153 files changed, 1475 insertions, 758 deletions

diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index 99983e67c13c..da95513571ea 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -162,7 +162,7 @@ Description:	Discover CPUs in the same CPU frequency coordination domain
 What:           /sys/devices/system/cpu/cpu*/cache/index3/cache_disable_{0,1}
 Date:           August 2008
 KernelVersion:  2.6.27
-Contact:        discuss@x86-64.org
+Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:    Disable L3 cache indices
 
                 These files exist in every CPU's cache/index3 directory. Each
diff --git a/MAINTAINERS b/MAINTAINERS
index 474bcb6c0bac..af802b357b6a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2427,7 +2427,6 @@ L:	linux-security-module@vger.kernel.org
 S:      Supported
 F:      include/linux/capability.h
 F:      include/uapi/linux/capability.h
-F:      security/capability.c
 F:      security/commoncap.c
 F:      kernel/capability.c
 
diff --git a/arch/alpha/boot/Makefile b/arch/alpha/boot/Makefile
index cd143887380a..8399bd0e68e8 100644
--- a/arch/alpha/boot/Makefile
+++ b/arch/alpha/boot/Makefile
@@ -14,6 +14,9 @@ targets		:= vmlinux.gz vmlinux \
                    tools/bootpzh bootloader bootpheader bootpzheader 
 OBJSTRIP        := $(obj)/tools/objstrip
 
+HOSTCFLAGS      := -Wall -I$(objtree)/usr/include
+BOOTCFLAGS      += -I$(obj) -I$(srctree)/$(obj)
+
 # SRM bootable image.  Copy to offset 512 of a partition.
 $(obj)/bootimage: $(addprefix $(obj)/tools/,mkbb lxboot bootlx) $(obj)/vmlinux.nh
         ( cat $(obj)/tools/lxboot $(obj)/tools/bootlx $(obj)/vmlinux.nh ) > $@ 
@@ -96,13 +99,14 @@ $(obj)/tools/bootph: $(obj)/bootpheader $(OBJSTRIP) FORCE
 $(obj)/tools/bootpzh: $(obj)/bootpzheader $(OBJSTRIP) FORCE
         $(call if_changed,objstrip)
 
-LDFLAGS_bootloader   := -static -uvsprintf -T  #-N -relax
-LDFLAGS_bootpheader  := -static -uvsprintf -T  #-N -relax
-LDFLAGS_bootpzheader := -static -uvsprintf -T  #-N -relax
+LDFLAGS_bootloader   := -static -T # -N -relax
+LDFLAGS_bootloader   := -static -T # -N -relax
+LDFLAGS_bootpheader  := -static -T # -N -relax
+LDFLAGS_bootpzheader := -static -T # -N -relax
 
-OBJ_bootlx   := $(obj)/head.o $(obj)/main.o
-OBJ_bootph   := $(obj)/head.o $(obj)/bootp.o
-OBJ_bootpzh  := $(obj)/head.o $(obj)/bootpz.o $(obj)/misc.o
+OBJ_bootlx   := $(obj)/head.o $(obj)/stdio.o $(obj)/main.o
+OBJ_bootph   := $(obj)/head.o $(obj)/stdio.o $(obj)/bootp.o
+OBJ_bootpzh  := $(obj)/head.o $(obj)/stdio.o $(obj)/bootpz.o $(obj)/misc.o
 
 $(obj)/bootloader: $(obj)/bootloader.lds $(OBJ_bootlx) $(LIBS_Y) FORCE
         $(call if_changed,ld)
diff --git a/arch/alpha/boot/main.c b/arch/alpha/boot/main.c
index 3baf2d1e908d..dd6eb4a33582 100644
--- a/arch/alpha/boot/main.c
+++ b/arch/alpha/boot/main.c
@@ -19,7 +19,6 @@
 
 #include "ksize.h"
 
-extern int vsprintf(char *, const char *, va_list);
 extern unsigned long switch_to_osf_pal(unsigned long nr,
         struct pcb_struct * pcb_va, struct pcb_struct * pcb_pa,
         unsigned long *vptb);
diff --git a/arch/alpha/boot/stdio.c b/arch/alpha/boot/stdio.c
new file mode 100644
index 000000000000..f844dae8a54a
--- /dev/null
+++ b/arch/alpha/boot/stdio.c
@@ -0,0 +1,306 @@
+/*
+ * Copyright (C) Paul Mackerras 1997.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <stdarg.h>
+#include <stddef.h>
+
+size_t strnlen(const char * s, size_t count)
+{
+        const char *sc;
+
+        for (sc = s; count-- && *sc != '\0'; ++sc)
+                /* nothing */;
+        return sc - s;
+}
+
+# define do_div(n, base) ({                                             \
+        unsigned int __base = (base);                                   \
+        unsigned int __rem;                                             \
+        __rem = ((unsigned long long)(n)) % __base;                     \
+        (n) = ((unsigned long long)(n)) / __base;                       \
+        __rem;                                                          \
+})
+
+
+static int skip_atoi(const char **s)
+{
+        int i, c;
+
+        for (i = 0; '0' <= (c = **s) && c <= '9'; ++*s)
+                i = i*10 + c - '0';
+        return i;
+}
+
+#define ZEROPAD 1               /* pad with zero */
+#define SIGN    2               /* unsigned/signed long */
+#define PLUS    4               /* show plus */
+#define SPACE   8               /* space if plus */
+#define LEFT    16              /* left justified */
+#define SPECIAL 32              /* 0x */
+#define LARGE   64              /* use 'ABCDEF' instead of 'abcdef' */
+
+static char * number(char * str, unsigned long long num, int base, int size, int precision, int type)
+{
+        char c,sign,tmp[66];
+        const char *digits="0123456789abcdefghijklmnopqrstuvwxyz";
+        int i;
+
+        if (type & LARGE)
+                digits = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+        if (type & LEFT)
+                type &= ~ZEROPAD;
+        if (base < 2 || base > 36)
+                return 0;
+        c = (type & ZEROPAD) ? '0' : ' ';
+        sign = 0;
+        if (type & SIGN) {
+                if ((signed long long)num < 0) {
+                        sign = '-';
+                        num = - (signed long long)num;
+                        size--;
+                } else if (type & PLUS) {
+                        sign = '+';
+                        size--;
+                } else if (type & SPACE) {
+                        sign = ' ';
+                        size--;
+                }
+        }
+        if (type & SPECIAL) {
+                if (base == 16)
+                        size -= 2;
+                else if (base == 8)
+                        size--;
+        }
+        i = 0;
+        if (num == 0)
+                tmp[i++]='0';
+        else while (num != 0) {
+                tmp[i++] = digits[do_div(num, base)];
+        }
+        if (i > precision)
+                precision = i;
+        size -= precision;
+        if (!(type&(ZEROPAD+LEFT)))
+                while(size-->0)
+                        *str++ = ' ';
+        if (sign)
+                *str++ = sign;
+        if (type & SPECIAL) {
+                if (base==8)
+                        *str++ = '0';
+                else if (base==16) {
+                        *str++ = '0';
+                        *str++ = digits[33];
+                }
+        }
+        if (!(type & LEFT))
+                while (size-- > 0)
+                        *str++ = c;
+        while (i < precision--)
+                *str++ = '0';
+        while (i-- > 0)
+                *str++ = tmp[i];
+        while (size-- > 0)
+                *str++ = ' ';
+        return str;
+}
+
+int vsprintf(char *buf, const char *fmt, va_list args)
+{
+        int len;
+        unsigned long long num;
+        int i, base;
+        char * str;
+        const char *s;
+
+        int flags;              /* flags to number() */
+
+        int field_width;        /* width of output field */
+        int precision;          /* min. # of digits for integers; max
+                                   number of chars for from string */
+        int qualifier;          /* 'h', 'l', or 'L' for integer fields */
+                                /* 'z' support added 23/7/1999 S.H.    */
+                                /* 'z' changed to 'Z' --davidm 1/25/99 */
+
+
+        for (str=buf ; *fmt ; ++fmt) {
+                if (*fmt != '%') {
+                        *str++ = *fmt;
+                        continue;
+                }
+
+                /* process flags */
+                flags = 0;
+                repeat:
+                        ++fmt;          /* this also skips first '%' */
+                        switch (*fmt) {
+                                case '-': flags |= LEFT; goto repeat;
+                                case '+': flags |= PLUS; goto repeat;
+                                case ' ': flags |= SPACE; goto repeat;
+                                case '#': flags |= SPECIAL; goto repeat;
+                                case '0': flags |= ZEROPAD; goto repeat;
+                                }
+
+                /* get field width */
+                field_width = -1;
+                if ('0' <= *fmt && *fmt <= '9')
+                        field_width = skip_atoi(&fmt);
+                else if (*fmt == '*') {
+                        ++fmt;
+                        /* it's the next argument */
+                        field_width = va_arg(args, int);
+                        if (field_width < 0) {
+                                field_width = -field_width;
+                                flags |= LEFT;
+                        }
+                }
+
+                /* get the precision */
+                precision = -1;
+                if (*fmt == '.') {
+                        ++fmt;
+                        if ('0' <= *fmt && *fmt <= '9')
+                                precision = skip_atoi(&fmt);
+                        else if (*fmt == '*') {
+                                ++fmt;
+                                /* it's the next argument */
+                                precision = va_arg(args, int);
+                        }
+                        if (precision < 0)
+                                precision = 0;
+                }
+
+                /* get the conversion qualifier */
+                qualifier = -1;
+                if (*fmt == 'l' && *(fmt + 1) == 'l') {
+                        qualifier = 'q';
+                        fmt += 2;
+                } else if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L'
+                        || *fmt == 'Z') {
+                        qualifier = *fmt;
+                        ++fmt;
+                }
+
+                /* default base */
+                base = 10;
+
+                switch (*fmt) {
+                case 'c':
+                        if (!(flags & LEFT))
+                                while (--field_width > 0)
+                                        *str++ = ' ';
+                        *str++ = (unsigned char) va_arg(args, int);
+                        while (--field_width > 0)
+                                *str++ = ' ';
+                        continue;
+
+                case 's':
+                        s = va_arg(args, char *);
+                        if (!s)
+                                s = "<NULL>";
+
+                        len = strnlen(s, precision);
+
+                        if (!(flags & LEFT))
+                                while (len < field_width--)
+                                        *str++ = ' ';
+                        for (i = 0; i < len; ++i)
+                                *str++ = *s++;
+                        while (len < field_width--)
+                                *str++ = ' ';
+                        continue;
+
+                case 'p':
+                        if (field_width == -1) {
+                                field_width = 2*sizeof(void *);
+                                flags |= ZEROPAD;
+                        }
+                        str = number(str,
+                                (unsigned long) va_arg(args, void *), 16,
+                                field_width, precision, flags);
+                        continue;
+
+
+                case 'n':
+                        if (qualifier == 'l') {
+                                long * ip = va_arg(args, long *);
+                                *ip = (str - buf);
+                        } else if (qualifier == 'Z') {
+                                size_t * ip = va_arg(args, size_t *);
+                                *ip = (str - buf);
+                        } else {
+                                int * ip = va_arg(args, int *);
+                                *ip = (str - buf);
+                        }
+                        continue;
+
+                case '%':
+                        *str++ = '%';
+                        continue;
+
+                /* integer number formats - set up the flags and "break" */
+                case 'o':
+                        base = 8;
+                        break;
+
+                case 'X':
+                        flags |= LARGE;
+                case 'x':
+                        base = 16;
+                        break;
+
+                case 'd':
+                case 'i':
+                        flags |= SIGN;
+                case 'u':
+                        break;
+
+                default:
+                        *str++ = '%';
+                        if (*fmt)
+                                *str++ = *fmt;
+                        else
+                                --fmt;
+                        continue;
+                }
+                if (qualifier == 'l') {
+                        num = va_arg(args, unsigned long);
+                        if (flags & SIGN)
+                                num = (signed long) num;
+                } else if (qualifier == 'q') {
+                        num = va_arg(args, unsigned long long);
+                        if (flags & SIGN)
+                                num = (signed long long) num;
+                } else if (qualifier == 'Z') {
+                        num = va_arg(args, size_t);
+                } else if (qualifier == 'h') {
+                        num = (unsigned short) va_arg(args, int);
+                        if (flags & SIGN)
+                                num = (signed short) num;
+                } else {
+                        num = va_arg(args, unsigned int);
+                        if (flags & SIGN)
+                                num = (signed int) num;
+                }
+                str = number(str, num, base, field_width, precision, flags);
+        }
+        *str = '\0';
+        return str-buf;
+}
+
+int sprintf(char * buf, const char *fmt, ...)
+{
+        va_list args;
+        int i;
+
+        va_start(args, fmt);
+        i=vsprintf(buf,fmt,args);
+        va_end(args);
+        return i;
+}
diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c
index 367d53d031fc..dee82695f48b 100644
--- a/arch/alpha/boot/tools/objstrip.c
+++ b/arch/alpha/boot/tools/objstrip.c
@@ -27,6 +27,9 @@
 #include <linux/param.h>
 #ifdef __ELF__
 # include <linux/elf.h>
+# define elfhdr elf64_hdr
+# define elf_phdr elf64_phdr
+# define elf_check_arch(x) ((x)->e_machine == EM_ALPHA)
 #endif
 
 /* bootfile size must be multiple of BLOCK_SIZE: */
diff --git a/arch/alpha/include/asm/types.h b/arch/alpha/include/asm/types.h
index f61e1a56c378..4cb4b6d3452c 100644
--- a/arch/alpha/include/asm/types.h
+++ b/arch/alpha/include/asm/types.h
@@ -2,6 +2,5 @@
 #define _ALPHA_TYPES_H
 
 #include <asm-generic/int-ll64.h>
-#include <uapi/asm/types.h>
 
 #endif /* _ALPHA_TYPES_H */
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index c509d306db45..a56e608db2f9 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -3,7 +3,7 @@
 
 #include <uapi/asm/unistd.h>
 
-#define NR_SYSCALLS                     511
+#define NR_SYSCALLS                     514
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
diff --git a/arch/alpha/include/uapi/asm/unistd.h b/arch/alpha/include/uapi/asm/unistd.h
index d214a0358100..aa33bf5aacb6 100644
--- a/arch/alpha/include/uapi/asm/unistd.h
+++ b/arch/alpha/include/uapi/asm/unistd.h
@@ -472,5 +472,8 @@
 #define __NR_sched_setattr              508
 #define __NR_sched_getattr              509
 #define __NR_renameat2                  510
+#define __NR_getrandom                  511
+#define __NR_memfd_create               512
+#define __NR_execveat                   513
 
 #endif /* _UAPI_ALPHA_UNISTD_H */
diff --git a/arch/alpha/kernel/err_ev6.c b/arch/alpha/kernel/err_ev6.c
index 253cf1a87481..51267ac5729b 100644
--- a/arch/alpha/kernel/err_ev6.c
+++ b/arch/alpha/kernel/err_ev6.c
@@ -6,7 +6,6 @@
  *      Error handling code supporting Alpha systems
  */
 
-#include <linux/init.h>
 #include <linux/sched.h>
 
 #include <asm/io.h>
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 7b2be251c30f..51f2c8654253 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -19,7 +19,6 @@
 #include <linux/ptrace.h>
 #include <linux/interrupt.h>
 #include <linux/random.h>
-#include <linux/init.h>
 #include <linux/irq.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index e51f578636a5..36dc91ace83a 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1019,14 +1019,13 @@ SYSCALL_DEFINE2(osf_settimeofday, struct timeval32 __user *, tv,
         if (tv) {
                 if (get_tv32((struct timeval *)&kts, tv))
                         return -EFAULT;
+                kts.tv_nsec *= 1000;
         }
         if (tz) {
                 if (copy_from_user(&ktz, tz, sizeof(*tz)))
                         return -EFAULT;
         }
 
-        kts.tv_nsec *= 1000;
-
         return do_sys_settimeofday(tv ? &kts : NULL, tz ? &ktz : NULL);
 }
 
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 1941a07b5811..84d13263ce46 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -236,12 +236,11 @@ release_thread(struct task_struct *dead_task)
 }
 
 /*
- * Copy an alpha thread..
+ * Copy architecture-specific thread state
  */
-
 int
 copy_thread(unsigned long clone_flags, unsigned long usp,
-            unsigned long arg,
+            unsigned long kthread_arg,
             struct task_struct *p)
 {
         extern void ret_from_fork(void);
@@ -262,7 +261,7 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
                         sizeof(struct switch_stack) + sizeof(struct pt_regs));
                 childstack->r26 = (unsigned long) ret_from_kernel_thread;
                 childstack->r9 = usp;   /* function */
-                childstack->r10 = arg;
+                childstack->r10 = kthread_arg;
                 childregs->hae = alpha_mv.hae_cache,
                 childti->pcb.usp = 0;
                 return 0;
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 99ac36d5de4e..2f24447fef92 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -63,7 +63,6 @@ static struct {
 enum ipi_message_type {
         IPI_RESCHEDULE,
         IPI_CALL_FUNC,
-        IPI_CALL_FUNC_SINGLE,
         IPI_CPU_STOP,
 };
 
@@ -506,7 +505,6 @@ setup_profiling_timer(unsigned int multiplier)
         return -EINVAL;
 }
 
-
 static void
 send_ipi_message(const struct cpumask *to_whom, enum ipi_message_type operation)
 {
@@ -552,10 +550,6 @@ handle_ipi(struct pt_regs *regs)
                         generic_smp_call_function_interrupt();
                         break;
 
-                case IPI_CALL_FUNC_SINGLE:
-                        generic_smp_call_function_single_interrupt();
-                        break;
-
                 case IPI_CPU_STOP:
                         halt();
 
@@ -606,7 +600,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 
 void arch_send_call_function_single_ipi(int cpu)
 {
-        send_ipi_message(cpumask_of(cpu), IPI_CALL_FUNC_SINGLE);
+        send_ipi_message(cpumask_of(cpu), IPI_CALL_FUNC);
 }
 
 static void
diff --git a/arch/alpha/kernel/srmcons.c b/arch/alpha/kernel/srmcons.c
index 6f01d9ad7b81..72b59511e59a 100644
--- a/arch/alpha/kernel/srmcons.c
+++ b/arch/alpha/kernel/srmcons.c
@@ -237,8 +237,7 @@ srmcons_init(void)
 
         return -ENODEV;
 }
-
-module_init(srmcons_init);
+device_initcall(srmcons_init);
 
 
 /*
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index f21d61fab678..24e41bd7d3c9 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -331,7 +331,7 @@ marvel_map_irq(const struct pci_dev *cdev, u8 slot, u8 pin)
         pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &intline);
         irq = intline;
 
-        msi_loc = pci_find_capability(dev, PCI_CAP_ID_MSI);
+        msi_loc = dev->msi_cap;
         msg_ctl = 0;
         if (msi_loc) 
                 pci_read_config_word(dev, msi_loc + PCI_MSI_FLAGS, &msg_ctl);
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index 24789713f1ea..9b62e3fd4f03 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -529,6 +529,9 @@ sys_call_table:
         .quad sys_sched_setattr
         .quad sys_sched_getattr
         .quad sys_renameat2                     /* 510 */
+        .quad sys_getrandom
+        .quad sys_memfd_create
+        .quad sys_execveat
 
         .size sys_call_table, . - sys_call_table
         .type sys_call_table, @object
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index 9c4c189eb22f..74aceead06e9 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -14,7 +14,6 @@
 #include <linux/tty.h>
 #include <linux/delay.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/kallsyms.h>
 #include <linux/ratelimit.h>
 
diff --git a/arch/alpha/oprofile/op_model_ev4.c b/arch/alpha/oprofile/op_model_ev4.c
index 18aa9b4f94f1..086a0d5445c5 100644
--- a/arch/alpha/oprofile/op_model_ev4.c
+++ b/arch/alpha/oprofile/op_model_ev4.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/ptrace.h>
 
diff --git a/arch/alpha/oprofile/op_model_ev5.c b/arch/alpha/oprofile/op_model_ev5.c
index c32f8a0ad925..c300f5ef3482 100644
--- a/arch/alpha/oprofile/op_model_ev5.c
+++ b/arch/alpha/oprofile/op_model_ev5.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/ptrace.h>
 
diff --git a/arch/alpha/oprofile/op_model_ev6.c b/arch/alpha/oprofile/op_model_ev6.c
index 1c84cc257fc7..02edf5971614 100644
--- a/arch/alpha/oprofile/op_model_ev6.c
+++ b/arch/alpha/oprofile/op_model_ev6.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/ptrace.h>
 
diff --git a/arch/alpha/oprofile/op_model_ev67.c b/arch/alpha/oprofile/op_model_ev67.c
index 34a57a126553..adb1744d20f3 100644
--- a/arch/alpha/oprofile/op_model_ev67.c
+++ b/arch/alpha/oprofile/op_model_ev67.c
@@ -9,7 +9,6 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/ptrace.h>
 
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 86217db2937a..992736b5229b 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -223,7 +223,7 @@ dtb-$(CONFIG_SOC_IMX25) += \
         imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dtb \
         imx25-karo-tx25.dtb \
         imx25-pdk.dtb
-dtb-$(CONFIG_SOC_IMX31) += \
+dtb-$(CONFIG_SOC_IMX27) += \
         imx27-apf27.dtb \
         imx27-apf27dev.dtb \
         imx27-eukrea-mbimxsd27-baseboard.dtb \
diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts
index 5c42d259fa68..901739fcb85a 100644
--- a/arch/arm/boot/dts/am335x-boneblack.dts
+++ b/arch/arm/boot/dts/am335x-boneblack.dts
@@ -80,7 +80,3 @@
                 status = "okay";
         };
 };
-
-&rtc {
-        system-power-controller;
-};
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 87fc7a35e802..156d05efcb70 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -654,7 +654,7 @@
         wlcore: wlcore@2 {
                 compatible = "ti,wl1271";
                 reg = <2>;
-                interrupt-parent = <&gpio1>;
+                interrupt-parent = <&gpio0>;
                 interrupts = <31 IRQ_TYPE_LEVEL_HIGH>; /* gpio 31 */
                 ref-clock-frequency = <38400000>;
         };
diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts
index 173ffa479ad3..792394dd0f2a 100644
--- a/arch/arm/boot/dts/exynos4412-trats2.dts
+++ b/arch/arm/boot/dts/exynos4412-trats2.dts
@@ -736,7 +736,7 @@
 
