[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     3b8f01df4ca760d54640e17fd95ac407b78fd536
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 21 11:24:21 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 21 11:24:21 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3b8f01df

Linux patcj 4.14.1

 0000_README             |    4 +
 1000_linux-4.14.1.patch | 1360 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1364 insertions(+)

diff --git a/0000_README b/0000_README
index fe79f36..a8d45fc 100644
--- a/0000_README
+++ b/0000_README
@@ -43,6 +43,10 @@ EXPERIMENTAL
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
 
+Patch:  1000_linux-4.14.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.1
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1000_linux-4.14.1.patch b/1000_linux-4.14.1.patch
new file mode 100644
index 0000000..4a007ec
--- /dev/null
+++ b/1000_linux-4.14.1.patch
@@ -0,0 +1,1360 @@
+diff --git a/Makefile b/Makefile
+index ccd981892ef2..01f9df1af256 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,9 +1,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+-NAME = Fearless Coyote
++NAME = Petit Gorille
+ 
+ # *DOCUMENTATION*
+ # To see a list of typical targets execute "make help"
+diff --git a/arch/sparc/include/asm/cmpxchg_32.h b/arch/sparc/include/asm/cmpxchg_32.h
+index 3e3823db303e..c73b5a3ab7b9 100644
+--- a/arch/sparc/include/asm/cmpxchg_32.h
++++ b/arch/sparc/include/asm/cmpxchg_32.h
+@@ -63,6 +63,9 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
+ 			(unsigned long)_n_, sizeof(*(ptr)));		\
+ })
+ 
++u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new);
++#define cmpxchg64(ptr, old, new)	__cmpxchg_u64(ptr, old, new)
++
+ #include <asm-generic/cmpxchg-local.h>
+ 
+ /*
+diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
+index e25d25b0a34b..b361702ef52a 100644
+--- a/arch/sparc/include/asm/mmu_context_64.h
++++ b/arch/sparc/include/asm/mmu_context_64.h
+@@ -8,9 +8,11 @@
+ 
+ #include <linux/spinlock.h>
+ #include <linux/mm_types.h>
++#include <linux/smp.h>
+ 
+ #include <asm/spitfire.h>
+ #include <asm-generic/mm_hooks.h>
++#include <asm/percpu.h>
+ 
+ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+ {
+diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
+index 25b6abdb3908..522a677e050d 100644
+--- a/arch/sparc/include/asm/tsb.h
++++ b/arch/sparc/include/asm/tsb.h
+@@ -217,7 +217,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
+ 	sllx		REG2, 32, REG2;			\
+ 	andcc		REG1, REG2, %g0;		\
+ 	be,pt		%xcc, 700f;			\
+-	 sethi		%hi(0x1ffc0000), REG2;		\
++	 sethi		%hi(0xffe00000), REG2;		\
+ 	sllx		REG2, 1, REG2;			\
+ 	brgez,pn	REG1, FAIL_LABEL;		\
+ 	 andn		REG1, REG2, REG1;		\
+diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
+index 5010df497387..465a901a0ada 100644
+--- a/arch/sparc/lib/atomic32.c
++++ b/arch/sparc/lib/atomic32.c
+@@ -173,6 +173,20 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
+ }
+ EXPORT_SYMBOL(__cmpxchg_u32);
+ 
++u64 __cmpxchg_u64(u64 *ptr, u64 old, u64 new)
++{
++	unsigned long flags;
++	u64 prev;
++
++	spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
++	if ((prev = *ptr) == old)
++		*ptr = new;
++	spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
++
++	return prev;
++}
++EXPORT_SYMBOL(__cmpxchg_u64);
++
+ unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
+ {
+ 	unsigned long flags;
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index 87cc9ab7a13c..4b8187639c2d 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -245,6 +245,9 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
+ 
+ 	if (m->status & MCI_STATUS_UC) {
+ 
++		if (ctx == IN_KERNEL)
++			return MCE_PANIC_SEVERITY;
++
+ 		/*
+ 		 * On older systems where overflow_recov flag is not present, we
+ 		 * should simply panic if an error overflow occurs. If
+@@ -255,10 +258,6 @@ static int mce_severity_amd(struct mce *m, int tolerant, char **msg, bool is_exc
+ 			if (mce_flags.smca)
+ 				return mce_severity_amd_smca(m, ctx);
+ 
+-			/* software can try to contain */
+-			if (!(m->mcgstatus & MCG_STATUS_RIPV) && (ctx == IN_KERNEL))
+-				return MCE_PANIC_SEVERITY;
+-
+ 			/* kill current process */
+ 			return MCE_AR_SEVERITY;
+ 		} else {
+diff --git a/crypto/dh.c b/crypto/dh.c
+index b1032a5c1bfa..aadaf36fb56f 100644
+--- a/crypto/dh.c
++++ b/crypto/dh.c
+@@ -21,19 +21,12 @@ struct dh_ctx {
+ 	MPI xa;
+ };
+ 
+-static inline void dh_clear_params(struct dh_ctx *ctx)
++static void dh_clear_ctx(struct dh_ctx *ctx)
+ {
+ 	mpi_free(ctx->p);
+ 	mpi_free(ctx->g);
+-	ctx->p = NULL;
+-	ctx->g = NULL;
+-}
+-
+-static void dh_free_ctx(struct dh_ctx *ctx)
+-{
+-	dh_clear_params(ctx);
+ 	mpi_free(ctx->xa);
+-	ctx->xa = NULL;
++	memset(ctx, 0, sizeof(*ctx));
+ }
+ 
+ /*
+@@ -71,10 +64,8 @@ static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
+ 		return -EINVAL;
+ 
+ 	ctx->g = mpi_read_raw_data(params->g, params->g_size);
+-	if (!ctx->g) {
+-		mpi_free(ctx->p);
++	if (!ctx->g)
+ 		return -EINVAL;
+-	}
+ 
+ 	return 0;
+ }
+@@ -86,21 +77,23 @@ static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
+ 	struct dh params;
+ 
+ 	/* Free the old MPI key if any */
+-	dh_free_ctx(ctx);
++	dh_clear_ctx(ctx);
+ 
+ 	if (crypto_dh_decode_key(buf, len, &params) < 0)
+-		return -EINVAL;
++		goto err_clear_ctx;
+ 
+ 	if (dh_set_params(ctx, &params) < 0)
+-		return -EINVAL;
++		goto err_clear_ctx;
+ 
+ 	ctx->xa = mpi_read_raw_data(params.key, params.key_size);
+-	if (!ctx->xa) {
+-		dh_clear_params(ctx);
+-		return -EINVAL;
+-	}
++	if (!ctx->xa)
++		goto err_clear_ctx;
+ 
+ 	return 0;
++
++err_clear_ctx:
++	dh_clear_ctx(ctx);
++	return -EINVAL;
+ }
+ 
+ static int dh_compute_value(struct kpp_request *req)
+@@ -158,7 +151,7 @@ static void dh_exit_tfm(struct crypto_kpp *tfm)
+ {
+ 	struct dh_ctx *ctx = dh_get_ctx(tfm);
+ 
+-	dh_free_ctx(ctx);
++	dh_clear_ctx(ctx);
+ }
+ 
+ static struct kpp_alg dh = {
+diff --git a/crypto/dh_helper.c b/crypto/dh_helper.c
+index 8ba8a3f82620..7f00c771fe8d 100644
+--- a/crypto/dh_helper.c
++++ b/crypto/dh_helper.c
+@@ -83,6 +83,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
+ 	if (secret.len != crypto_dh_key_len(params))
+ 		return -EINVAL;
+ 
++	/*
++	 * Don't permit the buffer for 'key' or 'g' to be larger than 'p', since
++	 * some drivers assume otherwise.
