Merge tag 'v3.7-rc8' into staging/for_v3.8

Linux 3.7-rc8

* tag 'v3.7-rc8': (112 commits)
  Linux 3.7-rc8
  [parisc] open(2) compat bug
  Revert "sched, autogroup: Stop going ahead if autogroup is disabled"
  open*(2) compat fixes (s390, arm64)
  8139cp: fix coherent mapping leak in error path.
  tcp: fix crashes in do_tcp_sendpages()
  workqueue: mod_delayed_work_on() shouldn't queue timer on 0 delay
  workqueue: exit rescuer_thread() as TASK_RUNNING
  x86, fpu: Avoid FPU lazy restore after suspend
  drivers/rtc/rtc-tps65910.c: fix invalid pointer access on _remove()
  mm: soft offline: split thp at the beginning of soft_offline_page()
  mm: avoid waking kswapd for THP allocations when compaction is deferred or contended
  revert "Revert "mm: remove __GFP_NO_KSWAPD""
  mm: vmscan: fix endless loop in kswapd balancing
  mm/vmemmap: fix wrong use of virt_to_page
  mm: compaction: fix return value of capture_free_page()
  fix off-by-one in argument passed by iterate_fd() to callbacks
  lookup_one_len: don't accept . and ..
  cifs: get rid of blind d_drop() in readdir
  nfs_lookup_revalidate(): fix a leak
  ...

44 files changed, 203 insertions, 241 deletions

diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index 89b30f32ba68..ff7bb8a42ed6 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -1961,6 +1961,7 @@ static int __devinit ucode_init (loader_block * lb, amb_dev * dev) {
     res = loader_verify(lb, dev, rec);
     if (res)
       break;
+    rec = ihex_next_binrec(rec);
   }
   release_firmware(fw);
   if (!res)
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index fbd9b2b850ef..c58ea9b80b1a 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -127,12 +127,12 @@ config HW_RANDOM_VIA
           If unsure, say Y.
 
 config HW_RANDOM_IXP4XX
-        tristate "Intel IXP4xx NPU HW Random Number Generator support"
+        tristate "Intel IXP4xx NPU HW Pseudo-Random Number Generator support"
         depends on HW_RANDOM && ARCH_IXP4XX
         default HW_RANDOM
         ---help---
-          This driver provides kernel-side support for the Random
-          Number Generator hardware found on the Intel IXP4xx NPU.
+          This driver provides kernel-side support for the Pseudo-Random
+          Number Generator hardware found on the Intel IXP45x/46x NPU.
 
           To compile this driver as a module, choose M here: the
           module will be called ixp4xx-rng.
diff --git a/drivers/char/hw_random/ixp4xx-rng.c b/drivers/char/hw_random/ixp4xx-rng.c
index 263567f5f392..beec1627db3c 100644
--- a/drivers/char/hw_random/ixp4xx-rng.c
+++ b/drivers/char/hw_random/ixp4xx-rng.c
@@ -45,6 +45,9 @@ static int __init ixp4xx_rng_init(void)
         void __iomem * rng_base;
         int err;
 
+        if (!cpu_is_ixp46x()) /* includes IXP455 */
+                return -ENOSYS;
+
         rng_base = ioremap(0x70002100, 4);
         if (!rng_base)
                 return -ENOMEM;
@@ -68,5 +71,5 @@ module_init(ixp4xx_rng_init);
 module_exit(ixp4xx_rng_exit);
 
 MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net>");
-MODULE_DESCRIPTION("H/W Random Number Generator (RNG) driver for IXP4xx");
+MODULE_DESCRIPTION("H/W Pseudo-Random Number Generator (RNG) driver for IXP45x/46x");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 0bb207eaef2f..54a3a6d09819 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -285,7 +285,7 @@ static long raw_ctl_compat_ioctl(struct file *file, unsigned int cmd,
 
 static const struct file_operations raw_fops = {
         .read           = do_sync_read,
-        .aio_read       = blkdev_aio_read,
+        .aio_read       = generic_file_aio_read,
         .write          = do_sync_write,
         .aio_write      = blkdev_aio_write,
         .fsync          = blkdev_fsync,
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 308c7fb92a60..f6644f59fd9d 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -224,7 +224,7 @@ config CRYPTO_DEV_TALITOS
 
 config CRYPTO_DEV_IXP4XX
         tristate "Driver for IXP4xx crypto hardware acceleration"
-        depends on ARCH_IXP4XX
+        depends on ARCH_IXP4XX && IXP4XX_QMGR && IXP4XX_NPE
         select CRYPTO_DES
         select CRYPTO_ALGAPI
         select CRYPTO_AUTHENC
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 8f3f74ce8c7f..21180d6cad6e 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -750,12 +750,12 @@ static int setup_cipher(struct crypto_tfm *tfm, int encrypt,
         }
         if (cipher_cfg & MOD_AES) {
                 switch (key_len) {
-                        case 16: keylen_cfg = MOD_AES128 | KEYLEN_128; break;
-                        case 24: keylen_cfg = MOD_AES192 | KEYLEN_192; break;
-                        case 32: keylen_cfg = MOD_AES256 | KEYLEN_256; break;
-                        default:
-                                *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
-                                return -EINVAL;
+                case 16: keylen_cfg = MOD_AES128; break;
+                case 24: keylen_cfg = MOD_AES192; break;
+                case 32: keylen_cfg = MOD_AES256; break;
+                default:
+                        *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+                        return -EINVAL;
                 }
                 cipher_cfg |= keylen_cfg;
         } else if (cipher_cfg & MOD_3DES) {
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 90f0b730e9bb..75c0a1a85fc3 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -416,10 +416,18 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
                 dimm->cschannel = chn;
 
                 /* Increment csrow location */
-                row++;
-                if (row == tot_csrows) {
-                        row = 0;
+                if (layers[0].is_virt_csrow) {
                         chn++;
+                        if (chn == tot_channels) {
+                                chn = 0;
+                                row++;
+                        }
+                } else {
+                        row++;
+                        if (row == tot_csrows) {
+                                row = 0;
+                                chn++;
+                        }
                 }
 
                 /* Increment dimm location */
diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
index a09d0667f72a..9d669cd43618 100644
--- a/drivers/edac/i7300_edac.c
+++ b/drivers/edac/i7300_edac.c
@@ -197,8 +197,8 @@ static const char *ferr_fat_fbd_name[] = {
         [0]  = "Memory Write error on non-redundant retry or "
                "FBD configuration Write error on retry",
 };
-#define GET_FBD_FAT_IDX(fbderr) (fbderr & (3 << 28))
-#define FERR_FAT_FBD_ERR_MASK ((1 << 0) | (1 << 1) | (1 << 2) | (1 << 3))
+#define GET_FBD_FAT_IDX(fbderr) (((fbderr) >> 28) & 3)
+#define FERR_FAT_FBD_ERR_MASK ((1 << 0) | (1 << 1) | (1 << 2) | (1 << 22))
 