                         display-timings {
                                 timing-0 {
-                                        clock-frequency = <0>;
+                                        clock-frequency = <57153600>;
                                         hactive = <720>;
                                         vactive = <1280>;
                                         hfront-porch = <5>;
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index 6951b66d1ab7..bc215e4b75fd 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -533,7 +533,7 @@
 
                         fec: ethernet@1002b000 {
                                 compatible = "fsl,imx27-fec";
-                                reg = <0x1002b000 0x4000>;
+                                reg = <0x1002b000 0x1000>;
                                 interrupts = <50>;
                                 clocks = <&clks IMX27_CLK_FEC_IPG_GATE>,
                                          <&clks IMX27_CLK_FEC_AHB_GATE>;
diff --git a/arch/arm/boot/dts/omap3-devkit8000.dts b/arch/arm/boot/dts/omap3-devkit8000.dts
index 134d3f27a8ec..921de6605f07 100644
--- a/arch/arm/boot/dts/omap3-devkit8000.dts
+++ b/arch/arm/boot/dts/omap3-devkit8000.dts
@@ -110,6 +110,8 @@
         nand@0,0 {
                 reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
                 nand-bus-width = <16>;
+                gpmc,device-width = <2>;
+                ti,nand-ecc-opt = "sw";
 
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 0ca4a3eaf65d..fbbb1915c6a9 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -429,7 +429,7 @@ CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_EHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD_STI=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_ISP1760_HCD=y
+CONFIG_USB_ISP1760=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_STI=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index 4d60005e9277..6d0893a3828e 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -280,9 +280,15 @@ void __init imx_gpc_check_dt(void)
         struct device_node *np;
 
         np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-gpc");
-        if (WARN_ON(!np ||
-                    !of_find_property(np, "interrupt-controller", NULL)))
-                pr_warn("Outdated DT detected, system is about to crash!!!\n");
+        if (WARN_ON(!np))
+                return;
+
+        if (WARN_ON(!of_find_property(np, "interrupt-controller", NULL))) {
+                pr_warn("Outdated DT detected, suspend/resume will NOT work\n");
+
+                /* map GPC, so that at least CPUidle and WARs keep working */
+                gpc_base = of_iomap(np, 0);
+        }
 }
 
 #ifdef CONFIG_PM_GENERIC_DOMAINS
@@ -443,6 +449,10 @@ static int imx_gpc_probe(struct platform_device *pdev)
         struct regulator *pu_reg;
         int ret;
 
+        /* bail out if DT too old and doesn't provide the necessary info */
+        if (!of_property_read_bool(pdev->dev.of_node, "#power-domain-cells"))
+                return 0;
+
         pu_reg = devm_regulator_get_optional(&pdev->dev, "pu");
         if (PTR_ERR(pu_reg) == -ENODEV)
                 pu_reg = NULL;
diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c
index f1aeb54fabe3..2385052b0ce1 100644
--- a/arch/arm/mach-pxa/pxa_cplds_irqs.c
+++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
@@ -107,7 +107,7 @@ static int cplds_probe(struct platform_device *pdev)
         struct resource *res;
         struct cplds *fpga;
         int ret;
-        unsigned int base_irq = 0;
+        int base_irq;
         unsigned long irqflags = 0;
 
         fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL);
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index e535533d5ab8..20190bdac9d5 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -708,6 +708,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                           struct pt_regs *regs)
 {
         int i, ret = 0;
+        char *tmp;
 
         for (i = 0; i < mca_cfg.banks; i++) {
                 m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
@@ -716,9 +717,11 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                         if (quirk_no_way_out)
                                 quirk_no_way_out(i, m, regs);
                 }
-                if (mce_severity(m, mca_cfg.tolerant, msg, true) >=
-                    MCE_PANIC_SEVERITY)
+
+                if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+                        *msg = tmp;
                         ret = 1;
+                }
         }
         return ret;
 }
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 009183276bb7..6185d3141219 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -173,6 +173,21 @@ static void init_thread_xstate(void)
                 xstate_size = sizeof(struct i387_fxsave_struct);
         else
                 xstate_size = sizeof(struct i387_fsave_struct);
+
+        /*
+         * Quirk: we don't yet handle the XSAVES* instructions
+         * correctly, as we don't correctly convert between
+         * standard and compacted format when interfacing
+         * with user-space - so disable it for now.
+         *
+         * The difference is small: with recent CPUs the
+         * compacted format is only marginally smaller than
+         * the standard FPU state format.
+         *
+         * ( This is easy to backport while we are fixing
+         *   XSAVES* support. )
+         */
+        setup_clear_cpu_cap(X86_FEATURE_XSAVES);
 }
 
 /*
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 99f76103c6b7..ddeff4844a10 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -966,7 +966,12 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
         }
         ctx.cleanup_addr = proglen;
 
-        for (pass = 0; pass < 10; pass++) {
+        /* JITed image shrinks with every pass and the loop iterates
+         * until the image stops shrinking. Very large bpf programs
+         * may converge on the last pass. In such case do one more
+         * pass to emit the final image
+         */
+        for (pass = 0; pass < 10 || image; pass++) {
                 proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
                 if (proglen <= 0) {
                         image = NULL;
diff --git a/arch/xtensa/include/asm/dma-mapping.h b/arch/xtensa/include/asm/dma-mapping.h
index 172a02a6ad14..ba78ccf651e7 100644
--- a/arch/xtensa/include/asm/dma-mapping.h
+++ b/arch/xtensa/include/asm/dma-mapping.h
@@ -185,4 +185,17 @@ static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
         return -EINVAL;
 }
 
+static inline void *dma_alloc_attrs(struct device *dev, size_t size,
+                                    dma_addr_t *dma_handle, gfp_t flag,
+                                    struct dma_attrs *attrs)
+{
+        return NULL;
+}
+
+static inline void dma_free_attrs(struct device *dev, size_t size,
+                                  void *vaddr, dma_addr_t dma_handle,
+                                  struct dma_attrs *attrs)
+{
+}
+
 #endif  /* _XTENSA_DMA_MAPPING_H */
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 8aaf298a80e1..362905e7c841 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1512,15 +1512,6 @@ config CRYPTO_USER_API_RNG
           This option enables the user-spaces interface for random
           number generator algorithms.
 
-config CRYPTO_USER_API_AEAD
-        tristate "User-space interface for AEAD cipher algorithms"
-        depends on NET
-        select CRYPTO_AEAD
-        select CRYPTO_USER_API
-        help
-          This option enables the user-spaces interface for AEAD
-          cipher algorithms.
-
 config CRYPTO_HASH_INFO
         bool
 
diff --git a/drivers/gpio/gpio-kempld.c b/drivers/gpio/gpio-kempld.c
index 6b8115f34208..83f281dda1e0 100644
--- a/drivers/gpio/gpio-kempld.c
+++ b/drivers/gpio/gpio-kempld.c
@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
                 = container_of(chip, struct kempld_gpio_data, chip);
         struct kempld_device_data *pld = gpio->pld;
 
-        return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
+        return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
 }
 
 static int kempld_gpio_pincount(struct kempld_device_data *pld)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 59eaa23767d8..6bc612b8a49f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -53,6 +53,11 @@ static DEFINE_MUTEX(gpio_lookup_lock);
 static LIST_HEAD(gpio_lookup_list);
 LIST_HEAD(gpio_chips);
 
+
+static void gpiochip_free_hogs(struct gpio_chip *chip);
+static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
+
+
 static inline void desc_set_label(struct gpio_desc *d, const char *label)
 {
         d->label = label;
@@ -297,6 +302,7 @@ int gpiochip_add(struct gpio_chip *chip)
 
 err_remove_chip:
         acpi_gpiochip_remove(chip);
+        gpiochip_free_hogs(chip);
         of_gpiochip_remove(chip);
         spin_lock_irqsave(&gpio_lock, flags);
         list_del(&chip->list);
@@ -313,10 +319,6 @@ err_free_descs:
 }
 EXPORT_SYMBOL_GPL(gpiochip_add);
 
-/* Forward-declaration */
-static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
-static void gpiochip_free_hogs(struct gpio_chip *chip);
-
 /**
  * gpiochip_remove() - unregister a gpio_chip
  * @chip: the chip to unregister
diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
index 40c1db9ad7c3..2f0ed11024eb 100644
--- a/drivers/gpu/drm/drm_plane_helper.c
+++ b/drivers/gpu/drm/drm_plane_helper.c
@@ -465,6 +465,9 @@ int drm_plane_helper_commit(struct drm_plane *plane,
                 if (!crtc[i])
                         continue;
 
+                if (crtc[i]->cursor == plane)
+                        continue;
+
                 /* There's no other way to figure out whether the crtc is running. */
                 ret = drm_crtc_vblank_get(crtc[i]);
                 if (ret == 0) {
diff --git a/drivers/gpu/drm/nouveau/include/nvif/class.h b/drivers/gpu/drm/nouveau/include/nvif/class.h
index 0b5af0fe8659..64f8b2f687d2 100644
--- a/drivers/gpu/drm/nouveau/include/nvif/class.h
+++ b/drivers/gpu/drm/nouveau/include/nvif/class.h
@@ -14,7 +14,7 @@
 
 #define FERMI_TWOD_A                                                 0x0000902d
 
-#define FERMI_MEMORY_TO_MEMORY_FORMAT_A                              0x0000903d
+#define FERMI_MEMORY_TO_MEMORY_FORMAT_A                              0x00009039
 
 #define KEPLER_INLINE_TO_MEMORY_A                                    0x0000a040
 #define KEPLER_INLINE_TO_MEMORY_B                                    0x0000a140
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gm204.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gm204.c
index 2f5eadd12a9b..fdb1dcf16a59 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gm204.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gm204.c
@@ -329,7 +329,6 @@ gm204_gr_init(struct nvkm_object *object)
         nv_mask(priv, 0x419cc0, 0x00000008, 0x00000008);
 
         for (gpc = 0; gpc < priv->gpc_nr; gpc++) {
-        printk(KERN_ERR "ppc %d %d\n", gpc, priv->ppc_nr[gpc]);
                 for (ppc = 0; ppc < priv->ppc_nr[gpc]; ppc++)
                         nv_wr32(priv, PPC_UNIT(gpc, ppc, 0x038), 0xc0000000);
                 nv_wr32(priv, GPC_UNIT(gpc, 0x0420), 0xc0000000);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c
index e8778c67578e..c61102f70805 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c
@@ -90,12 +90,14 @@ gf100_devinit_disable(struct nvkm_devinit *devinit)
         return disable;
 }
 
-static int
+int
 gf100_devinit_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
                    struct nvkm_oclass *oclass, void *data, u32 size,
                    struct nvkm_object **pobject)
 {
+        struct nvkm_devinit_impl *impl = (void *)oclass;
         struct nv50_devinit_priv *priv;
+        u64 disable;
         int ret;
 
         ret = nvkm_devinit_create(parent, engine, oclass, &priv);
@@ -103,7 +105,8 @@ gf100_devinit_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
         if (ret)
                 return ret;
 
-        if (nv_rd32(priv, 0x022500) & 0x00000001)
+        disable = impl->disable(&priv->base);
+        if (disable & (1ULL << NVDEV_ENGINE_DISP))
                 priv->base.post = true;
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
index b345a53e881d..87ca0ece37b4 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
@@ -48,7 +48,7 @@ struct nvkm_oclass *
 gm107_devinit_oclass = &(struct nvkm_devinit_impl) {
         .base.handle = NV_SUBDEV(DEVINIT, 0x07),
         .base.ofuncs = &(struct nvkm_ofuncs) {
-                .ctor = nv50_devinit_ctor,
+                .ctor = gf100_devinit_ctor,
                 .dtor = _nvkm_devinit_dtor,
                 .init = nv50_devinit_init,
                 .fini = _nvkm_devinit_fini,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c
index 535172c5f1ad..1076fcf0d716 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c
@@ -161,7 +161,7 @@ struct nvkm_oclass *
 gm204_devinit_oclass = &(struct nvkm_devinit_impl) {
         .base.handle = NV_SUBDEV(DEVINIT, 0x07),
         .base.ofuncs = &(struct nvkm_ofuncs) {
-                .ctor = nv50_devinit_ctor,
+                .ctor = gf100_devinit_ctor,
                 .dtor = _nvkm_devinit_dtor,
                 .init = nv50_devinit_init,
                 .fini = _nvkm_devinit_fini,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/nv50.h b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/nv50.h
index b882b65ff3cd..9243521c80ac 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/nv50.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/nv50.h
@@ -15,6 +15,9 @@ int  nv50_devinit_pll_set(struct nvkm_devinit *, u32, u32);
 
 int  gt215_devinit_pll_set(struct nvkm_devinit *, u32, u32);
 
+int  gf100_devinit_ctor(struct nvkm_object *, struct nvkm_object *,
+                        struct nvkm_oclass *, void *, u32,
+                        struct nvkm_object **);
 int  gf100_devinit_pll_set(struct nvkm_devinit *, u32, u32);
 
 u64  gm107_devinit_disable(struct nvkm_devinit *);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 42b2ea3fdcf3..e597ffc26563 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1798,7 +1798,9 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc)
                         if ((crtc->mode.clock == test_crtc->mode.clock) &&
                             (adjusted_clock == test_adjusted_clock) &&
                             (radeon_crtc->ss_enabled == test_radeon_crtc->ss_enabled) &&
-                            (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID))
+                            (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) &&
+                            (drm_detect_monitor_audio(radeon_connector_edid(test_radeon_crtc->connector)) ==
+                             drm_detect_monitor_audio(radeon_connector_edid(radeon_crtc->connector))))
                                 return test_radeon_crtc->pll_id;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index a0c35bbc8546..ba50f3c1c2e0 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -5822,7 +5822,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
                L2_CACHE_BIGK_FRAGMENT_SIZE(4));
         /* setup context0 */
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
                         (u32)(rdev->dummy_page.addr >> 12));
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 05e6d6ef5963..f848acfd3fc8 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2485,7 +2485,7 @@ static int evergreen_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
                                 RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 0926739c9fa7..9953356fe263 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -400,7 +400,7 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (enable) {
                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
-                if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+                if (connector && drm_detect_monitor_audio(radeon_connector_edid(connector))) {
                         WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset,
                                HDMI_AVI_INFO_SEND | /* enable AVI info frames */
                                HDMI_AVI_INFO_CONT | /* required for audio info values to be updated */
@@ -438,7 +438,8 @@ void evergreen_dp_enable(struct drm_encoder *encoder, bool enable)
         if (!dig || !dig->afmt)
                 return;
 
-        if (enable && drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+        if (enable && connector &&
+            drm_detect_monitor_audio(radeon_connector_edid(connector))) {
                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
                 struct radeon_connector *radeon_connector = to_radeon_connector(connector);
                 struct radeon_connector_atom_dig *dig_connector;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index aba2f428c0a8..64d3a771920d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1282,7 +1282,7 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
                L2_CACHE_BIGK_FRAGMENT_SIZE(6));
         /* setup context0 */
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
                         (u32)(rdev->dummy_page.addr >> 12));
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 25b4ac967742..8f6d862a1882 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1112,7 +1112,7 @@ static int r600_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
         WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
                                 RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
index dcb779647c57..25191f126f3b 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -460,9 +460,6 @@ void radeon_audio_detect(struct drm_connector *connector,
         if (!connector || !connector->encoder)
                 return;
 
-        if (!radeon_encoder_is_digital(connector->encoder))
-                return;
-
         rdev = connector->encoder->dev->dev_private;
 
         if (!radeon_audio_chipset_supported(rdev))
@@ -471,26 +468,26 @@ void radeon_audio_detect(struct drm_connector *connector,
         radeon_encoder = to_radeon_encoder(connector->encoder);
         dig = radeon_encoder->enc_priv;
 
-        if (!dig->afmt)
-                return;
-
         if (status == connector_status_connected) {
-                struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+                struct radeon_connector *radeon_connector;
+                int sink_type;
+
+                if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+                        radeon_encoder->audio = NULL;
+                        return;
+                }
+
+                radeon_connector = to_radeon_connector(connector);
+                sink_type = radeon_dp_getsinktype(radeon_connector);
 
                 if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort &&
-                    radeon_dp_getsinktype(radeon_connector) ==
-                    CONNECTOR_OBJECT_ID_DISPLAYPORT)
+                        sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT)
                         radeon_encoder->audio = rdev->audio.dp_funcs;
                 else
                         radeon_encoder->audio = rdev->audio.hdmi_funcs;
 
                 dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
-                if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
-                        radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
-                } else {
-                        radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                        dig->afmt->pin = NULL;
-                }
+                radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
         } else {
                 radeon_audio_enable(rdev, dig->afmt->pin, 0);
                 dig->afmt->pin = NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index d17d251dbd4f..cebb65e07e1d 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1379,10 +1379,8 @@ out:
         /* updated in get modes as well since we need to know if it's analog or digital */
         radeon_connector_update_scratch_regs(connector, ret);
 
-        if (radeon_audio != 0) {
-                radeon_connector_get_edid(connector);
+        if (radeon_audio != 0)
                 radeon_audio_detect(connector, ret);
-        }
 
 exit:
         pm_runtime_mark_last_busy(connector->dev->dev);
@@ -1719,10 +1717,8 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
 
         radeon_connector_update_scratch_regs(connector, ret);
 
-        if (radeon_audio != 0) {
-                radeon_connector_get_edid(connector);
+        if (radeon_audio != 0)
                 radeon_audio_detect(connector, ret);
-        }
 
 out:
         pm_runtime_mark_last_busy(connector->dev->dev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index c54d6313a46d..01ee96acb398 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -921,7 +921,7 @@ static int rv770_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
                                 RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 5326f753e107..4c679b802bc8 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -4303,7 +4303,7 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
                L2_CACHE_BIGK_FRAGMENT_SIZE(4));
         /* setup context0 */
         WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
-        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+        WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
         WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
                         (u32)(rdev->dummy_page.addr >> 12));
diff --git a/drivers/gpu/drm/vgem/Makefile b/drivers/gpu/drm/vgem/Makefile
index 1055cb79096c..3f4c7b842028 100644
--- a/drivers/gpu/drm/vgem/Makefile
+++ b/drivers/gpu/drm/vgem/Makefile
@@ -1,4 +1,4 @@
 ccflags-y := -Iinclude/drm
-vgem-y := vgem_drv.o vgem_dma_buf.o
+vgem-y := vgem_drv.o
 
 obj-$(CONFIG_DRM_VGEM)  += vgem.o
diff --git a/drivers/gpu/drm/vgem/vgem_dma_buf.c b/drivers/gpu/drm/vgem/vgem_dma_buf.c
deleted file mode 100644
index 0254438ad1a6..000000000000
--- a/drivers/gpu/drm/vgem/vgem_dma_buf.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright © 2012 Intel Corporation
- * Copyright © 2014 The Chromium OS Authors
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
- * IN THE SOFTWARE.
- *
- * Authors:
- *    Ben Widawsky <ben@bwidawsk.net>
- *
- */
-
-#include <linux/dma-buf.h>
-#include "vgem_drv.h"
-
-struct sg_table *vgem_gem_prime_get_sg_table(struct drm_gem_object *gobj)
-{
-        struct drm_vgem_gem_object *obj = to_vgem_bo(gobj);
-        BUG_ON(obj->pages == NULL);
-
-        return drm_prime_pages_to_sg(obj->pages, obj->base.size / PAGE_SIZE);
-}
-
-int vgem_gem_prime_pin(struct drm_gem_object *gobj)
-{
-        struct drm_vgem_gem_object *obj = to_vgem_bo(gobj);
-        return vgem_gem_get_pages(obj);
-}
-
-void vgem_gem_prime_unpin(struct drm_gem_object *gobj)
-{
-        struct drm_vgem_gem_object *obj = to_vgem_bo(gobj);
-        vgem_gem_put_pages(obj);
-}
-
-void *vgem_gem_prime_vmap(struct drm_gem_object *gobj)
-{
-        struct drm_vgem_gem_object *obj = to_vgem_bo(gobj);
-        BUG_ON(obj->pages == NULL);
-
-        return vmap(obj->pages, obj->base.size / PAGE_SIZE, 0, PAGE_KERNEL);
-}
-
-void vgem_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
-{
-        vunmap(vaddr);
-}
-
-struct drm_gem_object *vgem_gem_prime_import(struct drm_device *dev,
-                                             struct dma_buf *dma_buf)
-{
-        struct drm_vgem_gem_object *obj = NULL;
-        int ret;
-
-        obj = kzalloc(sizeof(*obj), GFP_KERNEL);
-        if (obj == NULL) {
-                ret = -ENOMEM;
-                goto fail;
-        }
-
-        ret = drm_gem_object_init(dev, &obj->base, dma_buf->size);
-        if (ret) {
-                ret = -ENOMEM;
-                goto fail_free;
-        }
-
-        get_dma_buf(dma_buf);
-
-        obj->base.dma_buf = dma_buf;
-        obj->use_dma_buf = true;
-
-        return &obj->base;
-
-fail_free:
-        kfree(obj);
-fail:
-        return ERR_PTR(ret);
-}
diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index cb3b43525b2d..7a207ca547be 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -302,22 +302,13 @@ static const struct file_operations vgem_driver_fops = {
 };
 
 static struct drm_driver vgem_driver = {
-        .driver_features                = DRIVER_GEM | DRIVER_PRIME,
+        .driver_features                = DRIVER_GEM,
         .gem_free_object                = vgem_gem_free_object,
         .gem_vm_ops                     = &vgem_gem_vm_ops,
         .ioctls                         = vgem_ioctls,
         .fops                           = &vgem_driver_fops,
         .dumb_create                    = vgem_gem_dumb_create,
         .dumb_map_offset                = vgem_gem_dumb_map,
-        .prime_handle_to_fd             = drm_gem_prime_handle_to_fd,
-        .prime_fd_to_handle             = drm_gem_prime_fd_to_handle,
-        .gem_prime_export               = drm_gem_prime_export,
-        .gem_prime_import               = vgem_gem_prime_import,
-        .gem_prime_pin                  = vgem_gem_prime_pin,
-        .gem_prime_unpin                = vgem_gem_prime_unpin,
-        .gem_prime_get_sg_table         = vgem_gem_prime_get_sg_table,
-        .gem_prime_vmap                 = vgem_gem_prime_vmap,
-        .gem_prime_vunmap               = vgem_gem_prime_vunmap,
         .name   = DRIVER_NAME,
         .desc   = DRIVER_DESC,
         .date   = DRIVER_DATE,
diff --git a/drivers/gpu/drm/vgem/vgem_drv.h b/drivers/gpu/drm/vgem/vgem_drv.h
index 57ab4d8f41f9..e9f92f7ee275 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.h
+++ b/drivers/gpu/drm/vgem/vgem_drv.h
@@ -43,15 +43,4 @@ struct drm_vgem_gem_object {
 extern void vgem_gem_put_pages(struct drm_vgem_gem_object *obj);
 extern int vgem_gem_get_pages(struct drm_vgem_gem_object *obj);
 
