113 files changed, 764 insertions, 463 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 03ca210406ed..e4b57756b9f5 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -539,3 +539,13 @@ When:	3.6
 Why:    setitimer is not returning -EFAULT if user pointer is NULL. This
         violates the spec.
 Who:    Sasikantha Babu <sasikanth.v19@gmail.com>
+
+----------------------------
+
+What:   V4L2_CID_HCENTER, V4L2_CID_VCENTER V4L2 controls
+When:   3.7
+Why:    The V4L2_CID_VCENTER, V4L2_CID_HCENTER controls have been deprecated
+        for about 4 years and they are not used by any mainline driver.
+        There are newer controls (V4L2_CID_PAN*, V4L2_CID_TILT*) that provide
+        similar functionality.
+Who:    Sylwester Nawrocki <sylvester.nawrocki@gmail.com>
diff --git a/arch/arm/mach-prima2/irq.c b/arch/arm/mach-prima2/irq.c
index 37c2de9b6f26..a7b9415d30f8 100644
--- a/arch/arm/mach-prima2/irq.c
+++ b/arch/arm/mach-prima2/irq.c
@@ -42,7 +42,8 @@ sirfsoc_alloc_gc(void __iomem *base, unsigned int irq_start, unsigned int num)
 static __init void sirfsoc_irq_init(void)
 {
         sirfsoc_alloc_gc(sirfsoc_intc_base, 0, 32);
-        sirfsoc_alloc_gc(sirfsoc_intc_base + 4, 32, SIRFSOC_INTENAL_IRQ_END - 32);
+        sirfsoc_alloc_gc(sirfsoc_intc_base + 4, 32,
+                        SIRFSOC_INTENAL_IRQ_END + 1 - 32);
 
         writel_relaxed(0, sirfsoc_intc_base + SIRFSOC_INT_RISC_LEVEL0);
         writel_relaxed(0, sirfsoc_intc_base + SIRFSOC_INT_RISC_LEVEL1);
@@ -68,7 +69,8 @@ void __init sirfsoc_of_irq_init(void)
         if (!sirfsoc_intc_base)
                 panic("unable to map intc cpu registers\n");
 
-        irq_domain_add_legacy(np, 32, 0, 0, &irq_domain_simple_ops, NULL);
+        irq_domain_add_legacy(np, SIRFSOC_INTENAL_IRQ_END + 1, 0, 0,
+                &irq_domain_simple_ops, NULL);
 
         of_node_put(np);
 
diff --git a/arch/arm/mach-tegra/flowctrl.c b/arch/arm/mach-tegra/flowctrl.c
index fef66a7486ed..f07488e0bd32 100644
--- a/arch/arm/mach-tegra/flowctrl.c
+++ b/arch/arm/mach-tegra/flowctrl.c
@@ -53,10 +53,10 @@ static void flowctrl_update(u8 offset, u32 value)
 
 void flowctrl_write_cpu_csr(unsigned int cpuid, u32 value)
 {
-        return flowctrl_update(flowctrl_offset_halt_cpu[cpuid], value);
+        return flowctrl_update(flowctrl_offset_cpu_csr[cpuid], value);
 }
 
 void flowctrl_write_cpu_halt(unsigned int cpuid, u32 value)
 {
-        return flowctrl_update(flowctrl_offset_cpu_csr[cpuid], value);
+        return flowctrl_update(flowctrl_offset_halt_cpu[cpuid], value);
 }
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index f07467533365..5bb48356d217 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -247,7 +247,9 @@ good_area:
         return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
 
 check_stack:
-        if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+        /* Don't allow expansion below FIRST_USER_ADDRESS */
+        if (vma->vm_flags & VM_GROWSDOWN &&
+            addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
                 goto good_area;
 out:
         return fault;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 2c7cf2f9c837..aa78de8bfdd3 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -489,7 +489,8 @@ static void __init build_mem_type_table(void)
          */
         for (i = 0; i < ARRAY_SIZE(mem_types); i++) {
                 mem_types[i].prot_pte |= PTE_EXT_AF;
-                mem_types[i].prot_sect |= PMD_SECT_AF;
+                if (mem_types[i].prot_sect)
+                        mem_types[i].prot_sect |= PMD_SECT_AF;
         }
         kern_pgprot |= PTE_EXT_AF;
         vecs_pgprot |= PTE_EXT_AF;
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index bc683b8219b5..b0197b2c857d 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/cpu.h>
 #include <linux/cpu_pm.h>
+#include <linux/hardirq.h>
 #include <linux/kernel.h>
 #include <linux/notifier.h>
 #include <linux/signal.h>
@@ -432,7 +433,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
 
 static void vfp_enable(void *unused)
 {
-        u32 access = get_copro_access();
+        u32 access;
+
+        BUG_ON(preemptible());
+        access = get_copro_access();
 
         /*
          * Enable full access to VFP (cp10 and cp11)
@@ -573,12 +577,6 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
          * entry.
          */
         hwstate->fpscr &= ~(FPSCR_LENGTH_MASK | FPSCR_STRIDE_MASK);
-
-        /*
-         * Disable VFP in the hwstate so that we can detect if it gets
-         * used.
-         */
-        hwstate->fpexc &= ~FPEXC_EN;
         return 0;
 }
 
@@ -591,12 +589,8 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
         unsigned long fpexc;
         int err = 0;
 
-        /*
-         * If VFP has been used, then disable it to avoid corrupting
-         * the new thread state.
-         */
-        if (hwstate->fpexc & FPEXC_EN)
-                vfp_flush_hwstate(thread);
+        /* Disable VFP to avoid corrupting the new thread state. */
+        vfp_flush_hwstate(thread);
 
         /*
          * Copy the floating point registers. There can be unused
@@ -657,7 +651,7 @@ static int __init vfp_init(void)
         unsigned int cpu_arch = cpu_architecture();
 
         if (cpu_arch >= CPU_ARCH_ARMv6)
-                vfp_enable(NULL);
+                on_each_cpu(vfp_enable, NULL, 1);
 
         /*
          * First check that there is a VFP that we can use.
@@ -678,8 +672,6 @@ static int __init vfp_init(void)
         } else {
                 hotcpu_notifier(vfp_hotplug, 0);
 
-                smp_call_function(vfp_enable, NULL, 1);
-
                 VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
                 printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
                         (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
diff --git a/arch/frv/include/asm/processor.h b/arch/frv/include/asm/processor.h
index 81c2e271d620..9b1a92b73f60 100644
--- a/arch/frv/include/asm/processor.h
+++ b/arch/frv/include/asm/processor.h
@@ -135,10 +135,6 @@ unsigned long get_wchan(struct task_struct *p);
 #define KSTK_EIP(tsk)   ((tsk)->thread.frame0->pc)
 #define KSTK_ESP(tsk)   ((tsk)->thread.frame0->sp)
 
-/* Allocation and freeing of basic task resources. */
-extern struct task_struct *alloc_task_struct_node(int node);
-extern void free_task_struct(struct task_struct *p);
-
 #define cpu_relax()    barrier()
 
 /* data cache prefetch */
diff --git a/arch/mn10300/kernel/smp.c b/arch/mn10300/kernel/smp.c
index 910dddf65e44..9cd69ad6aa02 100644
--- a/arch/mn10300/kernel/smp.c
+++ b/arch/mn10300/kernel/smp.c
@@ -24,6 +24,7 @@
 #include <linux/sched.h>
 #include <linux/profile.h>
 #include <linux/smp.h>
+#include <linux/cpu.h>
 #include <asm/tlbflush.h>
 #include <asm/bitops.h>
 #include <asm/processor.h>
@@ -38,7 +39,6 @@
 #include "internal.h"
 
 #ifdef CONFIG_HOTPLUG_CPU
-#include <linux/cpu.h>
 #include <asm/cacheflush.h>
 
 static unsigned long sleep_mode[NR_CPUS];
@@ -874,10 +874,13 @@ static void __init smp_online(void)
 
         cpu = smp_processor_id();
 
-        local_irq_enable();
+        notify_cpu_starting(cpu);
 
+        ipi_call_lock();
         set_cpu_online(cpu, true);
-        smp_wmb();
+        ipi_call_unlock();
+
+        local_irq_enable();
 }
 
 /**
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 0bb1d63907f8..4dc7b7942b4c 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -31,6 +31,7 @@
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <linux/ftrace.h>
+#include <linux/cpu.h>
 
 #include <linux/atomic.h>
 #include <asm/current.h>
@@ -295,8 +296,13 @@ smp_cpu_init(int cpunum)
 
                 printk(KERN_CRIT "CPU#%d already initialized!\n", cpunum);
                 machine_halt();
-        }  
+        }
+
+        notify_cpu_starting(cpunum);
+
+        ipi_call_lock();
         set_cpu_online(cpunum, true);
+        ipi_call_unlock();
 
         /* Initialise the idle task for this CPU */
         atomic_inc(&init_mm.mm_count);
diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
index aa795ccef294..fd07f43d6622 100644
--- a/arch/powerpc/include/asm/kvm_book3s.h
+++ b/arch/powerpc/include/asm/kvm_book3s.h
@@ -81,12 +81,13 @@ struct kvmppc_vcpu_book3s {
         u64 sdr1;
         u64 hior;
         u64 msr_mask;
-        u64 vsid_next;
 #ifdef CONFIG_PPC_BOOK3S_32
         u32 vsid_pool[VSID_POOL_SIZE];
+        u32 vsid_next;
 #else
-        u64 vsid_first;
-        u64 vsid_max;
+        u64 proto_vsid_first;
+        u64 proto_vsid_max;
+        u64 proto_vsid_next;
 #endif
         int context_id[SID_CONTEXTS];
 
diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c
index 6f87f39a1ac2..10fc8ec9d2a8 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_host.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_host.c
@@ -194,14 +194,14 @@ static struct kvmppc_sid_map *create_sid_map(struct kvm_vcpu *vcpu, u64 gvsid)
         backwards_map = !backwards_map;
 
         /* Uh-oh ... out of mappings. Let's flush! */
-        if (vcpu_book3s->vsid_next == vcpu_book3s->vsid_max) {
-                vcpu_book3s->vsid_next = vcpu_book3s->vsid_first;
+        if (vcpu_book3s->proto_vsid_next == vcpu_book3s->proto_vsid_max) {
+                vcpu_book3s->proto_vsid_next = vcpu_book3s->proto_vsid_first;
                 memset(vcpu_book3s->sid_map, 0,
                        sizeof(struct kvmppc_sid_map) * SID_MAP_NUM);
                 kvmppc_mmu_pte_flush(vcpu, 0, 0);
                 kvmppc_mmu_flush_segments(vcpu);
         }
-        map->host_vsid = vcpu_book3s->vsid_next++;
+        map->host_vsid = vsid_scramble(vcpu_book3s->proto_vsid_next++, 256M);
 
         map->guest_vsid = gvsid;
         map->valid = true;
@@ -319,9 +319,10 @@ int kvmppc_mmu_init(struct kvm_vcpu *vcpu)
                 return -1;
         vcpu3s->context_id[0] = err;
 
-        vcpu3s->vsid_max = ((vcpu3s->context_id[0] + 1) << USER_ESID_BITS) - 1;
-        vcpu3s->vsid_first = vcpu3s->context_id[0] << USER_ESID_BITS;
-        vcpu3s->vsid_next = vcpu3s->vsid_first;
+        vcpu3s->proto_vsid_max = ((vcpu3s->context_id[0] + 1)
+                                  << USER_ESID_BITS) - 1;
+        vcpu3s->proto_vsid_first = vcpu3s->context_id[0] << USER_ESID_BITS;
+        vcpu3s->proto_vsid_next = vcpu3s->proto_vsid_first;
 
         kvmppc_mmu_hpte_init(vcpu);
 
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index def880aea63a..cec4daddbf31 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -463,6 +463,7 @@ long kvmppc_h_bulk_remove(struct kvm_vcpu *vcpu)
                                 /* insert R and C bits from PTE */
                                 rcbits = rev->guest_rpte & (HPTE_R_R|HPTE_R_C);
                                 args[j] |= rcbits << (56 - 5);
+                                hp[0] = 0;
                                 continue;
                         }
 
diff --git a/arch/powerpc/kvm/book3s_segment.S b/arch/powerpc/kvm/book3s_segment.S
index 0676ae249b9f..6e6e9cef34a8 100644
--- a/arch/powerpc/kvm/book3s_segment.S
+++ b/arch/powerpc/kvm/book3s_segment.S
@@ -197,7 +197,8 @@ kvmppc_interrupt:
         /* Save guest PC and MSR */
 #ifdef CONFIG_PPC64
 BEGIN_FTR_SECTION
-        andi.   r0,r12,0x2
+        andi.   r0, r12, 0x2
+        cmpwi   cr1, r0, 0
         beq     1f
         mfspr   r3,SPRN_HSRR0
         mfspr   r4,SPRN_HSRR1
@@ -250,6 +251,12 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
         beq     ld_last_prev_inst
         cmpwi   r12, BOOK3S_INTERRUPT_ALIGNMENT
         beq-    ld_last_inst
+#ifdef CONFIG_PPC64
+BEGIN_FTR_SECTION
+        cmpwi   r12, BOOK3S_INTERRUPT_H_EMUL_ASSIST
+        beq-    ld_last_inst
+END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+#endif
 
         b       no_ld_last_inst
 
@@ -316,23 +323,17 @@ no_dcbz32_off:
          * Having set up SRR0/1 with the address where we want
          * to continue with relocation on (potentially in module
          * space), we either just go straight there with rfi[d],
-         * or we jump to an interrupt handler with bctr if there
-         * is an interrupt to be handled first.  In the latter
-         * case, the rfi[d] at the end of the interrupt handler
-         * will get us back to where we want to continue.
+         * or we jump to an interrupt handler if there is an
+         * interrupt to be handled first.  In the latter case,
+         * the rfi[d] at the end of the interrupt handler will
+         * get us back to where we want to continue.
          */
 