 #define FERR_NF_FBD     0xa0
 static const char *ferr_nf_fbd_name[] = {
@@ -225,7 +225,7 @@ static const char *ferr_nf_fbd_name[] = {
         [1]  = "Aliased Uncorrectable Non-Mirrored Demand Data ECC",
         [0]  = "Uncorrectable Data ECC on Replay",
 };
-#define GET_FBD_NF_IDX(fbderr)  (fbderr & (3 << 28))
+#define GET_FBD_NF_IDX(fbderr)  (((fbderr) >> 28) & 3)
 #define FERR_NF_FBD_ERR_MASK ((1 << 24) | (1 << 23) | (1 << 22) | (1 << 21) |\
                               (1 << 18) | (1 << 17) | (1 << 16) | (1 << 15) |\
                               (1 << 14) | (1 << 13) | (1 << 11) | (1 << 10) |\
@@ -464,7 +464,7 @@ static void i7300_process_fbd_error(struct mem_ctl_info *mci)
                 errnum = find_first_bit(&errors,
                                         ARRAY_SIZE(ferr_nf_fbd_name));
                 specific = GET_ERR_FROM_TABLE(ferr_nf_fbd_name, errnum);
-                branch = (GET_FBD_FAT_IDX(error_reg) == 2) ? 1 : 0;
+                branch = (GET_FBD_NF_IDX(error_reg) == 2) ? 1 : 0;
 
                 pci_read_config_dword(pvt->pci_dev_16_1_fsb_addr_map,
                         REDMEMA, &syndrome);
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 3672101023bd..10c8c00d6469 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -816,7 +816,7 @@ static ssize_t i7core_inject_store_##param(			\
         struct device_attribute *mattr,                         \
         const char *data, size_t count)                         \
 {                                                               \
-        struct mem_ctl_info *mci = to_mci(dev);                 \
+        struct mem_ctl_info *mci = dev_get_drvdata(dev);        \
         struct i7core_pvt *pvt;                                 \
         long value;                                             \
         int rc;                                                 \
@@ -845,7 +845,7 @@ static ssize_t i7core_inject_show_##param(			\
         struct device_attribute *mattr,                         \
         char *data)                                             \
 {                                                               \
-        struct mem_ctl_info *mci = to_mci(dev);                 \
+        struct mem_ctl_info *mci = dev_get_drvdata(dev);        \
         struct i7core_pvt *pvt;                                 \
                                                                 \
         pvt = mci->pvt_info;                                    \
@@ -1052,7 +1052,7 @@ static ssize_t i7core_show_counter_##param(			\
         struct device_attribute *mattr,                         \
         char *data)                                             \
 {                                                               \
-        struct mem_ctl_info *mci = to_mci(dev);                 \
+        struct mem_ctl_info *mci = dev_get_drvdata(dev);        \
         struct i7core_pvt *pvt = mci->pvt_info;                 \
                                                                 \
         edac_dbg(1, "\n");                                      \
diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
index 069e26c11c4f..a98020409fa9 100644
--- a/drivers/edac/i82975x_edac.c
+++ b/drivers/edac/i82975x_edac.c
@@ -370,10 +370,6 @@ static enum dev_type i82975x_dram_type(void __iomem *mch_window, int rank)
 static void i82975x_init_csrows(struct mem_ctl_info *mci,
                 struct pci_dev *pdev, void __iomem *mch_window)
 {
-        static const char *labels[4] = {
-                                                        "DIMM A1", "DIMM A2",
-                                                        "DIMM B1", "DIMM B2"
-                                                };
         struct csrow_info *csrow;
         unsigned long last_cumul_size;
         u8 value;
@@ -423,9 +419,10 @@ static void i82975x_init_csrows(struct mem_ctl_info *mci,
                         dimm = mci->csrows[index]->channels[chan]->dimm;
 
                         dimm->nr_pages = nr_pages / csrow->nr_channels;
-                        strncpy(csrow->channels[chan]->dimm->label,
-                                        labels[(index >> 1) + (chan * 2)],
-                                        EDAC_MC_LABEL_LEN);
+
+                        snprintf(csrow->channels[chan]->dimm->label, EDAC_MC_LABEL_LEN, "DIMM %c%d",
+                                 (chan == 0) ? 'A' : 'B',
+                                 index);
                         dimm->grain = 1 << 7;   /* 128Byte cache-line resolution */
                         dimm->dtype = i82975x_dram_type(mch_window, index);
                         dimm->mtype = MEM_DDR2; /* I82975x supports only DDR2 */
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 241ad1eeec64..f2df06c603f7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -226,6 +226,12 @@ static void exynos_drm_encoder_commit(struct drm_encoder *encoder)
          * already updated or not by exynos_drm_encoder_dpms function.
          */
         exynos_encoder->updated = true;
+
+        /*
+         * In case of setcrtc, there is no way to update encoder's dpms
+         * so update it here.
+         */
+        exynos_encoder->dpms = DRM_MODE_DPMS_ON;
 }
 
 static void exynos_drm_encoder_disable(struct drm_encoder *encoder)
@@ -507,6 +513,6 @@ void exynos_drm_encoder_plane_disable(struct drm_encoder *encoder, void *data)
          * because the setting for disabling the overlay will be updated
          * at vsync.
          */
-        if (overlay_ops->wait_for_vblank)
+        if (overlay_ops && overlay_ops->wait_for_vblank)
                 overlay_ops->wait_for_vblank(manager->dev);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 67eb6ba56edf..e7466c4414cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -87,7 +87,8 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
 
         dev->mode_config.fb_base = (resource_size_t)buffer->dma_addr;
         fbi->screen_base = buffer->kvaddr + offset;
-        fbi->fix.smem_start = (unsigned long)(buffer->dma_addr + offset);
+        fbi->fix.smem_start = (unsigned long)(page_to_phys(buffer->pages[0]) +
+                                offset);
         fbi->screen_size = size;
         fbi->fix.smem_len = size;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 130a2b510d4a..e08478f19f1a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -61,11 +61,11 @@ struct fimd_driver_data {
         unsigned int timing_base;
 };
 
-struct fimd_driver_data exynos4_fimd_driver_data = {
+static struct fimd_driver_data exynos4_fimd_driver_data = {
         .timing_base = 0x0,
 };
 