++	 */
++	if (params->key_size > params->p_size ||
++	    params->g_size > params->p_size)
++		return -EINVAL;
++
+ 	/* Don't allocate memory. Set pointers to data within
+ 	 * the given buffer
+ 	 */
+@@ -90,6 +98,14 @@ int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params)
+ 	params->p = (void *)(ptr + params->key_size);
+ 	params->g = (void *)(ptr + params->key_size + params->p_size);
+ 
++	/*
++	 * Don't permit 'p' to be 0.  It's not a prime number, and it's subject
++	 * to corner cases such as 'mod 0' being undefined or
++	 * crypto_kpp_maxsize() returning 0.
++	 */
++	if (memchr_inv(params->p, 0, params->p_size) == NULL)
++		return -EINVAL;
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(crypto_dh_decode_key);
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 8685c7e4debd..ee52c355bee0 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -256,6 +256,44 @@ spu_ablkcipher_tx_sg_create(struct brcm_message *mssg,
+ 	return 0;
+ }
+ 
++static int mailbox_send_message(struct brcm_message *mssg, u32 flags,
++				u8 chan_idx)
++{
++	int err;
++	int retry_cnt = 0;
++	struct device *dev = &(iproc_priv.pdev->dev);
++
++	err = mbox_send_message(iproc_priv.mbox[chan_idx], mssg);
++	if (flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
++		while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
++			/*
++			 * Mailbox queue is full. Since MAY_SLEEP is set, assume
++			 * not in atomic context and we can wait and try again.
++			 */
++			retry_cnt++;
++			usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
++			err = mbox_send_message(iproc_priv.mbox[chan_idx],
++						mssg);
++			atomic_inc(&iproc_priv.mb_no_spc);
++		}
++	}
++	if (err < 0) {
++		atomic_inc(&iproc_priv.mb_send_fail);
++		return err;
++	}
++
++	/* Check error returned by mailbox controller */
++	err = mssg->error;
++	if (unlikely(err < 0)) {
++		dev_err(dev, "message error %d", err);
++		/* Signal txdone for mailbox channel */
++	}
++
++	/* Signal txdone for mailbox channel */
++	mbox_client_txdone(iproc_priv.mbox[chan_idx], err);
++	return err;
++}
++
+ /**
+  * handle_ablkcipher_req() - Submit as much of a block cipher request as fits in
+  * a single SPU request message, starting at the current position in the request
+@@ -293,7 +331,6 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
+ 	u32 pad_len;		/* total length of all padding */
+ 	bool update_key = false;
+ 	struct brcm_message *mssg;	/* mailbox message */
+-	int retry_cnt = 0;
+ 
+ 	/* number of entries in src and dst sg in mailbox message. */
+ 	u8 rx_frag_num = 2;	/* response header and STATUS */
+@@ -462,24 +499,9 @@ static int handle_ablkcipher_req(struct iproc_reqctx_s *rctx)
+ 	if (err)
+ 		return err;
+ 
+-	err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
+-	if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
+-		while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
+-			/*
+-			 * Mailbox queue is full. Since MAY_SLEEP is set, assume
+-			 * not in atomic context and we can wait and try again.
+-			 */
+-			retry_cnt++;
+-			usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
+-			err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
+-						mssg);
+-			atomic_inc(&iproc_priv.mb_no_spc);
+-		}
+-	}
+-	if (unlikely(err < 0)) {
+-		atomic_inc(&iproc_priv.mb_send_fail);
++	err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
++	if (unlikely(err < 0))
+ 		return err;
+-	}
+ 
+ 	return -EINPROGRESS;
+ }
+@@ -710,7 +732,6 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
+ 	u32 spu_hdr_len;
+ 	unsigned int digestsize;
+ 	u16 rem = 0;
+-	int retry_cnt = 0;
+ 
+ 	/*
+ 	 * number of entries in src and dst sg. Always includes SPU msg header.
+@@ -904,24 +925,10 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
+ 	if (err)
+ 		return err;
+ 
+-	err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
+-	if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
+-		while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
+-			/*
+-			 * Mailbox queue is full. Since MAY_SLEEP is set, assume
+-			 * not in atomic context and we can wait and try again.
+-			 */
+-			retry_cnt++;
+-			usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
+-			err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
+-						mssg);
+-			atomic_inc(&iproc_priv.mb_no_spc);
+-		}
+-	}
+-	if (err < 0) {
+-		atomic_inc(&iproc_priv.mb_send_fail);
++	err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
++	if (unlikely(err < 0))
+ 		return err;
+-	}
++
+ 	return -EINPROGRESS;
+ }
+ 
+@@ -1320,7 +1327,6 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
+ 	int assoc_nents = 0;
+ 	bool incl_icv = false;
+ 	unsigned int digestsize = ctx->digestsize;
+-	int retry_cnt = 0;
+ 
+ 	/* number of entries in src and dst sg. Always includes SPU msg header.
+ 	 */
+@@ -1558,24 +1564,9 @@ static int handle_aead_req(struct iproc_reqctx_s *rctx)
+ 	if (err)
+ 		return err;
+ 
+-	err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx], mssg);
+-	if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) {
+-		while ((err == -ENOBUFS) && (retry_cnt < SPU_MB_RETRY_MAX)) {
+-			/*
+-			 * Mailbox queue is full. Since MAY_SLEEP is set, assume
+-			 * not in atomic context and we can wait and try again.