-        cmpwi   r12, BOOK3S_INTERRUPT_EXTERNAL
-        beq     1f
-        cmpwi   r12, BOOK3S_INTERRUPT_DECREMENTER
-        beq     1f
-        cmpwi   r12, BOOK3S_INTERRUPT_PERFMON
-1:      mtctr   r12
-
         /* Register usage at this point:
          *
          * R1       = host R1
          * R2       = host R2
+         * R10      = raw exit handler id
          * R12      = exit handler id
          * R13      = shadow vcpu (32-bit) or PACA (64-bit)
          * SVCPU.*  = guest *
@@ -342,12 +343,25 @@ no_dcbz32_off:
         PPC_LL  r6, HSTATE_HOST_MSR(r13)
         PPC_LL  r8, HSTATE_VMHANDLER(r13)
 
-        /* Restore host msr -> SRR1 */
+#ifdef CONFIG_PPC64
+BEGIN_FTR_SECTION
+        beq     cr1, 1f
+        mtspr   SPRN_HSRR1, r6
+        mtspr   SPRN_HSRR0, r8
+END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+#endif
+1:      /* Restore host msr -> SRR1 */
         mtsrr1  r6
         /* Load highmem handler address */
         mtsrr0  r8
 
         /* RFI into the highmem handler, or jump to interrupt handler */
-        beqctr
+        cmpwi   r12, BOOK3S_INTERRUPT_EXTERNAL
+        beqa    BOOK3S_INTERRUPT_EXTERNAL
+        cmpwi   r12, BOOK3S_INTERRUPT_DECREMENTER
+        beqa    BOOK3S_INTERRUPT_DECREMENTER
+        cmpwi   r12, BOOK3S_INTERRUPT_PERFMON
+        beqa    BOOK3S_INTERRUPT_PERFMON
+
         RFI
 kvmppc_handler_trampoline_exit_end:
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 96033e2d6845..74239dd77e06 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -11,6 +11,7 @@ config TILE
         select GENERIC_IRQ_PROBE
         select GENERIC_PENDING_IRQ if SMP
         select GENERIC_IRQ_SHOW
+        select HAVE_SYSCALL_WRAPPERS if TILEGX
         select SYS_HYPERVISOR
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
 
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index bc4f562bd459..7594764d8a69 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -100,9 +100,14 @@ extern void cpu_idle_on_new_stack(struct thread_info *old_ti,
 
 #else /* __ASSEMBLY__ */
 
-/* how to get the thread information struct from ASM */
+/*
+ * How to get the thread information struct from assembly.
+ * Note that we use different macros since different architectures
+ * have different semantics in their "mm" instruction and we would
+ * like to guarantee that the macro expands to exactly one instruction.
+ */
 #ifdef __tilegx__
-#define GET_THREAD_INFO(reg) move reg, sp; mm reg, zero, LOG2_THREAD_SIZE, 63
+#define EXTRACT_THREAD_INFO(reg) mm reg, zero, LOG2_THREAD_SIZE, 63
 #else
 #define GET_THREAD_INFO(reg) mm reg, sp, zero, LOG2_THREAD_SIZE, 31
 #endif
diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
index 77763ccd5a7d..cdef6e5ec022 100644
--- a/arch/tile/kernel/compat_signal.c
+++ b/arch/tile/kernel/compat_signal.c
@@ -403,19 +403,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
          * Set up registers for signal handler.
          * Registers that we don't modify keep the value they had from
          * user-space at the time we took the signal.
+         * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
+         * since some things rely on this (e.g. glibc's debug/segfault.c).
          */
         regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
         regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
         regs->sp = ptr_to_compat_reg(frame);
         regs->lr = restorer;
         regs->regs[0] = (unsigned long) usig;
-
-        if (ka->sa.sa_flags & SA_SIGINFO) {
-                /* Need extra arguments, so mark to restore caller-saves. */
-                regs->regs[1] = ptr_to_compat_reg(&frame->info);
-                regs->regs[2] = ptr_to_compat_reg(&frame->uc);
-                regs->flags |= PT_FLAGS_CALLER_SAVES;
-        }
+        regs->regs[1] = ptr_to_compat_reg(&frame->info);
+        regs->regs[2] = ptr_to_compat_reg(&frame->uc);
+        regs->flags |= PT_FLAGS_CALLER_SAVES;
 
         /*
          * Notify any tracer that was single-stepping it.
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index 5d56a1ef5ba5..6943515100f8 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -839,6 +839,18 @@ STD_ENTRY(interrupt_return)
         FEEDBACK_REENTER(interrupt_return)
 
         /*
+         * Use r33 to hold whether we have already loaded the callee-saves
+         * into ptregs.  We don't want to do it twice in this loop, since
+         * then we'd clobber whatever changes are made by ptrace, etc.
+         * Get base of stack in r32.
+         */
+        {
+         GET_THREAD_INFO(r32)
+         movei  r33, 0
+        }
+
+.Lretry_work_pending:
+        /*
          * Disable interrupts so as to make sure we don't
          * miss an interrupt that sets any of the thread flags (like
          * need_resched or sigpending) between sampling and the iret.
@@ -848,9 +860,6 @@ STD_ENTRY(interrupt_return)
         IRQ_DISABLE(r20, r21)
         TRACE_IRQS_OFF  /* Note: clobbers registers r0-r29 */
 
-        /* Get base of stack in r32; note r30/31 are used as arguments here. */
-        GET_THREAD_INFO(r32)
-
 
         /* Check to see if there is any work to do before returning to user. */
         {
@@ -866,16 +875,18 @@ STD_ENTRY(interrupt_return)
 
         /*
          * Make sure we have all the registers saved for signal
-         * handling or single-step.  Call out to C code to figure out
-         * exactly what we need to do for each flag bit, then if
-         * necessary, reload the flags and recheck.
+         * handling, notify-resume, or single-step.  Call out to C
+         * code to figure out exactly what we need to do for each flag bit,
+         * then if necessary, reload the flags and recheck.
          */
-        push_extra_callee_saves r0
         {
          PTREGS_PTR(r0, PTREGS_OFFSET_BASE)
-         jal    do_work_pending
+         bnz    r33, 1f
         }
-        bnz     r0, .Lresume_userspace
+        push_extra_callee_saves r0
+        movei   r33, 1
+1:      jal     do_work_pending
+        bnz     r0, .Lretry_work_pending
 
         /*
          * In the NMI case we
@@ -1180,10 +1191,12 @@ handle_syscall:
         add     r20, r20, tp
         lw      r21, r20
         addi    r21, r21, 1
-        sw      r20, r21
+        {
+         sw     r20, r21
+         GET_THREAD_INFO(r31)
+        }
 
         /* Trace syscalls, if requested. */
-        GET_THREAD_INFO(r31)
         addi    r31, r31, THREAD_INFO_FLAGS_OFFSET
         lw      r30, r31
         andi    r30, r30, _TIF_SYSCALL_TRACE
@@ -1362,7 +1375,10 @@ handle_ill:
 3:
         /* set PC and continue */
         lw      r26, r24
-        sw      r28, r26
+        {
+         sw     r28, r26
+         GET_THREAD_INFO(r0)
+        }
 
         /*
          * Clear TIF_SINGLESTEP to prevent recursion if we execute an ill.
@@ -1370,7 +1386,6 @@ handle_ill:
          * need to clear it here and can't really impose on all other arches.
          * So what's another write between friends?
          */
-        GET_THREAD_INFO(r0)
 
         addi    r1, r0, THREAD_INFO_FLAGS_OFFSET
         {
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index 49d9d6621682..30ae76e50c44 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -647,6 +647,20 @@ STD_ENTRY(interrupt_return)
         FEEDBACK_REENTER(interrupt_return)
 
         /*
+         * Use r33 to hold whether we have already loaded the callee-saves
+         * into ptregs.  We don't want to do it twice in this loop, since
+         * then we'd clobber whatever changes are made by ptrace, etc.
+         */
+        {
+         movei  r33, 0
+         move   r32, sp
+        }
+
+        /* Get base of stack in r32. */
+        EXTRACT_THREAD_INFO(r32)
+
+.Lretry_work_pending:
+        /*
          * Disable interrupts so as to make sure we don't
          * miss an interrupt that sets any of the thread flags (like
          * need_resched or sigpending) between sampling and the iret.
@@ -656,9 +670,6 @@ STD_ENTRY(interrupt_return)
         IRQ_DISABLE(r20, r21)
         TRACE_IRQS_OFF  /* Note: clobbers registers r0-r29 */
 
-        /* Get base of stack in r32; note r30/31 are used as arguments here. */
-        GET_THREAD_INFO(r32)
-
 
         /* Check to see if there is any work to do before returning to user. */
         {
@@ -674,16 +685,18 @@ STD_ENTRY(interrupt_return)
 
         /*
          * Make sure we have all the registers saved for signal
-         * handling or single-step.  Call out to C code to figure out
+         * handling or notify-resume.  Call out to C code to figure out
          * exactly what we need to do for each flag bit, then if
          * necessary, reload the flags and recheck.
          */
-        push_extra_callee_saves r0
         {
          PTREGS_PTR(r0, PTREGS_OFFSET_BASE)
-         jal    do_work_pending
+         bnez   r33, 1f
         }
-        bnez    r0, .Lresume_userspace
+        push_extra_callee_saves r0
+        movei   r33, 1
+1:      jal     do_work_pending
+        bnez    r0, .Lretry_work_pending
 
         /*
          * In the NMI case we
@@ -968,11 +981,16 @@ handle_syscall:
         shl16insli r20, r20, hw0(irq_stat + IRQ_CPUSTAT_SYSCALL_COUNT_OFFSET)
         add     r20, r20, tp
         ld4s    r21, r20
-        addi    r21, r21, 1
-        st4     r20, r21
+        {
+         addi   r21, r21, 1
+         move   r31, sp
+        }
+        {
+         st4    r20, r21
+         EXTRACT_THREAD_INFO(r31)
+        }
 
         /* Trace syscalls, if requested. */
-        GET_THREAD_INFO(r31)
         addi    r31, r31, THREAD_INFO_FLAGS_OFFSET
         ld      r30, r31
         andi    r30, r30, _TIF_SYSCALL_TRACE
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 2d5ef617bb39..54e6c64b85cc 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -567,6 +567,10 @@ struct task_struct *__sched _switch_to(struct task_struct *prev,
  */
 int do_work_pending(struct pt_regs *regs, u32 thread_info_flags)
 {
+        /* If we enter in kernel mode, do nothing and exit the caller loop. */
+        if (!user_mode(regs))
+                return 0;
+
         if (thread_info_flags & _TIF_NEED_RESCHED) {
                 schedule();
                 return 1;
@@ -589,8 +593,7 @@ int do_work_pending(struct pt_regs *regs, u32 thread_info_flags)
                 return 1;
         }
         if (thread_info_flags & _TIF_SINGLESTEP) {
-                if ((regs->ex1 & SPR_EX_CONTEXT_1_1__PL_MASK) == 0)
-                        single_step_once(regs);
+                single_step_once(regs);
                 return 0;
         }
         panic("work_pending: bad flags %#x\n", thread_info_flags);
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index 734c3767cfac..183922e13de1 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -170,6 +170,9 @@ static inline int kvm_para_available(void)
         unsigned int eax, ebx, ecx, edx;
         char signature[13];
 
+        if (boot_cpu_data.cpuid_level < 0)
+                return 0;       /* So we don't blow up on old processors */
+
         cpuid(KVM_CPUID_SIGNATURE, &eax, &ebx, &ecx, &edx);
         memcpy(signature + 0, &ebx, 4);
         memcpy(signature + 4, &ecx, 4);
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index a415b1f44365..7c439fe4941b 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -593,7 +593,7 @@ void __init acpi_set_irq_model_ioapic(void)
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 #include <acpi/processor.h>
 
-static void __cpuinitdata acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
+static void __cpuinit acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
 {
 #ifdef CONFIG_ACPI_NUMA
         int nid;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index d086a09c087d..11c9166c3337 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -945,9 +945,10 @@ struct mce_info {
         atomic_t                inuse;
         struct task_struct      *t;
         __u64                   paddr;
+        int                     restartable;
 } mce_info[MCE_INFO_MAX];
 
-static void mce_save_info(__u64 addr)
+static void mce_save_info(__u64 addr, int c)
 {
         struct mce_info *mi;
 
@@ -955,6 +956,7 @@ static void mce_save_info(__u64 addr)
                 if (atomic_cmpxchg(&mi->inuse, 0, 1) == 0) {
                         mi->t = current;
                         mi->paddr = addr;
+                        mi->restartable = c;
                         return;
                 }
         }
@@ -1130,7 +1132,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                         mce_panic("Fatal machine check on current CPU", &m, msg);
                 if (worst == MCE_AR_SEVERITY) {
                         /* schedule action before return to userland */
-                        mce_save_info(m.addr);
+                        mce_save_info(m.addr, m.mcgstatus & MCG_STATUS_RIPV);
                         set_thread_flag(TIF_MCE_NOTIFY);
                 } else if (kill_it) {
                         force_sig(SIGBUS, current);
@@ -1179,7 +1181,13 @@ void mce_notify_process(void)
 
         pr_err("Uncorrected hardware memory error in user-access at %llx",
                  mi->paddr);
-        if (memory_failure(pfn, MCE_VECTOR, MF_ACTION_REQUIRED) < 0) {
+        /*
+         * We must call memory_failure() here even if the current process is
+         * doomed. We still need to mark the page as poisoned and alert any
+         * other users of the page.
+         */
+        if (memory_failure(pfn, MCE_VECTOR, MF_ACTION_REQUIRED) < 0 ||
+                           mi->restartable == 0) {
                 pr_err("Memory error not recovered");
                 force_sig(SIGBUS, current);
         }
diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
index 3ca42d0e43a2..0327e2b3c408 100644
--- a/arch/x86/kernel/microcode_intel.c
+++ b/arch/x86/kernel/microcode_intel.c
@@ -147,12 +147,6 @@ static int collect_cpu_info(int cpu_num, struct cpu_signature *csig)
 
         memset(csig, 0, sizeof(*csig));
 