-struct fimd_driver_data exynos5_fimd_driver_data = {
+static struct fimd_driver_data exynos5_fimd_driver_data = {
         .timing_base = 0x20000,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index 60b877a388c2..862ca1eb2102 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -204,7 +204,6 @@ exynos_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
                 return ret;
 
         plane->crtc = crtc;
-        plane->fb = crtc->fb;
 
         exynos_plane_commit(plane);
         exynos_plane_dpms(plane, DRM_MODE_DPMS_ON);
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 0ed6baff4b0c..56846ed5ee55 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -499,12 +499,8 @@ parse_edp(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
 
         edp = find_section(bdb, BDB_EDP);
         if (!edp) {
-                if (SUPPORTS_EDP(dev_priv->dev) && dev_priv->edp.support) {
-                        DRM_DEBUG_KMS("No eDP BDB found but eDP panel "
-                                      "supported, assume %dbpp panel color "
-                                      "depth.\n",
-                                      dev_priv->edp.bpp);
-                }
+                if (SUPPORTS_EDP(dev_priv->dev) && dev_priv->edp.support)
+                        DRM_DEBUG_KMS("No eDP BDB found but eDP panel supported.\n");
                 return;
         }
 
@@ -657,9 +653,6 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
         dev_priv->lvds_use_ssc = 1;
         dev_priv->lvds_ssc_freq = intel_bios_ssc_frequency(dev, 1);
         DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq);
-
-        /* eDP data */
-        dev_priv->edp.bpp = 18;
 }
 
 static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 4154bcd7a070..b426d44a2b05 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3845,7 +3845,7 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                         /* Use VBT settings if we have an eDP panel */
                         unsigned int edp_bpc = dev_priv->edp.bpp / 3;
 
-                        if (edp_bpc < display_bpc) {
+                        if (edp_bpc && edp_bpc < display_bpc) {
                                 DRM_DEBUG_KMS("clamping display bpc (was %d) to eDP (%d)\n", display_bpc, edp_bpc);
                                 display_bpc = edp_bpc;
                         }
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 72f41aaa71ff..442968f8b201 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2373,15 +2373,9 @@ int intel_enable_rc6(const struct drm_device *dev)
         if (i915_enable_rc6 >= 0)
                 return i915_enable_rc6;
 
-        if (INTEL_INFO(dev)->gen == 5) {
-#ifdef CONFIG_INTEL_IOMMU
-                /* Disable rc6 on ilk if VT-d is on. */
-                if (intel_iommu_gfx_mapped)
-                        return false;
-#endif
-                DRM_DEBUG_DRIVER("Ironlake: only RC6 available\n");
-                return INTEL_RC6_ENABLE;
-        }
+        /* Disable RC6 on Ironlake */
+        if (INTEL_INFO(dev)->gen == 5)
+                return 0;
 
         if (IS_HASWELL(dev)) {
                 DRM_DEBUG_DRIVER("Haswell: only RC6 available\n");
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index c600fb06e25e..a6ac0b416964 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2201,7 +2201,6 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
                 connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
                 intel_sdvo->is_hdmi = true;
         }
-        intel_sdvo->base.cloneable = true;
 
         intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
         if (intel_sdvo->is_hdmi)
@@ -2232,7 +2231,6 @@ intel_sdvo_tv_init(struct intel_sdvo *intel_sdvo, int type)
 
         intel_sdvo->is_tv = true;
         intel_sdvo->base.needs_tv_clock = true;
-        intel_sdvo->base.cloneable = false;
 
         intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
 
@@ -2275,8 +2273,6 @@ intel_sdvo_analog_init(struct intel_sdvo *intel_sdvo, int device)
                 intel_sdvo_connector->output_flag = SDVO_OUTPUT_RGB1;
         }
 
-        intel_sdvo->base.cloneable = true;
-
         intel_sdvo_connector_init(intel_sdvo_connector,
                                   intel_sdvo);
         return true;
@@ -2307,9 +2303,6 @@ intel_sdvo_lvds_init(struct intel_sdvo *intel_sdvo, int device)
                 intel_sdvo_connector->output_flag = SDVO_OUTPUT_LVDS1;
         }
 
-        /* SDVO LVDS is not cloneable because the input mode gets adjusted by the encoder */
-        intel_sdvo->base.cloneable = false;
-
         intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
         if (!intel_sdvo_create_enhance_property(intel_sdvo, intel_sdvo_connector))
                 goto err;
@@ -2721,6 +2714,16 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                 goto err_output;
         }
 
+        /*
+         * Cloning SDVO with anything is often impossible, since the SDVO
+         * encoder can request a special input timing mode. And even if that's
+         * not the case we have evidence that cloning a plain unscaled mode with
+         * VGA doesn't really work. Furthermore the cloning flags are way too
+         * simplistic anyway to express such constraints, so just give up on
+         * cloning for SDVO encoders.
+         */
+        intel_sdvo->base.cloneable = false;
+
         /* Only enable the hotplug irq if we need it, to work around noisy
          * hotplug lines.
          */
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 3bce0299f64a..24d932f53203 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1696,42 +1696,22 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                         return ATOM_PPLL2;
                 DRM_ERROR("unable to allocate a PPLL\n");
                 return ATOM_PPLL_INVALID;
-        } else if (ASIC_IS_AVIVO(rdev)) {
-                /* in DP mode, the DP ref clock can come from either PPLL
-                 * depending on the asic:
-                 * DCE3: PPLL1 or PPLL2
-                 */
-                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
-                        /* use the same PPLL for all DP monitors */
-                        pll = radeon_get_shared_dp_ppll(crtc);
-                        if (pll != ATOM_PPLL_INVALID)
-                                return pll;
-                } else {
-                        /* use the same PPLL for all monitors with the same clock */
-                        pll = radeon_get_shared_nondp_ppll(crtc);
-                        if (pll != ATOM_PPLL_INVALID)
-                                return pll;
-                }
-                /* all other cases */
-                pll_in_use = radeon_get_pll_use_mask(crtc);
-                /* the order shouldn't matter here, but we probably
-                 * need this until we have atomic modeset
-                 */
-                if (rdev->flags & RADEON_IS_IGP) {
-                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
-                                return ATOM_PPLL1;
-                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                                return ATOM_PPLL2;
-                } else {
-                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                                return ATOM_PPLL2;
-                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
-                                return ATOM_PPLL1;
-                }
-                DRM_ERROR("unable to allocate a PPLL\n");
-                return ATOM_PPLL_INVALID;
         } else {
                 /* on pre-R5xx asics, the crtc to pll mapping is hardcoded */
+                /* some atombios (observed in some DCE2/DCE3) code have a bug,
+                 * the matching btw pll and crtc is done through
+                 * PCLK_CRTC[1|2]_CNTL (0x480/0x484) but atombios code use the
+                 * pll (1 or 2) to select which register to write. ie if using
+                 * pll1 it will use PCLK_CRTC1_CNTL (0x480) and if using pll2
+                 * it will use PCLK_CRTC2_CNTL (0x484), it then use crtc id to
+                 * choose which value to write. Which is reverse order from
+                 * register logic. So only case that works is when pllid is
+                 * same as crtcid or when both pll and crtc are enabled and
+                 * both use same clock.
+                 *
+                 * So just return crtc id as if crtc and pll were hard linked
+                 * together even if they aren't
+                 */
                 return radeon_crtc->crtc_id;
         }
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 636bae0405e8..a0f73092176e 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -963,7 +963,7 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
         struct r1conf *conf = mddev->private;
         struct bio *bio;
 