+-			 */
+-			retry_cnt++;
+-			usleep_range(MBOX_SLEEP_MIN, MBOX_SLEEP_MAX);
+-			err = mbox_send_message(iproc_priv.mbox[rctx->chan_idx],
+-						mssg);
+-			atomic_inc(&iproc_priv.mb_no_spc);
+-		}
+-	}
+-	if (err < 0) {
+-		atomic_inc(&iproc_priv.mb_send_fail);
++	err = mailbox_send_message(mssg, req->base.flags, rctx->chan_idx);
++	if (unlikely(err < 0))
+ 		return err;
+-	}
+ 
+ 	return -EINPROGRESS;
+ }
+@@ -4537,7 +4528,7 @@ static int spu_mb_init(struct device *dev)
+ 	mcl->dev = dev;
+ 	mcl->tx_block = false;
+ 	mcl->tx_tout = 0;
+-	mcl->knows_txdone = false;
++	mcl->knows_txdone = true;
+ 	mcl->rx_callback = spu_rx_callback;
+ 	mcl->tx_done = NULL;
+ 
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
+index 34ff53290b03..47edc7fbf91f 100644
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -702,6 +702,7 @@ static int dmatest_func(void *data)
+ 			 * free it this time?" dancing.  For now, just
+ 			 * leave it dangling.
+ 			 */
++			WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
+ 			dmaengine_unmap_put(um);
+ 			result("test timed out", total_tests, src_off, dst_off,
+ 			       len, 0);
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index dc0591654011..6241fa787d66 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -462,6 +462,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+ static const struct pci_id_descr pci_dev_descr_ibridge[] = {
+ 		/* Processor Home Agent */
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0,        0, IMC0) },
++	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1,        1, IMC1) },
+ 
+ 		/* Memory controller */
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA,     0, IMC0) },
+@@ -472,7 +473,6 @@ static const struct pci_id_descr pci_dev_descr_ibridge[] = {
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TAD3,   0, IMC0) },
+ 
+ 		/* Optional, mode 2HA */
+-	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1,        1, IMC1) },
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TA,     1, IMC1) },
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_RAS,    1, IMC1) },
+ 	{ PCI_DESCR(PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TAD0,   1, IMC1) },
+@@ -2291,6 +2291,13 @@ static int sbridge_get_onedevice(struct pci_dev **prev,
+ next_imc:
+ 	sbridge_dev = get_sbridge_dev(bus, dev_descr->dom, multi_bus, sbridge_dev);
+ 	if (!sbridge_dev) {
++		/* If the HA1 wasn't found, don't create EDAC second memory controller */
++		if (dev_descr->dom == IMC1 && devno != 1) {
++			edac_dbg(0, "Skip IMC1: %04x:%04x (since HA1 was absent)\n",
++				 PCI_VENDOR_ID_INTEL, dev_descr->dev_id);
++			pci_dev_put(pdev);
++			return 0;
++		}
+ 
+ 		if (dev_descr->dom == SOCK)
+ 			goto out_imc;
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 374301fcbc86..8c7a0ce147a1 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -230,7 +230,7 @@ config HID_CMEDIA
+ 
+ config HID_CP2112
+ 	tristate "Silicon Labs CP2112 HID USB-to-SMBus Bridge support"
+-	depends on USB_HID && I2C && GPIOLIB
++	depends on USB_HID && HIDRAW && I2C && GPIOLIB
+ 	select GPIOLIB_IRQCHIP
+ 	---help---
+ 	Support for Silicon Labs CP2112 HID USB to SMBus Master Bridge.
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 8a03654048bf..feb62fd4dfc3 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -166,6 +166,7 @@
+ 				 ((f)->physical == HID_DG_PEN) || \
+ 				 ((f)->application == HID_DG_PEN) || \
+ 				 ((f)->application == HID_DG_DIGITIZER) || \
++				 ((f)->application == WACOM_HID_WD_PEN) || \
+ 				 ((f)->application == WACOM_HID_WD_DIGITIZER) || \
+ 				 ((f)->application == WACOM_HID_G9_PEN) || \
+ 				 ((f)->application == WACOM_HID_G11_PEN))
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 7b3f31cc63d2..0c46155a8e9d 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -2517,6 +2517,11 @@ static int imon_probe(struct usb_interface *interface,
+ 	mutex_lock(&driver_lock);
+ 
+ 	first_if = usb_ifnum_to_if(usbdev, 0);
++	if (!first_if) {
++		ret = -ENODEV;
++		goto fail;
++	}
++
+ 	first_if_ctx = usb_get_intfdata(first_if);
+ 
+ 	if (ifnum == 0) {
+diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
+index 6020170fe99a..92098c1b78e5 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
+@@ -291,7 +291,7 @@ static int stk7700P2_frontend_attach(struct dvb_usb_adapter *adap)
+ 					     stk7700d_dib7000p_mt2266_config)
+ 		    != 0) {
+ 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
+-			dvb_detach(&state->dib7000p_ops);
++			dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 			return -ENODEV;
+ 		}
+ 	}
+@@ -325,7 +325,7 @@ static int stk7700d_frontend_attach(struct dvb_usb_adapter *adap)
+ 					     stk7700d_dib7000p_mt2266_config)
+ 		    != 0) {
+ 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
+-			dvb_detach(&state->dib7000p_ops);
++			dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 			return -ENODEV;
+ 		}
+ 	}
+@@ -478,7 +478,7 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap)
+ 				     &stk7700ph_dib7700_xc3028_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 		    __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -1010,7 +1010,7 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
+ 				     &dib7070p_dib7000p_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 		    __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -1068,7 +1068,7 @@ static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+ 				     &dib7770p_dib7000p_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 		    __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -3056,7 +3056,7 @@ static int nim7090_frontend_attach(struct dvb_usb_adapter *adap)
