--- /dev/null
+From 94cf42f823bc904305b0ee93a09bcd51ba380497 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 13 Mar 2014 19:00:36 +0100
+Subject: arch,hexagon: Convert smp_mb__*()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 94cf42f823bc904305b0ee93a09bcd51ba380497 upstream.
+
+Hexagon uses asm-gemeric/barrier.h and its smp_mb() is barrier().
+Therefore we can use the default implementation that uses smp_mb().
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/n/tip-87irqrrbgizeojjfdqhypud3@git.kernel.org
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Richard Kuo <rkuo@codeaurora.org>
+Cc: Vineet Gupta <vgupta@synopsys.com>
+Cc: linux-hexagon@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/hexagon/include/asm/atomic.h | 6 +-----
+ arch/hexagon/include/asm/bitops.h | 4 +---
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/arch/hexagon/include/asm/atomic.h
++++ b/arch/hexagon/include/asm/atomic.h
+@@ -24,6 +24,7 @@
+
+ #include <linux/types.h>
+ #include <asm/cmpxchg.h>
++#include <asm/barrier.h>
+
+ #define ATOMIC_INIT(i) { (i) }
+ #define atomic_set(v, i) ((v)->counter = (i))
+@@ -163,9 +164,4 @@ static inline int __atomic_add_unless(at
+ #define atomic_inc_return(v) (atomic_add_return(1, v))
+ #define atomic_dec_return(v) (atomic_sub_return(1, v))
+
+-#define smp_mb__before_atomic_dec() barrier()
+-#define smp_mb__after_atomic_dec() barrier()
+-#define smp_mb__before_atomic_inc() barrier()
+-#define smp_mb__after_atomic_inc() barrier()
+-
+ #endif
+--- a/arch/hexagon/include/asm/bitops.h
++++ b/arch/hexagon/include/asm/bitops.h
+@@ -25,12 +25,10 @@
+ #include <linux/compiler.h>
+ #include <asm/byteorder.h>
+ #include <asm/atomic.h>
++#include <asm/barrier.h>
+
+ #ifdef __KERNEL__
+
+-#define smp_mb__before_clear_bit() barrier()
+-#define smp_mb__after_clear_bit() barrier()
+-
+ /*
+ * The offset calculations for these are based on BITS_PER_LONG == 32
+ * (i.e. I get to shift by #5-2 (32 bits per long, 4 bytes per access),
--- /dev/null
+From ee5d004fd0591536a061451eba2b187092e9127c Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Wed, 22 Jul 2015 10:20:07 +1000
+Subject: md: flush ->event_work before stopping array.
+
+From: NeilBrown <neilb@suse.com>
+
+commit ee5d004fd0591536a061451eba2b187092e9127c upstream.
+
+The 'event_work' worker used by dm-raid may still be running
+when the array is stopped. This can result in an oops.
+
+So flush the workqueue on which it is run after detaching
+and before destroying the device.
+
+Reported-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Fixes: 9d09e663d550 ("dm: raid456 basic support")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5285,6 +5285,8 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
+ static void __md_stop(struct mddev *mddev)
+ {
+ mddev->ready = 0;
++ /* Ensure ->event_work is done */
++ flush_workqueue(md_misc_wq);
+ mddev->pers->stop(mddev);
+ if (mddev->pers->sync_request && mddev->to_remove == NULL)
+ mddev->to_remove = &md_redundancy_group;
--- /dev/null
+From 53960059d56ecef67d4ddd546731623641a3d2d1 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Fri, 27 Mar 2015 08:33:43 +0000
+Subject: MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 53960059d56ecef67d4ddd546731623641a3d2d1 upstream.
+
+If there is a DMA zone (usually 24bit = 16MB I believe), but no DMA32
+zone, as is the case for some 32-bit kernels, then massage_gfp_flags()
+will cause DMA memory allocated for devices with a 32..63-bit
+coherent_dma_mask to fall back to using __GFP_DMA, even though there may
+only be 32-bits of physical address available anyway.
+
+Correct that case to compare against a mask the size of phys_addr_t
+instead of always using a 64-bit mask.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Fixes: a2e715a86c6d ("MIPS: DMA: Fix computation of DMA flags from device's coherent_dma_mask.")