-/* vgem_dma_buf.c */
-extern struct sg_table *vgem_gem_prime_get_sg_table(
-                        struct drm_gem_object *gobj);
-extern int vgem_gem_prime_pin(struct drm_gem_object *gobj);
-extern void vgem_gem_prime_unpin(struct drm_gem_object *gobj);
-extern void *vgem_gem_prime_vmap(struct drm_gem_object *gobj);
-extern void vgem_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
-extern struct drm_gem_object *vgem_gem_prime_import(struct drm_device *dev,
-                                                    struct dma_buf *dma_buf);
-
-
 #endif
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 7dc93aa004c8..312ffd3d0017 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -173,7 +173,7 @@ static void unmap_switcher(void)
 bool lguest_address_ok(const struct lguest *lg,
                        unsigned long addr, unsigned long len)
 {
-        return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
+        return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
 }
 
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 63953477a07c..eff7bdd7731d 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -429,9 +429,11 @@ static int __multipath_map(struct dm_target *ti, struct request *clone,
                 /* blk-mq request-based interface */
                 *__clone = blk_get_request(bdev_get_queue(bdev),
                                            rq_data_dir(rq), GFP_ATOMIC);
-                if (IS_ERR(*__clone))
+                if (IS_ERR(*__clone)) {
                         /* ENOMEM, requeue */
+                        clear_mapinfo(m, map_context);
                         return r;
+                }
                 (*__clone)->bio = (*__clone)->biotail = NULL;
                 (*__clone)->rq_disk = bdev->bd_disk;
                 (*__clone)->cmd_flags |= REQ_FAILFAST_TRANSPORT;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index d9b00b8565c6..16ba55ad7089 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -820,6 +820,12 @@ void dm_consume_args(struct dm_arg_set *as, unsigned num_args)
 }
 EXPORT_SYMBOL(dm_consume_args);
 
+static bool __table_type_request_based(unsigned table_type)
+{
+        return (table_type == DM_TYPE_REQUEST_BASED ||
+                table_type == DM_TYPE_MQ_REQUEST_BASED);
+}
+
 static int dm_table_set_type(struct dm_table *t)
 {
         unsigned i;
@@ -852,8 +858,7 @@ static int dm_table_set_type(struct dm_table *t)
                  * Determine the type from the live device.
                  * Default to bio-based if device is new.
                  */
-                if (live_md_type == DM_TYPE_REQUEST_BASED ||
-                    live_md_type == DM_TYPE_MQ_REQUEST_BASED)
+                if (__table_type_request_based(live_md_type))
                         request_based = 1;
                 else
                         bio_based = 1;
@@ -903,7 +908,7 @@ static int dm_table_set_type(struct dm_table *t)
                         }
                 t->type = DM_TYPE_MQ_REQUEST_BASED;
 
-        } else if (hybrid && list_empty(devices) && live_md_type != DM_TYPE_NONE) {
+        } else if (list_empty(devices) && __table_type_request_based(live_md_type)) {
                 /* inherit live MD type */
                 t->type = live_md_type;
 
@@ -925,10 +930,7 @@ struct target_type *dm_table_get_immutable_target_type(struct dm_table *t)
 
 bool dm_table_request_based(struct dm_table *t)
 {
-        unsigned table_type = dm_table_get_type(t);
-
-        return (table_type == DM_TYPE_REQUEST_BASED ||
-                table_type == DM_TYPE_MQ_REQUEST_BASED);
+        return __table_type_request_based(dm_table_get_type(t));
 }
 
 bool dm_table_mq_request_based(struct dm_table *t)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index a930b72314ac..2caf492890d6 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1082,13 +1082,11 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
         dm_put(md);
 }
 
-static void free_rq_clone(struct request *clone, bool must_be_mapped)
+static void free_rq_clone(struct request *clone)
 {
         struct dm_rq_target_io *tio = clone->end_io_data;
         struct mapped_device *md = tio->md;
 
-        WARN_ON_ONCE(must_be_mapped && !clone->q);
-
         blk_rq_unprep_clone(clone);
 
         if (md->type == DM_TYPE_MQ_REQUEST_BASED)
@@ -1132,7 +1130,7 @@ static void dm_end_request(struct request *clone, int error)
                         rq->sense_len = clone->sense_len;
         }
 
-        free_rq_clone(clone, true);
+        free_rq_clone(clone);
         if (!rq->q->mq_ops)
                 blk_end_request_all(rq, error);
         else
@@ -1151,7 +1149,7 @@ static void dm_unprep_request(struct request *rq)
         }
 
         if (clone)
-                free_rq_clone(clone, false);
+                free_rq_clone(clone);
 }
 
 /*
@@ -1164,6 +1162,7 @@ static void old_requeue_request(struct request *rq)
 
         spin_lock_irqsave(q->queue_lock, flags);
         blk_requeue_request(q, rq);
+        blk_run_queue_async(q);
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 
@@ -1724,8 +1723,7 @@ static int dm_merge_bvec(struct request_queue *q,
         struct mapped_device *md = q->queuedata;
         struct dm_table *map = dm_get_live_table_fast(md);
         struct dm_target *ti;
-        sector_t max_sectors;
-        int max_size = 0;
+        sector_t max_sectors, max_size = 0;
 
         if (unlikely(!map))
                 goto out;
@@ -1740,8 +1738,16 @@ static int dm_merge_bvec(struct request_queue *q,
         max_sectors = min(max_io_len(bvm->bi_sector, ti),
                           (sector_t) queue_max_sectors(q));
         max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size;
-        if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */
-                max_size = 0;
+
+        /*
+         * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t
+         * to the targets' merge function since it holds sectors not bytes).
+         * Just doing this as an interim fix for stable@ because the more
+         * comprehensive cleanup of switching to sector_t will impact every
+         * DM target that implements a ->merge hook.
+         */
+        if (max_size > INT_MAX)
+                max_size = INT_MAX;
 
         /*
          * merge_bvec_fn() returns number of bytes
@@ -1749,7 +1755,7 @@ static int dm_merge_bvec(struct request_queue *q,
          * max is precomputed maximal io size
          */
         if (max_size && ti->type->merge)
-                max_size = ti->type->merge(ti, bvm, biovec, max_size);
+                max_size = ti->type->merge(ti, bvm, biovec, (int) max_size);
         /*
          * If the target doesn't support merge method and some of the devices
          * provided their merge_bvec method (we know this by looking for the
@@ -1971,8 +1977,8 @@ static int map_request(struct dm_rq_target_io *tio, struct request *rq,
                         dm_kill_unmapped_request(rq, r);
                         return r;
                 }
-                if (IS_ERR(clone))
-                        return DM_MAPIO_REQUEUE;
+                if (r != DM_MAPIO_REMAPPED)
+                        return r;
                 if (setup_clone(clone, rq, tio, GFP_ATOMIC)) {
                         /* -ENOMEM */
                         ti->type->release_clone_rq(clone);
@@ -2753,13 +2759,15 @@ static int dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (dm_table_get_type(map) == DM_TYPE_REQUEST_BASED) {
                 /* clone request is allocated at the end of the pdu */
                 tio->clone = (void *)blk_mq_rq_to_pdu(rq) + sizeof(struct dm_rq_target_io);
-                if (!clone_rq(rq, md, tio, GFP_ATOMIC))
-                        return BLK_MQ_RQ_QUEUE_BUSY;
+                (void) clone_rq(rq, md, tio, GFP_ATOMIC);
                 queue_kthread_work(&md->kworker, &tio->work);
         } else {
                 /* Direct call is fine since .queue_rq allows allocations */
-                if (map_request(tio, rq, md) == DM_MAPIO_REQUEUE)
-                        dm_requeue_unmapped_original_request(md, rq);
+                if (map_request(tio, rq, md) == DM_MAPIO_REQUEUE) {
+                        /* Undo dm_start_request() before requeuing */
+                        rq_completed(md, rq_data_dir(rq), false);
+                        return BLK_MQ_RQ_QUEUE_BUSY;
+                }
         }
 
         return BLK_MQ_RQ_QUEUE_OK;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 593a02476c78..27506302eb7a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4211,12 +4211,12 @@ action_store(struct mddev *mddev, const char *page, size_t len)
         if (!mddev->pers || !mddev->pers->sync_request)
                 return -EINVAL;
 
-        if (cmd_match(page, "frozen"))
-                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-        else
-                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 
         if (cmd_match(page, "idle") || cmd_match(page, "frozen")) {
+                if (cmd_match(page, "frozen"))
+                        set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                else
+                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                 flush_workqueue(md_misc_wq);
                 if (mddev->sync_thread) {
                         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
@@ -4229,16 +4229,17 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                    test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return -EBUSY;
         else if (cmd_match(page, "resync"))
-                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
         else if (cmd_match(page, "recover")) {
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                 set_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
-                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         } else if (cmd_match(page, "reshape")) {
                 int err;
                 if (mddev->pers->start_reshape == NULL)
                         return -EINVAL;
                 err = mddev_lock(mddev);
                 if (!err) {
+                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                         err = mddev->pers->start_reshape(mddev);
                         mddev_unlock(mddev);
                 }
@@ -4250,6 +4251,7 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                         set_bit(MD_RECOVERY_CHECK, &mddev->recovery);
                 else if (!cmd_match(page, "repair"))
                         return -EINVAL;
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                 set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
                 set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b9f2b9cc6060..553d54b87052 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -749,6 +749,7 @@ static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 static bool stripe_can_batch(struct stripe_head *sh)
 {
         return test_bit(STRIPE_BATCH_READY, &sh->state) &&
+                !test_bit(STRIPE_BITMAP_PENDING, &sh->state) &&
                 is_full_stripe_write(sh);
 }
 
@@ -837,6 +838,15 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                     < IO_THRESHOLD)
                         md_wakeup_thread(conf->mddev->thread);
 
+        if (test_and_clear_bit(STRIPE_BIT_DELAY, &sh->state)) {
+                int seq = sh->bm_seq;
+                if (test_bit(STRIPE_BIT_DELAY, &sh->batch_head->state) &&
+                    sh->batch_head->bm_seq > seq)
+                        seq = sh->batch_head->bm_seq;
+                set_bit(STRIPE_BIT_DELAY, &sh->batch_head->state);
+                sh->batch_head->bm_seq = seq;
+        }
+
         atomic_inc(&sh->count);
 unlock_out:
         unlock_two_stripes(head, sh);
@@ -2987,14 +2997,32 @@ static int add_stripe_bio(struct stripe_head *sh, struct bio *bi, int dd_idx,
         pr_debug("added bi b#%llu to stripe s#%llu, disk %d.\n",
                 (unsigned long long)(*bip)->bi_iter.bi_sector,
                 (unsigned long long)sh->sector, dd_idx);
-        spin_unlock_irq(&sh->stripe_lock);
 
         if (conf->mddev->bitmap && firstwrite) {
+                /* Cannot hold spinlock over bitmap_startwrite,
+                 * but must ensure this isn't added to a batch until
+                 * we have added to the bitmap and set bm_seq.
+                 * So set STRIPE_BITMAP_PENDING to prevent
+                 * batching.
+                 * If multiple add_stripe_bio() calls race here they
+                 * much all set STRIPE_BITMAP_PENDING.  So only the first one
+                 * to complete "bitmap_startwrite" gets to set
+                 * STRIPE_BIT_DELAY.  This is important as once a stripe
+                 * is added to a batch, STRIPE_BIT_DELAY cannot be changed
+                 * any more.
+                 */
+                set_bit(STRIPE_BITMAP_PENDING, &sh->state);
+                spin_unlock_irq(&sh->stripe_lock);
                 bitmap_startwrite(conf->mddev->bitmap, sh->sector,
                                   STRIPE_SECTORS, 0);
-                sh->bm_seq = conf->seq_flush+1;
-                set_bit(STRIPE_BIT_DELAY, &sh->state);
+                spin_lock_irq(&sh->stripe_lock);
+                clear_bit(STRIPE_BITMAP_PENDING, &sh->state);
+                if (!sh->batch_head) {
+                        sh->bm_seq = conf->seq_flush+1;
+                        set_bit(STRIPE_BIT_DELAY, &sh->state);
+                }
         }
+        spin_unlock_irq(&sh->stripe_lock);
 
         if (stripe_can_batch(sh))
                 stripe_add_to_batch_list(conf, sh);
@@ -3392,6 +3420,8 @@ static void handle_stripe_fill(struct stripe_head *sh,
         set_bit(STRIPE_HANDLE, &sh->state);
 }
 
+static void break_stripe_batch_list(struct stripe_head *head_sh,
+                                    unsigned long handle_flags);
 /* handle_stripe_clean_event
  * any written block on an uptodate or failed drive can be returned.
  * Note that if we 'wrote' to a failed drive, it will be UPTODATE, but
@@ -3405,7 +3435,6 @@ static void handle_stripe_clean_event(struct r5conf *conf,
         int discard_pending = 0;
         struct stripe_head *head_sh = sh;
         bool do_endio = false;
-        int wakeup_nr = 0;
 
         for (i = disks; i--; )
                 if (sh->dev[i].written) {
@@ -3494,44 +3523,8 @@ unhash:
                 if (atomic_dec_and_test(&conf->pending_full_writes))
                         md_wakeup_thread(conf->mddev->thread);
 
-        if (!head_sh->batch_head || !do_endio)
-                return;
-        for (i = 0; i < head_sh->disks; i++) {
-                if (test_and_clear_bit(R5_Overlap, &head_sh->dev[i].flags))
-                        wakeup_nr++;
-        }
-        while (!list_empty(&head_sh->batch_list)) {
-                int i;
-                sh = list_first_entry(&head_sh->batch_list,
-                                      struct stripe_head, batch_list);
-                list_del_init(&sh->batch_list);
-
-                set_mask_bits(&sh->state, ~STRIPE_EXPAND_SYNC_FLAG,
-                              head_sh->state & ~((1 << STRIPE_ACTIVE) |
-                                                 (1 << STRIPE_PREREAD_ACTIVE) |
-                                                 STRIPE_EXPAND_SYNC_FLAG));
-                sh->check_state = head_sh->check_state;
-                sh->reconstruct_state = head_sh->reconstruct_state;
-                for (i = 0; i < sh->disks; i++) {
-                        if (test_and_clear_bit(R5_Overlap, &sh->dev[i].flags))
-                                wakeup_nr++;
-                        sh->dev[i].flags = head_sh->dev[i].flags;
-                }
-
-                spin_lock_irq(&sh->stripe_lock);
-                sh->batch_head = NULL;
-                spin_unlock_irq(&sh->stripe_lock);
-                if (sh->state & STRIPE_EXPAND_SYNC_FLAG)
-                        set_bit(STRIPE_HANDLE, &sh->state);
-                release_stripe(sh);
-        }
-
-        spin_lock_irq(&head_sh->stripe_lock);
-        head_sh->batch_head = NULL;
-        spin_unlock_irq(&head_sh->stripe_lock);
-        wake_up_nr(&conf->wait_for_overlap, wakeup_nr);
-        if (head_sh->state & STRIPE_EXPAND_SYNC_FLAG)
-                set_bit(STRIPE_HANDLE, &head_sh->state);
+        if (head_sh->batch_head && do_endio)
+                break_stripe_batch_list(head_sh, STRIPE_EXPAND_SYNC_FLAGS);
 }
 
 static void handle_stripe_dirtying(struct r5conf *conf,
@@ -4172,9 +4165,13 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
 
 static int clear_batch_ready(struct stripe_head *sh)
 {
+        /* Return '1' if this is a member of batch, or
+         * '0' if it is a lone stripe or a head which can now be
+         * handled.
+         */
         struct stripe_head *tmp;
         if (!test_and_clear_bit(STRIPE_BATCH_READY, &sh->state))
-                return 0;
+                return (sh->batch_head && sh->batch_head != sh);
         spin_lock(&sh->stripe_lock);
         if (!sh->batch_head) {
                 spin_unlock(&sh->stripe_lock);
@@ -4202,38 +4199,65 @@ static int clear_batch_ready(struct stripe_head *sh)
         return 0;
 }
 
-static void check_break_stripe_batch_list(struct stripe_head *sh)
+static void break_stripe_batch_list(struct stripe_head *head_sh,
+                                    unsigned long handle_flags)
 {
-        struct stripe_head *head_sh, *next;
+        struct stripe_head *sh, *next;
         int i;
-
-        if (!test_and_clear_bit(STRIPE_BATCH_ERR, &sh->state))
-                return;
-
-        head_sh = sh;
+        int do_wakeup = 0;
 
         list_for_each_entry_safe(sh, next, &head_sh->batch_list, batch_list) {
 
                 list_del_init(&sh->batch_list);
 
-                set_mask_bits(&sh->state, ~STRIPE_EXPAND_SYNC_FLAG,
-                              head_sh->state & ~((1 << STRIPE_ACTIVE) |
-                                                 (1 << STRIPE_PREREAD_ACTIVE) |
-                                                 (1 << STRIPE_DEGRADED) |
-                                                 STRIPE_EXPAND_SYNC_FLAG));
+                WARN_ON_ONCE(sh->state & ((1 << STRIPE_ACTIVE) |
+                                          (1 << STRIPE_SYNCING) |
+                                          (1 << STRIPE_REPLACED) |
+                                          (1 << STRIPE_PREREAD_ACTIVE) |
+                                          (1 << STRIPE_DELAYED) |
+                                          (1 << STRIPE_BIT_DELAY) |
+                                          (1 << STRIPE_FULL_WRITE) |
+                                          (1 << STRIPE_BIOFILL_RUN) |
+                                          (1 << STRIPE_COMPUTE_RUN)  |
+                                          (1 << STRIPE_OPS_REQ_PENDING) |
+                                          (1 << STRIPE_DISCARD) |
+                                          (1 << STRIPE_BATCH_READY) |
+                                          (1 << STRIPE_BATCH_ERR) |
+                                          (1 << STRIPE_BITMAP_PENDING)));
+                WARN_ON_ONCE(head_sh->state & ((1 << STRIPE_DISCARD) |
+                                              (1 << STRIPE_REPLACED)));
+
+                set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
+                                            (1 << STRIPE_DEGRADED)),
+                              head_sh->state & (1 << STRIPE_INSYNC));
+
                 sh->check_state = head_sh->check_state;
                 sh->reconstruct_state = head_sh->reconstruct_state;
-                for (i = 0; i < sh->disks; i++)
+                for (i = 0; i < sh->disks; i++) {
+                        if (test_and_clear_bit(R5_Overlap, &sh->dev[i].flags))
+                                do_wakeup = 1;
                         sh->dev[i].flags = head_sh->dev[i].flags &
                                 (~((1 << R5_WriteError) | (1 << R5_Overlap)));
-
+                }
                 spin_lock_irq(&sh->stripe_lock);
                 sh->batch_head = NULL;
                 spin_unlock_irq(&sh->stripe_lock);
-
-                set_bit(STRIPE_HANDLE, &sh->state);
+                if (handle_flags == 0 ||
+                    sh->state & handle_flags)
+                        set_bit(STRIPE_HANDLE, &sh->state);
                 release_stripe(sh);
         }
+        spin_lock_irq(&head_sh->stripe_lock);
+        head_sh->batch_head = NULL;
+        spin_unlock_irq(&head_sh->stripe_lock);
+        for (i = 0; i < head_sh->disks; i++)
+                if (test_and_clear_bit(R5_Overlap, &head_sh->dev[i].flags))
+                        do_wakeup = 1;
+        if (head_sh->state & handle_flags)
+                set_bit(STRIPE_HANDLE, &head_sh->state);
+
+        if (do_wakeup)
+                wake_up(&head_sh->raid_conf->wait_for_overlap);
 }
 
 static void handle_stripe(struct stripe_head *sh)
@@ -4258,7 +4282,8 @@ static void handle_stripe(struct stripe_head *sh)
                 return;
         }
 
-        check_break_stripe_batch_list(sh);
+        if (test_and_clear_bit(STRIPE_BATCH_ERR, &sh->state))
+                break_stripe_batch_list(sh, 0);
 
         if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state) && !sh->batch_head) {
                 spin_lock(&sh->stripe_lock);
@@ -4312,6 +4337,7 @@ static void handle_stripe(struct stripe_head *sh)
         if (s.failed > conf->max_degraded) {
                 sh->check_state = 0;
                 sh->reconstruct_state = 0;
+                break_stripe_batch_list(sh, 0);
                 if (s.to_read+s.to_write+s.written)
                         handle_failed_stripe(conf, sh, &s, disks, &s.return_bi);
                 if (s.syncing + s.replacing)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 7dc0dd86074b..896d603ad0da 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -337,9 +337,12 @@ enum {
         STRIPE_ON_RELEASE_LIST,
         STRIPE_BATCH_READY,
         STRIPE_BATCH_ERR,
+        STRIPE_BITMAP_PENDING,  /* Being added to bitmap, don't add
+                                 * to batch yet.
+                                 */
 };
 
