--- /dev/null
+From a3930ed060df4ccf2a06cf0b68738dec3e6ff89a Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 27 Aug 2016 19:28:00 +0800
+Subject: ASoC: dapm: Fix kcontrol creation for output driver widget
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit a3930ed060df4ccf2a06cf0b68738dec3e6ff89a upstream.
+
+Commit d88429a695a4 ("ASoC: dapm: Add output driver widget") added
+the snd_soc_dapm_out_drv ID for the output driver widget, which is
+the same as the PGA widget, with a later power sequence number.
+
+Commit 19a2557b76d6 ("ASoC: dapm: Add kcontrol support for PGAs")
+then added kcontrol support for PGA widgets, but failed to account
+for output driver widgets. Attempts to use kcontrols with output
+driver widgets result in silent failures, with the developer having
+little idea about what went on.
+
+Add snd_soc_dapm_out_drv to the switch/case block under snd_soc_dapm_pga
+in dapm_create_or_share_kcontrol, since they are essentially the same.
+
+Fixes: 19a2557b76d6 (ASoC: dapm: Add kcontrol support for PGAs)
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -823,6 +823,7 @@ static int dapm_create_or_share_kcontrol
+ case snd_soc_dapm_switch:
+ case snd_soc_dapm_mixer:
+ case snd_soc_dapm_pga:
++ case snd_soc_dapm_out_drv:
+ wname_in_long_name = true;
+ kcname_in_long_name = true;
+ break;
--- /dev/null
+From 01ad5e7de67b408d9b48b437b06a9938ddf460b5 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 27 Aug 2016 19:27:58 +0800
+Subject: ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 01ad5e7de67b408d9b48b437b06a9938ddf460b5 upstream.
+
+If soc_dapm_read() fails, val will be uninitialized, and bogus values
+will be written later:
+
+ ret = soc_dapm_read(dapm, reg, &val);
+ val = (val >> shift) & mask;
+
+However, the compiler does not give a warning. Return on error before
+val is really used to avoid this.
+
+This is similar to the commit 6912831623c5 ("ASoC: dapm: Fix
+uninitialized variable in snd_soc_dapm_get_enum_double()")
+
+Fixes: ce0fc93ae56e (ASoC: Add DAPM support at the component level)
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3015,6 +3015,9 @@ int snd_soc_dapm_get_volsw(struct snd_kc
+ }
+ mutex_unlock(&card->dapm_mutex);
+
++ if (ret)
++ return ret;
++
+ if (invert)
+ ucontrol->value.integer.value[0] = max - val;
+ else
--- /dev/null
+From 071133a209354f39d4e5785d5a6a390e03241841 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 27 Aug 2016 19:27:59 +0800
+Subject: ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 071133a209354f39d4e5785d5a6a390e03241841 upstream.
+
+The value for the second channel in _ENUM_DOUBLE (double channel) MUXs
+is not correctly updated, due to using the wrong bit shift.
+
+Use the correct bit shift, so both channels toggle together.
+
+Fixes: 3727b4968453 (ASoC: dapm: Consolidate MUXs and value MUXs)
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Reviewed-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3169,7 +3169,7 @@ int snd_soc_dapm_put_enum_double(struct
+ if (e->shift_l != e->shift_r) {
+ if (item[1] > e->items)
+ return -EINVAL;
+- val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
++ val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
+ mask |= e->mask << e->shift_r;
+ }
+
--- /dev/null
+From 8ae3ea48df0d746b663057cf0b972a18d0777b7b Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Wed, 10 Aug 2016 13:43:12 +0000
+Subject: ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit 8ae3ea48df0d746b663057cf0b972a18d0777b7b upstream.
+
+Fix to return error code -ENOMEM instead of 0 when failed to create
+widget, as done elsewhere in this function.
+
+Fixes: 8a9782346dcc ("ASoC: topology: Add topology core")
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-topology.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1484,6 +1484,7 @@ widget:
+ if (widget == NULL) {
+ dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
+ w->name);
++ ret = -ENOMEM;
+ goto hdr_err;
+ }
+
--- /dev/null
+From 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Sat, 3 Sep 2016 01:22:02 +0200
+Subject: dmaengine: ipu: remove bogus NO_IRQ reference
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 upstream.
+
+A workaround for a warning introduced a use of the NO_IRQ
+macro that should have been gone for a long time.
+
+It is clear from the code that the value cannot actually
+be used, but apparently there was a configuration at
+some point that caused a warning, so instead of just
+reverting that patch, this rearranges the code in a way that
+the warning cannot reappear.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 6ef41cf6f721 ("dmaengine :ipu: change ipu_irq_handler() to remove compile warning")
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/ipu/ipu_irq.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/ipu/ipu_irq.c
++++ b/drivers/dma/ipu/ipu_irq.c
+@@ -286,22 +286,21 @@ static void ipu_irq_handler(struct irq_d
+ raw_spin_unlock(&bank_lock);
+ while ((line = ffs(status))) {
+ struct ipu_irq_map *map;
+- unsigned int irq = NO_IRQ;
++ unsigned int irq;
+
+ line--;
+ status &= ~(1UL << line);
+
+ raw_spin_lock(&bank_lock);
+ map = src2map(32 * i + line);
+- if (map)
+- irq = map->irq;
+- raw_spin_unlock(&bank_lock);
+-
+ if (!map) {
++ raw_spin_unlock(&bank_lock);
+ pr_err("IPU: Interrupt on unmapped source %u bank %d\n",
+ line, i);
+ continue;
+ }
++ irq = map->irq;
++ raw_spin_unlock(&bank_lock);
+ generic_handle_irq(irq);
+ }
+ }
--- /dev/null
+From ad8529fde9e3601180a839867a8ab041109aebb5 Mon Sep 17 00:00:00 2001
+From: Dave Gerlach <d-gerlach@ti.com>
+Date: Tue, 20 Sep 2016 10:25:40 -0500
+Subject: hwrng: omap - Only fail if pm_runtime_get_sync returns < 0
+
+From: Dave Gerlach <d-gerlach@ti.com>
+
+commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream.