-        if (from_schedule) {
+        if (from_schedule || current->bio_list) {
                 spin_lock_irq(&conf->device_lock);
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0d5d0ff2c0f7..c9acbd717131 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1069,7 +1069,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
         struct r10conf *conf = mddev->private;
         struct bio *bio;
 
-        if (from_schedule) {
+        if (from_schedule || current->bio_list) {
                 spin_lock_irq(&conf->device_lock);
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c
index 047f0f0434ec..c267c57c76fd 100644
--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c
+++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c
@@ -657,8 +657,7 @@ static int gsc_m2m_release(struct file *file)
         pr_debug("pid: %d, state: 0x%lx, refcnt= %d",
                 task_pid_nr(current), gsc->state, gsc->m2m.refcnt);
 
-        if (mutex_lock_interruptible(&gsc->lock))
-                return -ERESTARTSYS;
+        mutex_lock(&gsc->lock);
 
         v4l2_m2m_ctx_release(ctx->m2m_ctx);
         gsc_ctrls_delete(ctx);
@@ -732,6 +731,7 @@ int gsc_register_m2m_device(struct gsc_dev *gsc)
         gsc->vdev.ioctl_ops     = &gsc_m2m_ioctl_ops;
         gsc->vdev.release       = video_device_release_empty;
         gsc->vdev.lock          = &gsc->lock;
+        gsc->vdev.vfl_dir       = VFL_DIR_M2M;
         snprintf(gsc->vdev.name, sizeof(gsc->vdev.name), "%s.%d:m2m",
                                         GSC_MODULE_NAME, gsc->id);
 
diff --git a/drivers/media/platform/exynos-gsc/gsc-regs.h b/drivers/media/platform/exynos-gsc/gsc-regs.h
index 533e9947a925..4678f9a6a4fd 100644
--- a/drivers/media/platform/exynos-gsc/gsc-regs.h
+++ b/drivers/media/platform/exynos-gsc/gsc-regs.h
@@ -40,10 +40,10 @@
 #define GSC_IN_ROT_YFLIP                (2 << 16)
 #define GSC_IN_ROT_XFLIP                (1 << 16)
 #define GSC_IN_RGB_TYPE_MASK            (3 << 14)
-#define GSC_IN_RGB_HD_WIDE              (3 << 14)
-#define GSC_IN_RGB_HD_NARROW            (2 << 14)
-#define GSC_IN_RGB_SD_WIDE              (1 << 14)
-#define GSC_IN_RGB_SD_NARROW            (0 << 14)
+#define GSC_IN_RGB_HD_NARROW            (3 << 14)
+#define GSC_IN_RGB_HD_WIDE              (2 << 14)
+#define GSC_IN_RGB_SD_NARROW            (1 << 14)
+#define GSC_IN_RGB_SD_WIDE              (0 << 14)
 #define GSC_IN_YUV422_1P_ORDER_MASK     (1 << 13)
 #define GSC_IN_YUV422_1P_ORDER_LSB_Y    (0 << 13)
 #define GSC_IN_YUV422_1P_OEDER_LSB_C    (1 << 13)
@@ -85,10 +85,10 @@
 #define GSC_OUT_GLOBAL_ALPHA_MASK       (0xff << 24)
 #define GSC_OUT_GLOBAL_ALPHA(x)         ((x) << 24)
 #define GSC_OUT_RGB_TYPE_MASK           (3 << 10)
-#define GSC_OUT_RGB_HD_NARROW           (3 << 10)
-#define GSC_OUT_RGB_HD_WIDE             (2 << 10)
-#define GSC_OUT_RGB_SD_NARROW           (1 << 10)
-#define GSC_OUT_RGB_SD_WIDE             (0 << 10)
+#define GSC_OUT_RGB_HD_WIDE             (3 << 10)
+#define GSC_OUT_RGB_HD_NARROW           (2 << 10)
+#define GSC_OUT_RGB_SD_WIDE             (1 << 10)
+#define GSC_OUT_RGB_SD_NARROW           (0 << 10)
 #define GSC_OUT_YUV422_1P_ORDER_MASK    (1 << 9)
 #define GSC_OUT_YUV422_1P_ORDER_LSB_Y   (0 << 9)
 #define GSC_OUT_YUV422_1P_OEDER_LSB_C   (1 << 9)
diff --git a/drivers/media/platform/s5p-fimc/fimc-capture.c b/drivers/media/platform/s5p-fimc/fimc-capture.c
index 0d0aca500876..fdb6740248a7 100644
--- a/drivers/media/platform/s5p-fimc/fimc-capture.c
+++ b/drivers/media/platform/s5p-fimc/fimc-capture.c
@@ -556,8 +556,7 @@ static int fimc_capture_close(struct file *file)
 
         dbg("pid: %d, state: 0x%lx", task_pid_nr(current), fimc->state);
 
-        if (mutex_lock_interruptible(&fimc->lock))
-                return -ERESTARTSYS;
+        mutex_lock(&fimc->lock);
 
         if (--fimc->vid_cap.refcnt == 0) {
                 clear_bit(ST_CAPT_BUSY, &fimc->state);
@@ -1783,9 +1782,13 @@ static int fimc_capture_subdev_registered(struct v4l2_subdev *sd)
         if (ret)
                 return ret;
 