-#define STRIPE_EXPAND_SYNC_FLAG \
+#define STRIPE_EXPAND_SYNC_FLAGS \
         ((1 << STRIPE_EXPAND_SOURCE) |\
         (1 << STRIPE_EXPAND_READY) |\
         (1 << STRIPE_EXPANDING) |\
diff --git a/drivers/mfd/da9052-core.c b/drivers/mfd/da9052-core.c
index ae498b53ee40..46e3840c7a37 100644
--- a/drivers/mfd/da9052-core.c
+++ b/drivers/mfd/da9052-core.c
@@ -433,6 +433,10 @@ EXPORT_SYMBOL_GPL(da9052_adc_read_temp);
 static const struct mfd_cell da9052_subdev_info[] = {
         {
                 .name = "da9052-regulator",
+                .id = 0,
+        },
+        {
+                .name = "da9052-regulator",
                 .id = 1,
         },
         {
@@ -484,10 +488,6 @@ static const struct mfd_cell da9052_subdev_info[] = {
                 .id = 13,
         },
         {
-                .name = "da9052-regulator",
-                .id = 14,
-        },
-        {
                 .name = "da9052-onkey",
         },
         {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index a6dcbf850c1f..6f9ffb9026cd 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2358,11 +2358,11 @@ static int be_evt_queues_create(struct be_adapter *adapter)
                                     adapter->cfg_num_qs);
 
         for_all_evt_queues(adapter, eqo, i) {
+                int numa_node = dev_to_node(&adapter->pdev->dev);
                 if (!zalloc_cpumask_var(&eqo->affinity_mask, GFP_KERNEL))
                         return -ENOMEM;
-                cpumask_set_cpu_local_first(i, dev_to_node(&adapter->pdev->dev),
-                                            eqo->affinity_mask);
-
+                cpumask_set_cpu(cpumask_local_spread(i, numa_node),
+                                eqo->affinity_mask);
                 netif_napi_add(adapter->netdev, &eqo->napi, be_poll,
                                BE_NAPI_WEIGHT);
                 napi_hash_add(&eqo->napi);
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index de7919322190..b9df0cbd0a38 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2084,12 +2084,8 @@ static void emac_ethtool_get_pauseparam(struct net_device *ndev,
 
 static int emac_get_regs_len(struct emac_instance *dev)
 {
-        if (emac_has_feature(dev, EMAC_FTR_EMAC4))
-                return sizeof(struct emac_ethtool_regs_subhdr) +
-                        EMAC4_ETHTOOL_REGS_SIZE(dev);
-        else
                 return sizeof(struct emac_ethtool_regs_subhdr) +
-                        EMAC_ETHTOOL_REGS_SIZE(dev);
+                        sizeof(struct emac_regs);
 }
 
 static int emac_ethtool_get_regs_len(struct net_device *ndev)
@@ -2114,15 +2110,15 @@ static void *emac_dump_regs(struct emac_instance *dev, void *buf)
         struct emac_ethtool_regs_subhdr *hdr = buf;
 
         hdr->index = dev->cell_index;
-        if (emac_has_feature(dev, EMAC_FTR_EMAC4)) {
+        if (emac_has_feature(dev, EMAC_FTR_EMAC4SYNC)) {
+                hdr->version = EMAC4SYNC_ETHTOOL_REGS_VER;
+        } else if (emac_has_feature(dev, EMAC_FTR_EMAC4)) {
                 hdr->version = EMAC4_ETHTOOL_REGS_VER;
-                memcpy_fromio(hdr + 1, dev->emacp, EMAC4_ETHTOOL_REGS_SIZE(dev));
-                return (void *)(hdr + 1) + EMAC4_ETHTOOL_REGS_SIZE(dev);
         } else {
                 hdr->version = EMAC_ETHTOOL_REGS_VER;
-                memcpy_fromio(hdr + 1, dev->emacp, EMAC_ETHTOOL_REGS_SIZE(dev));
-                return (void *)(hdr + 1) + EMAC_ETHTOOL_REGS_SIZE(dev);
         }
+        memcpy_fromio(hdr + 1, dev->emacp, sizeof(struct emac_regs));
+        return (void *)(hdr + 1) + sizeof(struct emac_regs);
 }
 
 static void emac_ethtool_get_regs(struct net_device *ndev,
diff --git a/drivers/net/ethernet/ibm/emac/core.h b/drivers/net/ethernet/ibm/emac/core.h
index 67f342a9f65e..28df37420da9 100644
--- a/drivers/net/ethernet/ibm/emac/core.h
+++ b/drivers/net/ethernet/ibm/emac/core.h
@@ -461,10 +461,7 @@ struct emac_ethtool_regs_subhdr {
 };
 
 #define EMAC_ETHTOOL_REGS_VER           0
-#define EMAC_ETHTOOL_REGS_SIZE(dev)     ((dev)->rsrc_regs.end - \
-                                         (dev)->rsrc_regs.start + 1)
-#define EMAC4_ETHTOOL_REGS_VER          1
-#define EMAC4_ETHTOOL_REGS_SIZE(dev)    ((dev)->rsrc_regs.end - \
-                                         (dev)->rsrc_regs.start + 1)
+#define EMAC4_ETHTOOL_REGS_VER          1
+#define EMAC4SYNC_ETHTOOL_REGS_VER      2
 
 #endif /* __IBM_NEWEMAC_CORE_H */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 4f7dc044601e..529ef0594b90 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -714,8 +714,13 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
                                          msecs_to_jiffies(timeout))) {
                 mlx4_warn(dev, "command 0x%x timed out (go bit not cleared)\n",
                           op);
-                err = -EIO;
-                goto out_reset;
+                if (op == MLX4_CMD_NOP) {
+                        err = -EBUSY;
+                        goto out;
+                } else {
+                        err = -EIO;
+                        goto out_reset;
+                }
         }
 
         err = context->result;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 32f5ec737472..cf467a9f6cc7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1501,17 +1501,13 @@ static int mlx4_en_init_affinity_hint(struct mlx4_en_priv *priv, int ring_idx)
 {
         struct mlx4_en_rx_ring *ring = priv->rx_ring[ring_idx];
         int numa_node = priv->mdev->dev->numa_node;
-        int ret = 0;
 
         if (!zalloc_cpumask_var(&ring->affinity_mask, GFP_KERNEL))
                 return -ENOMEM;
 
-        ret = cpumask_set_cpu_local_first(ring_idx, numa_node,
-                                          ring->affinity_mask);
-        if (ret)
-                free_cpumask_var(ring->affinity_mask);
-
-        return ret;
+        cpumask_set_cpu(cpumask_local_spread(ring_idx, numa_node),
+                        ring->affinity_mask);
+        return 0;
 }
 
 static void mlx4_en_free_affinity_hint(struct mlx4_en_priv *priv, int ring_idx)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f7bf312fb443..7bed3a88579f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -144,9 +144,9 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
         ring->queue_index = queue_index;
 
         if (queue_index < priv->num_tx_rings_p_up)
-                cpumask_set_cpu_local_first(queue_index,
-                                            priv->mdev->dev->numa_node,
-                                            &ring->affinity_mask);
+                cpumask_set_cpu(cpumask_local_spread(queue_index,
+                                                     priv->mdev->dev->numa_node),
+                                &ring->affinity_mask);
 
         *pring = ring;
         return 0;
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index e0c31e3947d1..6409a06bbdf6 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -3025,9 +3025,9 @@ netxen_sysfs_read_dimm(struct file *filp, struct kobject *kobj,
         u8 dw, rows, cols, banks, ranks;
         u32 val;
 
-        if (size != sizeof(struct netxen_dimm_cfg)) {
+        if (size < attr->size) {
                 netdev_err(netdev, "Invalid size\n");
-                return -1;
+                return -EINVAL;
         }
 
         memset(&dimm, 0, sizeof(struct netxen_dimm_cfg));
@@ -3137,7 +3137,7 @@ out:
 
 static struct bin_attribute bin_attr_dimm = {
         .attr = { .name = "dimm", .mode = (S_IRUGO | S_IWUSR) },
-        .size = 0,
+        .size = sizeof(struct netxen_dimm_cfg),
         .read = netxen_sysfs_read_dimm,
 };
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 2ac9552d1fa3..73bab983edd9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -117,6 +117,12 @@ struct stmmac_priv {
         int use_riwt;
         int irq_wake;
         spinlock_t ptp_lock;
+
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *dbgfs_dir;
+        struct dentry *dbgfs_rings_status;
+        struct dentry *dbgfs_dma_cap;
+#endif
 };
 
 int stmmac_mdio_unregister(struct net_device *ndev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 05c146f718a3..2c5ce2baca87 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -118,7 +118,7 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id);
 
 #ifdef CONFIG_DEBUG_FS
 static int stmmac_init_fs(struct net_device *dev);
-static void stmmac_exit_fs(void);
+static void stmmac_exit_fs(struct net_device *dev);
 #endif
 
 #define STMMAC_COAL_TIMER(x) (jiffies + usecs_to_jiffies(x))
@@ -1916,7 +1916,7 @@ static int stmmac_release(struct net_device *dev)
         netif_carrier_off(dev);
 
 #ifdef CONFIG_DEBUG_FS
-        stmmac_exit_fs();
+        stmmac_exit_fs(dev);
 #endif
 
         stmmac_release_ptp(priv);
@@ -2508,8 +2508,6 @@ static int stmmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 
 #ifdef CONFIG_DEBUG_FS
 static struct dentry *stmmac_fs_dir;
-static struct dentry *stmmac_rings_status;
-static struct dentry *stmmac_dma_cap;
 
 static void sysfs_display_ring(void *head, int size, int extend_desc,
                                struct seq_file *seq)
@@ -2648,36 +2646,39 @@ static const struct file_operations stmmac_dma_cap_fops = {
 
 static int stmmac_init_fs(struct net_device *dev)
 {
-        /* Create debugfs entries */
-        stmmac_fs_dir = debugfs_create_dir(STMMAC_RESOURCE_NAME, NULL);
+        struct stmmac_priv *priv = netdev_priv(dev);
+
+        /* Create per netdev entries */
+        priv->dbgfs_dir = debugfs_create_dir(dev->name, stmmac_fs_dir);
 
-        if (!stmmac_fs_dir || IS_ERR(stmmac_fs_dir)) {
-                pr_err("ERROR %s, debugfs create directory failed\n",
-                       STMMAC_RESOURCE_NAME);
+        if (!priv->dbgfs_dir || IS_ERR(priv->dbgfs_dir)) {
+                pr_err("ERROR %s/%s, debugfs create directory failed\n",
+                       STMMAC_RESOURCE_NAME, dev->name);
 
                 return -ENOMEM;
         }
 
         /* Entry to report DMA RX/TX rings */
-        stmmac_rings_status = debugfs_create_file("descriptors_status",
-                                                  S_IRUGO, stmmac_fs_dir, dev,
-                                                  &stmmac_rings_status_fops);
+        priv->dbgfs_rings_status =
+                debugfs_create_file("descriptors_status", S_IRUGO,
+                                    priv->dbgfs_dir, dev,
+                                    &stmmac_rings_status_fops);
 
-        if (!stmmac_rings_status || IS_ERR(stmmac_rings_status)) {
+        if (!priv->dbgfs_rings_status || IS_ERR(priv->dbgfs_rings_status)) {
                 pr_info("ERROR creating stmmac ring debugfs file\n");
-                debugfs_remove(stmmac_fs_dir);
+                debugfs_remove_recursive(priv->dbgfs_dir);
 
                 return -ENOMEM;
         }
 
         /* Entry to report the DMA HW features */
-        stmmac_dma_cap = debugfs_create_file("dma_cap", S_IRUGO, stmmac_fs_dir,
-                                             dev, &stmmac_dma_cap_fops);
+        priv->dbgfs_dma_cap = debugfs_create_file("dma_cap", S_IRUGO,
+                                            priv->dbgfs_dir,
+                                            dev, &stmmac_dma_cap_fops);
 
-        if (!stmmac_dma_cap || IS_ERR(stmmac_dma_cap)) {
+        if (!priv->dbgfs_dma_cap || IS_ERR(priv->dbgfs_dma_cap)) {
                 pr_info("ERROR creating stmmac MMC debugfs file\n");
-                debugfs_remove(stmmac_rings_status);
-                debugfs_remove(stmmac_fs_dir);
+                debugfs_remove_recursive(priv->dbgfs_dir);
 
                 return -ENOMEM;
         }
@@ -2685,11 +2686,11 @@ static int stmmac_init_fs(struct net_device *dev)
         return 0;
 }
 
-static void stmmac_exit_fs(void)
+static void stmmac_exit_fs(struct net_device *dev)
 {
-        debugfs_remove(stmmac_rings_status);
-        debugfs_remove(stmmac_dma_cap);
-        debugfs_remove(stmmac_fs_dir);
+        struct stmmac_priv *priv = netdev_priv(dev);
+
+        debugfs_remove_recursive(priv->dbgfs_dir);
 }
 #endif /* CONFIG_DEBUG_FS */
 
@@ -3149,6 +3150,35 @@ err:
 __setup("stmmaceth=", stmmac_cmdline_opt);
 #endif /* MODULE */
 
+static int __init stmmac_init(void)
+{
+#ifdef CONFIG_DEBUG_FS
+        /* Create debugfs main directory if it doesn't exist yet */
+        if (!stmmac_fs_dir) {
+                stmmac_fs_dir = debugfs_create_dir(STMMAC_RESOURCE_NAME, NULL);
+
+                if (!stmmac_fs_dir || IS_ERR(stmmac_fs_dir)) {
+                        pr_err("ERROR %s, debugfs create directory failed\n",
+                               STMMAC_RESOURCE_NAME);
+
+                        return -ENOMEM;
+                }
+        }
+#endif
+
+        return 0;
+}
+
+static void __exit stmmac_exit(void)
+{
+#ifdef CONFIG_DEBUG_FS
+        debugfs_remove_recursive(stmmac_fs_dir);
+#endif
+}
+
+module_init(stmmac_init)
+module_exit(stmmac_exit)
+
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet device driver");
 MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/amd-xgbe-phy.c b/drivers/net/phy/amd-xgbe-phy.c
index fb276f64cd64..34a75cba3b73 100644
--- a/drivers/net/phy/amd-xgbe-phy.c
+++ b/drivers/net/phy/amd-xgbe-phy.c
@@ -755,6 +755,45 @@ static int amd_xgbe_phy_set_mode(struct phy_device *phydev,
         return ret;
 }
 
+static bool amd_xgbe_phy_use_xgmii_mode(struct phy_device *phydev)
+{
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                if (phydev->advertising & ADVERTISED_10000baseKR_Full)
+                        return true;
+        } else {
+                if (phydev->speed == SPEED_10000)
+                        return true;
+        }
+
+        return false;
+}
+
+static bool amd_xgbe_phy_use_gmii_2500_mode(struct phy_device *phydev)
+{
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                if (phydev->advertising & ADVERTISED_2500baseX_Full)
+                        return true;
+        } else {
+                if (phydev->speed == SPEED_2500)
+                        return true;
+        }
+
+        return false;
+}
+
+static bool amd_xgbe_phy_use_gmii_mode(struct phy_device *phydev)
+{
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                if (phydev->advertising & ADVERTISED_1000baseKX_Full)
+                        return true;
+        } else {
+                if (phydev->speed == SPEED_1000)
+                        return true;
+        }
+
+        return false;
+}
+
 static int amd_xgbe_phy_set_an(struct phy_device *phydev, bool enable,
                                bool restart)
 {
@@ -1235,11 +1274,11 @@ static int amd_xgbe_phy_config_init(struct phy_device *phydev)
         /* Set initial mode - call the mode setting routines
          * directly to insure we are properly configured
          */
-        if (phydev->advertising & SUPPORTED_10000baseKR_Full)
+        if (amd_xgbe_phy_use_xgmii_mode(phydev))
                 ret = amd_xgbe_phy_xgmii_mode(phydev);
-        else if (phydev->advertising & SUPPORTED_1000baseKX_Full)
+        else if (amd_xgbe_phy_use_gmii_mode(phydev))
                 ret = amd_xgbe_phy_gmii_mode(phydev);
-        else if (phydev->advertising & SUPPORTED_2500baseX_Full)
+        else if (amd_xgbe_phy_use_gmii_2500_mode(phydev))
                 ret = amd_xgbe_phy_gmii_2500_mode(phydev);
         else
                 ret = -EINVAL;
diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
index 64c74c6a4828..b5dc59de094e 100644
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -404,7 +404,7 @@ static struct phy_driver bcm7xxx_driver[] = {
         .name           = "Broadcom BCM7425",
         .features       = PHY_GBIT_FEATURES |
                           SUPPORTED_Pause | SUPPORTED_Asym_Pause,
-        .flags          = 0,
+        .flags          = PHY_IS_INTERNAL,
         .config_init    = bcm7xxx_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 496e02f961d3..00cb41e71312 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -47,7 +47,7 @@
 #define PSF_TX          0x1000
 #define EXT_EVENT       1
 #define CAL_EVENT       7
-#define CAL_TRIGGER     7
+#define CAL_TRIGGER     1
 #define DP83640_N_PINS  12
 
 #define MII_DP83640_MICR 0x11
@@ -496,7 +496,9 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp,
                         else
                                 evnt |= EVNT_RISE;
                 }
+                mutex_lock(&clock->extreg_lock);
                 ext_write(0, phydev, PAGE5, PTP_EVNT, evnt);
+                mutex_unlock(&clock->extreg_lock);
                 return 0;
 
         case PTP_CLK_REQ_PEROUT:
@@ -532,6 +534,8 @@ static u8 status_frame_src[6] = { 0x08, 0x00, 0x17, 0x0B, 0x6B, 0x0F };
 
 static void enable_status_frames(struct phy_device *phydev, bool on)
 {
+        struct dp83640_private *dp83640 = phydev->priv;
+        struct dp83640_clock *clock = dp83640->clock;
         u16 cfg0 = 0, ver;
 
         if (on)
@@ -539,9 +543,13 @@ static void enable_status_frames(struct phy_device *phydev, bool on)
 
         ver = (PSF_PTPVER & VERSIONPTP_MASK) << VERSIONPTP_SHIFT;
 
+        mutex_lock(&clock->extreg_lock);
+
         ext_write(0, phydev, PAGE5, PSF_CFG0, cfg0);
         ext_write(0, phydev, PAGE6, PSF_CFG1, ver);
 
+        mutex_unlock(&clock->extreg_lock);
+
         if (!phydev->attached_dev) {
                 pr_warn("expected to find an attached netdevice\n");
                 return;
@@ -838,7 +846,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
         list_del_init(&rxts->list);
         phy2rxts(phy_rxts, rxts);
 
-        spin_lock_irqsave(&dp83640->rx_queue.lock, flags);
+        spin_lock(&dp83640->rx_queue.lock);
         skb_queue_walk(&dp83640->rx_queue, skb) {
                 struct dp83640_skb_info *skb_info;
 
@@ -853,7 +861,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
                         break;
                 }
         }
-        spin_unlock_irqrestore(&dp83640->rx_queue.lock, flags);
+        spin_unlock(&dp83640->rx_queue.lock);
 
         if (!shhwtstamps)
                 list_add_tail(&rxts->list, &dp83640->rxts);
@@ -1173,11 +1181,18 @@ static int dp83640_config_init(struct phy_device *phydev)
 
         if (clock->chosen && !list_empty(&clock->phylist))
                 recalibrate(clock);
-        else
+        else {
+                mutex_lock(&clock->extreg_lock);
                 enable_broadcast(phydev, clock->page, 1);
+                mutex_unlock(&clock->extreg_lock);
+        }
 
         enable_status_frames(phydev, true);
+
+        mutex_lock(&clock->extreg_lock);
         ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
+        mutex_unlock(&clock->extreg_lock);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index ab019b45551b..f89f446e5c8a 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -21,6 +21,7 @@ config IWLWIFI
                 Intel 7260 Wi-Fi Adapter
                 Intel 3160 Wi-Fi Adapter
                 Intel 7265 Wi-Fi Adapter
+                Intel 3165 Wi-Fi Adapter
 
 
           This driver uses the kernel's mac80211 subsystem.
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 36e786f0387b..74ad278116be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -70,15 +70,14 @@
 
 /* Highest firmware API version supported */
 #define IWL7260_UCODE_API_MAX   13
-#define IWL3160_UCODE_API_MAX   13
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    12
-#define IWL3160_UCODE_API_OK    12
+#define IWL3165_UCODE_API_OK    13
 
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   10
-#define IWL3160_UCODE_API_MIN   10
+#define IWL3165_UCODE_API_MIN   13
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
@@ -104,9 +103,6 @@
 #define IWL3160_FW_PRE "iwlwifi-3160-"
 #define IWL3160_MODULE_FIRMWARE(api) IWL3160_FW_PRE __stringify(api) ".ucode"
 
-#define IWL3165_FW_PRE "iwlwifi-3165-"
-#define IWL3165_MODULE_FIRMWARE(api) IWL3165_FW_PRE __stringify(api) ".ucode"
-
 #define IWL7265_FW_PRE "iwlwifi-7265-"
 #define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
 
@@ -248,8 +244,13 @@ static const struct iwl_ht_params iwl7265_ht_params = {
 
 const struct iwl_cfg iwl3165_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 3165",
-        .fw_name_pre = IWL3165_FW_PRE,
+        .fw_name_pre = IWL7265D_FW_PRE,
         IWL_DEVICE_7000,
+        /* sparse doens't like the re-assignment but it is safe */
+#ifndef __CHECKER__
+        .ucode_api_ok = IWL3165_UCODE_API_OK,
+        .ucode_api_min = IWL3165_UCODE_API_MIN,
+#endif
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
@@ -325,6 +326,5 @@ const struct iwl_cfg iwl7265d_n_cfg = {
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
-MODULE_FIRMWARE(IWL3165_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
 MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 41ff85de7334..21302b6f2bfd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,6 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -748,6 +750,9 @@ void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
                 return;
         }
 
+        if (data->sku_cap_mimo_disabled)
+                rx_chains = 1;
+
         ht_info->ht_supported = true;
         ht_info->cap = IEEE80211_HT_CAP_DSSSCCK40;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
index 5234a0bf11e4..750c8c9ee70d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,6 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -84,6 +86,7 @@ struct iwl_nvm_data {
         bool sku_cap_11ac_enable;
         bool sku_cap_amt_enable;
         bool sku_cap_ipan_enable;
+        bool sku_cap_mimo_disabled;
 
         u16 radio_cfg_type;
         u8 radio_cfg_step;
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 83903a5025c2..75e96db6626b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -116,10 +116,11 @@ enum family_8000_nvm_offsets {
 
