_connection *connection, struct device *dev,
    687
    688 return 0;
    689
    690 -exit_spi_unregister:
    691 - spi_unregister_master(master);
    692 exit_spi_put:
    693 spi_master_put(master);
    694
    695 + return ret;
    696 +
    697 +exit_spi_unregister:
    698 + spi_unregister_master(master);
    699 +
    700 return ret;
    701 }
    702 EXPORT_SYMBOL_GPL(gb_spilib_master_init);
    703 @@ -558,7 +561,6 @@ void gb_spilib_master_exit(struct gb_connection *connection)
    704 struct spi_master *master = gb_connection_get_data(connection);
    705
    706 spi_unregister_master(master);
    707 - spi_master_put(master);
    708 }
    709 EXPORT_SYMBOL_GPL(gb_spilib_master_exit);
    710
    711 diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
    712 index 3fd5f4102b36..afb9dadc1cfe 100644
    713 --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
    714 +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
    715 @@ -259,10 +259,12 @@ static int recvframe_chkmic(struct adapter *adapter,
    716 }
    717
    718 /* icv_len included the mic code */
    719 - datalen = precvframe->pkt->len-prxattrib->hdrlen - 8;
    720 + datalen = precvframe->pkt->len-prxattrib->hdrlen -
    721 + prxattrib->iv_len-prxattrib->icv_len-8;
    722 pframe = precvframe->pkt->data;
    723 - payload = pframe+prxattrib->hdrlen;
    724 + payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
    725
    726 + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
    727 rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
    728 (unsigned char)prxattrib->priority); /* care the length of the data */
    729
    730 @@ -407,15 +409,9 @@ static struct recv_frame *decryptor(struct adapter *padapter,
    731 default:
    732 break;
    733 }
    734 - if (res != _FAIL) {
    735 - memmove(precv_frame->pkt->data + precv_frame->attrib.iv_len, precv_frame->pkt->data, precv_frame->attrib.hdrlen);
    736 - skb_pull(precv_frame->pkt, precv_frame->attrib.iv_len);
    737 - skb_trim(precv_frame->pkt, precv_frame->pkt->len - precv_frame->attrib.icv_len);
    738 - }
    739 } else if (prxattrib->bdecrypted == 1 && prxattrib->encrypt > 0 &&
    740 - (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_)) {
    741 - psecuritypriv->hw_decrypted = true;
    742 - }
    743 + (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_))
    744 + psecuritypriv->hw_decrypted = true;
    745
    746 if (res == _FAIL) {
    747 rtw_free_recvframe(return_packet, &padapter->recvpriv.free_recv_queue);
    748 @@ -456,7 +452,7 @@ static struct recv_frame *portctrl(struct adapter *adapter,
    749
    750 if (auth_alg == 2) {
    751 /* get ether_type */
    752 - ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
    753 + ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE + pfhdr->attrib.iv_len;
    754 memcpy(&be_tmp, ptr, 2);
    755 ether_type = ntohs(be_tmp);
    756
    757 @@ -1138,8 +1134,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
    758 }
    759
    760 if (pattrib->privacy) {
    761 - struct sk_buff *skb = precv_frame->pkt;
    762 -
    763 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
    764 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0], IS_MCAST(pattrib->ra)));
    765
    766 @@ -1148,13 +1142,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
    767 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n pattrib->encrypt=%d\n", pattrib->encrypt));
    768
    769 SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
    770 -
    771 - if (pattrib->bdecrypted == 1 && pattrib->encrypt > 0) {
    772 - memmove(skb->data + pattrib->iv_len,
    773 - skb->data, pattrib->hdrlen);
    774 - skb_pull(skb, pattrib->iv_len);
    775 - skb_trim(skb, skb->len - pattrib->icv_len);
    776 - }
    777 } else {
    778 pattrib->encrypt = 0;
    779 pattrib->iv_len = 0;
    780 @@ -1274,7 +1261,6 @@ static int validate_recv_frame(struct adapter *adapter,
    781 * Hence forward the frame to the monitor anyway to preserve the order
    782 * in which frames were received.