+ 
+ 	if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x10, &nim7090_dib7000p_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 	adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, 0x80, &nim7090_dib7000p_config);
+@@ -3109,7 +3109,7 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
+ 	/* initialize IC 0 */
+ 	if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, &tfe7090pvr_dib7000p_config[0]) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -3139,7 +3139,7 @@ static int tfe7090pvr_frontend1_attach(struct dvb_usb_adapter *adap)
+ 	i2c = state->dib7000p_ops.get_i2c_master(adap->dev->adapter[0].fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_6_7, 1);
+ 	if (state->dib7000p_ops.i2c_enumeration(i2c, 1, 0x10, &tfe7090pvr_dib7000p_config[1]) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -3214,7 +3214,7 @@ static int tfe7790p_frontend_attach(struct dvb_usb_adapter *adap)
+ 				1, 0x10, &tfe7790p_dib7000p_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 				__func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 	adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap,
+@@ -3309,7 +3309,7 @@ static int stk7070pd_frontend_attach0(struct dvb_usb_adapter *adap)
+ 				     stk7070pd_dib7000p_config) != 0) {
+ 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 		    __func__);
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -3384,7 +3384,7 @@ static int novatd_frontend_attach(struct dvb_usb_adapter *adap)
+ 					     stk7070pd_dib7000p_config) != 0) {
+ 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
+ 			    __func__);
+-			dvb_detach(&state->dib7000p_ops);
++			dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 			return -ENODEV;
+ 		}
+ 	}
+@@ -3620,7 +3620,7 @@ static int pctv340e_frontend_attach(struct dvb_usb_adapter *adap)
+ 
+ 	if (state->dib7000p_ops.dib7000pc_detection(&adap->dev->i2c_adap) == 0) {
+ 		/* Demodulator not found for some reason? */
+-		dvb_detach(&state->dib7000p_ops);
++		dvb_detach(state->dib7000p_ops.set_wbd_ref);
+ 		return -ENODEV;
+ 	}
+ 
+diff --git a/drivers/platform/x86/peaq-wmi.c b/drivers/platform/x86/peaq-wmi.c
+index bc98ef95514a..2da48ecc90c1 100644
+--- a/drivers/platform/x86/peaq-wmi.c
++++ b/drivers/platform/x86/peaq-wmi.c
+@@ -8,6 +8,7 @@
+  */
+ 
+ #include <linux/acpi.h>
++#include <linux/dmi.h>
+ #include <linux/input-polldev.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -64,8 +65,23 @@ static void peaq_wmi_poll(struct input_polled_dev *dev)
+ 	}
+ }
+ 
++/* Some other devices (Shuttle XS35) use the same WMI GUID for other purposes */
++static const struct dmi_system_id peaq_dmi_table[] = {
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "PEAQ"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "PEAQ PMM C1010 MD99187"),
++		},
++	},
++	{}
++};
++
+ static int __init peaq_wmi_init(void)
+ {
++	/* WMI GUID is not unique, also check for a DMI match */
++	if (!dmi_check_system(peaq_dmi_table))
++		return -ENODEV;
++
+ 	if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
+ 		return -ENODEV;
+ 
+@@ -86,6 +102,9 @@ static int __init peaq_wmi_init(void)
+ 
+ static void __exit peaq_wmi_exit(void)
+ {
++	if (!dmi_check_system(peaq_dmi_table))
++		return;
++
+ 	if (!wmi_has_guid(PEAQ_DOLBY_BUTTON_GUID))
+ 		return;
+ 
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 5dcc9bf1c5bc..e3242a0925a6 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1616,3 +1616,6 @@ void qcom_glink_native_unregister(struct qcom_glink *glink)
+ 	device_unregister(glink->dev);
+ }
+ EXPORT_SYMBOL_GPL(qcom_glink_native_unregister);
++
++MODULE_DESCRIPTION("Qualcomm GLINK driver");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index e8b5a5e21b2e..3ff0ee88c467 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2245,11 +2245,12 @@ static int __unregister(struct device *dev, void *null)
+ void spi_unregister_controller(struct spi_controller *ctlr)
+ {
+ 	struct spi_controller *found;
++	int id = ctlr->bus_num;
+ 	int dummy;
+ 
+ 	/* First make sure that this controller was ever added */
+ 	mutex_lock(&board_lock);
+-	found = idr_find(&spi_master_idr, ctlr->bus_num);
++	found = idr_find(&spi_master_idr, id);
+ 	mutex_unlock(&board_lock);
+ 	if (found != ctlr) {
+ 		dev_dbg(&ctlr->dev,
+@@ -2269,7 +2270,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ 	device_unregister(&ctlr->dev);
+ 	/* free bus id */
+ 	mutex_lock(&board_lock);
+-	idr_remove(&spi_master_idr, ctlr->bus_num);
++	idr_remove(&spi_master_idr, id);
+ 	mutex_unlock(&board_lock);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_controller);
+diff --git a/drivers/staging/ccree/cc_lli_defs.h b/drivers/staging/ccree/cc_lli_defs.h
+index 851d3907167e..a9c417b07b04 100644
+--- a/drivers/staging/ccree/cc_lli_defs.h
++++ b/drivers/staging/ccree/cc_lli_defs.h
+@@ -59,7 +59,7 @@ static inline void cc_lli_set_addr(u32 *lli_p, dma_addr_t addr)
+ 	lli_p[LLI_WORD0_OFFSET] = (addr & U32_MAX);
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ 	lli_p[LLI_WORD1_OFFSET] &= ~LLI_HADDR_MASK;
+-	lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 16));
++	lli_p[LLI_WORD1_OFFSET] |= FIELD_PREP(LLI_HADDR_MASK, (addr >> 32));
+ #endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT */
+ }
+ 
+diff --git a/drivers/staging/greybus/spilib.c b/drivers/staging/greybus/spilib.c
+index e97b19148497..1e7321a1404c 100644
+--- a/drivers/staging/greybus/spilib.c
++++ b/drivers/staging/greybus/spilib.c
+@@ -544,11 +544,14 @@ int gb_spilib_master_init(struct gb_connection *connection, struct device *dev,
+ 
+ 	return 0;
+ 