 /* SKU Capabilities (actual values from NVM definition) */
 enum nvm_sku_bits {
-        NVM_SKU_CAP_BAND_24GHZ  = BIT(0),
-        NVM_SKU_CAP_BAND_52GHZ  = BIT(1),
-        NVM_SKU_CAP_11N_ENABLE  = BIT(2),
-        NVM_SKU_CAP_11AC_ENABLE = BIT(3),
+        NVM_SKU_CAP_BAND_24GHZ          = BIT(0),
+        NVM_SKU_CAP_BAND_52GHZ          = BIT(1),
+        NVM_SKU_CAP_11N_ENABLE          = BIT(2),
+        NVM_SKU_CAP_11AC_ENABLE         = BIT(3),
+        NVM_SKU_CAP_MIMO_DISABLE        = BIT(5),
 };
 
 /*
@@ -368,6 +369,11 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
         if (cfg->ht_params->ldpc)
                 vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
 
+        if (data->sku_cap_mimo_disabled) {
+                num_rx_ants = 1;
+                num_tx_ants = 1;
+        }
+
         if (num_tx_ants > 1)
                 vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
         else
@@ -527,6 +533,10 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
         const u8 *hw_addr;
 
         if (mac_override) {
+                static const u8 reserved_mac[] = {
+                        0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
+                };
+
                 hw_addr = (const u8 *)(mac_override +
                                  MAC_ADDRESS_OVERRIDE_FAMILY_8000);
 
@@ -538,7 +548,12 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
                 data->hw_addr[4] = hw_addr[5];
                 data->hw_addr[5] = hw_addr[4];
 
-                if (is_valid_ether_addr(data->hw_addr))
+                /*
+                 * Force the use of the OTP MAC address in case of reserved MAC
+                 * address in the NVM, or if address is given but invalid.
+                 */
+                if (is_valid_ether_addr(data->hw_addr) &&
+                    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
                         return;
 
                 IWL_ERR_DEV(dev,
@@ -610,6 +625,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                 data->sku_cap_11n_enable = false;
         data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
                                     (sku & NVM_SKU_CAP_11AC_ENABLE);
+        data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
 
         data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index d954591e0be5..6ac6de2af977 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -776,7 +776,7 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
         struct iwl_host_cmd cmd = {
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
-                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .dataflags = { IWL_HCMD_DFL_DUP, },
                 .flags = CMD_ASYNC,
         };
         struct iwl_mvm_sta *mvmsta;
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 1b1b2bf26819..4310cf102d78 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -1750,8 +1750,10 @@ static void iwl_mvm_query_netdetect_reasons(struct iwl_mvm *mvm,
         int i, j, n_matches, ret;
 
         fw_status = iwl_mvm_get_wakeup_status(mvm, vif);
-        if (!IS_ERR_OR_NULL(fw_status))
+        if (!IS_ERR_OR_NULL(fw_status)) {
                 reasons = le32_to_cpu(fw_status->wakeup_reasons);
+                kfree(fw_status);
+        }
 
         if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
                 wakeup.rfkill_release = true;
@@ -1868,15 +1870,15 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         /* get the BSS vif pointer again */
         vif = iwl_mvm_get_bss_vif(mvm);
         if (IS_ERR_OR_NULL(vif))
-                goto out_unlock;
+                goto err;
 
         ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test);
         if (ret)
-                goto out_unlock;
+                goto err;
 
         if (d3_status != IWL_D3_STATUS_ALIVE) {
                 IWL_INFO(mvm, "Device was reset during suspend\n");
-                goto out_unlock;
+                goto err;
         }
 
         /* query SRAM first in case we want event logging */
@@ -1902,7 +1904,8 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
                 goto out_iterate;
         }
 
- out_unlock:
+err:
+        iwl_mvm_free_nd(mvm);
         mutex_unlock(&mvm->mutex);
 
 out_iterate:
@@ -1915,6 +1918,14 @@ out:
         /* return 1 to reconfigure the device */
         set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
         set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
+
+        /* We always return 1, which causes mac80211 to do a reconfig
+         * with IEEE80211_RECONFIG_TYPE_RESTART.  This type of
+         * reconfig calls iwl_mvm_restart_complete(), where we unref
+         * the IWL_MVM_REF_UCODE_DOWN, so we need to take the
+         * reference here.
+         */
+        iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
         return 1;
 }
 
@@ -2021,7 +2032,6 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         __iwl_mvm_resume(mvm, true);
         rtnl_unlock();
         iwl_abort_notification_waits(&mvm->notif_wait);
-        iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
         ieee80211_restart_hw(mvm->hw);
 
         /* wait for restart and disconnect all interfaces */
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 40265b9c66ae..dda9f7b5f342 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -3995,9 +3995,6 @@ static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
         if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_MLME))
                 return;
 
-        if (event->u.mlme.status == MLME_SUCCESS)
-                return;
-
         trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_MLME);
         trig_mlme = (void *)trig->data;
         if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 1c66297d82c0..2ea01238754e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -1263,11 +1263,13 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
                 ieee80211_iterate_active_interfaces(
                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
                         iwl_mvm_d0i3_disconnect_iter, mvm);
-
-        iwl_free_resp(&get_status_cmd);
 out:
         iwl_mvm_d0i3_enable_tx(mvm, qos_seq);
 
+        /* qos_seq might point inside resp_pkt, so free it only now */
+        if (get_status_cmd.resp_pkt)
+                iwl_free_resp(&get_status_cmd);
+
         /* the FW might have updated the regdomain */
         iwl_mvm_update_changed_regdom(mvm);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index f9928f2c125f..33cd68ae7bf9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -180,6 +180,9 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         if (iwl_mvm_vif_low_latency(mvmvif) && mvmsta->vif->p2p)
                 return false;
 
+        if (mvm->nvm_data->sku_cap_mimo_disabled)
+                return false;
+
         return true;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 47bbf573fdc8..d6f6515fe663 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1049,9 +1049,11 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
                 iwl_pcie_rx_stop(trans);
 
                 /* Power-down device's busmaster DMA clocks */
-                iwl_write_prph(trans, APMG_CLK_DIS_REG,
-                               APMG_CLK_VAL_DMA_CLK_RQT);
-                udelay(5);
+                if (trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) {
+                        iwl_write_prph(trans, APMG_CLK_DIS_REG,
+                                       APMG_CLK_VAL_DMA_CLK_RQT);
+                        udelay(5);
+                }
         }
 
         /* Make sure (redundant) we've released our request to stay awake */
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 3d8dbf5f2d39..fee02414529e 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -793,6 +793,7 @@ static void connect(struct backend_info *be)
                         goto err;
                 }
 
+                queue->credit_bytes = credit_bytes;
                 queue->remaining_credit = credit_bytes;
                 queue->credit_usec = credit_usec;
 
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 3f45afd4382e..e031c943286e 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info *info)
 
                 if (netif_running(info->netdev))
                         napi_disable(&queue->napi);
+                del_timer_sync(&queue->rx_refill_timer);
                 netif_napi_del(&queue->napi);
         }
 
@@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = {
 static int xennet_remove(struct xenbus_device *dev)
 {
         struct netfront_info *info = dev_get_drvdata(&dev->dev);
-        unsigned int num_queues = info->netdev->real_num_tx_queues;
-        struct netfront_queue *queue = NULL;
-        unsigned int i = 0;
 
         dev_dbg(&dev->dev, "%s\n", dev->nodename);
 
@@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev)
 
         unregister_netdev(info->netdev);
 
-        for (i = 0; i < num_queues; ++i) {
-                queue = &info->queues[i];
-                del_timer_sync(&queue->rx_refill_timer);
-        }
-
-        if (num_queues) {
-                kfree(info->queues);
-                info->queues = NULL;
-        }
-
+        xennet_destroy_queues(info);
         xennet_free_netdev(info->netdev);
 
         return 0;
diff --git a/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c b/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
index 4ad5c1a996e3..e406e3d8c1c7 100644
--- a/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
@@ -643,7 +643,9 @@ static const struct cygnus_gpio_pin_range cygnus_gpio_pintable[] = {
         CYGNUS_PINRANGE(87, 104, 12),
         CYGNUS_PINRANGE(99, 102, 2),
         CYGNUS_PINRANGE(101, 90, 4),
-        CYGNUS_PINRANGE(105, 116, 10),
+        CYGNUS_PINRANGE(105, 116, 6),
+        CYGNUS_PINRANGE(111, 100, 2),
+        CYGNUS_PINRANGE(113, 122, 4),
         CYGNUS_PINRANGE(123, 11, 1),
         CYGNUS_PINRANGE(124, 38, 4),
         CYGNUS_PINRANGE(128, 43, 1),
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 82f691eeeec4..732ff757a95f 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1292,6 +1292,49 @@ static void chv_gpio_irq_unmask(struct irq_data *d)
         chv_gpio_irq_mask_unmask(d, false);
 }
 
+static unsigned chv_gpio_irq_startup(struct irq_data *d)
+{
+        /*
+         * Check if the interrupt has been requested with 0 as triggering
+         * type. In that case it is assumed that the current values
+         * programmed to the hardware are used (e.g BIOS configured
+         * defaults).
+         *
+         * In that case ->irq_set_type() will never be called so we need to
+         * read back the values from hardware now, set correct flow handler
+         * and update mappings before the interrupt is being used.
+         */
+        if (irqd_get_trigger_type(d) == IRQ_TYPE_NONE) {
+                struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+                struct chv_pinctrl *pctrl = gpiochip_to_pinctrl(gc);
+                unsigned offset = irqd_to_hwirq(d);
+                int pin = chv_gpio_offset_to_pin(pctrl, offset);
+                irq_flow_handler_t handler;
+                unsigned long flags;
+                u32 intsel, value;
+
+                intsel = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
+                intsel &= CHV_PADCTRL0_INTSEL_MASK;
+                intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
+
+                value = readl(chv_padreg(pctrl, pin, CHV_PADCTRL1));
+                if (value & CHV_PADCTRL1_INTWAKECFG_LEVEL)
+                        handler = handle_level_irq;
+                else
+                        handler = handle_edge_irq;
+
+                spin_lock_irqsave(&pctrl->lock, flags);
+                if (!pctrl->intr_lines[intsel]) {
+                        __irq_set_handler_locked(d->irq, handler);
+                        pctrl->intr_lines[intsel] = offset;
+                }
+                spin_unlock_irqrestore(&pctrl->lock, flags);
+        }
+
+        chv_gpio_irq_unmask(d);
+        return 0;
+}
+
 static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
 {
         struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1357,6 +1400,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
 
 static struct irq_chip chv_gpio_irqchip = {
         .name = "chv-gpio",
+        .irq_startup = chv_gpio_irq_startup,
         .irq_ack = chv_gpio_irq_ack,
         .irq_mask = chv_gpio_irq_mask,
         .irq_unmask = chv_gpio_irq_unmask,
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index edcd140e0899..a70a5fe79d44 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -569,7 +569,7 @@ static int meson_gpiolib_register(struct meson_pinctrl *pc)
                 domain->chip.direction_output = meson_gpio_direction_output;
                 domain->chip.get = meson_gpio_get;
                 domain->chip.set = meson_gpio_set;
-                domain->chip.base = -1;
+                domain->chip.base = domain->data->pin_base;
                 domain->chip.ngpio = domain->data->num_pins;
                 domain->chip.can_sleep = false;
                 domain->chip.of_node = domain->of_node;
diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index 2f7ea6229880..9677807db364 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -876,13 +876,13 @@ static struct meson_domain_data meson8b_domain_data[] = {
                 .banks          = meson8b_banks,
                 .num_banks      = ARRAY_SIZE(meson8b_banks),
                 .pin_base       = 0,
-                .num_pins       = 83,
+                .num_pins       = 130,
         },
         {
                 .name           = "ao-bank",
                 .banks          = meson8b_ao_banks,
                 .num_banks      = ARRAY_SIZE(meson8b_ao_banks),
-                .pin_base       = 83,
+                .pin_base       = 130,
                 .num_pins       = 16,
         },
 };
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 9bb9ad6d4a1b..28f328136f0d 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -2897,7 +2897,7 @@ static ssize_t hotkey_wakeup_reason_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%d\n", hotkey_wakeup_reason);
 }
 
-static DEVICE_ATTR_RO(hotkey_wakeup_reason);
+static DEVICE_ATTR(wakeup_reason, S_IRUGO, hotkey_wakeup_reason_show, NULL);
 
 static void hotkey_wakeup_reason_notify_change(void)
 {
@@ -2913,7 +2913,8 @@ static ssize_t hotkey_wakeup_hotunplug_complete_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%d\n", hotkey_autosleep_ack);
 }
 
-static DEVICE_ATTR_RO(hotkey_wakeup_hotunplug_complete);
+static DEVICE_ATTR(wakeup_hotunplug_complete, S_IRUGO,
+                   hotkey_wakeup_hotunplug_complete_show, NULL);
 
 static void hotkey_wakeup_hotunplug_complete_notify_change(void)
 {
@@ -2978,8 +2979,8 @@ static struct attribute *hotkey_attributes[] __initdata = {
         &dev_attr_hotkey_enable.attr,
         &dev_attr_hotkey_bios_enabled.attr,
         &dev_attr_hotkey_bios_mask.attr,
-        &dev_attr_hotkey_wakeup_reason.attr,
-        &dev_attr_hotkey_wakeup_hotunplug_complete.attr,
+        &dev_attr_wakeup_reason.attr,
+        &dev_attr_wakeup_hotunplug_complete.attr,
         &dev_attr_hotkey_mask.attr,
         &dev_attr_hotkey_all_mask.attr,
         &dev_attr_hotkey_recommended_mask.attr,
@@ -4393,12 +4394,13 @@ static ssize_t wan_enable_store(struct device *dev,
                         attr, buf, count);
 }
 
-static DEVICE_ATTR_RW(wan_enable);
+static DEVICE_ATTR(wwan_enable, S_IWUSR | S_IRUGO,
+                   wan_enable_show, wan_enable_store);
 
 /* --------------------------------------------------------------------- */
 
 static struct attribute *wan_attributes[] = {
-        &dev_attr_wan_enable.attr,
+        &dev_attr_wwan_enable.attr,
         NULL
 };
 
@@ -8138,7 +8140,8 @@ static ssize_t fan_pwm1_enable_store(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR_RW(fan_pwm1_enable);
+static DEVICE_ATTR(pwm1_enable, S_IWUSR | S_IRUGO,
+                   fan_pwm1_enable_show, fan_pwm1_enable_store);
 
 /* sysfs fan pwm1 ------------------------------------------------------ */
 static ssize_t fan_pwm1_show(struct device *dev,
@@ -8198,7 +8201,7 @@ static ssize_t fan_pwm1_store(struct device *dev,
         return (rc) ? rc : count;
 }
 
-static DEVICE_ATTR_RW(fan_pwm1);
+static DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, fan_pwm1_show, fan_pwm1_store);
 
 /* sysfs fan fan1_input ------------------------------------------------ */
 static ssize_t fan_fan1_input_show(struct device *dev,
@@ -8215,7 +8218,7 @@ static ssize_t fan_fan1_input_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%u\n", speed);
 }
 
-static DEVICE_ATTR_RO(fan_fan1_input);
+static DEVICE_ATTR(fan1_input, S_IRUGO, fan_fan1_input_show, NULL);
 
 /* sysfs fan fan2_input ------------------------------------------------ */
 static ssize_t fan_fan2_input_show(struct device *dev,
@@ -8232,7 +8235,7 @@ static ssize_t fan_fan2_input_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%u\n", speed);
 }
 
-static DEVICE_ATTR_RO(fan_fan2_input);
+static DEVICE_ATTR(fan2_input, S_IRUGO, fan_fan2_input_show, NULL);
 
 /* sysfs fan fan_watchdog (hwmon driver) ------------------------------- */
 static ssize_t fan_fan_watchdog_show(struct device_driver *drv,
@@ -8265,8 +8268,8 @@ static DRIVER_ATTR(fan_watchdog, S_IWUSR | S_IRUGO,
 
 /* --------------------------------------------------------------------- */
 static struct attribute *fan_attributes[] = {
-        &dev_attr_fan_pwm1_enable.attr, &dev_attr_fan_pwm1.attr,
-        &dev_attr_fan_fan1_input.attr,
+        &dev_attr_pwm1_enable.attr, &dev_attr_pwm1.attr,
+        &dev_attr_fan1_input.attr,
         NULL, /* for fan2_input */
         NULL
 };
@@ -8400,7 +8403,7 @@ static int __init fan_init(struct ibm_init_struct *iibm)
                 if (tp_features.second_fan) {
                         /* attach second fan tachometer */
                         fan_attributes[ARRAY_SIZE(fan_attributes)-2] =
-                                        &dev_attr_fan_fan2_input.attr;
+                                        &dev_attr_fan2_input.attr;
                 }
                 rc = sysfs_create_group(&tpacpi_sensors_pdev->dev.kobj,
                                          &fan_attr_group);
@@ -8848,7 +8851,7 @@ static ssize_t thinkpad_acpi_pdev_name_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%s\n", TPACPI_NAME);
 }
 
-static DEVICE_ATTR_RO(thinkpad_acpi_pdev_name);
+static DEVICE_ATTR(name, S_IRUGO, thinkpad_acpi_pdev_name_show, NULL);
 
 /* --------------------------------------------------------------------- */
 
@@ -9390,8 +9393,7 @@ static void thinkpad_acpi_module_exit(void)
                 hwmon_device_unregister(tpacpi_hwmon);
 
         if (tp_features.sensors_pdev_attrs_registered)
-                device_remove_file(&tpacpi_sensors_pdev->dev,
-                                   &dev_attr_thinkpad_acpi_pdev_name);
+                device_remove_file(&tpacpi_sensors_pdev->dev, &dev_attr_name);
         if (tpacpi_sensors_pdev)
                 platform_device_unregister(tpacpi_sensors_pdev);
         if (tpacpi_pdev)
@@ -9512,8 +9514,7 @@ static int __init thinkpad_acpi_module_init(void)
                 thinkpad_acpi_module_exit();
                 return ret;
         }
-        ret = device_create_file(&tpacpi_sensors_pdev->dev,
-                                 &dev_attr_thinkpad_acpi_pdev_name);
+        ret = device_create_file(&tpacpi_sensors_pdev->dev, &dev_attr_name);
         if (ret) {
                 pr_err("unable to create sysfs hwmon device attributes\n");
                 thinkpad_acpi_module_exit();
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 8a4df7a1f2ee..e628d4c2f2ae 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -394,6 +394,7 @@ static inline struct da9052_regulator_info *find_regulator_info(u8 chip_id,
 
 static int da9052_regulator_probe(struct platform_device *pdev)
 {
+        const struct mfd_cell *cell = mfd_get_cell(pdev);
         struct regulator_config config = { };
         struct da9052_regulator *regulator;
         struct da9052 *da9052;
@@ -409,7 +410,7 @@ static int da9052_regulator_probe(struct platform_device *pdev)
         regulator->da9052 = da9052;
 
         regulator->info = find_regulator_info(regulator->da9052->chip_id,
-                                              pdev->id);
+                                              cell->id);
         if (regulator->info == NULL) {
                 dev_err(&pdev->dev, "invalid regulator ID specified\n");
                 return -EINVAL;
@@ -419,7 +420,7 @@ static int da9052_regulator_probe(struct platform_device *pdev)
         config.driver_data = regulator;
         config.regmap = da9052->regmap;
         if (pdata && pdata->regulators) {
-                config.init_data = pdata->regulators[pdev->id];
+                config.init_data = pdata->regulators[cell->id];
         } else {
 #ifdef CONFIG_OF
                 struct device_node *nproot = da9052->dev->of_node;
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 15a7ee3859dd..5fe1c22e289b 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -359,12 +359,13 @@ static void ssb_pcicore_init_hostmode(struct ssb_pcicore *pc)
 
         /*
          * Accessing PCI config without a proper delay after devices reset (not
-         * GPIO reset) was causing reboots on WRT300N v1.0.
+         * GPIO reset) was causing reboots on WRT300N v1.0 (BCM4704).
          * Tested delay 850 us lowered reboot chance to 50-80%, 1000 us fixed it
          * completely. Flushing all writes was also tested but with no luck.
+         * The same problem was reported for WRT350N v1 (BCM4705), so we just
+         * sleep here unconditionally.
          */
-        if (pc->dev->bus->chip_id == 0x4704)
-                usleep_range(1000, 2000);
+        usleep_range(1000, 2000);
 
         /* Enable PCI bridge BAR0 prefetch and burst */
         val = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 3a145a643e0d..6897f1c1bc73 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -274,6 +274,10 @@ static int pwm_backlight_probe(struct platform_device *pdev)
 
         pb->pwm = devm_pwm_get(&pdev->dev, NULL);
         if (IS_ERR(pb->pwm)) {
+                ret = PTR_ERR(pb->pwm);
+                if (ret == -EPROBE_DEFER)
+                        goto err_alloc;
+
                 dev_err(&pdev->dev, "unable to request PWM, trying legacy API\n");
                 pb->legacy = true;
                 pb->pwm = pwm_request(data->pwm_id, "pwm-backlight");
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 241ef68d2893..cd46e4158830 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -918,7 +918,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                         total_size = total_mapping_size(elf_phdata,
                                                         loc->elf_ex.e_phnum);
                         if (!total_size) {
-                                error = -EINVAL;
+                                retval = -EINVAL;
                                 goto out_free_dentry;
                         }
                 }
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 430e0348c99e..7dc886c9a78f 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -24,6 +24,7 @@
 #include "cifsfs.h"
 #include "dns_resolve.h"
 #include "cifs_debug.h"
+#include "cifs_unicode.h"
 
 static LIST_HEAD(cifs_dfs_automount_list);
 
@@ -312,7 +313,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         xid = get_xid();
         rc = get_dfs_path(xid, ses, full_path + 1, cifs_sb->local_nls,
                 &num_referrals, &referrals,
-                cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+                cifs_remap(cifs_sb));
         free_xid(xid);
 
         cifs_put_tlink(tlink);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 0303c6793d90..5a53ac6b1e02 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -27,41 +27,6 @@
 #include "cifsglob.h"
 #include "cifs_debug.h"
 