    783 */
    784 -
    785 rtl88eu_mon_recv_hook(adapter->pmondev, precv_frame);
    786
    787 exit:
    788 @@ -1296,8 +1282,11 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
    789 u8 *ptr = precvframe->pkt->data;
    790 struct rx_pkt_attrib *pattrib = &precvframe->attrib;
    791
    792 - psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen);
    793 - psnap_type = ptr+pattrib->hdrlen + SNAP_SIZE;
    794 + if (pattrib->encrypt)
    795 + skb_trim(precvframe->pkt, precvframe->pkt->len - pattrib->icv_len);
    796 +
    797 + psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
    798 + psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
    799 /* convert hdr + possible LLC headers into Ethernet header */
    800 if ((!memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
    801 (!memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == false) &&
    802 @@ -1310,9 +1299,12 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
    803 bsnaphdr = false;
    804 }
    805
    806 - rmv_len = pattrib->hdrlen + (bsnaphdr ? SNAP_SIZE : 0);
    807 + rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
    808 len = precvframe->pkt->len - rmv_len;
    809
    810 + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
    811 + ("\n===pattrib->hdrlen: %x, pattrib->iv_len:%x===\n\n", pattrib->hdrlen, pattrib->iv_len));
    812 +
    813 memcpy(&be_tmp, ptr+rmv_len, 2);
    814 eth_type = ntohs(be_tmp); /* pattrib->ether_type */
    815 pattrib->eth_type = eth_type;
    816 @@ -1337,6 +1329,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    817 struct __queue *defrag_q)
    818 {
    819 struct list_head *plist, *phead;
    820 + u8 wlanhdr_offset;
    821 u8 curfragnum;
    822 struct recv_frame *pfhdr, *pnfhdr;
    823 struct recv_frame *prframe, *pnextrframe;
    824 @@ -1385,7 +1378,12 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    825 /* copy the 2nd~n fragment frame's payload to the first fragment */
    826 /* get the 2nd~last fragment frame's payload */
    827
    828 - skb_pull(pnextrframe->pkt, pnfhdr->attrib.hdrlen);
    829 + wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
    830 +
    831 + skb_pull(pnextrframe->pkt, wlanhdr_offset);
    832 +
    833 + /* append to first fragment frame's tail (if privacy frame, pull the ICV) */
    834 + skb_trim(prframe->pkt, prframe->pkt->len - pfhdr->attrib.icv_len);
    835
    836 /* memcpy */
    837 memcpy(skb_tail_pointer(pfhdr->pkt), pnfhdr->pkt->data,
    838 @@ -1393,7 +1391,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
    839
    840 skb_put(prframe->pkt, pnfhdr->pkt->len);
    841
    842 - pfhdr->attrib.icv_len = 0;
    843 + pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
    844 plist = plist->next;
    845 }
    846
    847 @@ -1519,6 +1517,11 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
    848 nr_subframes = 0;
    849 pattrib = &prframe->attrib;
    850
    851 + skb_pull(prframe->pkt, prframe->attrib.hdrlen);
    852 +
    853 + if (prframe->attrib.iv_len > 0)
    854 + skb_pull(prframe->pkt, prframe->attrib.iv_len);
    855 +
    856 a_len = prframe->pkt->len;
    857
    858 pdata = prframe->pkt->data;
    859 @@ -1887,6 +1890,24 @@ static int process_recv_indicatepkts(struct adapter *padapter,
    860 return retval;
    861 }
    862
    863 +static int recv_func_prehandle(struct adapter *padapter,
    864 + struct recv_frame *rframe)
    865 +{
    866 + int ret = _SUCCESS;
    867 + struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
    868 +
    869 + /* check the frame crtl field and decache */
    870 + ret = validate_recv_frame(padapter, rframe);
    871 + if (ret != _SUCCESS) {
    872 + RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
    873 + rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