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9610/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/dma-default.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/mm/dma-default.c
++++ b/arch/mips/mm/dma-default.c
+@@ -94,7 +94,7 @@ static gfp_t massage_gfp_flags(const str
+ else
+ #endif
+ #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
+ dma_flag = __GFP_DMA;
+ else
+ #endif
regmap-debugfs-ensure-we-don-t-underflow-when-printing-access-masks.patch
regmap-debugfs-don-t-bother-actually-printing-when-calculating-max-length.patch
security-fix-typo-in-security_task_prctl.patch
+usb-use-the-usb_ss_mult-macro-to-get-the-burst-multiplier.patch
+usb-add-device-quirk-for-logitech-ptz-cameras.patch
+usb-add-reset-resume-quirk-for-two-plantronics-usb-headphones.patch
+mips-dma-default-fix-32-bit-fall-back-to-gfp_dma.patch
+arch-hexagon-convert-smp_mb__.patch
+staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch
+staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch
+md-flush-event_work-before-stopping-array.patch
--- /dev/null
+From 423b24c37dd5794a674c74b0ed56392003a69891 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 23 Jul 2015 16:46:57 +0100
+Subject: staging: comedi: usbduxsigma: don't clobber ai_timer in command test
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 423b24c37dd5794a674c74b0ed56392003a69891 upstream.
+
+`devpriv->ai_timer` is used while an asynchronous command is running on
+the AI subdevice. It also gets modified by the subdevice's `cmdtest`
+handler for checking new asynchronous commands
+(`usbduxsigma_ai_cmdtest()`), which is not correct as it's allowed to
+check new commands while an old command is still running. Fix it by
+moving the code which sets up `devpriv->ai_timer` and
+`devpriv->ai_interval` into the subdevice's `cmd` handler,
+`usbduxsigma_ai_cmd()`.
+
+Note that the removed code in `usbduxsigma_ai_cmdtest()` checked that
+`devpriv->ai_timer` did not end up less than than 1, but that could not
+happen because `cmd->scan_begin_arg` had already been checked to be at
+least the minimum required value (at least when `cmd->scan_begin_src ==
+TRIG_TIMER`, which had also been checked to be the case).
+
+Fixes: b986be8527c7 ("staging: comedi: usbduxsigma: tidy up analog input command support)
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
+Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/staging/comedi/drivers/usbduxsigma.c | 58 ++++++++++++---------------
+ 1 file changed, 27 insertions(+), 31 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/usbduxsigma.c
++++ b/drivers/staging/comedi/drivers/usbduxsigma.c
+@@ -575,37 +575,6 @@ static int usbduxsigma_ai_cmdtest(struct
+ if (err)
+ return 3;
+
+- /* Step 4: fix up any arguments */
+-
+- if (high_speed) {
+- /*
+- * every 2 channels get a time window of 125us. Thus, if we
+- * sample all 16 channels we need 1ms. If we sample only one
+- * channel we need only 125us
+- */
+- devpriv->ai_interval = interval;
+- devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
+- } else {
+- /* interval always 1ms */
+- devpriv->ai_interval = 1;
+- devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
+- }
+- if (devpriv->ai_timer < 1)
+- err |= -EINVAL;
+-
+- if (cmd->stop_src == TRIG_COUNT) {
+- /* data arrives as one packet */
+- devpriv->ai_sample_count = cmd->stop_arg;
+- devpriv->ai_continuous = 0;
+- } else {
+- /* continuous acquisition */
+- devpriv->ai_continuous = 1;
+- devpriv->ai_sample_count = 0;
+- }
+-
+- if (err)
+- return 4;
+-
+ return 0;
+ }
+
+@@ -704,6 +673,33 @@ static int usbduxsigma_ai_cmd(struct com
+
+ /* set current channel of the running acquisition to zero */
+ s->async->cur_chan = 0;
++
++ if (devpriv->high_speed) {
++ /*
++ * every 2 channels get a time window of 125us. Thus, if we
++ * sample all 16 channels we need 1ms. If we sample only one
++ * channel we need only 125us
++ */
++ unsigned int interval = usbduxsigma_chans_to_interval(len);
++
++ devpriv->ai_interval = interval;
++ devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
++ } else {
++ /* interval always 1ms */
++ devpriv->ai_interval = 1;
++ devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
++ }
++
++ if (cmd->stop_src == TRIG_COUNT) {
++ /* data arrives as one packet */
++ devpriv->ai_sample_count = cmd->stop_arg;
++ devpriv->ai_continuous = 0;
++ } else {
++ /* continuous acquisition */
++ devpriv->ai_continuous = 1;
++ devpriv->ai_sample_count = 0;
++ }
++
+ for (i = 0; i < len; i++) {
+ unsigned int chan = CR_CHAN(cmd->chanlist[i]);
+
--- /dev/null
+From c04a1f17803e0d3eeada586ca34a6b436959bc20 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 23 Jul 2015 16:46:58 +0100
+Subject: staging: comedi: usbduxsigma: don't clobber ao_timer in command test
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit c04a1f17803e0d3eeada586ca34a6b436959bc20 upstream.