+-exit_spi_unregister:
+-	spi_unregister_master(master);
+ exit_spi_put:
+ 	spi_master_put(master);
+ 
++	return ret;
++
++exit_spi_unregister:
++	spi_unregister_master(master);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(gb_spilib_master_init);
+@@ -558,7 +561,6 @@ void gb_spilib_master_exit(struct gb_connection *connection)
+ 	struct spi_master *master = gb_connection_get_data(connection);
+ 
+ 	spi_unregister_master(master);
+-	spi_master_put(master);
+ }
+ EXPORT_SYMBOL_GPL(gb_spilib_master_exit);
+ 
+diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
+index 3fd5f4102b36..afb9dadc1cfe 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
+@@ -259,10 +259,12 @@ static int recvframe_chkmic(struct adapter *adapter,
+ 			}
+ 
+ 			/* icv_len included the mic code */
+-			datalen = precvframe->pkt->len-prxattrib->hdrlen - 8;
++			datalen = precvframe->pkt->len-prxattrib->hdrlen -
++				  prxattrib->iv_len-prxattrib->icv_len-8;
+ 			pframe = precvframe->pkt->data;
+-			payload = pframe+prxattrib->hdrlen;
++			payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
+ 
++			RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
+ 			rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
+ 					   (unsigned char)prxattrib->priority); /* care the length of the data */
+ 
+@@ -407,15 +409,9 @@ static struct recv_frame *decryptor(struct adapter *padapter,
+ 		default:
+ 			break;
+ 		}
+-		if (res != _FAIL) {
+-			memmove(precv_frame->pkt->data + precv_frame->attrib.iv_len, precv_frame->pkt->data, precv_frame->attrib.hdrlen);
+-			skb_pull(precv_frame->pkt, precv_frame->attrib.iv_len);
+-			skb_trim(precv_frame->pkt, precv_frame->pkt->len - precv_frame->attrib.icv_len);
+-		}
+ 	} else if (prxattrib->bdecrypted == 1 && prxattrib->encrypt > 0 &&
+-		   (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_)) {
+-		psecuritypriv->hw_decrypted = true;
+-	}
++		   (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_))
++			psecuritypriv->hw_decrypted = true;
+ 
+ 	if (res == _FAIL) {
+ 		rtw_free_recvframe(return_packet, &padapter->recvpriv.free_recv_queue);
+@@ -456,7 +452,7 @@ static struct recv_frame *portctrl(struct adapter *adapter,
+ 
+ 	if (auth_alg == 2) {
+ 		/* get ether_type */
+-		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
++		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE + pfhdr->attrib.iv_len;
+ 		memcpy(&be_tmp, ptr, 2);
+ 		ether_type = ntohs(be_tmp);
+ 
+@@ -1138,8 +1134,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
+ 	}
+ 
+ 	if (pattrib->privacy) {
+-		struct sk_buff *skb = precv_frame->pkt;
+-
+ 		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
+ 		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0], IS_MCAST(pattrib->ra)));
+ 
+@@ -1148,13 +1142,6 @@ static int validate_recv_data_frame(struct adapter *adapter,
+ 		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n pattrib->encrypt=%d\n", pattrib->encrypt));
+ 
+ 		SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
+-
+-		if (pattrib->bdecrypted == 1 && pattrib->encrypt > 0) {
+-			memmove(skb->data + pattrib->iv_len,
+-				skb->data, pattrib->hdrlen);
+-			skb_pull(skb, pattrib->iv_len);
+-			skb_trim(skb, skb->len - pattrib->icv_len);
+-		}
+ 	} else {
+ 		pattrib->encrypt = 0;
+ 		pattrib->iv_len = 0;
+@@ -1274,7 +1261,6 @@ static int validate_recv_frame(struct adapter *adapter,
+ 	 * Hence forward the frame to the monitor anyway to preserve the order
+ 	 * in which frames were received.
+ 	 */
+-
+ 	rtl88eu_mon_recv_hook(adapter->pmondev, precv_frame);
+ 
+ exit:
+@@ -1296,8 +1282,11 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
+ 	u8 *ptr = precvframe->pkt->data;
+ 	struct rx_pkt_attrib *pattrib = &precvframe->attrib;
+ 
+-	psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen);
+-	psnap_type = ptr+pattrib->hdrlen + SNAP_SIZE;
++	if (pattrib->encrypt)
++		skb_trim(precvframe->pkt, precvframe->pkt->len - pattrib->icv_len);
++
++	psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
++	psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+ 	/* convert hdr + possible LLC headers into Ethernet header */
+ 	if ((!memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
+ 	     (!memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == false) &&
+@@ -1310,9 +1299,12 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
+ 		bsnaphdr = false;
+ 	}
+ 
+-	rmv_len = pattrib->hdrlen + (bsnaphdr ? SNAP_SIZE : 0);
++	rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
+ 	len = precvframe->pkt->len - rmv_len;
+ 
++	RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
++		 ("\n===pattrib->hdrlen: %x,  pattrib->iv_len:%x===\n\n", pattrib->hdrlen,  pattrib->iv_len));
++
+ 	memcpy(&be_tmp, ptr+rmv_len, 2);
+ 	eth_type = ntohs(be_tmp); /* pattrib->ether_type */
+ 	pattrib->eth_type = eth_type;
+@@ -1337,6 +1329,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
+ 					   struct __queue *defrag_q)
+ {
+ 	struct list_head *plist, *phead;
++	u8 wlanhdr_offset;
+ 	u8	curfragnum;
+ 	struct recv_frame *pfhdr, *pnfhdr;
+ 	struct recv_frame *prframe, *pnextrframe;
+@@ -1385,7 +1378,12 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
+ 		/* copy the 2nd~n fragment frame's payload to the first fragment */
+ 		/* get the 2nd~last fragment frame's payload */
+ 
+-		skb_pull(pnextrframe->pkt, pnfhdr->attrib.hdrlen);
++		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
++
++		skb_pull(pnextrframe->pkt, wlanhdr_offset);
++
++		/* append  to first fragment frame's tail (if privacy frame, pull the ICV) */
++		skb_trim(prframe->pkt, prframe->pkt->len - pfhdr->attrib.icv_len);
+ 