    874 + goto exit;
    875 + }
    876 +
    877 +exit:
    878 + return ret;
    879 +}
    880 +
    881 static int recv_func_posthandle(struct adapter *padapter,
    882 struct recv_frame *prframe)
    883 {
    884 @@ -1939,7 +1960,6 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
    885 struct rx_pkt_attrib *prxattrib = &rframe->attrib;
    886 struct security_priv *psecuritypriv = &padapter->securitypriv;
    887 struct mlme_priv *mlmepriv = &padapter->mlmepriv;
    888 - struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
    889
    890 /* check if need to handle uc_swdec_pending_queue*/
    891 if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey) {
    892 @@ -1951,12 +1971,9 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
    893 }
    894 }
    895
    896 - /* check the frame crtl field and decache */
    897 - ret = validate_recv_frame(padapter, rframe);
    898 - if (ret != _SUCCESS) {
    899 - RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
    900 - rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
    901 - } else {
    902 + ret = recv_func_prehandle(padapter, rframe);
    903 +
    904 + if (ret == _SUCCESS) {
    905 /* check if need to enqueue into uc_swdec_pending_queue*/
    906 if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
    907 !IS_MCAST(prxattrib->ra) && prxattrib->encrypt > 0 &&
    908 diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
    909 index 37fd52d7364f..225c23fc69dc 100644
    910 --- a/drivers/staging/rtl8188eu/os_dep/mon.c
    911 +++ b/drivers/staging/rtl8188eu/os_dep/mon.c
    912 @@ -66,34 +66,6 @@ static void mon_recv_decrypted(struct net_device *dev, const u8 *data,
    913 netif_rx(skb);
    914 }
    915
    916 -static void mon_recv_decrypted_recv(struct net_device *dev, const u8 *data,
    917 - int data_len)
    918 -{
    919 - struct sk_buff *skb;
    920 - struct ieee80211_hdr *hdr;
    921 - int hdr_len;
    922 -
    923 - skb = netdev_alloc_skb(dev, data_len);
    924 - if (!skb)
    925 - return;
    926 - memcpy(skb_put(skb, data_len), data, data_len);
    927 -
    928 - /*
    929 - * Frame data is not encrypted. Strip off protection so
    930 - * userspace doesn't think that it is.
    931 - */
    932 -
    933 - hdr = (struct ieee80211_hdr *)skb->data;
    934 - hdr_len = ieee80211_hdrlen(hdr->frame_control);
    935 -
    936 - if (ieee80211_has_protected(hdr->frame_control))
    937 - hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_PROTECTED);
    938 -
    939 - skb->ip_summed = CHECKSUM_UNNECESSARY;
    940 - skb->protocol = eth_type_trans(skb, dev);
    941 - netif_rx(skb);
    942 -}
    943 -
    944 static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
    945 int data_len)
    946 {
    947 @@ -110,6 +82,7 @@ static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
    948 void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
    949 {
    950 struct rx_pkt_attrib *attr;
    951 + int iv_len, icv_len;
    952 int data_len;
    953 u8 *data;
    954
    955 @@ -122,8 +95,11 @@ void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
    956 data = frame->pkt->data;
    957 data_len = frame->pkt->len;
    958
    959 + /* Broadcast and multicast frames don't have attr->{iv,icv}_len set */
    960 + SET_ICE_IV_LEN(iv_len, icv_len, attr->encrypt);
    961 +
    962 if (attr->bdecrypted)
    963 - mon_recv_decrypted_recv(dev, data, data_len);
    964 + mon_recv_decrypted(dev, data, data_len, iv_len, icv_len);
    965 else
    966 mon_recv_encrypted(dev, data, data_len);
    967 }
    968 diff --git a/drivers/staging/sm750fb/ddk750_chip.h b/drivers/staging/sm750fb/ddk750_chip.h
    969 index 09c223f815de..aee82fcaf669 100644
    970 --- a/drivers/staging/sm750fb/ddk750_chip.h
    971 +++ b/drivers/staging/sm750fb/ddk750_chip.h