+        fimc->pipeline_ops = v4l2_get_subdev_hostdata(sd);
+
         ret = fimc_register_capture_device(fimc, sd->v4l2_dev);
-        if (ret)
+        if (ret) {
                 fimc_unregister_m2m_device(fimc);
+                fimc->pipeline_ops = NULL;
+        }
 
         return ret;
 }
@@ -1802,6 +1805,7 @@ static void fimc_capture_subdev_unregistered(struct v4l2_subdev *sd)
         if (video_is_registered(&fimc->vid_cap.vfd)) {
                 video_unregister_device(&fimc->vid_cap.vfd);
                 media_entity_cleanup(&fimc->vid_cap.vfd.entity);
+                fimc->pipeline_ops = NULL;
         }
         kfree(fimc->vid_cap.ctx);
         fimc->vid_cap.ctx = NULL;
diff --git a/drivers/media/platform/s5p-fimc/fimc-lite.c b/drivers/media/platform/s5p-fimc/fimc-lite.c
index 9db246bed841..1b309a72f09f 100644
--- a/drivers/media/platform/s5p-fimc/fimc-lite.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite.c
@@ -491,8 +491,7 @@ static int fimc_lite_close(struct file *file)
         struct fimc_lite *fimc = video_drvdata(file);
         int ret;
 
-        if (mutex_lock_interruptible(&fimc->lock))
-                return -ERESTARTSYS;
+        mutex_lock(&fimc->lock);
 
         if (--fimc->ref_count == 0 && fimc->out_path == FIMC_IO_DMA) {
                 clear_bit(ST_FLITE_IN_USE, &fimc->state);
@@ -1263,10 +1262,12 @@ static int fimc_lite_subdev_registered(struct v4l2_subdev *sd)
                 return ret;
 
         video_set_drvdata(vfd, fimc);
+        fimc->pipeline_ops = v4l2_get_subdev_hostdata(sd);
 
         ret = video_register_device(vfd, VFL_TYPE_GRABBER, -1);
         if (ret < 0) {
                 media_entity_cleanup(&vfd->entity);
+                fimc->pipeline_ops = NULL;
                 return ret;
         }
 
@@ -1285,6 +1286,7 @@ static void fimc_lite_subdev_unregistered(struct v4l2_subdev *sd)
         if (video_is_registered(&fimc->vfd)) {
                 video_unregister_device(&fimc->vfd);
                 media_entity_cleanup(&fimc->vfd.entity);
+                fimc->pipeline_ops = NULL;
         }
 }
 
diff --git a/drivers/media/platform/s5p-fimc/fimc-m2m.c b/drivers/media/platform/s5p-fimc/fimc-m2m.c
index 26bcf4bc4209..1d21da4bd24b 100644
--- a/drivers/media/platform/s5p-fimc/fimc-m2m.c
+++ b/drivers/media/platform/s5p-fimc/fimc-m2m.c
@@ -728,8 +728,7 @@ static int fimc_m2m_release(struct file *file)
         dbg("pid: %d, state: 0x%lx, refcnt= %d",
                 task_pid_nr(current), fimc->state, fimc->m2m.refcnt);
 
-        if (mutex_lock_interruptible(&fimc->lock))
-                return -ERESTARTSYS;
+        mutex_lock(&fimc->lock);
 
         v4l2_m2m_ctx_release(ctx->m2m_ctx);
         fimc_ctrls_delete(ctx);
diff --git a/drivers/media/platform/s5p-fimc/fimc-mdevice.c b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
index 9bd5dd416220..1bd5678cfeb9 100644
--- a/drivers/media/platform/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
@@ -352,6 +352,7 @@ static int fimc_register_callback(struct device *dev, void *p)
 
         sd = &fimc->vid_cap.subdev;
         sd->grp_id = FIMC_GROUP_ID;
+        v4l2_set_subdev_hostdata(sd, (void *)&fimc_pipeline_ops);
 
         ret = v4l2_device_register_subdev(&fmd->v4l2_dev, sd);
         if (ret) {
@@ -360,7 +361,6 @@ static int fimc_register_callback(struct device *dev, void *p)
                 return ret;
         }
 
-        fimc->pipeline_ops = &fimc_pipeline_ops;
         fmd->fimc[fimc->id] = fimc;
         return 0;
 }
@@ -375,6 +375,7 @@ static int fimc_lite_register_callback(struct device *dev, void *p)
                 return 0;
 
         fimc->subdev.grp_id = FLITE_GROUP_ID;
+        v4l2_set_subdev_hostdata(&fimc->subdev, (void *)&fimc_pipeline_ops);
 
         ret = v4l2_device_register_subdev(&fmd->v4l2_dev, &fimc->subdev);
         if (ret) {
@@ -384,7 +385,6 @@ static int fimc_lite_register_callback(struct device *dev, void *p)
                 return ret;
         }
 
-        fimc->pipeline_ops = &fimc_pipeline_ops;
         fmd->fimc_lite[fimc->index] = fimc;
         return 0;
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 130f4ac8649e..3afe879d54d7 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -381,11 +381,8 @@ static void s5p_mfc_handle_frame(struct s5p_mfc_ctx *ctx,
                 ctx->consumed_stream += s5p_mfc_hw_call(dev->mfc_ops,
                                                 get_consumed_stream, dev);
                 if (ctx->codec_mode != S5P_MFC_CODEC_H264_DEC &&
-                        s5p_mfc_hw_call(dev->mfc_ops,
-                                get_dec_frame_type, dev) ==
-                                        S5P_FIMV_DECODE_FRAME_P_FRAME
-                                        && ctx->consumed_stream + STUFF_BYTE <
-                                        src_buf->b->v4l2_planes[0].bytesused) {
+                        ctx->consumed_stream + STUFF_BYTE <
+                        src_buf->b->v4l2_planes[0].bytesused) {
                         /* Run MFC again on the same buffer */
                         mfc_debug(2, "Running again the same buffer\n");
                         ctx->after_packed_pb = 1;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
index 50b5bee3c44e..3a8cfd9fc1bd 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
@@ -1762,7 +1762,7 @@ int s5p_mfc_get_dspl_y_adr_v6(struct s5p_mfc_dev *dev)
 
 int s5p_mfc_get_dec_y_adr_v6(struct s5p_mfc_dev *dev)
 {
-        return mfc_read(dev, S5P_FIMV_D_DISPLAY_LUMA_ADDR_V6);
+        return mfc_read(dev, S5P_FIMV_D_DECODED_LUMA_ADDR_V6);
 }
 
 int s5p_mfc_get_dspl_status_v6(struct s5p_mfc_dev *dev)
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index ec794a72975d..374c46dff7dd 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1077,8 +1077,7 @@ EXPORT_SYMBOL_GPL(mtd_writev);
  * until the request succeeds or until the allocation size falls below
  * the system page size. This attempts to make sure it does not adversely
  * impact system performance, so when allocating more than one page, we
- * ask the memory allocator to avoid re-trying, swapping, writing back
- * or performing I/O.
+ * ask the memory allocator to avoid re-trying.
  *
  * Note, this function also makes sure that the allocated buffer is aligned to
  * the MTD device's min. I/O unit, i.e. the "mtd->writesize" value.
@@ -1092,8 +1091,7 @@ EXPORT_SYMBOL_GPL(mtd_writev);
  */
 void *mtd_kmalloc_up_to(const struct mtd_info *mtd, size_t *size)
 {
-        gfp_t flags = __GFP_NOWARN | __GFP_WAIT |
-                       __GFP_NORETRY | __GFP_NO_KSWAPD;
+        gfp_t flags = __GFP_NOWARN | __GFP_WAIT | __GFP_NORETRY;
         size_t min_alloc = max_t(size_t, mtd->writesize, PAGE_SIZE);
         void *kbuf;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5f5b69f37d2e..a7d47350ea4b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3459,6 +3459,28 @@ static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
 