-        if (c->x86_vendor != X86_VENDOR_INTEL || c->x86 < 6 ||
-            cpu_has(c, X86_FEATURE_IA64)) {
-                pr_err("CPU%d not a capable Intel processor\n", cpu_num);
-                return -1;
-        }
-
         csig->sig = cpuid_eax(0x00000001);
 
         if ((c->x86_model >= 5) || (c->x86 > 6)) {
@@ -463,6 +457,14 @@ static struct microcode_ops microcode_intel_ops = {
 
 struct microcode_ops * __init init_intel_microcode(void)
 {
+        struct cpuinfo_x86 *c = &cpu_data(0);
+
+        if (c->x86_vendor != X86_VENDOR_INTEL || c->x86 < 6 ||
+            cpu_has(c, X86_FEATURE_IA64)) {
+                pr_err("Intel CPU family 0x%x not supported\n", c->x86);
+                return NULL;
+        }
+
         return &microcode_intel_ops;
 }
 
diff --git a/block/genhd.c b/block/genhd.c
index df9816ede75b..9cf5583c90ff 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -743,7 +743,7 @@ void __init printk_all_partitions(void)
                 struct hd_struct *part;
                 char name_buf[BDEVNAME_SIZE];
                 char devt_buf[BDEVT_SIZE];
-                u8 uuid[PARTITION_META_INFO_UUIDLTH * 2 + 1];
+                char uuid_buf[PARTITION_META_INFO_UUIDLTH * 2 + 5];
 
                 /*
                  * Don't show empty devices or things that have been
@@ -762,14 +762,16 @@ void __init printk_all_partitions(void)
                 while ((part = disk_part_iter_next(&piter))) {
                         bool is_part0 = part == &disk->part0;
 
-                        uuid[0] = 0;
+                        uuid_buf[0] = '\0';
                         if (part->info)
-                                part_unpack_uuid(part->info->uuid, uuid);
+                                snprintf(uuid_buf, sizeof(uuid_buf), "%pU",
+                                         part->info->uuid);
 
                         printk("%s%s %10llu %s %s", is_part0 ? "" : "  ",
                                bdevt_str(part_devt(part), devt_buf),
                                (unsigned long long)part->nr_sects >> 1,
-                               disk_name(disk, part->partno, name_buf), uuid);
+                               disk_name(disk, part->partno, name_buf),
+                               uuid_buf);
                         if (is_part0) {
                                 if (disk->driverfs_dev != NULL &&
                                     disk->driverfs_dev->driver != NULL)
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 3263b68cdfa3..3188da3df8da 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -250,6 +250,10 @@ static int __acpi_bus_set_power(struct acpi_device *device, int state)
                 return -ENODEV;
         }
 
+        /* For D3cold we should execute _PS3, not _PS4. */
+        if (state == ACPI_STATE_D3_COLD)
+                object_name[3] = '3';
+
         /*
          * Transition Power
          * ----------------
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 330bb4d75852..0500f719f63e 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -660,7 +660,7 @@ int acpi_power_on_resources(struct acpi_device *device, int state)
 
 int acpi_power_transition(struct acpi_device *device, int state)
 {
-        int result;
+        int result = 0;
 
         if (!device || (state < ACPI_STATE_D0) || (state > ACPI_STATE_D3_COLD))
                 return -EINVAL;
@@ -679,8 +679,11 @@ int acpi_power_transition(struct acpi_device *device, int state)
          * (e.g. so the device doesn't lose power while transitioning).  Then,
          * we dereference all power resources used in the current list.
          */
-        result = acpi_power_on_list(&device->power.states[state].resources);
-        if (!result)
+        if (state < ACPI_STATE_D3_COLD)
+                result = acpi_power_on_list(
+                        &device->power.states[state].resources);
+
+        if (!result && device->power.state < ACPI_STATE_D3_COLD)
                 acpi_power_off_list(
                         &device->power.states[device->power.state].resources);
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 7417267e88fa..85cbfdccc97c 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -908,6 +908,10 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
         device->power.states[ACPI_STATE_D3].flags.valid = 1;
         device->power.states[ACPI_STATE_D3].power = 0;
 
+        /* Set D3cold's explicit_set flag if _PS3 exists. */
+        if (device->power.states[ACPI_STATE_D3_HOT].flags.explicit_set)
+                device->power.states[ACPI_STATE_D3_COLD].flags.explicit_set = 1;
+
         acpi_bus_init_power(device);
 
         return 0;
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 8db9089127c5..9a13e889837e 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -6580,24 +6580,21 @@ static const struct file_operations dac960_user_command_proc_fops = {
 
 static void DAC960_CreateProcEntries(DAC960_Controller_T *Controller)
 {
-        struct proc_dir_entry *StatusProcEntry;
         struct proc_dir_entry *ControllerProcEntry;
-        struct proc_dir_entry *UserCommandProcEntry;
 
         if (DAC960_ProcDirectoryEntry == NULL) {
-                DAC960_ProcDirectoryEntry = proc_mkdir("rd", NULL);
-                StatusProcEntry = proc_create("status", 0,
-                                           DAC960_ProcDirectoryEntry,
-                                           &dac960_proc_fops);
+                DAC960_ProcDirectoryEntry = proc_mkdir("rd", NULL);
+                proc_create("status", 0, DAC960_ProcDirectoryEntry,
+                            &dac960_proc_fops);
         }
 
-      sprintf(Controller->ControllerName, "c%d", Controller->ControllerNumber);
-      ControllerProcEntry = proc_mkdir(Controller->ControllerName,
-                                       DAC960_ProcDirectoryEntry);
-      proc_create_data("initial_status", 0, ControllerProcEntry, &dac960_initial_status_proc_fops, Controller);
-      proc_create_data("current_status", 0, ControllerProcEntry, &dac960_current_status_proc_fops, Controller);
-      UserCommandProcEntry = proc_create_data("user_command", S_IWUSR | S_IRUSR, ControllerProcEntry, &dac960_user_command_proc_fops, Controller);
-      Controller->ControllerProcEntry = ControllerProcEntry;
+        sprintf(Controller->ControllerName, "c%d", Controller->ControllerNumber);
+        ControllerProcEntry = proc_mkdir(Controller->ControllerName,
+                                         DAC960_ProcDirectoryEntry);
+        proc_create_data("initial_status", 0, ControllerProcEntry, &dac960_initial_status_proc_fops, Controller);
+        proc_create_data("current_status", 0, ControllerProcEntry, &dac960_current_status_proc_fops, Controller);
+        proc_create_data("user_command", S_IWUSR | S_IRUSR, ControllerProcEntry, &dac960_user_command_proc_fops, Controller);
+        Controller->ControllerProcEntry = ControllerProcEntry;
 }
 
 
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 00f9fc992090..304000c3d433 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -2510,8 +2510,10 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
                 up(&dd->port->cmd_slot);
                 return NULL;
         }
-        if (unlikely(*tag < 0))
+        if (unlikely(*tag < 0)) {
+                up(&dd->port->cmd_slot);
                 return NULL;
+        }
 
         return dd->port->commands[*tag].sg;
 }
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index ddf86b6500b7..cdf2f5451c76 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1895,6 +1895,13 @@ static int virtcons_restore(struct virtio_device *vdev)
 
                 /* Get port open/close status on the host */
                 send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 1);
+
+                /*
+                 * If a port was open at the time of suspending, we
+                 * have to let the host know that it's still open.
+                 */
+                if (port->guest_connected)
+                        send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 1);
         }
         return 0;
 }
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index ab9abb46d01a..dd414d9350ef 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -164,6 +164,7 @@ config CRYPTO_DEV_MV_CESA
         select CRYPTO_ALGAPI
         select CRYPTO_AES
         select CRYPTO_BLKCIPHER2
+        select CRYPTO_HASH
         help
           This driver allows you to utilize the Cryptographic Engines and
           Security Accelerator (CESA) which can be found on the Marvell Orion
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 445fdf811695..bf0d7e4e345b 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -245,7 +245,9 @@ atc_chain_complete(struct at_dma_chan *atchan, struct at_desc *desc)
         dev_vdbg(chan2dev(&atchan->chan_common),
                 "descriptor %u complete\n", txd->cookie);
 
-        dma_cookie_complete(txd);
+        /* mark the descriptor as complete for non cyclic cases only */
+        if (!atc_chan_is_cyclic(atchan))
+                dma_cookie_complete(txd);
 
         /* move children to free_list */
         list_splice_init(&desc->tx_list, &atchan->free_list);
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index e6f133b78dc2..f6e9b572b998 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -703,7 +703,9 @@ static void ep93xx_dma_tasklet(unsigned long data)
         desc = ep93xx_dma_get_active(edmac);
         if (desc) {
                 if (desc->complete) {
-                        dma_cookie_complete(&desc->txd);
+                        /* mark descriptor complete for non cyclic case only */
+                        if (!test_bit(EP93XX_DMA_IS_CYCLIC, &edmac->flags))
+                                dma_cookie_complete(&desc->txd);
                         list_splice_init(&edmac->active, &list);
                 }
                 callback = desc->txd.callback;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 2ee6e23930ad..fa3fb21e60be 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2322,7 +2322,8 @@ static void pl330_tasklet(unsigned long data)
         /* Pick up ripe tomatoes */
         list_for_each_entry_safe(desc, _dt, &pch->work_list, node)
                 if (desc->status == DONE) {
-                        dma_cookie_complete(&desc->txd);
+                        if (pch->cyclic)
+                                dma_cookie_complete(&desc->txd);
                         list_move_tail(&desc->node, &list);
                 }
 
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2fd87b544a93..eb3d138ff55a 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1632,6 +1632,21 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         pool->low_water_blocks = pt->low_water_blocks;
         pool->pf = pt->pf;
 
+        /*
+         * If discard_passdown was enabled verify that the data device
+         * supports discards.  Disable discard_passdown if not; otherwise
+         * -EOPNOTSUPP will be returned.
+         */
+        if (pt->pf.discard_passdown) {
+                struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
+                if (!q || !blk_queue_discard(q)) {
+                        char buf[BDEVNAME_SIZE];
+                        DMWARN("Discard unsupported by data device (%s): Disabling discard passdown.",
+                               bdevname(pt->data_dev->bdev, buf));
+                        pool->pf.discard_passdown = 0;
+                }
+        }
+
         return 0;
 }
 
@@ -1988,19 +2003,6 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 goto out_flags_changed;
         }
 
-        /*
-         * If discard_passdown was enabled verify that the data device
-         * supports discards.  Disable discard_passdown if not; otherwise
-         * -EOPNOTSUPP will be returned.
-         */
-        if (pf.discard_passdown) {
-                struct request_queue *q = bdev_get_queue(data_dev->bdev);
-                if (!q || !blk_queue_discard(q)) {
-                        DMWARN("Discard unsupported by data device: Disabling discard passdown.");
-                        pf.discard_passdown = 0;
-                }
-        }
-
         pt->pool = pool;
         pt->ti = ti;
         pt->metadata_dev = metadata_dev;
@@ -2385,7 +2387,7 @@ static int pool_status(struct dm_target *ti, status_type_t type,
                        (unsigned long long)pt->low_water_blocks);
 
                 count = !pool->pf.zero_new_blocks + !pool->pf.discard_enabled +
-                        !pool->pf.discard_passdown;
+                        !pt->pf.discard_passdown;
                 DMEMIT("%u ", count);
 
                 if (!pool->pf.zero_new_blocks)
@@ -2394,7 +2396,7 @@ static int pool_status(struct dm_target *ti, status_type_t type,
                 if (!pool->pf.discard_enabled)
                         DMEMIT("ignore_discard ");
 
-                if (!pool->pf.discard_passdown)
+                if (!pt->pf.discard_passdown)
                         DMEMIT("no_discard_passdown ");
 
                 break;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 477eb2e180c0..01233d855eb2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -391,6 +391,8 @@ void mddev_suspend(struct mddev *mddev)
         synchronize_rcu();
         wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
         mddev->pers->quiesce(mddev, 1);
+
+        del_timer_sync(&mddev->safemode_timer);
 }
 EXPORT_SYMBOL_GPL(mddev_suspend);
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index c8dbb84d5357..3f91c2e1dfe7 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3164,12 +3164,40 @@ raid10_size(struct mddev *mddev, sector_t sectors, int raid_disks)
         return size << conf->chunk_shift;
 }
 
+static void calc_sectors(struct r10conf *conf, sector_t size)
+{
+        /* Calculate the number of sectors-per-device that will
+         * actually be used, and set conf->dev_sectors and
+         * conf->stride
+         */
+
+        size = size >> conf->chunk_shift;
+        sector_div(size, conf->far_copies);
+        size = size * conf->raid_disks;
+        sector_div(size, conf->near_copies);
+        /* 'size' is now the number of chunks in the array */
+        /* calculate "used chunks per device" */
+        size = size * conf->copies;
+
+        /* We need to round up when dividing by raid_disks to
+         * get the stride size.
+         */
+        size = DIV_ROUND_UP_SECTOR_T(size, conf->raid_disks);
+
+        conf->dev_sectors = size << conf->chunk_shift;
+
+        if (conf->far_offset)
+                conf->stride = 1 << conf->chunk_shift;
+        else {
+                sector_div(size, conf->far_copies);
+                conf->stride = size << conf->chunk_shift;
+        }
+}
 
 static struct r10conf *setup_conf(struct mddev *mddev)
 {
         struct r10conf *conf = NULL;
         int nc, fc, fo;
-        sector_t stride, size;
         int err = -EINVAL;
 
         if (mddev->new_chunk_sectors < (PAGE_SIZE >> 9) ||
@@ -3219,28 +3247,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
         if (!conf->r10bio_pool)
                 goto out;
 