    972 @@ -18,7 +18,7 @@ static inline u32 peek32(u32 addr)
    973 return readl(addr + mmio750);
    974 }
    975
    976 -static inline void poke32(u32 data, u32 addr)
    977 +static inline void poke32(u32 addr, u32 data)
    978 {
    979 writel(data, addr + mmio750);
    980 }
    981 diff --git a/drivers/staging/vboxvideo/vbox_drv.h b/drivers/staging/vboxvideo/vbox_drv.h
    982 index 4b9302703b36..eeac4f0cb2c6 100644
    983 --- a/drivers/staging/vboxvideo/vbox_drv.h
    984 +++ b/drivers/staging/vboxvideo/vbox_drv.h
    985 @@ -137,8 +137,8 @@ struct vbox_connector {
    986 char name[32];
    987 struct vbox_crtc *vbox_crtc;
    988 struct {
    989 - u16 width;
    990 - u16 height;
    991 + u32 width;
    992 + u32 height;
    993 bool disconnected;
    994 } mode_hint;
    995 };
    996 @@ -150,8 +150,8 @@ struct vbox_crtc {
    997 unsigned int crtc_id;
    998 u32 fb_offset;
    999 bool cursor_enabled;
    1000 - u16 x_hint;
    1001 - u16 y_hint;
    1002 + u32 x_hint;
    1003 + u32 y_hint;
    1004 };
    1005
    1006 struct vbox_encoder {
    1007 diff --git a/drivers/staging/vboxvideo/vbox_irq.c b/drivers/staging/vboxvideo/vbox_irq.c
    1008 index 3ca8bec62ac4..74abdf02d9fd 100644
    1009 --- a/drivers/staging/vboxvideo/vbox_irq.c
    1010 +++ b/drivers/staging/vboxvideo/vbox_irq.c
    1011 @@ -150,8 +150,8 @@ static void vbox_update_mode_hints(struct vbox_private *vbox)
    1012
    1013 disconnected = !(hints->enabled);
    1014 crtc_id = vbox_conn->vbox_crtc->crtc_id;
    1015 - vbox_conn->mode_hint.width = hints->cx & 0x8fff;
    1016 - vbox_conn->mode_hint.height = hints->cy & 0x8fff;
    1017 + vbox_conn->mode_hint.width = hints->cx;
    1018 + vbox_conn->mode_hint.height = hints->cy;
    1019 vbox_conn->vbox_crtc->x_hint = hints->dx;
    1020 vbox_conn->vbox_crtc->y_hint = hints->dy;
    1021 vbox_conn->mode_hint.disconnected = disconnected;
    1022 diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
    1023 index 257a77830410..6f08dc966719 100644
    1024 --- a/drivers/staging/vboxvideo/vbox_mode.c
    1025 +++ b/drivers/staging/vboxvideo/vbox_mode.c
    1026 @@ -553,12 +553,22 @@ static int vbox_get_modes(struct drm_connector *connector)
    1027 ++num_modes;
    1028 }
    1029 vbox_set_edid(connector, preferred_width, preferred_height);
    1030 - drm_object_property_set_value(
    1031 - &connector->base, vbox->dev->mode_config.suggested_x_property,
    1032 - vbox_connector->vbox_crtc->x_hint);
    1033 - drm_object_property_set_value(
    1034 - &connector->base, vbox->dev->mode_config.suggested_y_property,
    1035 - vbox_connector->vbox_crtc->y_hint);
    1036 +
    1037 + if (vbox_connector->vbox_crtc->x_hint != -1)
    1038 + drm_object_property_set_value(&connector->base,
    1039 + vbox->dev->mode_config.suggested_x_property,
    1040 + vbox_connector->vbox_crtc->x_hint);
    1041 + else
    1042 + drm_object_property_set_value(&connector->base,
    1043 + vbox->dev->mode_config.suggested_x_property, 0);
    1044 +
    1045 + if (vbox_connector->vbox_crtc->y_hint != -1)
    1046 + drm_object_property_set_value(&connector->base,
    1047 + vbox->dev->mode_config.suggested_y_property,
    1048 + vbox_connector->vbox_crtc->y_hint);
    1049 + else
    1050 + drm_object_property_set_value(&connector->base,
    1051 + vbox->dev->mode_config.suggested_y_property, 0);
    1052
    1053 return num_modes;
    1054 }
    1055 @@ -640,9 +650,9 @@ static int vbox_connector_init(struct drm_device *dev,
    1056
    1057 drm_mode_create_suggested_offset_properties(dev);
    1058 drm_object_attach_property(&connector->base,
    1059 - dev->mode_config.suggested_x_property, -1);
    1060 + dev->mode_config.suggested_x_property, 0);
    1061 drm_object_attach_property(&connector->base,