+
+`devpriv->ao_timer` is used while an asynchronous command is running on
+the AO subdevice. It also gets modified by the subdevice's `cmdtest`
+handler for checking new asynchronous commands,
+`usbduxsigma_ao_cmdtest()`, which is not correct as it's allowed to
+check new commands while an old command is still running. Fix it by
+moving the code which sets up `devpriv->ao_timer` into the subdevice's
+`cmd` handler, `usbduxsigma_ao_cmd()`.
+
+Note that the removed code in `usbduxsigma_ao_cmdtest()` checked that
+`devpriv->ao_timer` did not end up less that 1, but that could not
+happen due because `cmd->scan_begin_arg` or `cmd->convert_arg` had
+already been range-checked.
+
+Also note that we tested the `high_speed` variable in the old code, but
+that is currently always 0 and means that we always use "scan" timing
+(`cmd->scan_begin_src == TRIG_TIMER` and `cmd->convert_src == TRIG_NOW`)
+and never "convert" (individual sample) timing (`cmd->scan_begin_src ==
+TRIG_FOLLOW` and `cmd->convert_src == TRIG_TIMER`). The moved code
+tests `cmd->convert_src` instead to decide whether "scan" or "convert"
+timing is being used, although currently only "scan" timing is
+supported.
+
+Fixes: fb1ef622e7a3 ("staging: comedi: usbduxsigma: tidy up analog output command support")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
+Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/staging/comedi/drivers/usbduxsigma.c | 41 +++++++++++----------------
+ 1 file changed, 17 insertions(+), 24 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/usbduxsigma.c
++++ b/drivers/staging/comedi/drivers/usbduxsigma.c
+@@ -951,10 +951,24 @@ static int usbduxsigma_ao_cmdtest(struct
+ if (err)
+ return 3;
+
+- /* Step 4: fix up any arguments */
++ return 0;
++}
++
++static int usbduxsigma_ao_cmd(struct comedi_device *dev,
++ struct comedi_subdevice *s)
++{
++ struct usbduxsigma_private *devpriv = dev->private;
++ struct comedi_cmd *cmd = &s->async->cmd;
++ int ret;
++ int i;
++
++ down(&devpriv->sem);
++
++ /* set current channel of the running acquisition to zero */
++ s->async->cur_chan = 0;
+
+ /* we count in timer steps */
+- if (high_speed) {
++ if (cmd->convert_src == TRIG_TIMER) {
+ /* timing of the conversion itself: every 125 us */
+ devpriv->ao_timer = cmd->convert_arg / 125000;
+ } else {
+@@ -964,12 +978,9 @@ static int usbduxsigma_ao_cmdtest(struct
+ */
+ devpriv->ao_timer = cmd->scan_begin_arg / 1000000;
+ }
+- if (devpriv->ao_timer < 1)
+- err |= -EINVAL;
+-
+ if (cmd->stop_src == TRIG_COUNT) {
+ /* not continuous, use counter */
+- if (high_speed) {
++ if (cmd->convert_src == TRIG_TIMER) {
+ /* high speed also scans everything at once */
+ devpriv->ao_sample_count = cmd->stop_arg *
+ cmd->scan_end_arg;
+@@ -988,24 +999,6 @@ static int usbduxsigma_ao_cmdtest(struct
+ devpriv->ao_sample_count = 0;
+ }
+
+- if (err)
+- return 4;
+-
+- return 0;
+-}
+-
+-static int usbduxsigma_ao_cmd(struct comedi_device *dev,
+- struct comedi_subdevice *s)
+-{
+- struct usbduxsigma_private *devpriv = dev->private;
+- struct comedi_cmd *cmd = &s->async->cmd;
+- int ret;
+- int i;
+-
+- down(&devpriv->sem);
+-
+- /* set current channel of the running acquisition to zero */
+- s->async->cur_chan = 0;
+ for (i = 0; i < cmd->chanlist_len; ++i)
+ devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
+
--- /dev/null
+From 72194739f54607bbf8cfded159627a2015381557 Mon Sep 17 00:00:00 2001
+From: Vincent Palatin <vpalatin@chromium.org>
+Date: Thu, 1 Oct 2015 14:10:22 -0700
+Subject: usb: Add device quirk for Logitech PTZ cameras
+
+From: Vincent Palatin <vpalatin@chromium.org>
+
+commit 72194739f54607bbf8cfded159627a2015381557 upstream.