-        size = mddev->dev_sectors >> conf->chunk_shift;
-        sector_div(size, fc);
-        size = size * conf->raid_disks;
-        sector_div(size, nc);
-        /* 'size' is now the number of chunks in the array */
-        /* calculate "used chunks per device" in 'stride' */
-        stride = size * conf->copies;
-
-        /* We need to round up when dividing by raid_disks to
-         * get the stride size.
-         */
-        stride += conf->raid_disks - 1;
-        sector_div(stride, conf->raid_disks);
-
-        conf->dev_sectors = stride << conf->chunk_shift;
-
-        if (fo)
-                stride = 1;
-        else
-                sector_div(stride, fc);
-        conf->stride = stride << conf->chunk_shift;
-
+        calc_sectors(conf, mddev->dev_sectors);
 
         spin_lock_init(&conf->device_lock);
         INIT_LIST_HEAD(&conf->retry_list);
@@ -3468,7 +3475,8 @@ static int raid10_resize(struct mddev *mddev, sector_t sectors)
                 mddev->recovery_cp = oldsize;
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         }
-        mddev->dev_sectors = sectors;
+        calc_sectors(conf, sectors);
+        mddev->dev_sectors = conf->dev_sectors;
         mddev->resync_max_sectors = size;
         return 0;
 }
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 0f64d7182657..cb888d835a89 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -1921,6 +1921,10 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
         } else {
                 /* default values */
                 switch (c->delivery_system) {
+                case SYS_DVBS:
+                case SYS_DVBS2:
+                case SYS_ISDBS:
+                case SYS_TURBO:
                 case SYS_DVBC_ANNEX_A:
                 case SYS_DVBC_ANNEX_C:
                         fepriv->min_delay = HZ / 20;
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 860c112e0fd2..bef5296173c9 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
 
         spin_lock_init(&dev->hw_lock);
 
-        /* claim the resources */
-        error = -EBUSY;
-        dev->hw_io = pnp_port_start(pnp_dev, 0);
-        if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
-                dev->hw_io = -1;
-                dev->irq = -1;
-                goto error;
-        }
-
-        dev->irq = pnp_irq(pnp_dev, 0);
-        if (request_irq(dev->irq, ene_isr,
-                        IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
-                dev->irq = -1;
-                goto error;
-        }
-
         pnp_set_drvdata(pnp_dev, dev);
         dev->pnp_dev = pnp_dev;
 
@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
         device_set_wakeup_capable(&pnp_dev->dev, true);
         device_set_wakeup_enable(&pnp_dev->dev, true);
 
+        /* claim the resources */
+        error = -EBUSY;
+        dev->hw_io = pnp_port_start(pnp_dev, 0);
+        if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
+                dev->hw_io = -1;
+                dev->irq = -1;
+                goto error;
+        }
+
+        dev->irq = pnp_irq(pnp_dev, 0);
+        if (request_irq(dev->irq, ene_isr,
+                        IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
+                dev->irq = -1;
+                goto error;
+        }
+
         error = rc_register_device(rdev);
         if (error < 0)
                 goto error;
diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
index 392d4be91f8f..4a3a238bcfbc 100644
--- a/drivers/media/rc/fintek-cir.c
+++ b/drivers/media/rc/fintek-cir.c
@@ -197,7 +197,7 @@ static int fintek_hw_detect(struct fintek_dev *fintek)
         /*
          * Newer reviews of this chipset uses port 8 instead of 5
          */
-        if ((chip != 0x0408) || (chip != 0x0804))
+        if ((chip != 0x0408) && (chip != 0x0804))
                 fintek->logical_dev_cir = LOGICAL_DEV_CIR_REV2;
         else
                 fintek->logical_dev_cir = LOGICAL_DEV_CIR_REV1;
@@ -514,16 +514,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
 
         spin_lock_init(&fintek->fintek_lock);
 
-        ret = -EBUSY;
-        /* now claim resources */
-        if (!request_region(fintek->cir_addr,
-                            fintek->cir_port_len, FINTEK_DRIVER_NAME))
-                goto failure;
-
-        if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
-                        FINTEK_DRIVER_NAME, (void *)fintek))
-                goto failure;
-
         pnp_set_drvdata(pdev, fintek);
         fintek->pdev = pdev;
 
@@ -558,6 +548,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
         /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
         rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
 
+        ret = -EBUSY;
+        /* now claim resources */
+        if (!request_region(fintek->cir_addr,
+                            fintek->cir_port_len, FINTEK_DRIVER_NAME))
+                goto failure;
+
+        if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
+                        FINTEK_DRIVER_NAME, (void *)fintek))
+                goto failure;
+
         ret = rc_register_device(rdev);
         if (ret)
                 goto failure;
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index 682009d76cdf..0e49c99abf68 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
         /* initialize raw event */
         init_ir_raw_event(&itdev->rawir);
 
-        ret = -EBUSY;
-        /* now claim resources */
-        if (!request_region(itdev->cir_addr,
-                                dev_desc->io_region_size, ITE_DRIVER_NAME))
-                goto failure;
-
-        if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
-                        ITE_DRIVER_NAME, (void *)itdev))
-                goto failure;
-
         /* set driver data into the pnp device */
         pnp_set_drvdata(pdev, itdev);
         itdev->pdev = pdev;
@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
         rdev->driver_name = ITE_DRIVER_NAME;
         rdev->map_name = RC_MAP_RC6_MCE;
 
+        ret = -EBUSY;
+        /* now claim resources */
+        if (!request_region(itdev->cir_addr,
+                                dev_desc->io_region_size, ITE_DRIVER_NAME))
+                goto failure;
+
+        if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
+                        ITE_DRIVER_NAME, (void *)itdev))
+                goto failure;
+
         ret = rc_register_device(rdev);
         if (ret)
                 goto failure;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 144f3f55d765..8b2c071ac0ab 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
         spin_lock_init(&nvt->nvt_lock);
         spin_lock_init(&nvt->tx.lock);
 
-        ret = -EBUSY;
-        /* now claim resources */
-        if (!request_region(nvt->cir_addr,
-                            CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-                goto failure;
-
-        if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
-                        NVT_DRIVER_NAME, (void *)nvt))
-                goto failure;
-
-        if (!request_region(nvt->cir_wake_addr,
-                            CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-                goto failure;
-
-        if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
-                        NVT_DRIVER_NAME, (void *)nvt))
-                goto failure;
-
         pnp_set_drvdata(pdev, nvt);
         nvt->pdev = pdev;
 
@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
         rdev->tx_resolution = XYZ;
 #endif
 
+        ret = -EBUSY;
+        /* now claim resources */
+        if (!request_region(nvt->cir_addr,
+                            CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+                goto failure;
+
+        if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
+                        NVT_DRIVER_NAME, (void *)nvt))
+                goto failure;
+
+        if (!request_region(nvt->cir_wake_addr,
+                            CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+                goto failure;
+
+        if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
+                        NVT_DRIVER_NAME, (void *)nvt))
+                goto failure;
+
         ret = rc_register_device(rdev);
         if (ret)
                 goto failure;
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index af526586fa26..342c2c8c1ddf 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
                 "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
                 data->wbase, data->ebase, data->sbase, data->irq);
 
-        if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
-                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                        data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
-                err = -EBUSY;
-                goto exit_free_data;
-        }
-
-        if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
-                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                        data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
-                err = -EBUSY;
-                goto exit_release_wbase;
-        }
-
-        if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
-                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                        data->sbase, data->sbase + SP_IOMEM_LEN - 1);
-                err = -EBUSY;
-                goto exit_release_ebase;
-        }
-
-        err = request_irq(data->irq, wbcir_irq_handler,
-                          IRQF_DISABLED, DRVNAME, device);
-        if (err) {
-                dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
-                err = -EBUSY;
-                goto exit_release_sbase;
-        }
-
         led_trigger_register_simple("cir-tx", &data->txtrigger);
         if (!data->txtrigger) {
                 err = -ENOMEM;
-                goto exit_free_irq;
+                goto exit_free_data;
         }
 
         led_trigger_register_simple("cir-rx", &data->rxtrigger);
@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
         data->dev->priv = data;
         data->dev->dev.parent = &device->dev;
 
+        if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
+                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                        data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
+                err = -EBUSY;
+                goto exit_free_rc;
+        }
+
+        if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
+                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                        data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
+                err = -EBUSY;
+                goto exit_release_wbase;
+        }
+
+        if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
+                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                        data->sbase, data->sbase + SP_IOMEM_LEN - 1);
+                err = -EBUSY;
+                goto exit_release_ebase;
+        }
+
+        err = request_irq(data->irq, wbcir_irq_handler,
+                          IRQF_DISABLED, DRVNAME, device);
+        if (err) {
+                dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
+                err = -EBUSY;
+                goto exit_release_sbase;
+        }
+
         err = rc_register_device(data->dev);
         if (err)
-                goto exit_free_rc;
+                goto exit_free_irq;
 
         device_init_wakeup(&device->dev, 1);
 
@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
 
         return 0;
 
-exit_free_rc:
-        rc_free_device(data->dev);
-exit_unregister_led:
-        led_classdev_unregister(&data->led);
-exit_unregister_rxtrigger:
-        led_trigger_unregister_simple(data->rxtrigger);
-exit_unregister_txtrigger:
-        led_trigger_unregister_simple(data->txtrigger);
 exit_free_irq:
         free_irq(data->irq, device);
 exit_release_sbase:
@@ -1088,6 +1080,14 @@ exit_release_ebase:
         release_region(data->ebase, EHFUNC_IOMEM_LEN);
 exit_release_wbase:
         release_region(data->wbase, WAKEUP_IOMEM_LEN);
+exit_free_rc:
+        rc_free_device(data->dev);
+exit_unregister_led:
+        led_classdev_unregister(&data->led);
+exit_unregister_rxtrigger:
+        led_trigger_unregister_simple(data->rxtrigger);
+exit_unregister_txtrigger:
+        led_trigger_unregister_simple(data->txtrigger);
 exit_free_data:
         kfree(data);
         pnp_set_drvdata(device, NULL);
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index db8e5084df06..863c755dd2b7 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -2923,6 +2923,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
          * not the JPEG end of frame ('ff d9').
          */
 
+        /* count the packets and their size */
+        sd->npkt++;
+        sd->pktsz += len;
+
 /*fixme: assumption about the following code:
  *      - there can be only one marker in a packet
  */
@@ -2945,10 +2949,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                 data += i;
         }
 
-        /* count the packets and their size */
-        sd->npkt++;
-        sd->pktsz += len;
-
         /* search backwards if there is a marker in the packet */
         for (i = len - 1; --i >= 0; ) {
                 if (data[i] != 0xff) {
diff --git a/drivers/media/video/marvell-ccic/mmp-driver.c b/drivers/media/video/marvell-ccic/mmp-driver.c
index d23552323f45..c4c17fe76c0d 100644
--- a/drivers/media/video/marvell-ccic/mmp-driver.c
+++ b/drivers/media/video/marvell-ccic/mmp-driver.c
@@ -181,7 +181,6 @@ static int mmpcam_probe(struct platform_device *pdev)
         INIT_LIST_HEAD(&cam->devlist);
 
         mcam = &cam->mcam;
-        mcam->platform = MHP_Armada610;
         mcam->plat_power_up = mmpcam_power_up;
         mcam->plat_power_down = mmpcam_power_down;
         mcam->dev = &pdev->dev;
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index b06efd208328..7e9b2c612b03 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -246,28 +246,37 @@ int fimc_capture_resume(struct fimc_dev *fimc)
 
 }
 
-static unsigned int get_plane_size(struct fimc_frame *fr, unsigned int plane)
-{
-        if (!fr || plane >= fr->fmt->memplanes)
-                return 0;
-        return fr->f_width * fr->f_height * fr->fmt->depth[plane] / 8;
-}
-
-static int queue_setup(struct vb2_queue *vq,  const struct v4l2_format *pfmt,
+static int queue_setup(struct vb2_queue *vq, const struct v4l2_format *pfmt,
                        unsigned int *num_buffers, unsigned int *num_planes,
                        unsigned int sizes[], void *allocators[])
 {
+        const struct v4l2_pix_format_mplane *pixm = NULL;
         struct fimc_ctx *ctx = vq->drv_priv;
-        struct fimc_fmt *fmt = ctx->d_frame.fmt;
+        struct fimc_frame *frame = &ctx->d_frame;
+        struct fimc_fmt *fmt = frame->fmt;
+        unsigned long wh;
         int i;
 
-        if (!fmt)
+        if (pfmt) {
+                pixm = &pfmt->fmt.pix_mp;
+                fmt = fimc_find_format(&pixm->pixelformat, NULL,
+                                       FMT_FLAGS_CAM | FMT_FLAGS_M2M, -1);
+                wh = pixm->width * pixm->height;
+        } else {
+                wh = frame->f_width * frame->f_height;
+        }
+
+        if (fmt == NULL)
                 return -EINVAL;
 
         *num_planes = fmt->memplanes;
 
         for (i = 0; i < fmt->memplanes; i++) {
-                sizes[i] = get_plane_size(&ctx->d_frame, i);
+                unsigned int size = (wh * fmt->depth[i]) / 8;
+                if (pixm)
+                        sizes[i] = max(size, pixm->plane_fmt[i].sizeimage);
+                else
+                        sizes[i] = size;
                 allocators[i] = ctx->fimc_dev->alloc_ctx;
         }
 