 /*-------------------------- Device entry points ----------------------------*/
 
+static void bond_work_init_all(struct bonding *bond)
+{
+        INIT_DELAYED_WORK(&bond->mcast_work,
+                          bond_resend_igmp_join_requests_delayed);
+        INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
+        INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
+        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                INIT_DELAYED_WORK(&bond->arp_work, bond_activebackup_arp_mon);
+        else
+                INIT_DELAYED_WORK(&bond->arp_work, bond_loadbalance_arp_mon);
+        INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
+}
+
+static void bond_work_cancel_all(struct bonding *bond)
+{
+        cancel_delayed_work_sync(&bond->mii_work);
+        cancel_delayed_work_sync(&bond->arp_work);
+        cancel_delayed_work_sync(&bond->alb_work);
+        cancel_delayed_work_sync(&bond->ad_work);
+        cancel_delayed_work_sync(&bond->mcast_work);
+}
+
 static int bond_open(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
@@ -3481,41 +3503,27 @@ static int bond_open(struct net_device *bond_dev)
         }
         read_unlock(&bond->lock);
 
-        INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
+        bond_work_init_all(bond);
 
         if (bond_is_lb(bond)) {
                 /* bond_alb_initialize must be called before the timer
                  * is started.
                  */
-                if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
-                        /* something went wrong - fail the open operation */
+                if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB)))
                         return -ENOMEM;
-                }
-
-                INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
                 queue_delayed_work(bond->wq, &bond->alb_work, 0);
         }
 
-        if (bond->params.miimon) {  /* link check interval, in milliseconds. */
-                INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
+        if (bond->params.miimon)  /* link check interval, in milliseconds. */
                 queue_delayed_work(bond->wq, &bond->mii_work, 0);
-        }
 
         if (bond->params.arp_interval) {  /* arp interval, in milliseconds. */
-                if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
-                        INIT_DELAYED_WORK(&bond->arp_work,
-                                          bond_activebackup_arp_mon);
-                else
-                        INIT_DELAYED_WORK(&bond->arp_work,
-                                          bond_loadbalance_arp_mon);
-
                 queue_delayed_work(bond->wq, &bond->arp_work, 0);
                 if (bond->params.arp_validate)
                         bond->recv_probe = bond_arp_rcv;
         }
 
         if (bond->params.mode == BOND_MODE_8023AD) {
-                INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
                 queue_delayed_work(bond->wq, &bond->ad_work, 0);
                 /* register to receive LACPDUs */
                 bond->recv_probe = bond_3ad_lacpdu_recv;
@@ -3530,34 +3538,10 @@ static int bond_close(struct net_device *bond_dev)
         struct bonding *bond = netdev_priv(bond_dev);
 
         write_lock_bh(&bond->lock);
-
         bond->send_peer_notif = 0;
-
         write_unlock_bh(&bond->lock);
 
-        if (bond->params.miimon) {  /* link check interval, in milliseconds. */
-                cancel_delayed_work_sync(&bond->mii_work);
-        }
-
-        if (bond->params.arp_interval) {  /* arp interval, in milliseconds. */
-                cancel_delayed_work_sync(&bond->arp_work);
-        }
-
-        switch (bond->params.mode) {
-        case BOND_MODE_8023AD:
-                cancel_delayed_work_sync(&bond->ad_work);
-                break;
-        case BOND_MODE_TLB:
-        case BOND_MODE_ALB:
-                cancel_delayed_work_sync(&bond->alb_work);
-                break;
-        default:
-                break;
-        }
-
-        if (delayed_work_pending(&bond->mcast_work))
-                cancel_delayed_work_sync(&bond->mcast_work);
-
+        bond_work_cancel_all(bond);
         if (bond_is_lb(bond)) {
                 /* Must be called only after all
                  * slaves have been released
@@ -4436,26 +4420,6 @@ static void bond_setup(struct net_device *bond_dev)
         bond_dev->features |= bond_dev->hw_features;
 }
 
-static void bond_work_cancel_all(struct bonding *bond)
-{
-        if (bond->params.miimon && delayed_work_pending(&bond->mii_work))
-                cancel_delayed_work_sync(&bond->mii_work);
-
-        if (bond->params.arp_interval && delayed_work_pending(&bond->arp_work))
-                cancel_delayed_work_sync(&bond->arp_work);
-
-        if (bond->params.mode == BOND_MODE_ALB &&
-            delayed_work_pending(&bond->alb_work))
-                cancel_delayed_work_sync(&bond->alb_work);
-
-        if (bond->params.mode == BOND_MODE_8023AD &&
-            delayed_work_pending(&bond->ad_work))
-                cancel_delayed_work_sync(&bond->ad_work);
-
-        if (delayed_work_pending(&bond->mcast_work))
-                cancel_delayed_work_sync(&bond->mcast_work);
-}
-
 /*
 * Destroy a bonding device.
 * Must be under rtnl_lock when this function is called.
@@ -4706,12 +4670,13 @@ static int bond_check_params(struct bond_params *params)
              arp_ip_count++) {
                 /* not complete check, but should be good enough to
                    catch mistakes */
-                if (!isdigit(arp_ip_target[arp_ip_count][0])) {
+                __be32 ip = in_aton(arp_ip_target[arp_ip_count]);
+                if (!isdigit(arp_ip_target[arp_ip_count][0]) ||
+                    ip == 0 || ip == htonl(INADDR_BROADCAST)) {
                         pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
                                    arp_ip_target[arp_ip_count]);
                         arp_interval = 0;
                 } else {
-                        __be32 ip = in_aton(arp_ip_target[arp_ip_count]);
                         arp_target[arp_ip_count] = ip;
                 }
         }
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index ef8d2a080d17..1877ed7ca086 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -513,6 +513,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
         int new_value, ret = count;
         struct bonding *bond = to_bond(d);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (sscanf(buf, "%d", &new_value) != 1) {
                 pr_err("%s: no arp_interval value specified.\n",
                        bond->dev->name);
@@ -539,10 +541,6 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
                         bond->dev->name, bond->dev->name);
                 bond->params.miimon = 0;
-                if (delayed_work_pending(&bond->mii_work)) {
-                        cancel_delayed_work(&bond->mii_work);
-                        flush_workqueue(bond->wq);
-                }
         }
         if (!bond->params.arp_targets[0]) {
                 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
@@ -554,19 +552,12 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                  * timer will get fired off when the open function
                  * is called.
                  */
-                if (!delayed_work_pending(&bond->arp_work)) {
-                        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
-                                INIT_DELAYED_WORK(&bond->arp_work,
-                                                  bond_activebackup_arp_mon);
-                        else
-                                INIT_DELAYED_WORK(&bond->arp_work,
-                                                  bond_loadbalance_arp_mon);
-
-                        queue_delayed_work(bond->wq, &bond->arp_work, 0);
-                }
+                cancel_delayed_work_sync(&bond->mii_work);
+                queue_delayed_work(bond->wq, &bond->arp_work, 0);
         }
 