+
+Add a device quirk for the Logitech PTZ Pro Camera and its sibling the
+ConferenceCam CC3000e Camera.
+This fixes the failed camera enumeration on some boot, particularly on
+machines with fast CPU.
+
+Tested by connecting a Logitech PTZ Pro Camera to a machine with a
+Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles
+while recording the kernel logs and taking camera picture after each boot.
+Before the patch, more than 7% of the boots show some enumeration transfer
+failures and in a few of them, the kernel is giving up before actually
+enumerating the webcam. After the patch, the enumeration has been correct
+on every reboot.
+
+Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Logitech ConferenceCam CC3000e */
++ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
++
++ /* Logitech PTZ Pro Camera */
++ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Logitech Quickcam Fusion */
+ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 8484bf2981b3d006426ac052a3642c9ce1d8d980 Mon Sep 17 00:00:00 2001
+From: Yao-Wen Mao <yaowen@google.com>
+Date: Mon, 31 Aug 2015 14:24:09 +0800
+Subject: USB: Add reset-resume quirk for two Plantronics usb headphones.
+
+From: Yao-Wen Mao <yaowen@google.com>
+
+commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.
+
+These two headphones need a reset-resume quirk to properly resume to
+original volume level.
+
+Signed-off-by: Yao-Wen Mao <yaowen@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -85,6 +85,12 @@ static const struct usb_device_id usb_qu
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Plantronic Audio 655 DSP */
++ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
++
++ /* Plantronic Audio 648 USB */
++ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Artisman Watchdog Dongle */
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
--- /dev/null
+From ff30cbc8da425754e8ab96904db1d295bd034f27 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 21 Sep 2015 17:46:09 +0300
+Subject: usb: Use the USB_SS_MULT() macro to get the burst multiplier.
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.
+
+Bits 1:0 of the bmAttributes are used for the burst multiplier.
+The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
+into use.
+
+Use the existing USB_SS_MULT() macro instead to make sure the mult value
+and hence max packet calculations are correct for USB3.1 devices.
+
+Note that burst multiplier in bmAttributes is zero based and that
+the USB_SS_MULT() macro adds one.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -113,7 +113,7 @@ static void usb_parse_ss_endpoint_compan
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 16;
+ } else if (usb_endpoint_xfer_isoc(&ep->desc) &&
+- desc->bmAttributes > 2) {
++ USB_SS_MULT(desc->bmAttributes) > 3) {
+ dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+ "config %d interface %d altsetting %d ep %d: "
+ "setting to 3\n", desc->bmAttributes + 1,
+@@ -122,7 +122,8 @@ static void usb_parse_ss_endpoint_compan
+ }
+
+ if (usb_endpoint_xfer_isoc(&ep->desc))
+- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
++ max_tx = (desc->bMaxBurst + 1) *
++ (USB_SS_MULT(desc->bmAttributes)) *
+ usb_endpoint_maxp(&ep->desc);
+ else if (usb_endpoint_xfer_int(&ep->desc))
+ max_tx = usb_endpoint_maxp(&ep->desc) *