@@ -1383,7 +1392,7 @@ static int fimc_subdev_set_crop(struct v4l2_subdev *sd,
         fimc_capture_try_crop(ctx, r, crop->pad);
 
         if (crop->which == V4L2_SUBDEV_FORMAT_TRY) {
-                mutex_lock(&fimc->lock);
+                mutex_unlock(&fimc->lock);
                 *v4l2_subdev_get_try_crop(fh, crop->pad) = *r;
                 return 0;
         }
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index e184e650022a..e09ba7b0076e 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -1048,14 +1048,14 @@ static int fimc_m2m_g_fmt_mplane(struct file *file, void *fh,
  * @mask: the color flags to match
  * @index: offset in the fimc_formats array, ignored if negative
  */
-struct fimc_fmt *fimc_find_format(u32 *pixelformat, u32 *mbus_code,
+struct fimc_fmt *fimc_find_format(const u32 *pixelformat, const u32 *mbus_code,
                                   unsigned int mask, int index)
 {
         struct fimc_fmt *fmt, *def_fmt = NULL;
         unsigned int i;
         int id = 0;
 
-        if (index >= ARRAY_SIZE(fimc_formats))
+        if (index >= (int)ARRAY_SIZE(fimc_formats))
                 return NULL;
 
         for (i = 0; i < ARRAY_SIZE(fimc_formats); ++i) {
diff --git a/drivers/media/video/s5p-fimc/fimc-core.h b/drivers/media/video/s5p-fimc/fimc-core.h
index a18291e648e2..84fd83550bd7 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.h
+++ b/drivers/media/video/s5p-fimc/fimc-core.h
@@ -718,7 +718,7 @@ void fimc_alpha_ctrl_update(struct fimc_ctx *ctx);
 int fimc_fill_format(struct fimc_frame *frame, struct v4l2_format *f);
 void fimc_adjust_mplane_format(struct fimc_fmt *fmt, u32 width, u32 height,
                                struct v4l2_pix_format_mplane *pix);
-struct fimc_fmt *fimc_find_format(u32 *pixelformat, u32 *mbus_code,
+struct fimc_fmt *fimc_find_format(const u32 *pixelformat, const u32 *mbus_code,
                                   unsigned int mask, int index);
 
 int fimc_check_scaler_ratio(struct fimc_ctx *ctx, int sw, int sh,
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index eb25756a07af..aedb970d13f6 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -530,7 +530,10 @@ static int soc_camera_open(struct file *file)
                 if (icl->reset)
                         icl->reset(icd->pdev);
 
+                /* Don't mess with the host during probe */
+                mutex_lock(&ici->host_lock);
                 ret = ici->ops->add(icd);
+                mutex_unlock(&ici->host_lock);
                 if (ret < 0) {
                         dev_err(icd->pdev, "Couldn't activate the camera: %d\n", ret);
                         goto eiciadd;
@@ -956,7 +959,7 @@ static void scan_add_host(struct soc_camera_host *ici)
 {
         struct soc_camera_device *icd;
 
-        mutex_lock(&list_lock);
+        mutex_lock(&ici->host_lock);
 
         list_for_each_entry(icd, &devices, list) {
                 if (icd->iface == ici->nr) {
@@ -967,7 +970,7 @@ static void scan_add_host(struct soc_camera_host *ici)
                 }
         }
 
-        mutex_unlock(&list_lock);
+        mutex_unlock(&ici->host_lock);
 }
 
 #ifdef CONFIG_I2C_BOARDINFO
@@ -1313,6 +1316,7 @@ int soc_camera_host_register(struct soc_camera_host *ici)
         list_add_tail(&ici->list, &hosts);
         mutex_unlock(&list_lock);
 
+        mutex_init(&ici->host_lock);
         scan_add_host(ici);
 
         return 0;
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index f17ad98fcc5f..4b7132660a93 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -15,6 +15,7 @@
 #include <linux/dma-mapping.h>
 
 #include <media/videobuf2-core.h>
+#include <media/videobuf2-dma-contig.h>
 #include <media/videobuf2-memops.h>
 
 struct vb2_dc_conf {
@@ -85,7 +86,7 @@ static void *vb2_dma_contig_vaddr(void *buf_priv)
 {
         struct vb2_dc_buf *buf = buf_priv;
         if (!buf)
-                return 0;
+                return NULL;
 
         return buf->vaddr;
 }
diff --git a/drivers/media/video/videobuf2-memops.c b/drivers/media/video/videobuf2-memops.c
index c41cb60245d6..504cd4cbe29e 100644
--- a/drivers/media/video/videobuf2-memops.c
+++ b/drivers/media/video/videobuf2-memops.c
@@ -55,6 +55,7 @@ struct vm_area_struct *vb2_get_vma(struct vm_area_struct *vma)
 
         return vma_copy;
 }
+EXPORT_SYMBOL_GPL(vb2_get_vma);
 
 /**
  * vb2_put_userptr() - release a userspace virtual memory area
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 58fc65f5c817..f2f482bec573 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -376,7 +376,7 @@ static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
          * Make a fake call to mtd_read_fact_prot_reg() to check if OTP
          * operations are supported.
          */
-        if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP)
+        if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP)
                 return -EOPNOTSUPP;
 
         switch (mode) {
diff --git a/drivers/mtd/nand/ams-delta.c b/drivers/mtd/nand/ams-delta.c
index 73416951f4c1..861ca8f7e47d 100644
--- a/drivers/mtd/nand/ams-delta.c
+++ b/drivers/mtd/nand/ams-delta.c
@@ -212,18 +212,17 @@ static int __devinit ams_delta_init(struct platform_device *pdev)
         /* Link the private data with the MTD structure */
         ams_delta_mtd->priv = this;
 
-        if (!request_mem_region(res->start, resource_size(res),
-                        dev_name(&pdev->dev))) {
-                dev_err(&pdev->dev, "request_mem_region failed\n");
-                err = -EBUSY;
-                goto out_free;
-        }
+        /*
+         * Don't try to request the memory region from here,
+         * it should have been already requested from the
+         * gpio-omap driver and requesting it again would fail.
+         */
 
         io_base = ioremap(res->start, resource_size(res));
         if (io_base == NULL) {
                 dev_err(&pdev->dev, "ioremap failed\n");
                 err = -EIO;
-                goto out_release_io;
+                goto out_free;
         }
 
         this->priv = io_base;
@@ -271,8 +270,6 @@ out_gpio:
         platform_set_drvdata(pdev, NULL);
         gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB);
         iounmap(io_base);
-out_release_io:
-        release_mem_region(res->start, resource_size(res));
 out_free:
         kfree(ams_delta_mtd);
  out:
@@ -285,7 +282,6 @@ out_free:
 static int __devexit ams_delta_cleanup(struct platform_device *pdev)
 {
         void __iomem *io_base = platform_get_drvdata(pdev);
-        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
         /* Release resources, unregister device */
         nand_release(ams_delta_mtd);
@@ -293,7 +289,6 @@ static int __devexit ams_delta_cleanup(struct platform_device *pdev)
         gpio_free_array(_mandatory_gpio, ARRAY_SIZE(_mandatory_gpio));
         gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB);
         iounmap(io_base);
-        release_mem_region(res->start, resource_size(res));
 
         /* Free the MTD device structure */
         kfree(ams_delta_mtd);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 9abfde479316..2e1f8066f1a8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -342,26 +342,26 @@ static void rlb_update_entry_from_arp(struct bonding *bond, struct arp_pkt *arp)
         _unlock_rx_hashtbl_bh(bond);
 }
 
-static void rlb_arp_recv(struct sk_buff *skb, struct bonding *bond,
+static int rlb_arp_recv(struct sk_buff *skb, struct bonding *bond,
                          struct slave *slave)
 {
         struct arp_pkt *arp;
 
         if (skb->protocol != cpu_to_be16(ETH_P_ARP))
-                return;
+                goto out;
 
         arp = (struct arp_pkt *) skb->data;
         if (!arp) {
                 pr_debug("Packet has no ARP data\n");
-                return;
+                goto out;
         }
 
         if (!pskb_may_pull(skb, arp_hdr_len(bond->dev)))
-                return;
+                goto out;
 
         if (skb->len < sizeof(struct arp_pkt)) {
                 pr_debug("Packet is too small to be an ARP\n");
-                return;
+                goto out;
         }
 
         if (arp->op_code == htons(ARPOP_REPLY)) {
@@ -369,6 +369,8 @@ static void rlb_arp_recv(struct sk_buff *skb, struct bonding *bond,
                 rlb_update_entry_from_arp(bond, arp);
                 pr_debug("Server received an ARP Reply from client\n");
         }
+out:
+        return RX_HANDLER_ANOTHER;
 }
 
 /* Caller must hold bond lock for read */
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 9f2bae6616d3..4581aa5ccaba 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -218,7 +218,7 @@ struct bonding {
         struct   slave *primary_slave;
         bool     force_primary;
         s32      slave_cnt; /* never change this value outside the attach/detach wrappers */
-        void     (*recv_probe)(struct sk_buff *, struct bonding *,
+        int     (*recv_probe)(struct sk_buff *, struct bonding *,
                                struct slave *);
         rwlock_t lock;
         rwlock_t curr_slave_lock;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 37caa8885c2a..8d8908d2a9b1 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -493,7 +493,11 @@ out:
 static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
         set_bit(__E1000_DOWN, &adapter->flags);
-        cancel_work_sync(&adapter->reset_task);
+
+        /* Only kill reset task if adapter is not resetting */
+        if (!test_bit(__E1000_RESETTING, &adapter->flags))
+                cancel_work_sync(&adapter->reset_task);
+
         cancel_delayed_work_sync(&adapter->watchdog_task);
         cancel_delayed_work_sync(&adapter->phy_info_task);
         cancel_delayed_work_sync(&adapter->fifo_stall_task);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
index dd14915f54bb..ba781747d174 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
@@ -584,7 +584,6 @@ struct pch_gbe_hw_stats {
 /**
  * struct pch_gbe_adapter - board specific private data structure
  * @stats_lock: Spinlock structure for status
- * @tx_queue_lock:      Spinlock structure for transmit
  * @ethtool_lock:       Spinlock structure for ethtool
  * @irq_sem:            Semaphore for interrupt
  * @netdev:             Pointer of network device structure
@@ -609,7 +608,6 @@ struct pch_gbe_hw_stats {
 
 struct pch_gbe_adapter {
         spinlock_t stats_lock;
-        spinlock_t tx_queue_lock;
         spinlock_t ethtool_lock;
         atomic_t irq_sem;
         struct net_device *netdev;
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 8035e5ff6e06..1e38d502a062 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -640,14 +640,11 @@ static void pch_gbe_mac_set_pause_packet(struct pch_gbe_hw *hw)
  */
 static int pch_gbe_alloc_queues(struct pch_gbe_adapter *adapter)
 {
-        int size;
-
-        size = (int)sizeof(struct pch_gbe_tx_ring);
-        adapter->tx_ring = kzalloc(size, GFP_KERNEL);
+        adapter->tx_ring = kzalloc(sizeof(*adapter->tx_ring), GFP_KERNEL);
         if (!adapter->tx_ring)
                 return -ENOMEM;
-        size = (int)sizeof(struct pch_gbe_rx_ring);
-        adapter->rx_ring = kzalloc(size, GFP_KERNEL);
+
+        adapter->rx_ring = kzalloc(sizeof(*adapter->rx_ring), GFP_KERNEL);
         if (!adapter->rx_ring) {
                 kfree(adapter->tx_ring);
                 return -ENOMEM;
@@ -1162,7 +1159,6 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter,
         struct sk_buff *tmp_skb;
         unsigned int frame_ctrl;
         unsigned int ring_num;
-        unsigned long flags;
 
         /*-- Set frame control --*/
         frame_ctrl = 0;
@@ -1211,14 +1207,14 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter,
                         }
                 }
         }
-        spin_lock_irqsave(&tx_ring->tx_lock, flags);
+
         ring_num = tx_ring->next_to_use;
         if (unlikely((ring_num + 1) == tx_ring->count))
                 tx_ring->next_to_use = 0;
         else
                 tx_ring->next_to_use = ring_num + 1;
 
-        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+
         buffer_info = &tx_ring->buffer_info[ring_num];
         tmp_skb = buffer_info->skb;
 
@@ -1518,7 +1514,7 @@ pch_gbe_alloc_rx_buffers_pool(struct pch_gbe_adapter *adapter,
                                                 &rx_ring->rx_buff_pool_logic,
                                                 GFP_KERNEL);
         if (!rx_ring->rx_buff_pool) {
-                pr_err("Unable to allocate memory for the receive poll buffer\n");
+                pr_err("Unable to allocate memory for the receive pool buffer\n");
                 return -ENOMEM;
         }
         memset(rx_ring->rx_buff_pool, 0, size);
@@ -1637,15 +1633,17 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
         pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
                  cleaned_count);
         /* Recover from running out of Tx resources in xmit_frame */
+        spin_lock(&tx_ring->tx_lock);
         if (unlikely(cleaned && (netif_queue_stopped(adapter->netdev)))) {
                 netif_wake_queue(adapter->netdev);
                 adapter->stats.tx_restart_count++;
                 pr_debug("Tx wake queue\n");
         }
-        spin_lock(&adapter->tx_queue_lock);
+
         tx_ring->next_to_clean = i;
-        spin_unlock(&adapter->tx_queue_lock);
+
         pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
+        spin_unlock(&tx_ring->tx_lock);
         return cleaned;
 }
 
@@ -2037,7 +2035,6 @@ static int pch_gbe_sw_init(struct pch_gbe_adapter *adapter)
                 return -ENOMEM;
         }
         spin_lock_init(&adapter->hw.miim_lock);
-        spin_lock_init(&adapter->tx_queue_lock);
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->ethtool_lock);
         atomic_set(&adapter->irq_sem, 0);
@@ -2142,10 +2139,10 @@ static int pch_gbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                          tx_ring->next_to_use, tx_ring->next_to_clean);
                 return NETDEV_TX_BUSY;
         }
-        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
 