+
+Currently omap-rng checks the return value of pm_runtime_get_sync and
+reports failure if anything is returned, however it should be checking
+if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
+1 if the device was already active which is not a failure case. Only
+values < 0 are actual failures.
+
+Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed")
+Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/hw_random/omap-rng.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -385,7 +385,7 @@ static int omap_rng_probe(struct platfor
+
+ pm_runtime_enable(&pdev->dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
+ pm_runtime_put_noidle(&pdev->dev);
+ goto err_ioremap;
+@@ -443,7 +443,7 @@ static int __maybe_unused omap_rng_resum
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(dev, "Failed to runtime_get device: %d\n", ret);
+ pm_runtime_put_noidle(dev);
+ return ret;
--- /dev/null
+From 0610735928ee47870e083d5901caa371089216f1 Mon Sep 17 00:00:00 2001
+From: Georges Savoundararadj <savoundg@gmail.com>
+Date: Wed, 7 Sep 2016 18:38:15 -0700
+Subject: power: bq24257: Fix use of uninitialized pointer bq->charger
+
+From: Georges Savoundararadj <savoundg@gmail.com>
+
+commit 0610735928ee47870e083d5901caa371089216f1 upstream.
+
+bq->charger is initialized in bq24257_power_supply_init.
+Therefore, bq24257_power_supply_init should be called before the
+registration of the IRQ handler bq24257_irq_handler_thread that calls
+power_supply_changed(bq->charger).
+
+Signed-off-by: Georges Savoundararadj <savoundg@gmail.com>
+Cc: Aurelien Chanot <chanot.a@gmail.com>
+Cc: Andreas Dannenberg <dannenberg@ti.com>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/bq24257_charger.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/power/bq24257_charger.c
++++ b/drivers/power/bq24257_charger.c
+@@ -1068,6 +1068,12 @@ static int bq24257_probe(struct i2c_clie
+ return ret;
+ }
+
++ ret = bq24257_power_supply_init(bq);
++ if (ret < 0) {
++ dev_err(dev, "Failed to register power supply\n");
++ return ret;
++ }
++
+ ret = devm_request_threaded_irq(dev, client->irq, NULL,
+ bq24257_irq_handler_thread,
+ IRQF_TRIGGER_FALLING |
+@@ -1078,12 +1084,6 @@ static int bq24257_probe(struct i2c_clie
+ return ret;
+ }
+
+- ret = bq24257_power_supply_init(bq);
+- if (ret < 0) {
+- dev_err(dev, "Failed to register power supply\n");
+- return ret;
+- }
+-
+ ret = sysfs_create_group(&bq->charger->dev.kobj, &bq24257_attr_group);
+ if (ret < 0) {
+ dev_err(dev, "Can't create sysfs entries\n");
mwifiex-correct-aid-value-during-tdls-setup.patch
crypto-gcm-fix-iv-buffer-size-in-crypto_gcm_setkey.patch
crypto-arm-ghash-ce-add-missing-async-import-export.patch
+hwrng-omap-only-fail-if-pm_runtime_get_sync-returns-0.patch
+asoc-topology-fix-error-return-code-in-soc_tplg_dapm_widget_create.patch
+asoc-dapm-fix-possible-uninitialized-variable-in-snd_soc_dapm_get_volsw.patch
+asoc-dapm-fix-value-setting-for-_enum_double-mux-s-second-channel.patch
+asoc-dapm-fix-kcontrol-creation-for-output-driver-widget.patch
+staging-r8188eu-fix-scheduling-while-atomic-splat.patch
+power-bq24257-fix-use-of-uninitialized-pointer-bq-charger.patch
+dmaengine-ipu-remove-bogus-no_irq-reference.patch
--- /dev/null
+From 1335a9516d3d52f157ad87456efdd8dc9ae1747b Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 5 Jun 2016 14:11:19 -0500
+Subject: staging: r8188eu: Fix scheduling while atomic splat
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 1335a9516d3d52f157ad87456efdd8dc9ae1747b upstream.
+
+Commit fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu:
+Remove rtw_zmalloc(), wrapper for kzalloc()") changed all allocation
+calls to be GFP_KERNEL even though the original wrapper was testing
+to determine if the caller was in atomic mode. Most of the mistakes
+were corrected with commit 33dc85c3c667209c930b2dac5ccbc2a365e06b7a
+("staging: r8188eu: Fix scheduling while atomic error introduced in
+commit fadbe0cd"); however, two kzalloc calls were missed as the
+call only happens when the driver is shutting down.
+
+Fixes: fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu: Remove rtw_zmalloc(), wrapper for kzalloc()")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: navin patidar <navin.patidar@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/core/rtw_cmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
++++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
+@@ -718,13 +718,13 @@ u8 rtw_addbareq_cmd(struct adapter *pada
+ u8 res = _SUCCESS;
+
+
+- ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
++ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
+ if (ph2c == NULL) {
+ res = _FAIL;
+ goto exit;
+ }
+
+- paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_KERNEL);
++ paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_ATOMIC);
+ if (paddbareq_parm == NULL) {
+ kfree(ph2c);
+ res = _FAIL;