--- /dev/null
+From 4b707fa00a80b19b80bc8df6f1cbf4bdd9c91402 Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Tue, 22 Nov 2016 16:42:04 -0800
+Subject: ARM: dts: imx7d: fix LCDIF clock assignment
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 4b707fa00a80b19b80bc8df6f1cbf4bdd9c91402 upstream.
+
+The eLCDIF IP of the i.MX 7 SoC knows multiple clocks and lists them
+separately:
+
+Clock Clock Root Description
+apb_clk MAIN_AXI_CLK_ROOT AXI clock
+pix_clk LCDIF_PIXEL_CLK_ROOT Pixel clock
+ipg_clk_s MAIN_AXI_CLK_ROOT Peripheral access clock
+
+All of them are switched by a single gate, which is part of the
+IMX7D_LCDIF_PIXEL_ROOT_CLK clock. Hence using that clock also for
+the AXI bus clock (clock-name "axi") makes sure the gate gets
+enabled when accessing registers.
+
+There seem to be no separate AXI display clock, and the clock is
+optional. Hence remove the dummy clock.
+
+This fixes kernel freezes when starting the X-Server (which
+disables/re-enables the display controller).
+
+Fixes: e8ed73f691bd ("ARM: dts: imx7d: add lcdif support")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Acked-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx7s.dtsi | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -640,9 +640,8 @@
+ reg = <0x30730000 0x10000>;
+ interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
+- <&clks IMX7D_CLK_DUMMY>,
+- <&clks IMX7D_CLK_DUMMY>;
+- clock-names = "pix", "axi", "disp_axi";
++ <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>;
++ clock-names = "pix", "axi";
+ status = "disabled";
+ };
+ };
--- /dev/null
+From 038ccb3e8cee52e07dc118ff99f47eaebc1d0746 Mon Sep 17 00:00:00 2001
+From: Roger Shimizu <rogershimizu@gmail.com>
+Date: Fri, 2 Dec 2016 00:11:12 +0900
+Subject: ARM: dts: orion5x: fix number of sata port for linkstation ls-gl
+
+From: Roger Shimizu <rogershimizu@gmail.com>
+
+commit 038ccb3e8cee52e07dc118ff99f47eaebc1d0746 upstream.
+
+Bug report from Debian [0] shows there's minor changed model of
+Linkstation LS-GL that uses the 2nd SATA port of the SoC.
+So it's necessary to enable two SATA ports, though for that specific
+model only the 2nd one is used.
+
+[0] https://bugs.debian.org/845611
+
+Fixes: b1742ffa9ddb ("ARM: dts: orion5x: add device tree for buffalo linkstation ls-gl")
+Reported-by: Ryan Tandy <ryan@nardis.ca>
+Tested-by: Ryan Tandy <ryan@nardis.ca>
+Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/orion5x-linkstation-lsgl.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
++++ b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
+@@ -82,6 +82,10 @@
+ gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
+ };
+
++&sata {
++ nr-ports = <2>;
++};
++
+ &ehci1 {
+ status = "okay";
+ };
--- /dev/null
+From c2d0f48a13e53b4747704c9e692f5e765e52041a Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Wed, 30 Nov 2016 21:47:09 +0100
+Subject: batman-adv: Check for alloc errors when preparing TT local data
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit c2d0f48a13e53b4747704c9e692f5e765e52041a upstream.
+
+batadv_tt_prepare_tvlv_local_data can fail to allocate the memory for the
+new TVLV block. The caller is informed about this problem with the returned
+length of 0. Not checking this value results in an invalid memory access
+when either tt_data or tt_change is accessed.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/translation-table.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -2849,7 +2849,7 @@ static bool batadv_send_my_tt_response(s
+ &tvlv_tt_data,
+ &tt_change,
+ &tt_len);
+- if (!tt_len)
++ if (!tt_len || !tvlv_len)
+ goto unlock;
+
+ /* Copy the last orig_node's OGM buffer */
+@@ -2867,7 +2867,7 @@ static bool batadv_send_my_tt_response(s
+ &tvlv_tt_data,
+ &tt_change,
+ &tt_len);
+- if (!tt_len)
++ if (!tt_len || !tvlv_len)
+ goto out;
+
+ /* fill the rest of the tvlv with the real TT entries */
--- /dev/null
+From c3f4688a08fd86f1bf8e055724c84b7a40a09733 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Wed, 30 Nov 2016 15:56:46 -0500
+Subject: ceph: don't set req->r_locked_dir in ceph_d_revalidate
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit c3f4688a08fd86f1bf8e055724c84b7a40a09733 upstream.