    1062 - dev->mode_config.suggested_y_property, -1);
    1063 + dev->mode_config.suggested_y_property, 0);
    1064 drm_connector_register(connector);
    1065
    1066 drm_mode_connector_attach_encoder(connector, encoder);
    1067 diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
    1068 index 9addef1f1e12..f49dfa82f1b8 100644
    1069 --- a/drivers/staging/wilc1000/wilc_wlan.c
    1070 +++ b/drivers/staging/wilc1000/wilc_wlan.c
    1071 @@ -714,7 +714,7 @@ int wilc_wlan_handle_txq(struct net_device *dev, u32 *txq_count)
    1072 char *bssid = ((struct tx_complete_data *)(tqe->priv))->bssid;
    1073
    1074 buffer_offset = ETH_ETHERNET_HDR_OFFSET;
    1075 - memcpy(&txb[offset + 4], bssid, 6);
    1076 + memcpy(&txb[offset + 8], bssid, 6);
    1077 } else {
    1078 buffer_offset = HOST_HDR_OFFSET;
    1079 }
    1080 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    1081 index e9326f31db8d..98c666ef9a57 100644
    1082 --- a/drivers/usb/core/devio.c
    1083 +++ b/drivers/usb/core/devio.c
    1084 @@ -1833,6 +1833,18 @@ static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
    1085 return 0;
    1086 }
    1087
    1088 +static void compute_isochronous_actual_length(struct urb *urb)
    1089 +{
    1090 + unsigned int i;
    1091 +
    1092 + if (urb->number_of_packets > 0) {
    1093 + urb->actual_length = 0;
    1094 + for (i = 0; i < urb->number_of_packets; i++)
    1095 + urb->actual_length +=
    1096 + urb->iso_frame_desc[i].actual_length;
    1097 + }
    1098 +}
    1099 +
    1100 static int processcompl(struct async *as, void __user * __user *arg)
    1101 {
    1102 struct urb *urb = as->urb;
    1103 @@ -1840,6 +1852,7 @@ static int processcompl(struct async *as, void __user * __user *arg)
    1104 void __user *addr = as->userurb;
    1105 unsigned int i;
    1106
    1107 + compute_isochronous_actual_length(urb);
    1108 if (as->userbuffer && urb->actual_length) {
    1109 if (copy_urb_data_to_user(as->userbuffer, urb))
    1110 goto err_out;
    1111 @@ -2008,6 +2021,7 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
    1112 void __user *addr = as->userurb;
    1113 unsigned int i;
    1114
    1115 + compute_isochronous_actual_length(urb);
    1116 if (as->userbuffer && urb->actual_length) {
    1117 if (copy_urb_data_to_user(as->userbuffer, urb))
    1118 return -EFAULT;
    1119 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    1120 index a6aaf2f193a4..37c418e581fb 100644
    1121 --- a/drivers/usb/core/quirks.c
    1122 +++ b/drivers/usb/core/quirks.c
    1123 @@ -221,6 +221,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1124 /* Corsair Strafe RGB */
    1125 { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
    1126
    1127 + /* Corsair K70 LUX */
    1128 + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
    1129 +
    1130 /* MIDI keyboard WORLDE MINI */
    1131 { USB_DEVICE(0x1c75, 0x0204), .driver_info =
    1132 USB_QUIRK_CONFIG_INTF_STRINGS },
    1133 diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
    1134 index 2df0f6e613fe..a516cab0bf4a 100644
    1135 --- a/drivers/usb/early/xhci-dbc.h
    1136 +++ b/drivers/usb/early/xhci-dbc.h
    1137 @@ -90,8 +90,8 @@ struct xdbc_context {
    1138
    1139 #define XDBC_INFO_CONTEXT_SIZE 48
    1140 #define XDBC_MAX_STRING_LENGTH 64
    1141 -#define XDBC_STRING_MANUFACTURER "Linux"
    1142 -#define XDBC_STRING_PRODUCT "Remote GDB"
    1143 +#define XDBC_STRING_MANUFACTURER "Linux Foundation"
    1144 +#define XDBC_STRING_PRODUCT "Linux USB GDB Target"
    1145 #define XDBC_STRING_SERIAL "0001"
    1146
    1147 struct xdbc_strings {
    1148 @@ -103,7 +103,7 @@ struct xdbc_strings {
    1149
    1150 #define XDBC_PROTOCOL 1 /* GNU Remote Debug Command Set */
    1151 #define XDBC_VENDOR_ID 0x1d6b /* Linux Foundation 0x1d6b */