+ 		/* memcpy */
+ 		memcpy(skb_tail_pointer(pfhdr->pkt), pnfhdr->pkt->data,
+@@ -1393,7 +1391,7 @@ static struct recv_frame *recvframe_defrag(struct adapter *adapter,
+ 
+ 		skb_put(prframe->pkt, pnfhdr->pkt->len);
+ 
+-		pfhdr->attrib.icv_len = 0;
++		pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
+ 		plist = plist->next;
+ 	}
+ 
+@@ -1519,6 +1517,11 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
+ 	nr_subframes = 0;
+ 	pattrib = &prframe->attrib;
+ 
++	skb_pull(prframe->pkt, prframe->attrib.hdrlen);
++
++	if (prframe->attrib.iv_len > 0)
++		skb_pull(prframe->pkt, prframe->attrib.iv_len);
++
+ 	a_len = prframe->pkt->len;
+ 
+ 	pdata = prframe->pkt->data;
+@@ -1887,6 +1890,24 @@ static int process_recv_indicatepkts(struct adapter *padapter,
+ 	return retval;
+ }
+ 
++static int recv_func_prehandle(struct adapter *padapter,
++			       struct recv_frame *rframe)
++{
++	int ret = _SUCCESS;
++	struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
++
++	/* check the frame crtl field and decache */
++	ret = validate_recv_frame(padapter, rframe);
++	if (ret != _SUCCESS) {
++		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
++		rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
++		goto exit;
++	}
++
++exit:
++	return ret;
++}
++
+ static int recv_func_posthandle(struct adapter *padapter,
+ 				struct recv_frame *prframe)
+ {
+@@ -1939,7 +1960,6 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
+ 	struct rx_pkt_attrib *prxattrib = &rframe->attrib;
+ 	struct security_priv *psecuritypriv = &padapter->securitypriv;
+ 	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+-	struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+ 
+ 	/* check if need to handle uc_swdec_pending_queue*/
+ 	if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey) {
+@@ -1951,12 +1971,9 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
+ 		}
+ 	}
+ 
+-	/* check the frame crtl field and decache */
+-	ret = validate_recv_frame(padapter, rframe);
+-	if (ret != _SUCCESS) {
+-		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
+-		rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
+-	} else {
++	ret = recv_func_prehandle(padapter, rframe);
++
++	if (ret == _SUCCESS) {
+ 		/* check if need to enqueue into uc_swdec_pending_queue*/
+ 		if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
+ 		    !IS_MCAST(prxattrib->ra) && prxattrib->encrypt > 0 &&
+diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
+index 37fd52d7364f..225c23fc69dc 100644
+--- a/drivers/staging/rtl8188eu/os_dep/mon.c
++++ b/drivers/staging/rtl8188eu/os_dep/mon.c
+@@ -66,34 +66,6 @@ static void mon_recv_decrypted(struct net_device *dev, const u8 *data,
+ 	netif_rx(skb);
+ }
+ 
+-static void mon_recv_decrypted_recv(struct net_device *dev, const u8 *data,
+-				    int data_len)
+-{
+-	struct sk_buff *skb;
+-	struct ieee80211_hdr *hdr;
+-	int hdr_len;
+-
+-	skb = netdev_alloc_skb(dev, data_len);
+-	if (!skb)
+-		return;
+-	memcpy(skb_put(skb, data_len), data, data_len);
+-
+-	/*
+-	 * Frame data is not encrypted. Strip off protection so
+-	 * userspace doesn't think that it is.
+-	 */
+-
+-	hdr = (struct ieee80211_hdr *)skb->data;
+-	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+-
+-	if (ieee80211_has_protected(hdr->frame_control))
+-		hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+-
+-	skb->ip_summed = CHECKSUM_UNNECESSARY;
+-	skb->protocol = eth_type_trans(skb, dev);
+-	netif_rx(skb);
+-}
+-
+ static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
+ 			       int data_len)
+ {
+@@ -110,6 +82,7 @@ static void mon_recv_encrypted(struct net_device *dev, const u8 *data,
+ void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
+ {
+ 	struct rx_pkt_attrib *attr;
++	int iv_len, icv_len;
+ 	int data_len;
+ 	u8 *data;
+ 
+@@ -122,8 +95,11 @@ void rtl88eu_mon_recv_hook(struct net_device *dev, struct recv_frame *frame)
+ 	data = frame->pkt->data;
+ 	data_len = frame->pkt->len;
+ 
++	/* Broadcast and multicast frames don't have attr->{iv,icv}_len set */
++	SET_ICE_IV_LEN(iv_len, icv_len, attr->encrypt);
++
+ 	if (attr->bdecrypted)
+-		mon_recv_decrypted_recv(dev, data, data_len);
++		mon_recv_decrypted(dev, data, data_len, iv_len, icv_len);
+ 	else
+ 		mon_recv_encrypted(dev, data, data_len);
+ }
+diff --git a/drivers/staging/sm750fb/ddk750_chip.h b/drivers/staging/sm750fb/ddk750_chip.h
+index 09c223f815de..aee82fcaf669 100644
+--- a/drivers/staging/sm750fb/ddk750_chip.h
++++ b/drivers/staging/sm750fb/ddk750_chip.h
+@@ -18,7 +18,7 @@ static inline u32 peek32(u32 addr)
+ 	return readl(addr + mmio750);
+ }
+ 
+-static inline void poke32(u32 data, u32 addr)
++static inline void poke32(u32 addr, u32 data)
+ {
+ 	writel(data, addr + mmio750);
+ }
+diff --git a/drivers/staging/vboxvideo/vbox_drv.h b/drivers/staging/vboxvideo/vbox_drv.h
+index 4b9302703b36..eeac4f0cb2c6 100644
+--- a/drivers/staging/vboxvideo/vbox_drv.h
++++ b/drivers/staging/vboxvideo/vbox_drv.h
+@@ -137,8 +137,8 @@ struct vbox_connector {
+ 	char name[32];
+ 	struct vbox_crtc *vbox_crtc;
+ 	struct {
+-		u16 width;
+-		u16 height;
++		u32 width;
++		u32 height;
+ 		bool disconnected;
+ 	} mode_hint;
+ };
+@@ -150,8 +150,8 @@ struct vbox_crtc {
+ 	unsigned int crtc_id;
+ 	u32 fb_offset;
+ 	bool cursor_enabled;
+-	u16 x_hint;
+-	u16 y_hint;
++	u32 x_hint;
++	u32 y_hint;
+ };
+ 
+ struct vbox_encoder {
+diff --git a/drivers/staging/vboxvideo/vbox_irq.c b/drivers/staging/vboxvideo/vbox_irq.c
+index 3ca8bec62ac4..74abdf02d9fd 100644
+--- a/drivers/staging/vboxvideo/vbox_irq.c
++++ b/drivers/staging/vboxvideo/vbox_irq.c