         /* CRC,ITAG no support */
         pch_gbe_tx_queue(adapter, tx_ring, skb);
+        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 00880edba048..425e201f597c 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -485,6 +485,7 @@ static const struct driver_info wwan_info = {
 /*-------------------------------------------------------------------------*/
 
 #define HUAWEI_VENDOR_ID        0x12D1
+#define NOVATEL_VENDOR_ID       0x1410
 
 static const struct usb_device_id       products [] = {
 /*
@@ -602,6 +603,21 @@ static const struct usb_device_id	products [] = {
  * because of bugs/quirks in a given product (like Zaurus, above).
  */
 {
+        /* Novatel USB551L */
+        /* This match must come *before* the generic CDC-ETHER match so that
+         * we get FLAG_WWAN set on the device, since it's descriptors are
+         * generic CDC-ETHER.
+         */
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_PRODUCT
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = NOVATEL_VENDOR_ID,
+        .idProduct              = 0xB001,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 2d927fb4adf4..b38db48b1ce0 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -282,17 +282,32 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu)
 }
 EXPORT_SYMBOL_GPL(usbnet_change_mtu);
 
+/* The caller must hold list->lock */
+static void __usbnet_queue_skb(struct sk_buff_head *list,
+                        struct sk_buff *newsk, enum skb_state state)
+{
+        struct skb_data *entry = (struct skb_data *) newsk->cb;
+
+        __skb_queue_tail(list, newsk);
+        entry->state = state;
+}
+
 /*-------------------------------------------------------------------------*/
 
 /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from
  * completion callbacks.  2.5 should have fixed those bugs...
  */
 
-static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
+static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
+                struct sk_buff_head *list, enum skb_state state)
 {
         unsigned long           flags;
+        enum skb_state          old_state;
+        struct skb_data *entry = (struct skb_data *) skb->cb;
 
         spin_lock_irqsave(&list->lock, flags);
+        old_state = entry->state;
+        entry->state = state;
         __skb_unlink(skb, list);
         spin_unlock(&list->lock);
         spin_lock(&dev->done.lock);
@@ -300,6 +315,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_hea
         if (dev->done.qlen == 1)
                 tasklet_schedule(&dev->bh);
         spin_unlock_irqrestore(&dev->done.lock, flags);
+        return old_state;
 }
 
 /* some work can't be done in tasklets, so we use keventd
@@ -340,7 +356,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
         entry = (struct skb_data *) skb->cb;
         entry->urb = urb;
         entry->dev = dev;
-        entry->state = rx_start;
         entry->length = 0;
 
         usb_fill_bulk_urb (urb, dev->udev, dev->in,
@@ -372,7 +387,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
                         tasklet_schedule (&dev->bh);
                         break;
                 case 0:
-                        __skb_queue_tail (&dev->rxq, skb);
+                        __usbnet_queue_skb(&dev->rxq, skb, rx_start);
                 }
         } else {
                 netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
@@ -423,16 +438,17 @@ static void rx_complete (struct urb *urb)
         struct skb_data         *entry = (struct skb_data *) skb->cb;
         struct usbnet           *dev = entry->dev;
         int                     urb_status = urb->status;
+        enum skb_state          state;
 
         skb_put (skb, urb->actual_length);
-        entry->state = rx_done;
+        state = rx_done;
         entry->urb = NULL;
 
         switch (urb_status) {
         /* success */
         case 0:
                 if (skb->len < dev->net->hard_header_len) {
-                        entry->state = rx_cleanup;
+                        state = rx_cleanup;
                         dev->net->stats.rx_errors++;
                         dev->net->stats.rx_length_errors++;
                         netif_dbg(dev, rx_err, dev->net,
@@ -471,7 +487,7 @@ static void rx_complete (struct urb *urb)
                                   "rx throttle %d\n", urb_status);
                 }
 block:
-                entry->state = rx_cleanup;
+                state = rx_cleanup;
                 entry->urb = urb;
                 urb = NULL;
                 break;
@@ -482,17 +498,18 @@ block:
                 // FALLTHROUGH
 
         default:
-                entry->state = rx_cleanup;
+                state = rx_cleanup;
                 dev->net->stats.rx_errors++;
                 netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status);
                 break;
         }
 
-        defer_bh(dev, skb, &dev->rxq);
+        state = defer_bh(dev, skb, &dev->rxq, state);
 
         if (urb) {
                 if (netif_running (dev->net) &&
-                    !test_bit (EVENT_RX_HALT, &dev->flags)) {
+                    !test_bit (EVENT_RX_HALT, &dev->flags) &&
+                    state != unlink_start) {
                         rx_submit (dev, urb, GFP_ATOMIC);
                         usb_mark_last_busy(dev->udev);
                         return;
@@ -579,16 +596,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
 static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
 {
         unsigned long           flags;
-        struct sk_buff          *skb, *skbnext;
+        struct sk_buff          *skb;
         int                     count = 0;
 
         spin_lock_irqsave (&q->lock, flags);
-        skb_queue_walk_safe(q, skb, skbnext) {
+        while (!skb_queue_empty(q)) {
                 struct skb_data         *entry;
                 struct urb              *urb;
                 int                     retval;
 
-                entry = (struct skb_data *) skb->cb;
+                skb_queue_walk(q, skb) {
+                        entry = (struct skb_data *) skb->cb;
+                        if (entry->state != unlink_start)
+                                goto found;
+                }
+                break;
+found:
+                entry->state = unlink_start;
                 urb = entry->urb;
 
                 /*
@@ -1039,8 +1063,7 @@ static void tx_complete (struct urb *urb)
         }
 
         usb_autopm_put_interface_async(dev->intf);
-        entry->state = tx_done;
-        defer_bh(dev, skb, &dev->txq);
+        (void) defer_bh(dev, skb, &dev->txq, tx_done);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1096,7 +1119,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         entry = (struct skb_data *) skb->cb;
         entry->urb = urb;
         entry->dev = dev;
-        entry->state = tx_start;
         entry->length = length;
 
         usb_fill_bulk_urb (urb, dev->udev, dev->out,
@@ -1155,7 +1177,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                 break;
         case 0:
                 net->trans_start = jiffies;
-                __skb_queue_tail (&dev->txq, skb);
+                __usbnet_queue_skb(&dev->txq, skb, tx_start);
                 if (dev->txq.qlen >= TX_QLEN (dev))
                         netif_stop_queue (net);
         }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index af8acc85f4bb..cbefe671bcc6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -492,7 +492,9 @@ static void virtnet_napi_enable(struct virtnet_info *vi)
          * We synchronize against interrupts via NAPI_STATE_SCHED */
         if (napi_schedule_prep(&vi->napi)) {
                 virtqueue_disable_cb(vi->rvq);
+                local_bh_disable();
                 __napi_schedule(&vi->napi);
+                local_bh_enable();
         }
 }
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index cc15fdb36060..67f9430ee197 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1851,14 +1851,6 @@ int __devinit rtl_pci_probe(struct pci_dev *pdev,
         /*like read eeprom and so on */
         rtlpriv->cfg->ops->read_eeprom_info(hw);
 
-        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
-                err = -ENODEV;
-                goto fail3;
-        }
-
-        rtlpriv->cfg->ops->init_sw_leds(hw);
-
         /*aspm */
         rtl_pci_init_aspm(hw);
 
@@ -1877,6 +1869,14 @@ int __devinit rtl_pci_probe(struct pci_dev *pdev,
                 goto fail3;
         }
 
+        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
+                err = -ENODEV;
+                goto fail3;
+        }
+
+        rtlpriv->cfg->ops->init_sw_leds(hw);
+
         err = sysfs_create_group(&pdev->dev.kobj, &rtl_attribute_group);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index d04dbda13f5a..a6049d7d51b3 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -971,11 +971,6 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
         rtlpriv->cfg->ops->read_chip_version(hw);
         /*like read eeprom and so on */
         rtlpriv->cfg->ops->read_eeprom_info(hw);
-        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
-                goto error_out;
-        }
-        rtlpriv->cfg->ops->init_sw_leds(hw);
         err = _rtl_usb_init(hw);
         if (err)
                 goto error_out;
@@ -987,6 +982,11 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
                          "Can't allocate sw for mac80211\n");
                 goto error_out;
         }
+        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
+                goto error_out;
+        }
+        rtlpriv->cfg->ops->init_sw_leds(hw);
 
         return 0;
 error_out:
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 1929c0c63b75..61e2fefeedab 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -223,7 +223,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                 [PCI_D0] = ACPI_STATE_D0,
                 [PCI_D1] = ACPI_STATE_D1,
                 [PCI_D2] = ACPI_STATE_D2,
-                [PCI_D3hot] = ACPI_STATE_D3_HOT,
+                [PCI_D3hot] = ACPI_STATE_D3,
                 [PCI_D3cold] = ACPI_STATE_D3
         };
         int error = -EINVAL;
diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
index 375eb04c16ea..6fff68020488 100644
--- a/drivers/ptp/ptp_pch.c
+++ b/drivers/ptp/ptp_pch.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/ptp_clock_kernel.h>
+#include <linux/slab.h>
 
 #define STATION_ADDR_LEN        20
 #define PCI_DEVICE_ID_PCH_1588  0x8819
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index ee15c68fb519..e756a0df3664 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -354,7 +354,7 @@ static void __rproc_free_vrings(struct rproc_vdev *rvdev, int i)
 {
         struct rproc *rproc = rvdev->rproc;
 
-        for (i--; i > 0; i--) {
+        for (i--; i >= 0; i--) {
                 struct rproc_vring *rvring = &rvdev->vring[i];
                 int size = PAGE_ALIGN(vring_size(rvring->len, rvring->align));
 
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 684ef4bbfce4..f027c063fb20 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -312,6 +312,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         int ret;
         struct pl031_local *ldata;
         struct rtc_class_ops *ops = id->data;
+        unsigned long time;
 
         ret = amba_request_regions(adev, NULL);
         if (ret)
@@ -343,6 +344,23 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
                 writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
                        ldata->base + RTC_CR);
 
+        /*
+         * On ST PL031 variants, the RTC reset value does not provide correct
+         * weekday for 2000-01-01. Correct the erroneous sunday to saturday.
+         */
+        if (ldata->hw_designer == AMBA_VENDOR_ST) {
+                if (readl(ldata->base + RTC_YDR) == 0x2000) {
+                        time = readl(ldata->base + RTC_DR);
+                        if ((time &
+                             (RTC_MON_MASK | RTC_MDAY_MASK | RTC_WDAY_MASK))
+                            == 0x02120000) {
+                                time = time | (0x7 << RTC_WDAY_SHIFT);
+                                writel(0x2000, ldata->base + RTC_YLR);
+                                writel(time, ldata->base + RTC_LR);
+                        }
+                }
+        }
+
         ldata->rtc = rtc_device_register("pl031", &adev->dev, ops,
                                         THIS_MODULE);
         if (IS_ERR(ldata->rtc)) {
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 7ed58e2df791..f286955331a2 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -169,6 +169,7 @@ static struct se_device *fd_create_virtdevice(
         inode = file->f_mapping->host;
         if (S_ISBLK(inode->i_mode)) {
                 struct request_queue *q;
+                unsigned long long dev_size;
                 /*
                  * Setup the local scope queue_limits from struct request_queue->limits
                  * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
@@ -183,13 +184,12 @@ static struct se_device *fd_create_virtdevice(
                  * one (1) logical sector from underlying struct block_device
                  */
                 fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
-                fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
+                dev_size = (i_size_read(file->f_mapping->host) -
                                        fd_dev->fd_block_size);
 
                 pr_debug("FILEIO: Using size: %llu bytes from struct"
                         " block_device blocks: %llu logical_block_size: %d\n",
-                        fd_dev->fd_dev_size,
-                        div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
+                        dev_size, div_u64(dev_size, fd_dev->fd_block_size),
                         fd_dev->fd_block_size);
         } else {
                 if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
@@ -605,10 +605,20 @@ static u32 fd_get_device_type(struct se_device *dev)
 static sector_t fd_get_blocks(struct se_device *dev)
 {
         struct fd_dev *fd_dev = dev->dev_ptr;
-        unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
-                        dev->se_sub_dev->se_dev_attrib.block_size);
+        struct file *f = fd_dev->fd_file;
+        struct inode *i = f->f_mapping->host;
+        unsigned long long dev_size;
+        /*
+         * When using a file that references an underlying struct block_device,
+         * ensure dev_size is always based on the current inode size in order
+         * to handle underlying block_device resize operations.
+         */
+        if (S_ISBLK(i->i_mode))
+                dev_size = (i_size_read(i) - fd_dev->fd_block_size);
+        else
+                dev_size = fd_dev->fd_dev_size;
 
-        return blocks_long;
+        return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
 }
 
 static struct se_subsystem_api fileio_template = {
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 86f0c3b5d500..c3148b10b4b3 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -220,6 +220,9 @@ int target_scsi2_reservation_release(struct se_task *task)
         if (dev->dev_reserved_node_acl != sess->se_node_acl)
                 goto out_unlock;
 
+        if (dev->dev_res_bin_isid != sess->sess_bin_isid)
+                goto out_unlock;
+
         dev->dev_reserved_node_acl = NULL;
         dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
         if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 29ca20dbd335..3b0c4e32ed7b 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -2044,7 +2044,7 @@ int vt_do_kdskled(int console, int cmd, unsigned long arg, int perm)
                 kbd->default_ledflagstate = ((arg >> 4) & 7);
                 set_leds();
                 spin_unlock_irqrestore(&kbd_event_lock, flags);
-                break;
+                return 0;
 
         /* the ioctls below only set the lights, not the functions */
         /* for those, see KDGKBLED and KDSKBLED above */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index c2d05a8279fd..8807fe501d20 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -390,6 +390,7 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
         /* There might be pages left in the balloon: free them. */
         while (vb->num_pages)
                 leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
 