+
+This function sets req->r_locked_dir which is supposed to indicate to
+ceph_fill_trace that the parent's i_rwsem is locked for write.
+Unfortunately, there is no guarantee that the dir will be locked when
+d_revalidate is called, so we really don't want ceph_fill_trace to do
+any dcache manipulation from this context. Clear req->r_locked_dir since
+it's clearly not safe to do that.
+
+What we really want to know with d_revalidate is whether the dentry
+still points to the same inode. ceph_fill_trace installs a pointer to
+the inode in req->r_target_inode, so we can just compare that to
+d_inode(dentry) to see if it's the same one after the lookup.
+
+Also, since we aren't generally interested in the parent here, we can
+switch to using a GETATTR to hint that to the MDS, which also means that
+we only need to reserve one cap.
+
+Finally, just remove the d_unhashed check. That's really outside the
+purview of a filesystem's d_revalidate. If the thing became unhashed
+while we're checking it, then that's up to the VFS to handle anyway.
+
+Fixes: 200fd27c8fa2 ("ceph: use lookup request to revalidate dentry")
+Link: http://tracker.ceph.com/issues/18041
+Reported-by: Donatas Abraitis <donatas.abraitis@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/dir.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1257,26 +1257,30 @@ static int ceph_d_revalidate(struct dent
+ return -ECHILD;
+
+ op = ceph_snap(dir) == CEPH_SNAPDIR ?
+- CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP;
++ CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_GETATTR;
+ req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS);
+ if (!IS_ERR(req)) {
+ req->r_dentry = dget(dentry);
+- req->r_num_caps = 2;
++ req->r_num_caps = op == CEPH_MDS_OP_GETATTR ? 1 : 2;
+
+ mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED;
+ if (ceph_security_xattr_wanted(dir))
+ mask |= CEPH_CAP_XATTR_SHARED;
+ req->r_args.getattr.mask = mask;
+
+- req->r_locked_dir = dir;
+ err = ceph_mdsc_do_request(mdsc, NULL, req);
+- if (err == 0 || err == -ENOENT) {
+- if (dentry == req->r_dentry) {
+- valid = !d_unhashed(dentry);
+- } else {
+- d_invalidate(req->r_dentry);
+- err = -EAGAIN;
+- }
++ switch (err) {
++ case 0:
++ if (d_really_is_positive(dentry) &&
++ d_inode(dentry) == req->r_target_inode)
++ valid = 1;
++ break;
++ case -ENOENT:
++ if (d_really_is_negative(dentry))
++ valid = 1;
++ /* Fallthrough */
++ default:
++ break;
+ }
+ ceph_mdsc_put_request(req);
+ dout("d_revalidate %p lookup result=%d\n",
--- /dev/null
+From 7e251bb21ae08ca2e4fb28cc0981fac2685a8efa Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Fri, 28 Oct 2016 17:12:28 +0200
+Subject: m68k: Fix ndelay() macro
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit 7e251bb21ae08ca2e4fb28cc0981fac2685a8efa upstream.
+
+The current ndelay() macro definition has an extra semi-colon at the
+end of the line thus leading to a compilation error when ndelay is used
+in a conditional block without curly braces like this one:
+
+ if (cond)
+ ndelay(t);
+ else
+ ...
+
+which, after the preprocessor pass gives:
+
+ if (cond)
+ m68k_ndelay(t);;
+ else
+ ...
+
+thus leading to the following gcc error:
+
+ error: 'else' without a previous 'if'
+
+Remove this extra semi-colon.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: c8ee038bd1488 ("m68k: Implement ndelay() based on the existing udelay() logic")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/m68k/include/asm/delay.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/m68k/include/asm/delay.h
++++ b/arch/m68k/include/asm/delay.h
+@@ -114,6 +114,6 @@ static inline void __udelay(unsigned lon
+ */
+ #define HZSCALE (268435456 / (1000000 / HZ))
+
+-#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000));
++#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000))
+
+ #endif /* defined(_M68K_DELAY_H) */
can-raw-raw_setsockopt-limit-number-of-can_filter-that-can-be-set.patch
can-peak-fix-bad-memory-access-and-free-sequence.patch
revert-acpi-execute-_pts-before-system-reboot.patch
+arm-dts-orion5x-fix-number-of-sata-port-for-linkstation-ls-gl.patch
+arm-dts-imx7d-fix-lcdif-clock-assignment.patch
+ceph-don-t-set-req-r_locked_dir-in-ceph_d_revalidate.patch
+m68k-fix-ndelay-macro.patch
+batman-adv-check-for-alloc-errors-when-preparing-tt-local-data.patch