-/*
- * cifs_utf16_bytes - how long will a string be after conversion?
- * @utf16 - pointer to input string
- * @maxbytes - don't go past this many bytes of input string
- * @codepage - destination codepage
- *
- * Walk a utf16le string and return the number of bytes that the string will
- * be after being converted to the given charset, not including any null
- * termination required. Don't walk past maxbytes in the source buffer.
- */
-int
-cifs_utf16_bytes(const __le16 *from, int maxbytes,
-                const struct nls_table *codepage)
-{
-        int i;
-        int charlen, outlen = 0;
-        int maxwords = maxbytes / 2;
-        char tmp[NLS_MAX_CHARSET_SIZE];
-        __u16 ftmp;
-
-        for (i = 0; i < maxwords; i++) {
-                ftmp = get_unaligned_le16(&from[i]);
-                if (ftmp == 0)
-                        break;
-
-                charlen = codepage->uni2char(ftmp, tmp, NLS_MAX_CHARSET_SIZE);
-                if (charlen > 0)
-                        outlen += charlen;
-                else
-                        outlen++;
-        }
-
-        return outlen;
-}
-
 int cifs_remap(struct cifs_sb_info *cifs_sb)
 {
         int map_type;
@@ -155,10 +120,13 @@ convert_sfm_char(const __u16 src_char, char *target)
  * enough to hold the result of the conversion (at least NLS_MAX_CHARSET_SIZE).
  */
 static int
-cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
+cifs_mapchar(char *target, const __u16 *from, const struct nls_table *cp,
              int maptype)
 {
         int len = 1;
+        __u16 src_char;
+
+        src_char = *from;
 
         if ((maptype == SFM_MAP_UNI_RSVD) && convert_sfm_char(src_char, target))
                 return len;
@@ -168,10 +136,23 @@ cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
 
         /* if character not one of seven in special remap set */
         len = cp->uni2char(src_char, target, NLS_MAX_CHARSET_SIZE);
-        if (len <= 0) {
-                *target = '?';
-                len = 1;
-        }
+        if (len <= 0)
+                goto surrogate_pair;
+
+        return len;
+
+surrogate_pair:
+        /* convert SURROGATE_PAIR and IVS */
+        if (strcmp(cp->charset, "utf8"))
+                goto unknown;
+        len = utf16s_to_utf8s(from, 3, UTF16_LITTLE_ENDIAN, target, 6);
+        if (len <= 0)
+                goto unknown;
+        return len;
+
+unknown:
+        *target = '?';
+        len = 1;
         return len;
 }
 
@@ -206,7 +187,7 @@ cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
         int nullsize = nls_nullsize(codepage);
         int fromwords = fromlen / 2;
         char tmp[NLS_MAX_CHARSET_SIZE];
-        __u16 ftmp;
+        __u16 ftmp[3];          /* ftmp[3] = 3array x 2bytes = 6bytes UTF-16 */
 
         /*
          * because the chars can be of varying widths, we need to take care
@@ -217,9 +198,17 @@ cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
         safelen = tolen - (NLS_MAX_CHARSET_SIZE + nullsize);
 
         for (i = 0; i < fromwords; i++) {
-                ftmp = get_unaligned_le16(&from[i]);
-                if (ftmp == 0)
+                ftmp[0] = get_unaligned_le16(&from[i]);
+                if (ftmp[0] == 0)
                         break;
+                if (i + 1 < fromwords)
+                        ftmp[1] = get_unaligned_le16(&from[i + 1]);
+                else
+                        ftmp[1] = 0;
+                if (i + 2 < fromwords)
+                        ftmp[2] = get_unaligned_le16(&from[i + 2]);
+                else
+                        ftmp[2] = 0;
 
                 /*
                  * check to see if converting this character might make the
@@ -234,6 +223,17 @@ cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
                 /* put converted char into 'to' buffer */
                 charlen = cifs_mapchar(&to[outlen], ftmp, codepage, map_type);
                 outlen += charlen;
+
+                /* charlen (=bytes of UTF-8 for 1 character)
+                 * 4bytes UTF-8(surrogate pair) is charlen=4
+                 *   (4bytes UTF-16 code)
+                 * 7-8bytes UTF-8(IVS) is charlen=3+4 or 4+4
+                 *   (2 UTF-8 pairs divided to 2 UTF-16 pairs) */
+                if (charlen == 4)
+                        i++;
+                else if (charlen >= 5)
+                        /* 5-6bytes UTF-8 */
+                        i += 2;
         }
 
         /* properly null-terminate string */
@@ -296,6 +296,46 @@ success:
 }
 
 /*
+ * cifs_utf16_bytes - how long will a string be after conversion?
+ * @utf16 - pointer to input string
+ * @maxbytes - don't go past this many bytes of input string
+ * @codepage - destination codepage
+ *
+ * Walk a utf16le string and return the number of bytes that the string will
+ * be after being converted to the given charset, not including any null
+ * termination required. Don't walk past maxbytes in the source buffer.
+ */
+int
+cifs_utf16_bytes(const __le16 *from, int maxbytes,
+                const struct nls_table *codepage)
+{
+        int i;
+        int charlen, outlen = 0;
+        int maxwords = maxbytes / 2;
+        char tmp[NLS_MAX_CHARSET_SIZE];
+        __u16 ftmp[3];
+
+        for (i = 0; i < maxwords; i++) {
+                ftmp[0] = get_unaligned_le16(&from[i]);
+                if (ftmp[0] == 0)
+                        break;
+                if (i + 1 < maxwords)
+                        ftmp[1] = get_unaligned_le16(&from[i + 1]);
+                else
+                        ftmp[1] = 0;
+                if (i + 2 < maxwords)
+                        ftmp[2] = get_unaligned_le16(&from[i + 2]);
+                else
+                        ftmp[2] = 0;
+
+                charlen = cifs_mapchar(tmp, ftmp, codepage, NO_MAP_UNI_RSVD);
+                outlen += charlen;
+        }
+
+        return outlen;
+}
+
+/*
  * cifs_strndup_from_utf16 - copy a string from wire format to the local
  * codepage
  * @src - source string
@@ -409,10 +449,15 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         char src_char;
         __le16 dst_char;
         wchar_t tmp;
+        wchar_t *wchar_to;      /* UTF-16 */
+        int ret;
+        unicode_t u;
 
         if (map_chars == NO_MAP_UNI_RSVD)
                 return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
+        wchar_to = kzalloc(6, GFP_KERNEL);
+
         for (i = 0; i < srclen; j++) {
                 src_char = source[i];
                 charlen = 1;
@@ -441,11 +486,55 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                          * if no match, use question mark, which at least in
                          * some cases serves as wild card
                          */
-                        if (charlen < 1) {
-                                dst_char = cpu_to_le16(0x003f);
-                                charlen = 1;
+                        if (charlen > 0)
+                                goto ctoUTF16;
+
+                        /* convert SURROGATE_PAIR */
+                        if (strcmp(cp->charset, "utf8") || !wchar_to)
+                                goto unknown;
+                        if (*(source + i) & 0x80) {
+                                charlen = utf8_to_utf32(source + i, 6, &u);
+                                if (charlen < 0)
+                                        goto unknown;
+                        } else
+                                goto unknown;
+                        ret  = utf8s_to_utf16s(source + i, charlen,
+                                               UTF16_LITTLE_ENDIAN,
+                                               wchar_to, 6);
+                        if (ret < 0)
+                                goto unknown;
+
+                        i += charlen;
+                        dst_char = cpu_to_le16(*wchar_to);
+                        if (charlen <= 3)
+                                /* 1-3bytes UTF-8 to 2bytes UTF-16 */
+                                put_unaligned(dst_char, &target[j]);
+                        else if (charlen == 4) {
+                                /* 4bytes UTF-8(surrogate pair) to 4bytes UTF-16
+                                 * 7-8bytes UTF-8(IVS) divided to 2 UTF-16
+                                 *   (charlen=3+4 or 4+4) */
+                                put_unaligned(dst_char, &target[j]);
+                                dst_char = cpu_to_le16(*(wchar_to + 1));
+                                j++;
+                                put_unaligned(dst_char, &target[j]);
+                        } else if (charlen >= 5) {
+                                /* 5-6bytes UTF-8 to 6bytes UTF-16 */
+                                put_unaligned(dst_char, &target[j]);
+                                dst_char = cpu_to_le16(*(wchar_to + 1));
+                                j++;
+                                put_unaligned(dst_char, &target[j]);
+                                dst_char = cpu_to_le16(*(wchar_to + 2));
+                                j++;
+                                put_unaligned(dst_char, &target[j]);
                         }
+                        continue;
+
+unknown:
+                        dst_char = cpu_to_le16(0x003f);
+                        charlen = 1;
                 }
+
+ctoUTF16:
                 /*
                  * character may take more than one byte in the source string,
                  * but will take exactly two bytes in the target string
@@ -456,6 +545,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
 
 ctoUTF16_out:
         put_unaligned(0, &target[j]); /* Null terminate target unicode string */
+        kfree(wchar_to);
         return j;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f5089bde3635..0a9fb6b53126 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -469,6 +469,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                 seq_puts(s, ",nouser_xattr");
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR)
                 seq_puts(s, ",mapchars");
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SFM_CHR)
+                seq_puts(s, ",mapposix");
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)
                 seq_puts(s, ",sfu");
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_BRL)
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index c31ce98c1704..c63fd1dde25b 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -361,11 +361,11 @@ extern int CIFSUnixCreateHardLink(const unsigned int xid,
 extern int CIFSUnixCreateSymLink(const unsigned int xid,
                         struct cifs_tcon *tcon,
                         const char *fromName, const char *toName,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 extern int CIFSSMBUnixQuerySymLink(const unsigned int xid,
                         struct cifs_tcon *tcon,
                         const unsigned char *searchName, char **syminfo,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 extern int CIFSSMBQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
                                __u16 fid, char **symlinkinfo,
                                const struct nls_table *nls_codepage);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 84650a51c7c4..f26ffbfc64d8 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -2784,7 +2784,7 @@ copyRetry:
 int
 CIFSUnixCreateSymLink(const unsigned int xid, struct cifs_tcon *tcon,
                       const char *fromName, const char *toName,
-                      const struct nls_table *nls_codepage)
+                      const struct nls_table *nls_codepage, int remap)
 {
         TRANSACTION2_SPI_REQ *pSMB = NULL;
         TRANSACTION2_SPI_RSP *pSMBr = NULL;
@@ -2804,9 +2804,9 @@ createSymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUTF16((__le16 *) pSMB->FileName, fromName,
-                                    /* find define for this maxpathcomponent */
-                                    PATH_MAX, nls_codepage);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fromName,
+                                /* find define for this maxpathcomponent */
+                                        PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -2828,9 +2828,9 @@ createSymLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifs_strtoUTF16((__le16 *) data_offset, toName, PATH_MAX
-                                    /* find define for this maxpathcomponent */
-                                    , nls_codepage);
+                    cifsConvertToUTF16((__le16 *) data_offset, toName,
+                                /* find define for this maxpathcomponent */
+                                        PATH_MAX, nls_codepage, remap);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3034,7 +3034,7 @@ winCreateHardLinkRetry:
 int
 CIFSSMBUnixQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
                         const unsigned char *searchName, char **symlinkinfo,
-                        const struct nls_table *nls_codepage)
+                        const struct nls_table *nls_codepage, int remap)
 {
 /* SMB_QUERY_FILE_UNIX_LINK */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -3055,8 +3055,9 @@ querySymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifs_strtoUTF16((__le16 *) pSMB->FileName, searchName,
-                                        PATH_MAX, nls_codepage);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4917,7 +4918,7 @@ getDFSRetry:
                 strncpy(pSMB->RequestFileName, search_name, name_len);
         }
 
-        if (ses->server && ses->server->sign)
+        if (ses->server->sign)
                 pSMB->hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 
         pSMB->hdr.Uid = ses->Suid;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f3bfe08e177b..8383d5ea4202 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -386,6 +386,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
                 rc = generic_ip_connect(server);
                 if (rc) {
                         cifs_dbg(FYI, "reconnect error %d\n", rc);
+                        mutex_unlock(&server->srv_mutex);
                         msleep(3000);
                 } else {
                         atomic_inc(&tcpSesReconnectCount);
@@ -393,8 +394,8 @@ cifs_reconnect(struct TCP_Server_Info *server)
                         if (server->tcpStatus != CifsExiting)
                                 server->tcpStatus = CifsNeedNegotiate;
                         spin_unlock(&GlobalMid_Lock);
+                        mutex_unlock(&server->srv_mutex);
                 }
-                mutex_unlock(&server->srv_mutex);
         } while (server->tcpStatus == CifsNeedReconnect);
 
         return rc;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 338d56936f6a..c3eb998a99bd 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -620,8 +620,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
                 }
                 rc = CIFSSMBUnixSetPathInfo(xid, tcon, full_path, &args,
                                             cifs_sb->local_nls,
-                                            cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+                                            cifs_remap(cifs_sb));
                 if (rc)
                         goto mknod_out;
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index cafbf10521d5..3f50cee79df9 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -140,8 +140,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         posix_flags = cifs_posix_convert_flags(f_flags);
         rc = CIFSPOSIXCreate(xid, tcon, posix_flags, mode, pnetfid, presp_data,
                              poplock, full_path, cifs_sb->local_nls,
-                             cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                             cifs_remap(cifs_sb));
         cifs_put_tlink(tlink);
 
         if (rc)
@@ -1553,8 +1552,8 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
                 rc = server->ops->mand_unlock_range(cfile, flock, xid);
 
 out:
-        if (flock->fl_flags & FL_POSIX)
-                posix_lock_file_wait(file, flock);
+        if (flock->fl_flags & FL_POSIX && !rc)
+                rc = posix_lock_file_wait(file, flock);
         return rc;
 }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 55b58112d122..f621b44cb800 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -373,8 +373,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* could have done a find first instead but this returns more info */
         rc = CIFSSMBUnixQPathInfo(xid, tcon, full_path, &find_data,
-                                  cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                                  cifs_sb->local_nls, cifs_remap(cifs_sb));
         cifs_put_tlink(tlink);
 
         if (!rc) {
@@ -402,9 +401,25 @@ int cifs_get_inode_info_unix(struct inode **pinode,
                         rc = -ENOMEM;
         } else {
                 /* we already have inode, update it */
+
+                /* if uniqueid is different, return error */
+                if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
+                    CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) {
+                        rc = -ESTALE;
+                        goto cgiiu_exit;
+                }
+
+                /* if filetype is different, return error */
+                if (unlikely(((*pinode)->i_mode & S_IFMT) !=
+                    (fattr.cf_mode & S_IFMT))) {
+                        rc = -ESTALE;
+                        goto cgiiu_exit;
+                }
+
                 cifs_fattr_to_inode(*pinode, &fattr);
         }
 
+cgiiu_exit:
         return rc;
 }
 
@@ -839,6 +854,15 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
                 if (!*inode)
                         rc = -ENOMEM;
         } else {
+                /* we already have inode, update it */
+
+                /* if filetype is different, return error */
+                if (unlikely(((*inode)->i_mode & S_IFMT) !=
+                    (fattr.cf_mode & S_IFMT))) {
+                        rc = -ESTALE;
+                        goto cgii_exit;
+                }
+
                 cifs_fattr_to_inode(*inode, &fattr);
         }
 
@@ -2215,8 +2239,7 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                 pTcon = tlink_tcon(tlink);
                 rc = CIFSSMBUnixSetPathInfo(xid, pTcon, full_path, args,
                                     cifs_sb->local_nls,
-                                    cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                                    cifs_remap(cifs_sb));
                 cifs_put_tlink(tlink);
         }
 
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 252e672d5604..e6c707cc62b3 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -717,7 +717,8 @@ cifs_symlink(struct inode *inode, struct dentry *direntry, const char *symname)
                 rc = create_mf_symlink(xid, pTcon, cifs_sb, full_path, symname);
         else if (pTcon->unix_ext)
                 rc = CIFSUnixCreateSymLink(xid, pTcon, full_path, symname,
-                                           cifs_sb->local_nls);
+                                           cifs_sb->local_nls,
+                                           cifs_remap(cifs_sb));
         /* else
            rc = CIFSCreateReparseSymLink(xid, pTcon, fromName, toName,
                                         cifs_sb_target->local_nls); */
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index b4a47237486b..b1eede3678a9 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -90,6 +90,8 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name,
         if (dentry) {
                 inode = d_inode(dentry);
                 if (inode) {
+                        if (d_mountpoint(dentry))
+                                goto out;
                         /*
                          * If we're generating inode numbers, then we don't
                          * want to clobber the existing one with the one that
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 7bfdd6066276..fc537c29044e 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -960,7 +960,8 @@ cifs_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
         /* Check for unix extensions */
         if (cap_unix(tcon->ses)) {
                 rc = CIFSSMBUnixQuerySymLink(xid, tcon, full_path, target_path,
-                                             cifs_sb->local_nls);
+                                             cifs_sb->local_nls,
+                                             cifs_remap(cifs_sb));
                 if (rc == -EREMOTE)
                         rc = cifs_unix_dfs_readlink(xid, tcon, full_path,
                                                     target_path,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 65cd7a84c8bc..54cbe19d9c08 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -110,7 +110,7 @@ smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
 
         /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
         /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
-        if ((tcon->ses) &&
+        if ((tcon->ses) && (tcon->ses->server) &&
             (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
                 hdr->CreditCharge = cpu_to_le16(1);
         /* else CreditCharge MBZ */
diff --git a/fs/omfs/bitmap.c b/fs/omfs/bitmap.c
index 082234581d05..83f4e76511c2 100644
--- a/fs/omfs/bitmap.c
+++ b/fs/omfs/bitmap.c
@@ -159,7 +159,7 @@ int omfs_allocate_range(struct super_block *sb,
         goto out;
 
 found:
-        *return_block = i * bits_per_entry + bit;
+        *return_block = (u64) i * bits_per_entry + bit;
         *return_size = run;
         ret = set_run(sb, i, bits_per_entry, bit, run, 1);
 
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 138321b0c6c2..3d935c81789a 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = {
  */
 static int omfs_get_imap(struct super_block *sb)
 {
-        unsigned int bitmap_size, count, array_size;
+        unsigned int bitmap_size, array_size;
+        int count;
         struct omfs_sb_info *sbi = OMFS_SB(sb);
         struct buffer_head *bh;
         unsigned long **ptr;
@@ -359,7 +360,7 @@ nomem:
 }
 
 enum {
-        Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
+        Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
 };
 
 static const match_table_t tokens = {
@@ -368,6 +369,7 @@ static const match_table_t tokens = {
         {Opt_umask, "umask=%o"},
         {Opt_dmask, "dmask=%o"},
         {Opt_fmask, "fmask=%o"},
+        {Opt_err, NULL},
 };
 
 static int parse_options(char *options, struct omfs_sb_info *sbi)
@@ -548,8 +550,10 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
         }
 
         sb->s_root = d_make_root(root);
-        if (!sb->s_root)
+        if (!sb->s_root) {
+                ret = -ENOMEM;
                 goto out_brelse_bh2;
+        }
         printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name);
 
         ret = 0;
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 24f640441bd9..84d693d37428 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -299,6 +299,9 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
         struct cred *override_cred;
         char *link = NULL;
 
+        if (WARN_ON(!workdir))
+                return -EROFS;
+
         ovl_path_upper(parent, &parentpath);
         upperdir = parentpath.dentry;
 
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index d139405d2bfa..692ceda3bc21 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -222,6 +222,9 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
         struct kstat stat;
         int err;
 
+        if (WARN_ON(!workdir))
+                return ERR_PTR(-EROFS);
+
         err = ovl_lock_rename_workdir(workdir, upperdir);
         if (err)
                 goto out;
@@ -322,6 +325,9 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
         struct dentry *newdentry;
         int err;
 
+        if (WARN_ON(!workdir))
+                return -EROFS;
+
         err = ovl_lock_rename_workdir(workdir, upperdir);
         if (err)
                 goto out;
@@ -506,11 +512,28 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
         struct dentry *opaquedir = NULL;
         int err;
 
-        if (is_dir && OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) {
-                opaquedir = ovl_check_empty_and_clear(dentry);
-                err = PTR_ERR(opaquedir);
-                if (IS_ERR(opaquedir))
-                        goto out;
+        if (WARN_ON(!workdir))
+                return -EROFS;
+
+        if (is_dir) {
+                if (OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) {
+                        opaquedir = ovl_check_empty_and_clear(dentry);
+                        err = PTR_ERR(opaquedir);
+                        if (IS_ERR(opaquedir))
+                                goto out;
+                } else {
+                        LIST_HEAD(list);
+
+                        /*
+                         * When removing an empty opaque directory, then it
+                         * makes no sense to replace it with an exact replica of
+                         * itself.  But emptiness still needs to be checked.
+                         */
+                        err = ovl_check_empty_dir(dentry, &list);
+                        ovl_cache_free(&list);
+                        if (err)
+                                goto out;
+                }
         }
 
         err = ovl_lock_rename_workdir(workdir, upperdir);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 5f0d1993e6e3..bf8537c7f455 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -529,7 +529,7 @@ static int ovl_remount(struct super_block *sb, int *flags, char *data)
 {
         struct ovl_fs *ufs = sb->s_fs_info;
 
-        if (!(*flags & MS_RDONLY) && !ufs->upper_mnt)
+        if (!(*flags & MS_RDONLY) && (!ufs->upper_mnt || !ufs->workdir))
                 return -EROFS;
 
         return 0;
@@ -925,9 +925,10 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 ufs->workdir = ovl_workdir_create(ufs->upper_mnt, workpath.dentry);
                 err = PTR_ERR(ufs->workdir);
                 if (IS_ERR(ufs->workdir)) {
-                        pr_err("overlayfs: failed to create directory %s/%s\n",
-                               ufs->config.workdir, OVL_WORKDIR_NAME);
-                        goto out_put_upper_mnt;
+                        pr_warn("overlayfs: failed to create directory %s/%s (errno: %i); mounting read-only\n",
+                                ufs->config.workdir, OVL_WORKDIR_NAME, -err);
+                        sb->s_flags |= MS_RDONLY;
+                        ufs->workdir = NULL;
                 }
         }
 