+@@ -150,8 +150,8 @@ static void vbox_update_mode_hints(struct vbox_private *vbox)
+ 
+ 		disconnected = !(hints->enabled);
+ 		crtc_id = vbox_conn->vbox_crtc->crtc_id;
+-		vbox_conn->mode_hint.width = hints->cx & 0x8fff;
+-		vbox_conn->mode_hint.height = hints->cy & 0x8fff;
++		vbox_conn->mode_hint.width = hints->cx;
++		vbox_conn->mode_hint.height = hints->cy;
+ 		vbox_conn->vbox_crtc->x_hint = hints->dx;
+ 		vbox_conn->vbox_crtc->y_hint = hints->dy;
+ 		vbox_conn->mode_hint.disconnected = disconnected;
+diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
+index 257a77830410..6f08dc966719 100644
+--- a/drivers/staging/vboxvideo/vbox_mode.c
++++ b/drivers/staging/vboxvideo/vbox_mode.c
+@@ -553,12 +553,22 @@ static int vbox_get_modes(struct drm_connector *connector)
+ 		++num_modes;
+ 	}
+ 	vbox_set_edid(connector, preferred_width, preferred_height);
+-	drm_object_property_set_value(
+-		&connector->base, vbox->dev->mode_config.suggested_x_property,
+-		vbox_connector->vbox_crtc->x_hint);
+-	drm_object_property_set_value(
+-		&connector->base, vbox->dev->mode_config.suggested_y_property,
+-		vbox_connector->vbox_crtc->y_hint);
++
++	if (vbox_connector->vbox_crtc->x_hint != -1)
++		drm_object_property_set_value(&connector->base,
++			vbox->dev->mode_config.suggested_x_property,
++			vbox_connector->vbox_crtc->x_hint);
++	else
++		drm_object_property_set_value(&connector->base,
++			vbox->dev->mode_config.suggested_x_property, 0);
++
++	if (vbox_connector->vbox_crtc->y_hint != -1)
++		drm_object_property_set_value(&connector->base,
++			vbox->dev->mode_config.suggested_y_property,
++			vbox_connector->vbox_crtc->y_hint);
++	else
++		drm_object_property_set_value(&connector->base,
++			vbox->dev->mode_config.suggested_y_property, 0);
+ 
+ 	return num_modes;
+ }
+@@ -640,9 +650,9 @@ static int vbox_connector_init(struct drm_device *dev,
+ 
+ 	drm_mode_create_suggested_offset_properties(dev);
+ 	drm_object_attach_property(&connector->base,
+-				   dev->mode_config.suggested_x_property, -1);
++				   dev->mode_config.suggested_x_property, 0);
+ 	drm_object_attach_property(&connector->base,
+-				   dev->mode_config.suggested_y_property, -1);
++				   dev->mode_config.suggested_y_property, 0);
+ 	drm_connector_register(connector);
+ 
+ 	drm_mode_connector_attach_encoder(connector, encoder);
+diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
+index 9addef1f1e12..f49dfa82f1b8 100644
+--- a/drivers/staging/wilc1000/wilc_wlan.c
++++ b/drivers/staging/wilc1000/wilc_wlan.c
+@@ -714,7 +714,7 @@ int wilc_wlan_handle_txq(struct net_device *dev, u32 *txq_count)
+ 					char *bssid = ((struct tx_complete_data *)(tqe->priv))->bssid;
+ 
+ 					buffer_offset = ETH_ETHERNET_HDR_OFFSET;
+-					memcpy(&txb[offset + 4], bssid, 6);
++					memcpy(&txb[offset + 8], bssid, 6);
+ 				} else {
+ 					buffer_offset = HOST_HDR_OFFSET;
+ 				}
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e9326f31db8d..98c666ef9a57 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1833,6 +1833,18 @@ static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
+ 	return 0;
+ }
+ 
++static void compute_isochronous_actual_length(struct urb *urb)
++{
++	unsigned int i;
++
++	if (urb->number_of_packets > 0) {
++		urb->actual_length = 0;
++		for (i = 0; i < urb->number_of_packets; i++)
++			urb->actual_length +=
++					urb->iso_frame_desc[i].actual_length;
++	}
++}
++
+ static int processcompl(struct async *as, void __user * __user *arg)
+ {
+ 	struct urb *urb = as->urb;
+@@ -1840,6 +1852,7 @@ static int processcompl(struct async *as, void __user * __user *arg)
+ 	void __user *addr = as->userurb;
+ 	unsigned int i;
+ 
++	compute_isochronous_actual_length(urb);
+ 	if (as->userbuffer && urb->actual_length) {
+ 		if (copy_urb_data_to_user(as->userbuffer, urb))
+ 			goto err_out;
+@@ -2008,6 +2021,7 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
+ 	void __user *addr = as->userurb;
+ 	unsigned int i;
+ 
++	compute_isochronous_actual_length(urb);
+ 	if (as->userbuffer && urb->actual_length) {
+ 		if (copy_urb_data_to_user(as->userbuffer, urb))
+ 			return -EFAULT;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index a6aaf2f193a4..37c418e581fb 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -221,6 +221,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Corsair Strafe RGB */
+ 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
++	/* Corsair K70 LUX */
++	{ USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* MIDI keyboard WORLDE MINI */
+ 	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
+index 2df0f6e613fe..a516cab0bf4a 100644
+--- a/drivers/usb/early/xhci-dbc.h
++++ b/drivers/usb/early/xhci-dbc.h
+@@ -90,8 +90,8 @@ struct xdbc_context {
+ 
+ #define XDBC_INFO_CONTEXT_SIZE		48
+ #define XDBC_MAX_STRING_LENGTH		64
+-#define XDBC_STRING_MANUFACTURER	"Linux"
+-#define XDBC_STRING_PRODUCT		"Remote GDB"
++#define XDBC_STRING_MANUFACTURER	"Linux Foundation"
++#define XDBC_STRING_PRODUCT		"Linux USB GDB Target"
+ #define XDBC_STRING_SERIAL		"0001"
+ 
+ struct xdbc_strings {
+@@ -103,7 +103,7 @@ struct xdbc_strings {
+ 
+ #define XDBC_PROTOCOL		1	/* GNU Remote Debug Command Set */
+ #define XDBC_VENDOR_ID		0x1d6b	/* Linux Foundation 0x1d6b */
+-#define XDBC_PRODUCT_ID		0x0004	/* __le16 idProduct; device 0004 */
++#define XDBC_PRODUCT_ID		0x0011	/* __le16 idProduct; device 0011 */
+ #define XDBC_DEVICE_REV		0x0010	/* 0.10 */
+ 
+ /*
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 8b342587f8ad..ef8f7d63a8f0 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data *ffs)
+ 		goto done;
+ 
+ 	ffs_obj->desc_ready = false;
++	ffs_obj->ffs_data = NULL;