    1152 -#define XDBC_PRODUCT_ID 0x0004 /* __le16 idProduct; device 0004 */
    1153 +#define XDBC_PRODUCT_ID 0x0011 /* __le16 idProduct; device 0011 */
    1154 #define XDBC_DEVICE_REV 0x0010 /* 0.10 */
    1155
    1156 /*
    1157 diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
    1158 index 8b342587f8ad..ef8f7d63a8f0 100644
    1159 --- a/drivers/usb/gadget/function/f_fs.c
    1160 +++ b/drivers/usb/gadget/function/f_fs.c
    1161 @@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data *ffs)
    1162 goto done;
    1163
    1164 ffs_obj->desc_ready = false;
    1165 + ffs_obj->ffs_data = NULL;
    1166
    1167 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
    1168 ffs_obj->ffs_closed_callback)
    1169 diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
    1170 index b2f2e87aed94..91e7e3a166a5 100644
    1171 --- a/drivers/usb/serial/garmin_gps.c
    1172 +++ b/drivers/usb/serial/garmin_gps.c
    1173 @@ -138,6 +138,7 @@ struct garmin_data {
    1174 __u8 privpkt[4*6];
    1175 spinlock_t lock;
    1176 struct list_head pktlist;
    1177 + struct usb_anchor write_urbs;
    1178 };
    1179
    1180
    1181 @@ -905,13 +906,19 @@ static int garmin_init_session(struct usb_serial_port *port)
    1182 sizeof(GARMIN_START_SESSION_REQ), 0);
    1183
    1184 if (status < 0)
    1185 - break;
    1186 + goto err_kill_urbs;
    1187 }
    1188
    1189 if (status > 0)
    1190 status = 0;
    1191 }
    1192
    1193 + return status;
    1194 +
    1195 +err_kill_urbs:
    1196 + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1197 + usb_kill_urb(port->interrupt_in_urb);
    1198 +
    1199 return status;
    1200 }
    1201
    1202 @@ -930,7 +937,6 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port)
    1203 spin_unlock_irqrestore(&garmin_data_p->lock, flags);
    1204
    1205 /* shutdown any bulk reads that might be going on */
    1206 - usb_kill_urb(port->write_urb);
    1207 usb_kill_urb(port->read_urb);
    1208
    1209 if (garmin_data_p->state == STATE_RESET)
    1210 @@ -953,7 +959,7 @@ static void garmin_close(struct usb_serial_port *port)
    1211
    1212 /* shutdown our urbs */
    1213 usb_kill_urb(port->read_urb);
    1214 - usb_kill_urb(port->write_urb);
    1215 + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1216
    1217 /* keep reset state so we know that we must start a new session */
    1218 if (garmin_data_p->state != STATE_RESET)
    1219 @@ -1037,12 +1043,14 @@ static int garmin_write_bulk(struct usb_serial_port *port,
    1220 }
    1221
    1222 /* send it down the pipe */
    1223 + usb_anchor_urb(urb, &garmin_data_p->write_urbs);
    1224 status = usb_submit_urb(urb, GFP_ATOMIC);
    1225 if (status) {
    1226 dev_err(&port->dev,
    1227 "%s - usb_submit_urb(write bulk) failed with status = %d\n",
    1228 __func__, status);
    1229 count = status;
    1230 + usb_unanchor_urb(urb);
    1231 kfree(buffer);
    1232 }
    1233
    1234 @@ -1401,9 +1409,16 @@ static int garmin_port_probe(struct usb_serial_port *port)
    1235 garmin_data_p->state = 0;
    1236 garmin_data_p->flags = 0;
    1237 garmin_data_p->count = 0;
    1238 + init_usb_anchor(&garmin_data_p->write_urbs);
    1239 usb_set_serial_port_data(port, garmin_data_p);
    1240
    1241 status = garmin_init_session(port);
    1242 + if (status)
    1243 + goto err_free;
    1244 +
    1245 + return 0;
    1246 +err_free:
    1247 + kfree(garmin_data_p);
    1248
    1249 return status;
    1250 }
    1251 @@ -1413,6 +1428,7 @@ static int garmin_port_remove(struct usb_serial_port *port)
    1252 {
    1253 struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
    1254
    1255 + usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
    1256 usb_kill_urb(port->interrupt_in_urb);
    1257 del_timer_sync(&garmin_data_p->timer);