@@ -997,7 +998,6 @@ out_put_lower_mnt:
         kfree(ufs->lower_mnt);
 out_put_workdir:
         dput(ufs->workdir);
-out_put_upper_mnt:
         mntput(ufs->upper_mnt);
 out_put_lowerpath:
         for (i = 0; i < numlower; i++)
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 04e79d57bca6..e9d401ce93bb 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -574,8 +574,8 @@ xfs_attr_shortform_add(xfs_da_args_t *args, int forkoff)
  * After the last attribute is removed revert to original inode format,
  * making all literal area available to the data fork once more.
  */
-STATIC void
-xfs_attr_fork_reset(
+void
+xfs_attr_fork_remove(
         struct xfs_inode        *ip,
         struct xfs_trans        *tp)
 {
@@ -641,7 +641,7 @@ xfs_attr_shortform_remove(xfs_da_args_t *args)
             (mp->m_flags & XFS_MOUNT_ATTR2) &&
             (dp->i_d.di_format != XFS_DINODE_FMT_BTREE) &&
             !(args->op_flags & XFS_DA_OP_ADDNAME)) {
-                xfs_attr_fork_reset(dp, args->trans);
+                xfs_attr_fork_remove(dp, args->trans);
         } else {
                 xfs_idata_realloc(dp, -size, XFS_ATTR_FORK);
                 dp->i_d.di_forkoff = xfs_attr_shortform_bytesfit(dp, totsize);
@@ -905,7 +905,7 @@ xfs_attr3_leaf_to_shortform(
         if (forkoff == -1) {
                 ASSERT(dp->i_mount->m_flags & XFS_MOUNT_ATTR2);
                 ASSERT(dp->i_d.di_format != XFS_DINODE_FMT_BTREE);
-                xfs_attr_fork_reset(dp, args->trans);
+                xfs_attr_fork_remove(dp, args->trans);
                 goto out;
         }
 
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h
index 025c4b820c03..882c8d338891 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.h
+++ b/fs/xfs/libxfs/xfs_attr_leaf.h
@@ -53,7 +53,7 @@ int	xfs_attr_shortform_remove(struct xfs_da_args *args);
 int     xfs_attr_shortform_list(struct xfs_attr_list_context *context);
 int     xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp);
 int     xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes);
-
+void    xfs_attr_fork_remove(struct xfs_inode *ip, struct xfs_trans *tp);
 
 /*
  * Internal routines when attribute fork size == XFS_LBSIZE(mp).
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index aeffeaaac0ec..f1026e86dabc 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3224,12 +3224,24 @@ xfs_bmap_extsize_align(
                 align_alen += temp;
                 align_off -= temp;
         }
+
+        /* Same adjustment for the end of the requested area. */
+        temp = (align_alen % extsz);
+        if (temp)
+                align_alen += extsz - temp;
+
         /*
-         * Same adjustment for the end of the requested area.
+         * For large extent hint sizes, the aligned extent might be larger than
+         * MAXEXTLEN. In that case, reduce the size by an extsz so that it pulls
+         * the length back under MAXEXTLEN. The outer allocation loops handle
+         * short allocation just fine, so it is safe to do this. We only want to
+         * do it when we are forced to, though, because it means more allocation
+         * operations are required.
          */
-        if ((temp = (align_alen % extsz))) {
-                align_alen += extsz - temp;
-        }
+        while (align_alen > MAXEXTLEN)
+                align_alen -= extsz;
+        ASSERT(align_alen <= MAXEXTLEN);
+
         /*
          * If the previous block overlaps with this proposed allocation
          * then move the start forward without adjusting the length.
@@ -3318,7 +3330,9 @@ xfs_bmap_extsize_align(
                         return -EINVAL;
         } else {
                 ASSERT(orig_off >= align_off);
-                ASSERT(orig_end <= align_off + align_alen);
+                /* see MAXEXTLEN handling above */
+                ASSERT(orig_end <= align_off + align_alen ||
+                       align_alen + extsz > MAXEXTLEN);
         }
 
 #ifdef DEBUG
@@ -4099,13 +4113,6 @@ xfs_bmapi_reserve_delalloc(
         /* Figure out the extent size, adjust alen */
         extsz = xfs_get_extsz_hint(ip);
         if (extsz) {
-                /*
-                 * Make sure we don't exceed a single extent length when we
-                 * align the extent by reducing length we are going to
-                 * allocate by the maximum amount extent size aligment may
-                 * require.
-                 */
-                alen = XFS_FILBLKS_MIN(len, MAXEXTLEN - (2 * extsz - 1));
                 error = xfs_bmap_extsize_align(mp, got, prev, extsz, rt, eof,
                                                1, 0, &aoff, &alen);
                 ASSERT(!error);
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 07349a183a11..1c9e75521250 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -376,7 +376,7 @@ xfs_ialloc_ag_alloc(
          */
         newlen = args.mp->m_ialloc_inos;
         if (args.mp->m_maxicount &&
-            percpu_counter_read(&args.mp->m_icount) + newlen >
+            percpu_counter_read_positive(&args.mp->m_icount) + newlen >
                                                         args.mp->m_maxicount)
                 return -ENOSPC;
         args.minlen = args.maxlen = args.mp->m_ialloc_blks;
@@ -1339,10 +1339,13 @@ xfs_dialloc(
          * If we have already hit the ceiling of inode blocks then clear
          * okalloc so we scan all available agi structures for a free
          * inode.
+         *
+         * Read rough value of mp->m_icount by percpu_counter_read_positive,
+         * which will sacrifice the preciseness but improve the performance.
          */
         if (mp->m_maxicount &&
-            percpu_counter_read(&mp->m_icount) + mp->m_ialloc_inos >
-                                                        mp->m_maxicount) {
+            percpu_counter_read_positive(&mp->m_icount) + mp->m_ialloc_inos
+                                                        > mp->m_maxicount) {
                 noroom = 1;
                 okalloc = 0;
         }
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index f9c1c64782d3..3fbf167cfb4c 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -380,23 +380,31 @@ xfs_attr3_root_inactive(
         return error;
 }
 
+/*
+ * xfs_attr_inactive kills all traces of an attribute fork on an inode. It
+ * removes both the on-disk and in-memory inode fork. Note that this also has to
+ * handle the condition of inodes without attributes but with an attribute fork
+ * configured, so we can't use xfs_inode_hasattr() here.
+ *
+ * The in-memory attribute fork is removed even on error.
+ */
 int
-xfs_attr_inactive(xfs_inode_t *dp)
+xfs_attr_inactive(
+        struct xfs_inode        *dp)
 {
-        xfs_trans_t *trans;
-        xfs_mount_t *mp;
-        int error;
+        struct xfs_trans        *trans;
+        struct xfs_mount        *mp;
+        int                     cancel_flags = 0;
+        int                     lock_mode = XFS_ILOCK_SHARED;
+        int                     error = 0;
 
         mp = dp->i_mount;
         ASSERT(! XFS_NOT_DQATTACHED(mp, dp));
 
-        xfs_ilock(dp, XFS_ILOCK_SHARED);
-        if (!xfs_inode_hasattr(dp) ||
-            dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
-                xfs_iunlock(dp, XFS_ILOCK_SHARED);
-                return 0;
-        }
-        xfs_iunlock(dp, XFS_ILOCK_SHARED);
+        xfs_ilock(dp, lock_mode);
+        if (!XFS_IFORK_Q(dp))
+                goto out_destroy_fork;
+        xfs_iunlock(dp, lock_mode);
 
         /*
          * Start our first transaction of the day.
@@ -408,13 +416,18 @@ xfs_attr_inactive(xfs_inode_t *dp)
          * the inode in every transaction to let it float upward through
          * the log.
          */
+        lock_mode = 0;
         trans = xfs_trans_alloc(mp, XFS_TRANS_ATTRINVAL);
         error = xfs_trans_reserve(trans, &M_RES(mp)->tr_attrinval, 0, 0);
-        if (error) {
-                xfs_trans_cancel(trans, 0);
-                return error;
-        }
-        xfs_ilock(dp, XFS_ILOCK_EXCL);
+        if (error)
+                goto out_cancel;
+
+        lock_mode = XFS_ILOCK_EXCL;
+        cancel_flags = XFS_TRANS_RELEASE_LOG_RES | XFS_TRANS_ABORT;
+        xfs_ilock(dp, lock_mode);
+
+        if (!XFS_IFORK_Q(dp))
+                goto out_cancel;
 
         /*
          * No need to make quota reservations here. We expect to release some
@@ -422,29 +435,31 @@ xfs_attr_inactive(xfs_inode_t *dp)
          */
         xfs_trans_ijoin(trans, dp, 0);
 
-        /*
-         * Decide on what work routines to call based on the inode size.
-         */
-        if (!xfs_inode_hasattr(dp) ||
-            dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
-                error = 0;
-                goto out;
+        /* invalidate and truncate the attribute fork extents */
+        if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
+                error = xfs_attr3_root_inactive(&trans, dp);
+                if (error)
+                        goto out_cancel;
+
+                error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);
+                if (error)
+                        goto out_cancel;
         }
-        error = xfs_attr3_root_inactive(&trans, dp);
-        if (error)
-                goto out;
 
-        error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);
-        if (error)
-                goto out;
+        /* Reset the attribute fork - this also destroys the in-core fork */
+        xfs_attr_fork_remove(dp, trans);
 
         error = xfs_trans_commit(trans, XFS_TRANS_RELEASE_LOG_RES);
-        xfs_iunlock(dp, XFS_ILOCK_EXCL);
-
+        xfs_iunlock(dp, lock_mode);
         return error;
 
-out:
-        xfs_trans_cancel(trans, XFS_TRANS_RELEASE_LOG_RES|XFS_TRANS_ABORT);
-        xfs_iunlock(dp, XFS_ILOCK_EXCL);
+out_cancel:
+        xfs_trans_cancel(trans, cancel_flags);
+out_destroy_fork:
+        /* kill the in-core attr fork before we drop the inode lock */
+        if (dp->i_afp)
+                xfs_idestroy_fork(dp, XFS_ATTR_FORK);
+        if (lock_mode)
+                xfs_iunlock(dp, lock_mode);
         return error;
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 8121e75352ee..3b7591224f4a 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -124,7 +124,7 @@ xfs_iozero(
                 status = 0;
         } while (count);
 
-        return (-status);
+        return status;
 }
 
 int
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index d6ebc85192b7..539a85fddbc2 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1946,21 +1946,17 @@ xfs_inactive(
         /*
          * If there are attributes associated with the file then blow them away
          * now.  The code calls a routine that recursively deconstructs the
-         * attribute fork.  We need to just commit the current transaction
-         * because we can't use it for xfs_attr_inactive().
+         * attribute fork. If also blows away the in-core attribute fork.
          */
-        if (ip->i_d.di_anextents > 0) {
-                ASSERT(ip->i_d.di_forkoff != 0);
-
+        if (XFS_IFORK_Q(ip)) {
                 error = xfs_attr_inactive(ip);
                 if (error)
                         return;
         }
 
-        if (ip->i_afp)
-                xfs_idestroy_fork(ip, XFS_ATTR_FORK);
-
+        ASSERT(!ip->i_afp);
         ASSERT(ip->i_d.di_anextents == 0);
+        ASSERT(ip->i_d.di_forkoff == 0);
 
         /*
          * Free the inode.
@@ -2883,7 +2879,13 @@ xfs_rename_alloc_whiteout(
         if (error)
                 return error;
 
-        /* Satisfy xfs_bumplink that this is a real tmpfile */
+        /*
+         * Prepare the tmpfile inode as if it were created through the VFS.
+         * Otherwise, the link increment paths will complain about nlink 0->1.
+         * Drop the link count as done by d_tmpfile(), complete the inode setup
+         * and flag it as linkable.
+         */
+        drop_nlink(VFS_I(tmpfile));
         xfs_finish_inode_setup(tmpfile);
         VFS_I(tmpfile)->i_state |= I_LINKABLE;
 
@@ -3151,7 +3153,7 @@ xfs_rename(
          * intermediate state on disk.
          */
         if (wip) {
-                ASSERT(wip->i_d.di_nlink == 0);
+                ASSERT(VFS_I(wip)->i_nlink == 0 && wip->i_d.di_nlink == 0);
                 error = xfs_bumplink(tp, wip);
                 if (error)
                         goto out_trans_abort;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 2ce7ee3b4ec1..6f23fbdfb365 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1084,14 +1084,18 @@ xfs_log_sbcount(xfs_mount_t *mp)
         return xfs_sync_sb(mp, true);
 }
 
+/*
+ * Deltas for the inode count are +/-64, hence we use a large batch size
+ * of 128 so we don't need to take the counter lock on every update.
+ */
+#define XFS_ICOUNT_BATCH        128
 int
 xfs_mod_icount(
         struct xfs_mount        *mp,
         int64_t                 delta)
 {
-        /* deltas are +/-64, hence the large batch size of 128. */
-        __percpu_counter_add(&mp->m_icount, delta, 128);
-        if (percpu_counter_compare(&mp->m_icount, 0) < 0) {
+        __percpu_counter_add(&mp->m_icount, delta, XFS_ICOUNT_BATCH);
+        if (__percpu_counter_compare(&mp->m_icount, 0, XFS_ICOUNT_BATCH) < 0) {
                 ASSERT(0);
                 percpu_counter_add(&mp->m_icount, -delta);
                 return -EINVAL;
@@ -1113,6 +1117,14 @@ xfs_mod_ifree(
         return 0;
 }
 
+/*
+ * Deltas for the block count can vary from 1 to very large, but lock contention
+ * only occurs on frequent small block count updates such as in the delayed
+ * allocation path for buffered writes (page a time updates). Hence we set
+ * a large batch count (1024) to minimise global counter updates except when
+ * we get near to ENOSPC and we have to be very accurate with our updates.
+ */
+#define XFS_FDBLOCKS_BATCH      1024
 int
 xfs_mod_fdblocks(
         struct xfs_mount        *mp,
@@ -1151,25 +1163,19 @@ xfs_mod_fdblocks(
          * Taking blocks away, need to be more accurate the closer we
          * are to zero.
          *
-         * batch size is set to a maximum of 1024 blocks - if we are
-         * allocating of freeing extents larger than this then we aren't
-         * going to be hammering the counter lock so a lock per update
-         * is not a problem.
-         *
          * If the counter has a value of less than 2 * max batch size,
          * then make everything serialise as we are real close to
          * ENOSPC.
          */
-#define __BATCH 1024
-        if (percpu_counter_compare(&mp->m_fdblocks, 2 * __BATCH) < 0)
+        if (__percpu_counter_compare(&mp->m_fdblocks, 2 * XFS_FDBLOCKS_BATCH,
+                                     XFS_FDBLOCKS_BATCH) < 0)
                 batch = 1;
         else
-                batch = __BATCH;
-#undef __BATCH
+                batch = XFS_FDBLOCKS_BATCH;
 
         __percpu_counter_add(&mp->m_fdblocks, delta, batch);
-        if (percpu_counter_compare(&mp->m_fdblocks,
-                                   XFS_ALLOC_SET_ASIDE(mp)) >= 0) {
+        if (__percpu_counter_compare(&mp->m_fdblocks, XFS_ALLOC_SET_ASIDE(mp),
+                                     XFS_FDBLOCKS_BATCH) >= 0) {
                 /* we had space! */
                 return 0;
         }
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index ae2982c0f7a6..656da2a12ffe 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -17,7 +17,7 @@
 #define PHY_ID_BCM7250                  0xae025280
 #define PHY_ID_BCM7364                  0xae025260
 #define PHY_ID_BCM7366                  0x600d8490
-#define PHY_ID_BCM7425                  0x03625e60
+#define PHY_ID_BCM7425                  0x600d86b0
 #define PHY_ID_BCM7429                  0x600d8730
 #define PHY_ID_BCM7439                  0x600d8480
 #define PHY_ID_BCM7439_2                0xae025080
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index 27e285b92b5f..59915ea5373c 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -151,10 +151,8 @@ static inline unsigned int cpumask_any_but(const struct cpumask *mask,
         return 1;
 }
 
-static inline int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
+static inline unsigned int cpumask_local_spread(unsigned int i, int node)
 {
-        set_bit(0, cpumask_bits(dstp));
-
         return 0;
 }
 
@@ -208,7 +206,7 @@ static inline unsigned int cpumask_next_zero(int n, const struct cpumask *srcp)
 
 int cpumask_next_and(int n, const struct cpumask *, const struct cpumask *);
 int cpumask_any_but(const struct cpumask *mask, unsigned int cpu);
-int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp);
+unsigned int cpumask_local_spread(unsigned int i, int node);
 
 /**
  * for_each_cpu - iterate over every cpu in a mask
diff --git a/include/linux/percpu_counter.h b/include/linux/percpu_counter.h
index 50e50095c8d1..84a109449610 100644
--- a/include/linux/percpu_counter.h
+++ b/include/linux/percpu_counter.h
@@ -41,7 +41,12 @@ void percpu_counter_destroy(struct percpu_counter *fbc);
 void percpu_counter_set(struct percpu_counter *fbc, s64 amount);
 void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch);
 s64 __percpu_counter_sum(struct percpu_counter *fbc);
-int percpu_counter_compare(struct percpu_counter *fbc, s64 rhs);
+int __percpu_counter_compare(struct percpu_counter *fbc, s64 rhs, s32 batch);
+
+static inline int percpu_counter_compare(struct percpu_counter *fbc, s64 rhs)
+{
+        return __percpu_counter_compare(fbc, rhs, percpu_counter_batch);
+}
 
 static inline void percpu_counter_add(struct percpu_counter *fbc, s64 amount)
 {
@@ -116,6 +121,12 @@ static inline int percpu_counter_compare(struct percpu_counter *fbc, s64 rhs)
                 return 0;
 }
 
+static inline int
+__percpu_counter_compare(struct percpu_counter *fbc, s64 rhs, s32 batch)
+{
+        return percpu_counter_compare(fbc, rhs);
+}
+
 static inline void
 percpu_counter_add(struct percpu_counter *fbc, s64 amount)
 {
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index c56a438c3a1e..ce13cf20f625 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -574,11 +574,14 @@ static inline void sctp_v6_map_v4(union sctp_addr *addr)
 /* Map v4 address to v4-mapped v6 address */
 static inline void sctp_v4_map_v6(union sctp_addr *addr)
 {
+        __be16 port;
+
+        port = addr->v4.sin_port;
+        addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
+        addr->v6.sin6_port = port;
         addr->v6.sin6_family = AF_INET6;
         addr->v6.sin6_flowinfo = 0;
         addr->v6.sin6_scope_id = 0;
-        addr->v6.sin6_port = addr->v4.sin_port;
-        addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
         addr->v6.sin6_addr.s6_addr32[0] = 0;
         addr->v6.sin6_addr.s6_addr32[1] = 0;
         addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index 81ea59812117..f7554fd7fc62 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -140,19 +140,42 @@ DEFINE_EVENT(kmem_free, kfree,
         TP_ARGS(call_site, ptr)
 );
 
-DEFINE_EVENT(kmem_free, kmem_cache_free,
+DEFINE_EVENT_CONDITION(kmem_free, kmem_cache_free,
 
         TP_PROTO(unsigned long call_site, const void *ptr),
 
-        TP_ARGS(call_site, ptr)
+        TP_ARGS(call_site, ptr),
+
+        /*
+         * This trace can be potentially called from an offlined cpu.
+         * Since trace points use RCU and RCU should not be used from
+         * offline cpus, filter such calls out.
+         * While this trace can be called from a preemptable section,
+         * it has no impact on the condition since tasks can migrate
+         * only from online cpus to other online cpus. Thus its safe
+         * to use raw_smp_processor_id.
+         */
+        TP_CONDITION(cpu_online(raw_smp_processor_id()))
 );
 
-TRACE_EVENT(mm_page_free,
+TRACE_EVENT_CONDITION(mm_page_free,
 
         TP_PROTO(struct page *page, unsigned int order),
 
         TP_ARGS(page, order),
 
+
+        /*
+         * This trace can be potentially called from an offlined cpu.
+         * Since trace points use RCU and RCU should not be used from
+         * offline cpus, filter such calls out.
+         * While this trace can be called from a preemptable section,
+         * it has no impact on the condition since tasks can migrate
+         * only from online cpus to other online cpus. Thus its safe
+         * to use raw_smp_processor_id.
+         */
+        TP_CONDITION(cpu_online(raw_smp_processor_id())),
+
         TP_STRUCT__entry(
                 __field(        unsigned long,  pfn             )
                 __field(        unsigned int,   order           )
@@ -253,12 +276,35 @@ DEFINE_EVENT(mm_page, mm_page_alloc_zone_locked,
         TP_ARGS(page, order, migratetype)
 );
 
-DEFINE_EVENT_PRINT(mm_page, mm_page_pcpu_drain,
+TRACE_EVENT_CONDITION(mm_page_pcpu_drain,
 
         TP_PROTO(struct page *page, unsigned int order, int migratetype),
 
         TP_ARGS(page, order, migratetype),
 
+        /*
+         * This trace can be potentially called from an offlined cpu.
+         * Since trace points use RCU and RCU should not be used from
+         * offline cpus, filter such calls out.
+         * While this trace can be called from a preemptable section,
+         * it has no impact on the condition since tasks can migrate
+         * only from online cpus to other online cpus. Thus its safe
+         * to use raw_smp_processor_id.
+         */
+        TP_CONDITION(cpu_online(raw_smp_processor_id())),
+
+        TP_STRUCT__entry(
+                __field(        unsigned long,  pfn             )
+                __field(        unsigned int,   order           )
+                __field(        int,            migratetype     )
+        ),
+
+        TP_fast_assign(
+                __entry->pfn            = page ? page_to_pfn(page) : -1UL;
+                __entry->order          = order;
+                __entry->migratetype    = migratetype;
+        ),
+
         TP_printk("page=%p pfn=%lu order=%d migratetype=%d",
                 pfn_to_page(__entry->pfn), __entry->pfn,
                 __entry->order, __entry->migratetype)
diff --git a/kernel/module.c b/kernel/module.c
index 42a1d2afb217..cfc9e843a924 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3370,6 +3370,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
         module_bug_cleanup(mod);
         mutex_unlock(&module_mutex);
 