+ 
+ 	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
+ 	    ffs_obj->ffs_closed_callback)
+diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
+index b2f2e87aed94..91e7e3a166a5 100644
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -138,6 +138,7 @@ struct garmin_data {
+ 	__u8   privpkt[4*6];
+ 	spinlock_t lock;
+ 	struct list_head pktlist;
++	struct usb_anchor write_urbs;
+ };
+ 
+ 
+@@ -905,13 +906,19 @@ static int garmin_init_session(struct usb_serial_port *port)
+ 					sizeof(GARMIN_START_SESSION_REQ), 0);
+ 
+ 			if (status < 0)
+-				break;
++				goto err_kill_urbs;
+ 		}
+ 
+ 		if (status > 0)
+ 			status = 0;
+ 	}
+ 
++	return status;
++
++err_kill_urbs:
++	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
++	usb_kill_urb(port->interrupt_in_urb);
++
+ 	return status;
+ }
+ 
+@@ -930,7 +937,6 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	spin_unlock_irqrestore(&garmin_data_p->lock, flags);
+ 
+ 	/* shutdown any bulk reads that might be going on */
+-	usb_kill_urb(port->write_urb);
+ 	usb_kill_urb(port->read_urb);
+ 
+ 	if (garmin_data_p->state == STATE_RESET)
+@@ -953,7 +959,7 @@ static void garmin_close(struct usb_serial_port *port)
+ 
+ 	/* shutdown our urbs */
+ 	usb_kill_urb(port->read_urb);
+-	usb_kill_urb(port->write_urb);
++	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+ 
+ 	/* keep reset state so we know that we must start a new session */
+ 	if (garmin_data_p->state != STATE_RESET)
+@@ -1037,12 +1043,14 @@ static int garmin_write_bulk(struct usb_serial_port *port,
+ 	}
+ 
+ 	/* send it down the pipe */
++	usb_anchor_urb(urb, &garmin_data_p->write_urbs);
+ 	status = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (status) {
+ 		dev_err(&port->dev,
+ 		   "%s - usb_submit_urb(write bulk) failed with status = %d\n",
+ 				__func__, status);
+ 		count = status;
++		usb_unanchor_urb(urb);
+ 		kfree(buffer);
+ 	}
+ 
+@@ -1401,9 +1409,16 @@ static int garmin_port_probe(struct usb_serial_port *port)
+ 	garmin_data_p->state = 0;
+ 	garmin_data_p->flags = 0;
+ 	garmin_data_p->count = 0;
++	init_usb_anchor(&garmin_data_p->write_urbs);
+ 	usb_set_serial_port_data(port, garmin_data_p);
+ 
+ 	status = garmin_init_session(port);
++	if (status)
++		goto err_free;
++
++	return 0;
++err_free:
++	kfree(garmin_data_p);
+ 
+ 	return status;
+ }
+@@ -1413,6 +1428,7 @@ static int garmin_port_remove(struct usb_serial_port *port)
+ {
+ 	struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
+ 
++	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+ 	usb_kill_urb(port->interrupt_in_urb);
+ 	del_timer_sync(&garmin_data_p->timer);
+ 	kfree(garmin_data_p);
+diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
+index 14511d6a7d44..3950d44b80f1 100644
+--- a/drivers/usb/serial/metro-usb.c
++++ b/drivers/usb/serial/metro-usb.c
+@@ -189,7 +189,7 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 		dev_err(&port->dev,
+ 			"%s - failed submitting interrupt in urb, error code=%d\n",
+ 			__func__, result);
+-		goto exit;
++		return result;
+ 	}
+ 
+ 	/* Send activate cmd to device */
+@@ -198,9 +198,14 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 		dev_err(&port->dev,
+ 			"%s - failed to configure device, error code=%d\n",
+ 			__func__, result);
+-		goto exit;
++		goto err_kill_urb;
+ 	}
+-exit:
++
++	return 0;
++
++err_kill_urb:
++	usb_kill_urb(port->interrupt_in_urb);
++
+ 	return result;
+ }
+ 
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index eb9928963a53..9f9d3a904464 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -148,6 +148,7 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_SWI(0x1199, 0x68a2)},	/* Sierra Wireless MC7710 */
+ 	{DEVICE_SWI(0x1199, 0x68c0)},	/* Sierra Wireless MC7304/MC7354 */
+ 	{DEVICE_SWI(0x1199, 0x901c)},	/* Sierra Wireless EM7700 */
++	{DEVICE_SWI(0x1199, 0x901e)},	/* Sierra Wireless EM7355 QDL */
+ 	{DEVICE_SWI(0x1199, 0x901f)},	/* Sierra Wireless EM7355 */
+ 	{DEVICE_SWI(0x1199, 0x9040)},	/* Sierra Wireless Modem */
+ 	{DEVICE_SWI(0x1199, 0x9041)},	/* Sierra Wireless MC7305/MC7355 */
+diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
+index 12f4c5a91e62..48f285a1ad00 100644
+--- a/drivers/usb/serial/usb_debug.c
++++ b/drivers/usb/serial/usb_debug.c
+@@ -34,13 +34,13 @@ static const struct usb_device_id id_table[] = {
+ };
+ 
+ static const struct usb_device_id dbc_id_table[] = {
+-	{ USB_DEVICE(0x1d6b, 0x0004) },
++	{ USB_DEVICE(0x1d6b, 0x0011) },
+ 	{ },
+ };
+ 
+ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(0x0525, 0x127a) },
+-	{ USB_DEVICE(0x1d6b, 0x0004) },
++	{ USB_DEVICE(0x1d6b, 0x0011) },
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table_combined);
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index 555e43ca846b..7a1cc0e56d2d 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -189,17 +189,29 @@ void lots_o_noops_around_write(int *write_to_me)
+ #define u64 uint64_t
+ 
+ #ifdef __i386__
+-#define SYS_mprotect_key 380
+-#define SYS_pkey_alloc	 381
+-#define SYS_pkey_free	 382
++
++#ifndef SYS_mprotect_key
++# define SYS_mprotect_key 380
++#endif
++#ifndef SYS_pkey_alloc
++# define SYS_pkey_alloc	 381
++# define SYS_pkey_free	 382
++#endif
+ #define REG_IP_IDX REG_EIP
+ #define si_pkey_offset 0x14
++
+ #else
+-#define SYS_mprotect_key 329
+-#define SYS_pkey_alloc	 330
+-#define SYS_pkey_free	 331
++
++#ifndef SYS_mprotect_key
++# define SYS_mprotect_key 329
++#endif
++#ifndef SYS_pkey_alloc
++# define SYS_pkey_alloc	 330
++# define SYS_pkey_free	 331
++#endif
+ #define REG_IP_IDX REG_RIP
+ #define si_pkey_offset 0x20
++
+ #endif
+ 
+ void dump_mem(void *dumpme, int len_bytes)