         /* Now we reset the device so we can clean up the queues. */
         vdev->config->reset(vdev);
diff --git a/fs/bio.c b/fs/bio.c
index e453924036e9..84da88539046 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -505,9 +505,14 @@ EXPORT_SYMBOL(bio_clone);
 int bio_get_nr_vecs(struct block_device *bdev)
 {
         struct request_queue *q = bdev_get_queue(bdev);
-        return min_t(unsigned,
+        int nr_pages;
+
+        nr_pages = min_t(unsigned,
                      queue_max_segments(q),
                      queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
+
+        return min_t(unsigned, nr_pages, BIO_MAX_PAGES);
+
 }
 EXPORT_SYMBOL(bio_get_nr_vecs);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index e08f6a20a5bb..ba11c30f302d 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -70,7 +70,7 @@ static void bdev_inode_switch_bdi(struct inode *inode,
         spin_unlock(&dst->wb.list_lock);
 }
 
-static sector_t max_block(struct block_device *bdev)
+sector_t blkdev_max_block(struct block_device *bdev)
 {
         sector_t retval = ~((sector_t)0);
         loff_t sz = i_size_read(bdev->bd_inode);
@@ -163,7 +163,7 @@ static int
 blkdev_get_block(struct inode *inode, sector_t iblock,
                 struct buffer_head *bh, int create)
 {
-        if (iblock >= max_block(I_BDEV(inode))) {
+        if (iblock >= blkdev_max_block(I_BDEV(inode))) {
                 if (create)
                         return -EIO;
 
@@ -185,7 +185,7 @@ static int
 blkdev_get_blocks(struct inode *inode, sector_t iblock,
                 struct buffer_head *bh, int create)
 {
-        sector_t end_block = max_block(I_BDEV(inode));
+        sector_t end_block = blkdev_max_block(I_BDEV(inode));
         unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
 
         if ((iblock + max_blocks) > end_block) {
diff --git a/fs/buffer.c b/fs/buffer.c
index 351e18ea2e53..ad5938ca357c 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -921,6 +921,7 @@ init_page_buffers(struct page *page, struct block_device *bdev,
         struct buffer_head *head = page_buffers(page);
         struct buffer_head *bh = head;
         int uptodate = PageUptodate(page);
+        sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode));
 
         do {
                 if (!buffer_mapped(bh)) {
@@ -929,7 +930,8 @@ init_page_buffers(struct page *page, struct block_device *bdev,
                         bh->b_blocknr = block;
                         if (uptodate)
                                 set_buffer_uptodate(bh);
-                        set_buffer_mapped(bh);
+                        if (block < end_block)
+                                set_buffer_mapped(bh);
                 }
                 block++;
                 bh = bh->b_this_page;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 5dcc55197fb3..e0b56d7a19c5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -164,7 +164,8 @@ static const match_table_t cifs_mount_option_tokens = {
         { Opt_sign, "sign" },
         { Opt_seal, "seal" },
         { Opt_direct, "direct" },
-        { Opt_direct, "forceddirectio" },
+        { Opt_direct, "directio" },
+        { Opt_direct, "forcedirectio" },
         { Opt_strictcache, "strictcache" },
         { Opt_noac, "noac" },
         { Opt_fsc, "fsc" },
diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
index ad271c70aa25..5a2dec2b064c 100644
--- a/fs/jffs2/gc.c
+++ b/fs/jffs2/gc.c
@@ -234,8 +234,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
                         return 0;
 
                 jffs2_dbg(1, "No progress from erasing block; doing GC anyway\n");
-                spin_lock(&c->erase_completion_lock);
                 mutex_lock(&c->alloc_sem);
+                spin_lock(&c->erase_completion_lock);
         }
 
         /* First, work out which block we're garbage-collecting */
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 1c8b280146d7..57b8159f26f3 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1799,10 +1799,15 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
         if (task) {
                 files = get_files_struct(task);
                 if (files) {
+                        struct file *file;
                         rcu_read_lock();
-                        if (fcheck_files(files, fd)) {
+                        file = fcheck_files(files, fd);
+                        if (file) {
+                                unsigned i_mode, f_mode = file->f_mode;
+
                                 rcu_read_unlock();
                                 put_files_struct(files);
+
                                 if (task_dumpable(task)) {
                                         rcu_read_lock();
                                         cred = __task_cred(task);
@@ -1813,7 +1818,14 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
                                         inode->i_uid = 0;
                                         inode->i_gid = 0;
                                 }
-                                inode->i_mode &= ~(S_ISUID | S_ISGID);
+
+                                i_mode = S_IFLNK;
+                                if (f_mode & FMODE_READ)
+                                        i_mode |= S_IRUSR | S_IXUSR;
+                                if (f_mode & FMODE_WRITE)
+                                        i_mode |= S_IWUSR | S_IXUSR;
+                                inode->i_mode = i_mode;
+
                                 security_task_to_inode(task, inode);
                                 put_task_struct(task);
                                 return 1;
@@ -1837,8 +1849,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
         struct dentry *dentry, struct task_struct *task, const void *ptr)
 {
         unsigned fd = *(const unsigned *)ptr;
-        struct file *file;
-        struct files_struct *files;
         struct inode *inode;
         struct proc_inode *ei;
         struct dentry *error = ERR_PTR(-ENOENT);
@@ -1848,25 +1858,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
                 goto out;
         ei = PROC_I(inode);
         ei->fd = fd;
-        files = get_files_struct(task);
-        if (!files)
-                goto out_iput;
-        inode->i_mode = S_IFLNK;
-
-        /*
-         * We are not taking a ref to the file structure, so we must
-         * hold ->file_lock.
-         */
-        spin_lock(&files->file_lock);
-        file = fcheck_files(files, fd);
-        if (!file)
-                goto out_unlock;
-        if (file->f_mode & FMODE_READ)
-                inode->i_mode |= S_IRUSR | S_IXUSR;
-        if (file->f_mode & FMODE_WRITE)
-                inode->i_mode |= S_IWUSR | S_IXUSR;
-        spin_unlock(&files->file_lock);
-        put_files_struct(files);
 
         inode->i_op = &proc_pid_link_inode_operations;
         inode->i_size = 64;
@@ -1879,12 +1870,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
 
  out:
         return error;
-out_unlock:
-        spin_unlock(&files->file_lock);
-        put_files_struct(files);
-out_iput:
-        iput(inode);
-        goto out;
 }
 
 static struct dentry *proc_lookupfd_common(struct inode *dir,
@@ -2177,16 +2162,16 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
                 goto out;
 
         result = ERR_PTR(-EACCES);
-        if (lock_trace(task))
+        if (!ptrace_may_access(task, PTRACE_MODE_READ))
                 goto out_put_task;
 
         result = ERR_PTR(-ENOENT);
         if (dname_to_vma_addr(dentry, &vm_start, &vm_end))
-                goto out_unlock;
+                goto out_put_task;
 
         mm = get_task_mm(task);
         if (!mm)
-                goto out_unlock;
+                goto out_put_task;
 
         down_read(&mm->mmap_sem);
         vma = find_exact_vma(mm, vm_start, vm_end);
@@ -2198,8 +2183,6 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
 out_no_vma:
         up_read(&mm->mmap_sem);
         mmput(mm);
-out_unlock:
-        unlock_trace(task);
 out_put_task:
         put_task_struct(task);
 out:
@@ -2233,7 +2216,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 goto out;
 
         ret = -EACCES;
-        if (lock_trace(task))
+        if (!ptrace_may_access(task, PTRACE_MODE_READ))
                 goto out_put_task;
 
         ret = 0;
@@ -2241,12 +2224,12 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
         case 0:
                 ino = inode->i_ino;
                 if (filldir(dirent, ".", 1, 0, ino, DT_DIR) < 0)
-                        goto out_unlock;
+                        goto out_put_task;
                 filp->f_pos++;
         case 1:
                 ino = parent_ino(dentry);
                 if (filldir(dirent, "..", 2, 1, ino, DT_DIR) < 0)
-                        goto out_unlock;
+                        goto out_put_task;
                 filp->f_pos++;
         default:
         {
@@ -2257,7 +2240,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
 
                 mm = get_task_mm(task);
                 if (!mm)
-                        goto out_unlock;
+                        goto out_put_task;
                 down_read(&mm->mmap_sem);
 
                 nr_files = 0;
@@ -2287,7 +2270,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                         flex_array_free(fa);
                                 up_read(&mm->mmap_sem);
                                 mmput(mm);
-                                goto out_unlock;
+                                goto out_put_task;
                         }
                         for (i = 0, vma = mm->mmap, pos = 2; vma;
                                         vma = vma->vm_next) {
@@ -2332,8 +2315,6 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
         }
         }
 
-out_unlock:
-        unlock_trace(task);
 out_put_task:
         put_task_struct(task);
 out:
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 2aa24664a5b5..4d4ac24a263e 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1,9 +1,10 @@
 #ifndef _LINUX_BLKDEV_H
 #define _LINUX_BLKDEV_H
 
+#include <linux/sched.h>
+
 #ifdef CONFIG_BLOCK
 
-#include <linux/sched.h>
 #include <linux/major.h>
 #include <linux/genhd.h>
 #include <linux/list.h>
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8de675523e46..25c40b9f848a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2051,6 +2051,7 @@ extern void unregister_blkdev(unsigned int, const char *);
 extern struct block_device *bdget(dev_t);
 extern struct block_device *bdgrab(struct block_device *bdev);
 extern void bd_set_size(struct block_device *, loff_t size);
+extern sector_t blkdev_max_block(struct block_device *bdev);
 extern void bd_forget(struct inode *inode);
 extern void bdput(struct block_device *);
 extern void invalidate_bdev(struct block_device *);
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 5f3f3be5af09..176a939d1547 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -179,6 +179,7 @@ enum {
         TRACE_EVENT_FL_RECORDED_CMD_BIT,
         TRACE_EVENT_FL_CAP_ANY_BIT,
         TRACE_EVENT_FL_NO_SET_FILTER_BIT,
+        TRACE_EVENT_FL_IGNORE_ENABLE_BIT,
 };
 
 enum {
@@ -187,6 +188,7 @@ enum {
         TRACE_EVENT_FL_RECORDED_CMD     = (1 << TRACE_EVENT_FL_RECORDED_CMD_BIT),
         TRACE_EVENT_FL_CAP_ANY          = (1 << TRACE_EVENT_FL_CAP_ANY_BIT),
         TRACE_EVENT_FL_NO_SET_FILTER    = (1 << TRACE_EVENT_FL_NO_SET_FILTER_BIT),
+        TRACE_EVENT_FL_IGNORE_ENABLE    = (1 << TRACE_EVENT_FL_IGNORE_ENABLE_BIT),
 };
 
 struct ftrace_event_call {
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index e61d3192448e..017a7fb5a1fc 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -222,12 +222,6 @@ static inline void part_pack_uuid(const u8 *uuid_str, u8 *to)
         }
 }
 
-static inline char *part_unpack_uuid(const u8 *uuid, char *out)
-{
-        sprintf(out, "%pU", uuid);
-        return out;
-}
-
 static inline int disk_max_parts(struct gendisk *disk)
 {
         if (disk->flags & GENHD_FL_EXT_DEVT)
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index 05a5d72680be..230a290e1973 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -99,6 +99,22 @@ struct ip_set_hash {
 #endif
 };
 
+static size_t
+htable_size(u8 hbits)
+{
+        size_t hsize;
+
+        /* We must fit both into u32 in jhash and size_t */
+        if (hbits > 31)
+                return 0;
+        hsize = jhash_size(hbits);
+        if ((((size_t)-1) - sizeof(struct htable))/sizeof(struct hbucket)
+            < hsize)
+                return 0;
+
+        return hsize * sizeof(struct hbucket) + sizeof(struct htable);
+}
+
 /* Compute htable_bits from the user input parameter hashsize */
 static u8
 htable_bits(u32 hashsize)
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 605b0aa8d852..76f439647c4b 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb *);
 enum skb_state {
         illegal = 0,
         tx_start, tx_done,
-        rx_start, rx_done, rx_cleanup
+        rx_start, rx_done, rx_cleanup,
+        unlink_start
 };
 
 struct skb_data {       /* skb->cb is one of these */
diff --git a/include/media/soc_camera.h b/include/media/soc_camera.h
index b5c2b6cb0d81..cad374bdcf4b 100644
--- a/include/media/soc_camera.h
+++ b/include/media/soc_camera.h
@@ -59,7 +59,8 @@ struct soc_camera_device {
 struct soc_camera_host {
         struct v4l2_device v4l2_dev;
         struct list_head list;
-        unsigned char nr;                               /* Host number */
+        struct mutex host_lock;         /* Protect during probing */
+        unsigned char nr;               /* Host number */
         void *priv;
         const char *drv_name;
         struct soc_camera_host_ops *ops;
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 262ebd1747d4..a65910bda381 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -191,6 +191,7 @@ struct bt_sock {
         struct list_head accept_q;
         struct sock *parent;
         u32 defer_setup;
+        bool suspended;
 };
 
 struct bt_sock_list {
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 6080f6bc8c33..3914c1e03cff 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -518,6 +518,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
+EXPORT_SYMBOL(handle_edge_irq);
 
 #ifdef CONFIG_IRQ_EDGE_EOI_HANDLER
 /**
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index d86e254b95eb..192a302d6cfd 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -112,6 +112,7 @@ struct irq_desc *irq_to_desc(unsigned int irq)
 {
         return radix_tree_lookup(&irq_desc_tree, irq);
 }
+EXPORT_SYMBOL(irq_to_desc);
 
 static void delete_irq_desc(unsigned int irq)
 {
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 0533a688ce22..e5212ae294f6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6382,6 +6382,8 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
                         if (!sg)
                                 return -ENOMEM;
 