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(arp_interval, S_IRUGO | S_IWUSR,
@@ -962,6 +953,8 @@ static ssize_t bonding_store_miimon(struct device *d,
         int new_value, ret = count;
         struct bonding *bond = to_bond(d);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (sscanf(buf, "%d", &new_value) != 1) {
                 pr_err("%s: no miimon value specified.\n",
                        bond->dev->name);
@@ -993,10 +986,6 @@ static ssize_t bonding_store_miimon(struct device *d,
                                 bond->params.arp_validate =
                                         BOND_ARP_VALIDATE_NONE;
                         }
-                        if (delayed_work_pending(&bond->arp_work)) {
-                                cancel_delayed_work(&bond->arp_work);
-                                flush_workqueue(bond->wq);
-                        }
                 }
 
                 if (bond->dev->flags & IFF_UP) {
@@ -1005,15 +994,12 @@ static ssize_t bonding_store_miimon(struct device *d,
                          * timer will get fired off when the open function
                          * is called.
                          */
-                        if (!delayed_work_pending(&bond->mii_work)) {
-                                INIT_DELAYED_WORK(&bond->mii_work,
-                                                  bond_mii_monitor);
-                                queue_delayed_work(bond->wq,
-                                                   &bond->mii_work, 0);
-                        }
+                        cancel_delayed_work_sync(&bond->arp_work);
+                        queue_delayed_work(bond->wq, &bond->mii_work, 0);
                 }
         }
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(miimon, S_IRUGO | S_IWUSR,
@@ -1582,6 +1568,7 @@ static ssize_t bonding_store_slaves_active(struct device *d,
                 goto out;
         }
 
+        read_lock(&bond->lock);
         bond_for_each_slave(bond, slave, i) {
                 if (!bond_is_active_slave(slave)) {
                         if (new_value)
@@ -1590,6 +1577,7 @@ static ssize_t bonding_store_slaves_active(struct device *d,
                                 slave->inactive = 1;
                 }
         }
+        read_unlock(&bond->lock);
 out:
         return ret;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 86f26a1ede4c..25723d8ee201 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -519,8 +519,10 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
         mc->pdev->dev.can.state = new_state;
 
         if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) {
+                struct skb_shared_hwtstamps *hwts = skb_hwtstamps(skb);
+
                 peak_usb_get_ts_tv(&mc->pdev->time_ref, mc->ts16, &tv);
-                skb->tstamp = timeval_to_ktime(tv);
+                hwts->hwtstamp = timeval_to_ktime(tv);
         }
 
         netif_rx(skb);
@@ -605,6 +607,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
         struct sk_buff *skb;
         struct can_frame *cf;
         struct timeval tv;
+        struct skb_shared_hwtstamps *hwts;
 
         skb = alloc_can_skb(mc->netdev, &cf);
         if (!skb)
@@ -652,7 +655,8 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
 
         /* convert timestamp into kernel time */
         peak_usb_get_ts_tv(&mc->pdev->time_ref, mc->ts16, &tv);
-        skb->tstamp = timeval_to_ktime(tv);
+        hwts = skb_hwtstamps(skb);
+        hwts->hwtstamp = timeval_to_ktime(tv);
 
         /* push the skb */
         netif_rx(skb);
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index e1626d92511a..30d79bfa5b10 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -532,6 +532,7 @@ static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
         struct can_frame *can_frame;
         struct sk_buff *skb;
         struct timeval tv;
+        struct skb_shared_hwtstamps *hwts;
 
         skb = alloc_can_skb(netdev, &can_frame);
         if (!skb)
@@ -549,7 +550,8 @@ static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
                 memcpy(can_frame->data, rx->data, can_frame->can_dlc);
 
         peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(rx->ts32), &tv);
-        skb->tstamp = timeval_to_ktime(tv);
+        hwts = skb_hwtstamps(skb);
+        hwts->hwtstamp = timeval_to_ktime(tv);
 
         netif_rx(skb);
         netdev->stats.rx_packets++;
@@ -570,6 +572,7 @@ static int pcan_usb_pro_handle_error(struct pcan_usb_pro_interface *usb_if,
         u8 err_mask = 0;
         struct sk_buff *skb;
         struct timeval tv;
+        struct skb_shared_hwtstamps *hwts;
 
         /* nothing should be sent while in BUS_OFF state */
         if (dev->can.state == CAN_STATE_BUS_OFF)
@@ -664,7 +667,8 @@ static int pcan_usb_pro_handle_error(struct pcan_usb_pro_interface *usb_if,
         dev->can.state = new_state;
 
         peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(er->ts32), &tv);
-        skb->tstamp = timeval_to_ktime(tv);
+        hwts = skb_hwtstamps(skb);
+        hwts->hwtstamp = timeval_to_ktime(tv);
         netif_rx(skb);
         netdev->stats.rx_packets++;
         netdev->stats.rx_bytes += can_frame->can_dlc;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 5d36795877cb..b799ab12a291 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -237,7 +237,7 @@ static int mlx4_en_dcbnl_ieee_setmaxrate(struct net_device *dev,
         if (err)
                 return err;
 