    1258 kfree(garmin_data_p);
    1259 diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
    1260 index 14511d6a7d44..3950d44b80f1 100644
    1261 --- a/drivers/usb/serial/metro-usb.c
    1262 +++ b/drivers/usb/serial/metro-usb.c
    1263 @@ -189,7 +189,7 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
    1264 dev_err(&port->dev,
    1265 "%s - failed submitting interrupt in urb, error code=%d\n",
    1266 __func__, result);
    1267 - goto exit;
    1268 + return result;
    1269 }
    1270
    1271 /* Send activate cmd to device */
    1272 @@ -198,9 +198,14 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
    1273 dev_err(&port->dev,
    1274 "%s - failed to configure device, error code=%d\n",
    1275 __func__, result);
    1276 - goto exit;
    1277 + goto err_kill_urb;
    1278 }
    1279 -exit:
    1280 +
    1281 + return 0;
    1282 +
    1283 +err_kill_urb:
    1284 + usb_kill_urb(port->interrupt_in_urb);
    1285 +
    1286 return result;
    1287 }
    1288
    1289 diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    1290 index eb9928963a53..9f9d3a904464 100644
    1291 --- a/drivers/usb/serial/qcserial.c
    1292 +++ b/drivers/usb/serial/qcserial.c
    1293 @@ -148,6 +148,7 @@ static const struct usb_device_id id_table[] = {
    1294 {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
    1295 {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC7304/MC7354 */
    1296 {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
    1297 + {DEVICE_SWI(0x1199, 0x901e)}, /* Sierra Wireless EM7355 QDL */
    1298 {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
    1299 {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
    1300 {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */
    1301 diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
    1302 index 12f4c5a91e62..48f285a1ad00 100644
    1303 --- a/drivers/usb/serial/usb_debug.c
    1304 +++ b/drivers/usb/serial/usb_debug.c
    1305 @@ -34,13 +34,13 @@ static const struct usb_device_id id_table[] = {
    1306 };
    1307
    1308 static const struct usb_device_id dbc_id_table[] = {
    1309 - { USB_DEVICE(0x1d6b, 0x0004) },
    1310 + { USB_DEVICE(0x1d6b, 0x0011) },
    1311 { },
    1312 };
    1313
    1314 static const struct usb_device_id id_table_combined[] = {
    1315 { USB_DEVICE(0x0525, 0x127a) },
    1316 - { USB_DEVICE(0x1d6b, 0x0004) },
    1317 + { USB_DEVICE(0x1d6b, 0x0011) },
    1318 { },
    1319 };
    1320 MODULE_DEVICE_TABLE(usb, id_table_combined);
    1321 diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
    1322 index 555e43ca846b..7a1cc0e56d2d 100644
    1323 --- a/tools/testing/selftests/x86/protection_keys.c
    1324 +++ b/tools/testing/selftests/x86/protection_keys.c
    1325 @@ -189,17 +189,29 @@ void lots_o_noops_around_write(int *write_to_me)
    1326 #define u64 uint64_t
    1327
    1328 #ifdef __i386__
    1329 -#define SYS_mprotect_key 380
    1330 -#define SYS_pkey_alloc 381
    1331 -#define SYS_pkey_free 382
    1332 +
    1333 +#ifndef SYS_mprotect_key
    1334 +# define SYS_mprotect_key 380
    1335 +#endif
    1336 +#ifndef SYS_pkey_alloc
    1337 +# define SYS_pkey_alloc 381
    1338 +# define SYS_pkey_free 382
    1339 +#endif
    1340 #define REG_IP_IDX REG_EIP
    1341 #define si_pkey_offset 0x14
    1342 +
    1343 #else
    1344 -#define SYS_mprotect_key 329
    1345 -#define SYS_pkey_alloc 330
    1346 -#define SYS_pkey_free 331
    1347 +
    1348 +#ifndef SYS_mprotect_key
    1349 +# define SYS_mprotect_key 329
    1350 +#endif
    1351 +#ifndef SYS_pkey_alloc
    1352 +# define SYS_pkey_alloc 330
    1353 +# define SYS_pkey_free 331
    1354 +#endif
    1355 #define REG_IP_IDX REG_RIP
    1356 #define si_pkey_offset 0x20
    1357 +
    1358 #endif
    1359
    1360 void dump_mem(void *dumpme, int len_bytes)