+                        sg->next = sg;
+
                         *per_cpu_ptr(sdd->sg, j) = sg;
 
                         sgp = kzalloc_node(sizeof(struct sched_group_power),
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 079a93ae8a9d..29111da1d100 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -294,6 +294,9 @@ static int __ftrace_set_clr_event(const char *match, const char *sub,
                 if (!call->name || !call->class || !call->class->reg)
                         continue;
 
+                if (call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)
+                        continue;
+
                 if (match &&
                     strcmp(match, call->name) != 0 &&
                     strcmp(match, call->class->system) != 0)
@@ -1164,7 +1167,7 @@ event_create_dir(struct ftrace_event_call *call, struct dentry *d_events,
                 return -1;
         }
 
-        if (call->class->reg)
+        if (call->class->reg && !(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE))
                 trace_create_file("enable", 0644, call->dir, call,
                                   enable);
 
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 3dd15e8bc856..e039906b037d 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -180,6 +180,7 @@ struct ftrace_event_call __used event_##call = {			\
         .event.type             = etype,                                \
         .class                  = &event_class_ftrace_##call,           \
         .print_fmt              = print,                                \
+        .flags                  = TRACE_EVENT_FL_IGNORE_ENABLE,         \
 };                                                                      \
 struct ftrace_event_call __used                                         \
 __attribute__((section("_ftrace_events"))) *__event_##call = &event_##call;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index b659260c56ad..7685d4a0b3ce 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5481,7 +5481,7 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pmd,
          *    part of thp split is not executed yet.
          */
         if (pmd_trans_huge_lock(pmd, vma) == 1) {
-                if (!mc.precharge) {
+                if (mc.precharge < HPAGE_PMD_NR) {
                         spin_unlock(&vma->vm_mm->page_table_lock);
                         return 0;
                 }
diff --git a/mm/slub.c b/mm/slub.c
index ffe13fdf8144..80848cd3901c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2040,7 +2040,7 @@ static bool has_cpu_slab(int cpu, void *info)
         struct kmem_cache *s = info;
         struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu);
 
-        return !!(c->page);
+        return c->page || c->partial;
 }
 
 static void flush_all(struct kmem_cache *s)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 72eb187a5f60..6fb68a9743af 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -450,7 +450,7 @@ unsigned int bt_sock_poll(struct file *file, struct socket *sock, poll_table *wa
                         sk->sk_state == BT_CONFIG)
                 return mask;
 
-        if (sock_writeable(sk))
+        if (!bt_sk(sk)->suspended && sock_writeable(sk))
                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
         else
                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index edfd61addcec..d6dc44cd15b0 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2784,6 +2784,14 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn) {
                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
+                hci_dev_lock(hdev);
+                if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+                    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                        mgmt_device_connected(hdev, &conn->dst, conn->type,
+                                              conn->dst_type, 0, NULL, 0,
+                                              conn->dev_class);
+                hci_dev_unlock(hdev);
+
                 /* Send to upper protocol */
                 l2cap_recv_acldata(conn, skb, flags);
                 return;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 6c065254afc0..1266f78fa8e3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2039,6 +2039,12 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
 
                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
+                if (ev->status && conn->state == BT_CONNECTED) {
+                        hci_acl_disconn(conn, 0x13);
+                        hci_conn_put(conn);
+                        goto unlock;
+                }
+
                 if (conn->state == BT_CONFIG) {
                         if (!ev->status)
                                 conn->state = BT_CONNECTED;
@@ -2049,6 +2055,7 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -2102,7 +2109,7 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                 goto unlock;
         }
 
-        if (!ev->status) {
+        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
                 struct hci_cp_remote_name_req cp;
                 memset(&cp, 0, sizeof(cp));
                 bacpy(&cp.bdaddr, &conn->dst);
@@ -2871,7 +2878,7 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
         if (conn->state != BT_CONFIG)
                 goto unlock;
 
-        if (!ev->status) {
+        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
                 struct hci_cp_remote_name_req cp;
                 memset(&cp, 0, sizeof(cp));
                 bacpy(&cp.bdaddr, &conn->dst);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 94552b33d528..6f9c25b633a6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4589,6 +4589,11 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
                 if (!status && (chan->state == BT_CONNECTED ||
                                                 chan->state == BT_CONFIG)) {
+                        struct sock *sk = chan->sk;
+
+                        bt_sk(sk)->suspended = false;
+                        sk->sk_state_change(sk);
+
                         l2cap_check_encryption(chan, encrypt);
                         l2cap_chan_unlock(chan);
                         continue;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 29122ed28ea9..04e7c172d49c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -592,10 +592,14 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                         sk->sk_state = BT_CONFIG;
                         chan->state = BT_CONFIG;
 
-                /* or for ACL link, under defer_setup time */
-                } else if (sk->sk_state == BT_CONNECT2 &&
-                                        bt_sk(sk)->defer_setup) {
-                        err = l2cap_chan_check_security(chan);
+                /* or for ACL link */
+                } else if ((sk->sk_state == BT_CONNECT2 &&
+                           bt_sk(sk)->defer_setup) ||
+                           sk->sk_state == BT_CONNECTED) {
+                        if (!l2cap_chan_check_security(chan))
+                                bt_sk(sk)->suspended = true;
+                        else
+                                sk->sk_state_change(sk);
                 } else {
                         err = -EINVAL;
                 }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 77a59980b579..b81369b6ddc0 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3755,13 +3755,13 @@ static void __exit pg_cleanup(void)
 {
         struct pktgen_thread *t;
         struct list_head *q, *n;
-        struct list_head list;
+        LIST_HEAD(list);
 
         /* Stop all interfaces & threads */
         pktgen_exiting = true;
 
         mutex_lock(&pktgen_thread_lock);
-        list_splice(&list, &pktgen_threads);
+        list_splice_init(&pktgen_threads, &list);
         mutex_unlock(&pktgen_thread_lock);
 
         list_for_each_safe(q, n, &list) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1272a88c2a63..6589e11d57b6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -851,8 +851,7 @@ new_segment:
 wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                if (copied)
-                        tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                 if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                         goto do_error;
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 5139dea6019e..828ce46cb34b 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -364,6 +364,7 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 netmask, hbits;
+        size_t hsize;
         struct ip_set_hash *h;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
@@ -405,9 +406,12 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 9c27e249c171..e8dbb498af8f 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -449,6 +449,7 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -476,9 +477,12 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 9134057c0728..52f79d8ef741 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -467,6 +467,7 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -494,9 +495,12 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5d05e6969862..97583f5af745 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -616,6 +616,7 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -645,9 +646,12 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 7c3d945517cf..1721cdecc9f9 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -460,6 +460,7 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         struct ip_set_hash *h;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -489,9 +490,12 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index f24037ff4322..33bafc97ca6d 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -722,6 +722,7 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -752,9 +753,12 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->ahash_max = AHASH_MAX_SIZE;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index ce2e77100b64..3a5e198641d6 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -572,6 +572,7 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -601,9 +602,12 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 777716bc80f7..e66341ec455c 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -321,7 +321,7 @@ static int queue_userspace_packet(int dp_ifindex, struct sk_buff *skb,
                         return -ENOMEM;
 
                 nskb = __vlan_put_tag(nskb, vlan_tx_tag_get(nskb));
-                if (!skb)
+                if (!nskb)
                         return -ENOMEM;
 
                 nskb->vlan_tci = 0;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 4742cac26aa9..2cb1e08f962a 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4415,9 +4415,9 @@ static int stac92xx_init(struct hda_codec *codec)
                 def_conf = get_defcfg_connect(def_conf);
                 /* skip any ports that don't have jacks since presence
                  * detection is useless */
-                if (def_conf != AC_JACK_PORT_COMPLEX) {
-                        if (def_conf != AC_JACK_PORT_NONE)
-                                stac_toggle_power_map(codec, nid, 1);
+                if (def_conf != AC_JACK_PORT_NONE &&
+                    !is_jack_detectable(codec, nid)) {
+                        stac_toggle_power_map(codec, nid, 1);
                         continue;
                 }
                 if (enable_pin_detect(codec, nid, STAC_PWR_EVENT)) {
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index 07c44b71f096..3686417f5ea5 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -568,22 +568,22 @@ static const struct snd_kcontrol_new cs42l73_snd_controls[] = {
                         attn_tlv),
 
         SOC_SINGLE_TLV("SPK-IP Mono Volume",
-                        CS42L73_SPKMIPMA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_SPKMIPMA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("SPK-XSP Mono Volume",
-                        CS42L73_SPKMXSPA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_SPKMXSPA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("SPK-ASP Mono Volume",
-                        CS42L73_SPKMASPA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_SPKMASPA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("SPK-VSP Mono Volume",
-                        CS42L73_SPKMVSPMA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_SPKMVSPMA, 0, 0x3F, 1, attn_tlv),
 
         SOC_SINGLE_TLV("ESL-IP Mono Volume",
-                        CS42L73_ESLMIPMA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_ESLMIPMA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("ESL-XSP Mono Volume",
-                        CS42L73_ESLMXSPA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_ESLMXSPA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("ESL-ASP Mono Volume",
-                        CS42L73_ESLMASPA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_ESLMASPA, 0, 0x3F, 1, attn_tlv),
         SOC_SINGLE_TLV("ESL-VSP Mono Volume",
-                        CS42L73_ESLMVSPMA, 0, 0x3E, 1, attn_tlv),
+                        CS42L73_ESLMVSPMA, 0, 0x3F, 1, attn_tlv),
 
         SOC_ENUM("IP Digital Swap/Mono Select", ip_swap_enum),
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 6c1fe3afd4b5..2de12ebe43b5 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1144,7 +1144,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
                 snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
                                     WM8994_AIF2DACL_ENA |
                                     WM8994_AIF2DACR_ENA, 0);
-                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
                                     WM8994_AIF2ADCL_ENA |
                                     WM8994_AIF2ADCR_ENA, 0);
 
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 9bf3fc759344..92271d32bc30 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -774,10 +774,10 @@ $(OUTPUT)perf.o perf.spec \
 # over the general rule for .o
 
 $(OUTPUT)util/%-flex.o: $(OUTPUT)util/%-flex.c $(OUTPUT)PERF-CFLAGS
-        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -Iutil/ -Wno-redundant-decls -Wno-switch-default -Wno-unused-function $<
+        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -Iutil/ -w $<
 
 $(OUTPUT)util/%-bison.o: $(OUTPUT)util/%-bison.c $(OUTPUT)PERF-CFLAGS
-        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DYYENABLE_NLS=0 -DYYLTYPE_IS_TRIVIAL=0 -Iutil/ -Wno-redundant-decls -Wno-switch-default -Wno-unused-function $<
+        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DYYENABLE_NLS=0 -DYYLTYPE_IS_TRIVIAL=0 -Iutil/ -w $<
 
 $(OUTPUT)%.o: %.c $(OUTPUT)PERF-CFLAGS
         $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $<
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index c941bb640f49..1e5e9b270f5e 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -283,6 +283,8 @@ static int create_perf_stat_counter(struct perf_evsel *evsel,
 {
         struct perf_event_attr *attr = &evsel->attr;
         struct xyarray *group_fd = NULL;
+        bool exclude_guest_missing = false;
+        int ret;
 
         if (group && evsel != first)
                 group_fd = first->fd;
@@ -293,16 +295,39 @@ static int create_perf_stat_counter(struct perf_evsel *evsel,
 
         attr->inherit = !no_inherit;
 
-        if (system_wide)
-                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus,
+retry:
+        if (exclude_guest_missing)
+                evsel->attr.exclude_guest = evsel->attr.exclude_host = 0;
+
+        if (system_wide) {
+                ret = perf_evsel__open_per_cpu(evsel, evsel_list->cpus,
                                                 group, group_fd);
+                if (ret)
+                        goto check_ret;
+                return 0;
+        }
+
         if (!target_pid && !target_tid && (!group || evsel == first)) {
                 attr->disabled = 1;
                 attr->enable_on_exec = 1;
         }
 
-        return perf_evsel__open_per_thread(evsel, evsel_list->threads,
-                                           group, group_fd);
+        ret = perf_evsel__open_per_thread(evsel, evsel_list->threads,
+                                          group, group_fd);
+        if (!ret)
+                return 0;
+        /* fall through */
+check_ret:
+        if (ret && errno == EINVAL) {
+                if (!exclude_guest_missing &&
+                    (evsel->attr.exclude_guest || evsel->attr.exclude_host)) {
+                        pr_debug("Old kernel, cannot exclude "
+                                 "guest or host samples.\n");
+                        exclude_guest_missing = true;
+                        goto retry;
+                }
+        }
+        return ret;
 }
 
 /*
@@ -463,8 +488,13 @@ static int run_perf_stat(int argc __used, const char **argv)
 
         list_for_each_entry(counter, &evsel_list->entries, node) {
                 if (create_perf_stat_counter(counter, first) < 0) {
+                        /*
+                         * PPC returns ENXIO for HW counters until 2.6.37
+                         * (behavior changed with commit b0a873e).
+                         */
                         if (errno == EINVAL || errno == ENOSYS ||
-                            errno == ENOENT || errno == EOPNOTSUPP) {
+                            errno == ENOENT || errno == EOPNOTSUPP ||
+                            errno == ENXIO) {
                                 if (verbose)
                                         ui__warning("%s event is not supported by the kernel.\n",
                                                     event_name(counter));
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 4c7c2d73251f..c0b70c697a36 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -296,7 +296,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
         if (mkdir_p(filename, 0755))
                 goto out_free;
 
-        snprintf(filename + len, sizeof(filename) - len, "/%s", sbuild_id);
+        snprintf(filename + len, size - len, "/%s", sbuild_id);
 
         if (access(filename, F_OK)) {
                 if (is_kallsyms) {