-        memcpy(priv->maxrate, tmp, sizeof(*priv->maxrate));
+        memcpy(priv->maxrate, tmp, sizeof(priv->maxrate));
 
         return 0;
 }
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index b01f83a044c4..609125a249d9 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -1060,17 +1060,22 @@ static int cp_init_rings (struct cp_private *cp)
 
 static int cp_alloc_rings (struct cp_private *cp)
 {
+        struct device *d = &cp->pdev->dev;
         void *mem;
+        int rc;
 
-        mem = dma_alloc_coherent(&cp->pdev->dev, CP_RING_BYTES,
-                                 &cp->ring_dma, GFP_KERNEL);
+        mem = dma_alloc_coherent(d, CP_RING_BYTES, &cp->ring_dma, GFP_KERNEL);
         if (!mem)
                 return -ENOMEM;
 
         cp->rx_ring = mem;
         cp->tx_ring = &cp->rx_ring[CP_RX_RING_SIZE];
 
-        return cp_init_rings(cp);
+        rc = cp_init_rings(cp);
+        if (rc < 0)
+                dma_free_coherent(d, CP_RING_BYTES, cp->rx_ring, cp->ring_dma);
+
+        return rc;
 }
 
 static void cp_clean_rings (struct cp_private *cp)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index d44cca327588..ad86660fb8f9 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1794,10 +1794,12 @@ static void team_setup(struct net_device *dev)
 
         dev->features |= NETIF_F_LLTX;
         dev->features |= NETIF_F_GRO;
-        dev->hw_features = NETIF_F_HW_VLAN_TX |
+        dev->hw_features = TEAM_VLAN_FEATURES |
+                           NETIF_F_HW_VLAN_TX |
                            NETIF_F_HW_VLAN_RX |
                            NETIF_F_HW_VLAN_FILTER;
 
+        dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
         dev->features |= dev->hw_features;
 }
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3b566fa0f8e6..1ea91f4237f0 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -385,6 +385,7 @@ static const struct usb_device_id products[] = {
         },
 
         /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
         {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
         {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index e9a3da588e95..760776b3d66c 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1365,7 +1365,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, port);
 
-        netdev_info(dev, "HSS-%i\n", port->id);
+        netdev_info(dev, "initialized\n");
         return 0;
 
 err_free_netdev:
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 10896393e5a0..2830ea290502 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1012,12 +1012,12 @@ static void iwl_calc_basic_rates(struct iwl_priv *priv,
          * As a consequence, it's not as complicated as it sounds, just add
          * any lower rates to the ACK rate bitmap.
          */
-        if (IWL_RATE_11M_INDEX < lowest_present_ofdm)
-                ofdm |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE;
-        if (IWL_RATE_5M_INDEX < lowest_present_ofdm)
-                ofdm |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE;
-        if (IWL_RATE_2M_INDEX < lowest_present_ofdm)
-                ofdm |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE;
+        if (IWL_RATE_11M_INDEX < lowest_present_cck)
+                cck |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE;
+        if (IWL_RATE_5M_INDEX < lowest_present_cck)
+                cck |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE;
+        if (IWL_RATE_2M_INDEX < lowest_present_cck)
+                cck |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE;
         /* 1M already there or needed so always add */
         cck |= IWL_RATE_1M_MASK >> IWL_FIRST_CCK_RATE;
 
diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c
index e7a4780e93db..9e198e590675 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -120,15 +120,11 @@ static struct virtqueue *rp_find_vq(struct virtio_device *vdev,
         return vq;
 }
 
-static void rproc_virtio_del_vqs(struct virtio_device *vdev)
+static void __rproc_virtio_del_vqs(struct virtio_device *vdev)
 {
         struct virtqueue *vq, *n;
-        struct rproc *rproc = vdev_to_rproc(vdev);
         struct rproc_vring *rvring;
 
-        /* power down the remote processor before deleting vqs */
-        rproc_shutdown(rproc);
-
         list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
                 rvring = vq->priv;
                 rvring->vq = NULL;
@@ -137,6 +133,16 @@ static void rproc_virtio_del_vqs(struct virtio_device *vdev)
         }
 }
 
+static void rproc_virtio_del_vqs(struct virtio_device *vdev)
+{
+        struct rproc *rproc = vdev_to_rproc(vdev);
+
+        /* power down the remote processor before deleting vqs */
+        rproc_shutdown(rproc);
+
+        __rproc_virtio_del_vqs(vdev);
+}
+
 static int rproc_virtio_find_vqs(struct virtio_device *vdev, unsigned nvqs,
                        struct virtqueue *vqs[],
                        vq_callback_t *callbacks[],
@@ -163,7 +169,7 @@ static int rproc_virtio_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         return 0;
 
 error:
-        rproc_virtio_del_vqs(vdev);
+        __rproc_virtio_del_vqs(vdev);
         return ret;
 }
 
diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c
index 7a82337e4dee..073108dcf9e7 100644
--- a/drivers/rtc/rtc-tps65910.c
+++ b/drivers/rtc/rtc-tps65910.c
@@ -288,11 +288,11 @@ static int __devinit tps65910_rtc_probe(struct platform_device *pdev)
 static int __devexit tps65910_rtc_remove(struct platform_device *pdev)
 {
         /* leave rtc running, but disable irqs */
-        struct rtc_device *rtc = platform_get_drvdata(pdev);
+        struct tps65910_rtc *tps_rtc = platform_get_drvdata(pdev);
 
-        tps65910_rtc_alarm_irq_enable(&rtc->dev, 0);
+        tps65910_rtc_alarm_irq_enable(&pdev->dev, 0);
 
-        rtc_device_unregister(rtc);
+        rtc_device_unregister(tps_rtc->rtc);
         return 0;
 }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9097155e9ebe..dcecbfb17243 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1819,8 +1819,10 @@ void target_execute_cmd(struct se_cmd *cmd)
         /*
          * If the received CDB has aleady been aborted stop processing it here.
          */
-        if (transport_check_aborted_status(cmd, 1))
+        if (transport_check_aborted_status(cmd, 1)) {
+                complete(&cmd->t_transport_stop_comp);
                 return;
+        }
 
         /*
          * Determine if IOCTL context caller in requesting the stopping of this
@@ -3067,7 +3069,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
         unsigned long flags;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
+        if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION | SCF_SENT_DELAYED_TAS)) {
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 return;
         }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 99ac2cb08b43..dedaf81d8f36 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1076,7 +1076,7 @@ static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len,
                 }
                 _iov = iov + ret;
                 size = reg->memory_size - addr + reg->guest_phys_addr;
-                _iov->iov_len = min((u64)len, size);
+                _iov->iov_len = min((u64)len - s, size);
                 _iov->iov_base = (void __user *)(unsigned long)
                         (reg->userspace_addr + addr - reg->guest_phys_addr);
                 s += size;