+        blocking_notifier_call_chain(&module_notify_list,
+                                     MODULE_STATE_GOING, mod);
+
         /* we can't deallocate the module until we clear memory protection */
         unset_module_init_ro_nx(mod);
         unset_module_core_ro_nx(mod);
diff --git a/lib/cpumask.c b/lib/cpumask.c
index 830dd5dec40f..5f627084f2e9 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -139,64 +139,42 @@ void __init free_bootmem_cpumask_var(cpumask_var_t mask)
 #endif
 
 /**
- * cpumask_set_cpu_local_first - set i'th cpu with local numa cpu's first
- *
+ * cpumask_local_spread - select the i'th cpu with local numa cpu's first
  * @i: index number
- * @numa_node: local numa_node
- * @dstp: cpumask with the relevant cpu bit set according to the policy
+ * @node: local numa_node
  *
- * This function sets the cpumask according to a numa aware policy.
- * cpumask could be used as an affinity hint for the IRQ related to a
- * queue. When the policy is to spread queues across cores - local cores
- * first.
+ * This function selects an online CPU according to a numa aware policy;
+ * local cpus are returned first, followed by non-local ones, then it
+ * wraps around.
  *
- * Returns 0 on success, -ENOMEM for no memory, and -EAGAIN when failed to set
- * the cpu bit and need to re-call the function.
+ * It's not very efficient, but useful for setup.
  */
-int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
+unsigned int cpumask_local_spread(unsigned int i, int node)
 {
-        cpumask_var_t mask;
         int cpu;
-        int ret = 0;
-
-        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
-                return -ENOMEM;
 
+        /* Wrap: we always want a cpu. */
         i %= num_online_cpus();
 
-        if (numa_node == -1 || !cpumask_of_node(numa_node)) {
-                /* Use all online cpu's for non numa aware system */
-                cpumask_copy(mask, cpu_online_mask);
+        if (node == -1) {
+                for_each_cpu(cpu, cpu_online_mask)
+                        if (i-- == 0)
+                                return cpu;
         } else {
-                int n;
-
-                cpumask_and(mask,
-                            cpumask_of_node(numa_node), cpu_online_mask);
-
-                n = cpumask_weight(mask);
-                if (i >= n) {
-                        i -= n;
-
-                        /* If index > number of local cpu's, mask out local
-                         * cpu's
-                         */
-                        cpumask_andnot(mask, cpu_online_mask, mask);
+                /* NUMA first. */
+                for_each_cpu_and(cpu, cpumask_of_node(node), cpu_online_mask)
+                        if (i-- == 0)
+                                return cpu;
+
+                for_each_cpu(cpu, cpu_online_mask) {
+                        /* Skip NUMA nodes, done above. */
+                        if (cpumask_test_cpu(cpu, cpumask_of_node(node)))
+                                continue;
+
+                        if (i-- == 0)
+                                return cpu;
                 }
         }
-
-        for_each_cpu(cpu, mask) {
-                if (--i < 0)
-                        goto out;
-        }
-
-        ret = -EAGAIN;
-
-out:
-        free_cpumask_var(mask);
-
-        if (!ret)
-                cpumask_set_cpu(cpu, dstp);
-
-        return ret;
+        BUG();
 }
-EXPORT_SYMBOL(cpumask_set_cpu_local_first);
+EXPORT_SYMBOL(cpumask_local_spread);
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index 48144cdae819..f051d69f0910 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -197,13 +197,13 @@ static int percpu_counter_hotcpu_callback(struct notifier_block *nb,
  * Compare counter against given value.
  * Return 1 if greater, 0 if equal and -1 if less
  */
-int percpu_counter_compare(struct percpu_counter *fbc, s64 rhs)
+int __percpu_counter_compare(struct percpu_counter *fbc, s64 rhs, s32 batch)
 {
         s64     count;
 
         count = percpu_counter_read(fbc);
         /* Check to see if rough count will be sufficient for comparison */
-        if (abs(count - rhs) > (percpu_counter_batch*num_online_cpus())) {
+        if (abs(count - rhs) > (batch * num_online_cpus())) {
                 if (count > rhs)
                         return 1;
                 else
@@ -218,7 +218,7 @@ int percpu_counter_compare(struct percpu_counter *fbc, s64 rhs)
         else
                 return 0;
 }
-EXPORT_SYMBOL(percpu_counter_compare);
+EXPORT_SYMBOL(__percpu_counter_compare);
 
 static int __init percpu_counter_startup(void)
 {
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 4ec0c803aef1..112ad784838a 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -330,6 +330,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
                 release_sock(sk);
                 timeo = schedule_timeout(timeo);
                 lock_sock(sk);
+
+                if (sock_flag(sk, SOCK_DEAD))
+                        break;
+
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
@@ -373,6 +377,10 @@ static int caif_stream_recvmsg(struct socket *sock, struct msghdr *msg,
                 struct sk_buff *skb;
 
                 lock_sock(sk);
+                if (sock_flag(sk, SOCK_DEAD)) {
+                        err = -ECONNRESET;
+                        goto unlock;
+                }
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 caif_check_flow_release(sk);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 265e42721a66..ff347a0eebd4 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2495,51 +2495,22 @@ static bool ieee80211_coalesce_started_roc(struct ieee80211_local *local,
                                            struct ieee80211_roc_work *new_roc,
                                            struct ieee80211_roc_work *cur_roc)
 {
-        unsigned long j = jiffies;
-        unsigned long cur_roc_end = cur_roc->hw_start_time +
-                                    msecs_to_jiffies(cur_roc->duration);
-        struct ieee80211_roc_work *next_roc;
-        int new_dur;
+        unsigned long now = jiffies;
+        unsigned long remaining = cur_roc->hw_start_time +
+                                  msecs_to_jiffies(cur_roc->duration) -
+                                  now;
 
         if (WARN_ON(!cur_roc->started || !cur_roc->hw_begun))
                 return false;
 
-        if (time_after(j + IEEE80211_ROC_MIN_LEFT, cur_roc_end))
+        /* if it doesn't fit entirely, schedule a new one */
+        if (new_roc->duration > jiffies_to_msecs(remaining))
                 return false;
 
         ieee80211_handle_roc_started(new_roc);
 
-        new_dur = new_roc->duration - jiffies_to_msecs(cur_roc_end - j);
-
-        /* cur_roc is long enough - add new_roc to the dependents list. */
-        if (new_dur <= 0) {
-                list_add_tail(&new_roc->list, &cur_roc->dependents);
-                return true;
-        }
-
-        new_roc->duration = new_dur;
-
-        /*
-         * if cur_roc was already coalesced before, we might
-         * want to extend the next roc instead of adding
-         * a new one.
-         */
-        next_roc = list_entry(cur_roc->list.next,
-                              struct ieee80211_roc_work, list);
-        if (&next_roc->list != &local->roc_list &&
-            next_roc->chan == new_roc->chan &&
-            next_roc->sdata == new_roc->sdata &&
-            !WARN_ON(next_roc->started)) {
-                list_add_tail(&new_roc->list, &next_roc->dependents);
-                next_roc->duration = max(next_roc->duration,
-                                         new_roc->duration);
-                next_roc->type = max(next_roc->type, new_roc->type);
-                return true;
-        }
-
-        /* add right after cur_roc */
-        list_add(&new_roc->list, &cur_roc->list);
-
+        /* add to dependents so we send the expired event properly */
+        list_add_tail(&new_roc->list, &cur_roc->dependents);
         return true;
 }
 
@@ -2652,17 +2623,9 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                          * In the offloaded ROC case, if it hasn't begun, add
                          * this new one to the dependent list to be handled
                          * when the master one begins. If it has begun,
-                         * check that there's still a minimum time left and
-                         * if so, start this one, transmitting the frame, but
-                         * add it to the list directly after this one with
-                         * a reduced time so we'll ask the driver to execute
-                         * it right after finishing the previous one, in the
-                         * hope that it'll also be executed right afterwards,
-                         * effectively extending the old one.
-                         * If there's no minimum time left, just add it to the
-                         * normal list.
-                         * TODO: the ROC type is ignored here, assuming that it
-                         * is better to immediately use the current ROC.
+                         * check if it fits entirely within the existing one,
+                         * in which case it will just be dependent as well.
+                         * Otherwise, schedule it by itself.
                          */
                         if (!tmp->hw_begun) {
                                 list_add_tail(&roc->list, &tmp->dependents);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ab46ab4a7249..c0a9187bc3a9 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -205,6 +205,8 @@ enum ieee80211_packet_rx_flags {
  * @IEEE80211_RX_CMNTR: received on cooked monitor already
  * @IEEE80211_RX_BEACON_REPORTED: This frame was already reported
  *      to cfg80211_report_obss_beacon().
+ * @IEEE80211_RX_REORDER_TIMER: this frame is released by the
+ *      reorder buffer timeout timer, not the normal RX path
  *
  * These flags are used across handling multiple interfaces
  * for a single frame.
@@ -212,6 +214,7 @@ enum ieee80211_packet_rx_flags {
 enum ieee80211_rx_flags {
         IEEE80211_RX_CMNTR              = BIT(0),
         IEEE80211_RX_BEACON_REPORTED    = BIT(1),
+        IEEE80211_RX_REORDER_TIMER      = BIT(2),
 };
 
 struct ieee80211_rx_data {
@@ -325,12 +328,6 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-#if HZ/100 == 0
-#define IEEE80211_ROC_MIN_LEFT  1
-#else
-#define IEEE80211_ROC_MIN_LEFT  (HZ/100)
-#endif
-
 struct ieee80211_roc_work {
         struct list_head list;
         struct list_head dependents;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index bab5c63c0bad..84cef600c573 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -522,6 +522,12 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
                        sizeof(sdata->vif.hw_queue));
                 sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
+
+                mutex_lock(&local->key_mtx);
+                sdata->crypto_tx_tailroom_needed_cnt +=
+                        master->crypto_tx_tailroom_needed_cnt;
+                mutex_unlock(&local->key_mtx);
+
                 break;
                 }
         case NL80211_IFTYPE_AP:
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 2291cd730091..a907f2d5c12d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -58,6 +58,22 @@ static void assert_key_lock(struct ieee80211_local *local)
         lockdep_assert_held(&local->key_mtx);
 }
 
+static void
+update_vlan_tailroom_need_count(struct ieee80211_sub_if_data *sdata, int delta)
+{
+        struct ieee80211_sub_if_data *vlan;
+
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
+                return;
+
+        mutex_lock(&sdata->local->mtx);
+
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                vlan->crypto_tx_tailroom_needed_cnt += delta;
+
+        mutex_unlock(&sdata->local->mtx);
+}
+
 static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
 {
         /*
@@ -79,6 +95,8 @@ static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
          * http://mid.gmane.org/1308590980.4322.19.camel@jlt3.sipsolutions.net
          */
 
+        update_vlan_tailroom_need_count(sdata, 1);
+
         if (!sdata->crypto_tx_tailroom_needed_cnt++) {
                 /*
                  * Flush all XMIT packets currently using HW encryption or no
@@ -88,6 +106,15 @@ static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
         }
 }
 
+static void decrease_tailroom_need_count(struct ieee80211_sub_if_data *sdata,
+                                         int delta)
+{
+        WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt < delta);
+
+        update_vlan_tailroom_need_count(sdata, -delta);
+        sdata->crypto_tx_tailroom_needed_cnt -= delta;
+}
+
 static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
         struct ieee80211_sub_if_data *sdata;
@@ -144,7 +171,7 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
                 if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
                       (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
-                        sdata->crypto_tx_tailroom_needed_cnt--;
+                        decrease_tailroom_need_count(sdata, 1);
 
                 WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
                         (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV));
@@ -541,7 +568,7 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key,
                         schedule_delayed_work(&sdata->dec_tailroom_needed_wk,
                                               HZ/2);
                 } else {
-                        sdata->crypto_tx_tailroom_needed_cnt--;
+                        decrease_tailroom_need_count(sdata, 1);
                 }
         }
 
@@ -631,6 +658,7 @@ void ieee80211_key_free(struct ieee80211_key *key, bool delay_tailroom)
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
+        struct ieee80211_sub_if_data *vlan;
 
         ASSERT_RTNL();
 
@@ -639,7 +667,14 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&sdata->local->key_mtx);
 
-        sdata->crypto_tx_tailroom_needed_cnt = 0;
+        WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
+                     sdata->crypto_tx_tailroom_pending_dec);
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        WARN_ON_ONCE(vlan->crypto_tx_tailroom_needed_cnt ||
+                                     vlan->crypto_tx_tailroom_pending_dec);
+        }
 
         list_for_each_entry(key, &sdata->key_list, list) {
                 increment_tailroom_need_count(sdata);
@@ -649,6 +684,22 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&sdata->local->key_mtx);
 }
 
+void ieee80211_reset_crypto_tx_tailroom(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_sub_if_data *vlan;
+
+        mutex_lock(&sdata->local->key_mtx);
+
+        sdata->crypto_tx_tailroom_needed_cnt = 0;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        vlan->crypto_tx_tailroom_needed_cnt = 0;
+        }
+
+        mutex_unlock(&sdata->local->key_mtx);
+}
+
 void ieee80211_iter_keys(struct ieee80211_hw *hw,
                          struct ieee80211_vif *vif,
                          void (*iter)(struct ieee80211_hw *hw,
@@ -688,8 +739,8 @@ static void ieee80211_free_keys_iface(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_key *key, *tmp;
 
-        sdata->crypto_tx_tailroom_needed_cnt -=
-                sdata->crypto_tx_tailroom_pending_dec;
+        decrease_tailroom_need_count(sdata,
+                                     sdata->crypto_tx_tailroom_pending_dec);
         sdata->crypto_tx_tailroom_pending_dec = 0;
 
         ieee80211_debugfs_key_remove_mgmt_default(sdata);
@@ -709,6 +760,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_sub_if_data *master;
         struct ieee80211_key *key, *tmp;
         LIST_HEAD(keys);
 
@@ -728,8 +780,20 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
         list_for_each_entry_safe(key, tmp, &keys, list)
                 __ieee80211_key_destroy(key, false);
 
-        WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
-                     sdata->crypto_tx_tailroom_pending_dec);
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                if (sdata->bss) {
+                        master = container_of(sdata->bss,
+                                              struct ieee80211_sub_if_data,
+                                              u.ap);
+
+                        WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt !=
+                                     master->crypto_tx_tailroom_needed_cnt);
+                }
+        } else {
+                WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
+                             sdata->crypto_tx_tailroom_pending_dec);
+        }
+
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                         WARN_ON_ONCE(vlan->crypto_tx_tailroom_needed_cnt ||
@@ -793,8 +857,8 @@ void ieee80211_delayed_tailroom_dec(struct work_struct *wk)
          */
 
         mutex_lock(&sdata->local->key_mtx);
-        sdata->crypto_tx_tailroom_needed_cnt -=
-                sdata->crypto_tx_tailroom_pending_dec;
+        decrease_tailroom_need_count(sdata,
+                                     sdata->crypto_tx_tailroom_pending_dec);
         sdata->crypto_tx_tailroom_pending_dec = 0;
         mutex_unlock(&sdata->local->key_mtx);
 }
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index c5a31835be0e..96557dd1e77d 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -161,6 +161,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
 void ieee80211_free_sta_keys(struct ieee80211_local *local,
                              struct sta_info *sta);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
+void ieee80211_reset_crypto_tx_tailroom(struct ieee80211_sub_if_data *sdata);
 
 #define key_mtx_dereference(local, ref) \
         rcu_dereference_protected(ref, lockdep_is_held(&((local)->key_mtx)))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 260eed45b6d2..5793f75c5ffd 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2121,7 +2121,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                 /* deliver to local stack */
                 skb->protocol = eth_type_trans(skb, dev);
                 memset(skb->cb, 0, sizeof(skb->cb));
-                if (rx->local->napi)
+                if (!(rx->flags & IEEE80211_RX_REORDER_TIMER) &&
+                    rx->local->napi)
                         napi_gro_receive(rx->local->napi, skb);
                 else
                         netif_receive_skb(skb);
@@ -3231,7 +3232,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
                 /* This is OK -- must be QoS data frame */
                 .security_idx = tid,
                 .seqno_idx = tid,
-                .flags = 0,
+                .flags = IEEE80211_RX_REORDER_TIMER,
         };
         struct tid_ampdu_rx *tid_agg_rx;
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 79412f16b61d..b864ebc6ab8f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2023,6 +2023,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         /* add back keys */
         list_for_each_entry(sdata, &local->interfaces, list)
+                ieee80211_reset_crypto_tx_tailroom(sdata);
+
+        list_for_each_entry(sdata, &local->interfaces, list)
                 if (ieee80211_sdata_running(sdata))
                         ieee80211_enable_keys(sdata);
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ad9eed70bc8f..1e1c89e51a11 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -815,10 +815,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                 if (dev->flags & IFF_UP)
                         dev_deactivate(dev);
 
-                if (new && new->ops->attach) {
-                        new->ops->attach(new);
-                        num_q = 0;
-                }
+                if (new && new->ops->attach)
+                        goto skip;
 
                 for (i = 0; i < num_q; i++) {
                         struct netdev_queue *dev_queue = dev_ingress_queue(dev);
@@ -834,12 +832,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                                 qdisc_destroy(old);
                 }
 
+skip:
                 if (!ingress) {
                         notify_and_destroy(net, skb, n, classid,
                                            dev->qdisc, new);
                         if (new && !new->ops->attach)
                                 atomic_inc(&new->refcnt);
                         dev->qdisc = new ? : &noop_qdisc;
+
+                        if (new && new->ops->attach)
+                                new->ops->attach(new);
                 } else {
                         notify_and_destroy(net, skb, n, classid, old, new);
                 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 5266ea7b922b..06430598cf51 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1880,6 +1880,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
                 unix_state_unlock(sk);
                 timeo = freezable_schedule_timeout(timeo);
                 unix_state_lock(sk);
+
+                if (sock_flag(sk, SOCK_DEAD))
+                        break;
+
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
@@ -1939,6 +1943,10 @@ static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg,
                 struct sk_buff *skb, *last;
 
                 unix_state_lock(sk);
+                if (sock_flag(sk, SOCK_DEAD)) {
+                        err = -ECONNRESET;
+                        goto unlock;
+                }
                 last = skb = skb_peek(&sk->sk_receive_queue);
 again:
                 if (skb == NULL) {
diff --git a/scripts/gdb/linux/modules.py b/scripts/gdb/linux/modules.py
index a1504c4f1900..25db8cff44a2 100644
--- a/scripts/gdb/linux/modules.py
+++ b/scripts/gdb/linux/modules.py
@@ -73,18 +73,11 @@ class LxLsmod(gdb.Command):
                 "        " if utils.get_long_type().sizeof == 8 else ""))
 
         for module in module_list():
-            ref = 0
-            module_refptr = module['refptr']
-            for cpu in cpus.cpu_list("cpu_possible_mask"):
-                refptr = cpus.per_cpu(module_refptr, cpu)
-                ref += refptr['incs']
-                ref -= refptr['decs']
-
             gdb.write("{address} {name:<19} {size:>8}  {ref}".format(
                 address=str(module['module_core']).split()[0],
                 name=module['name'].string(),
                 size=str(module['core_size']),
-                ref=str(ref)))
+                ref=str(module['refcnt']['counter'])))
 
             source_list = module['source_list']
             t = self._module_use_type.get_type().pointer()
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 1c8678775f40..ac0db1679f09 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4926,9 +4926,12 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
  dig_only:
         parse_digital(codec);
 
-        if (spec->power_down_unused || codec->power_save_node)
+        if (spec->power_down_unused || codec->power_save_node) {
                 if (!codec->power_filter)
                         codec->power_filter = snd_hda_gen_path_power_filter;
+                if (!codec->patch_ops.stream_pm)
+                        codec->patch_ops.stream_pm = snd_hda_gen_stream_pm;
+        }
 
         if (!spec->no_analog && spec->beep_nid) {
                 err = snd_hda_attach_beep_device(codec, spec->beep_nid);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 34040d26c94f..fea198c58196 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2089,6 +2089,8 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0xaab0),
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaac8),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         /* VIA VT8251/VT8237A */
         { PCI_DEVICE(0x1106, 0x3288),
           .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 31f8f13be907..464168426465 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -884,6 +884,7 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
         { 0x10ec0275, 0x1028, 0, "ALC3260" },
         { 0x10ec0899, 0x1028, 0, "ALC3861" },
         { 0x10ec0298, 0x1028, 0, "ALC3266" },
+        { 0x10ec0256, 0x1028, 0, "ALC3246" },
         { 0x10ec0670, 0x1025, 0, "ALC669X" },
         { 0x10ec0676, 0x1025, 0, "ALC679X" },
         { 0x10ec0282, 0x1043, 0, "ALC3229" },
@@ -4227,6 +4228,11 @@ static void alc_fixup_headset_mode_alc662(struct hda_codec *codec,
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
                 spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
                 spec->gen.hp_mic = 1; /* Mic-in is same pin as headphone */
+
+                /* Disable boost for mic-in permanently. (This code is only called
+                   from quirks that guarantee that the headphone is at NID 0x1b.) */
+                snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_AMP_GAIN_MUTE, 0x7000);
+                snd_hda_override_wcaps(codec, 0x1b, get_wcaps(codec, 0x1b) & ~AC_WCAP_IN_AMP);
         } else
                 alc_fixup_headset_mode(codec, fix, action);
 }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 43c99ce4a520..6833c74ed6ff 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4403,7 +4403,6 @@ static const struct hda_codec_ops stac_patch_ops = {
 #ifdef CONFIG_PM
         .suspend = stac_suspend,
 #endif
-        .stream_pm = snd_hda_gen_stream_pm,
         .reboot_notify = stac_shutup,
 };
 
@@ -4697,7 +4696,8 @@ static int patch_stac92hd71bxx(struct hda_codec *codec)
                 return err;
 
         spec = codec->spec;
-        codec->power_save_node = 1;
+        /* disabled power_save_node since it causes noises on a Dell machine */
+        /* codec->power_save_node = 1; */
         spec->linear_tone_beep = 0;
         spec->gen.own_eapd_ctl = 1;
         spec->gen.power_down_unused = 1;
diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
index d51703e30523..0a4ad5feb82e 100644
--- a/sound/pci/hda/thinkpad_helper.c
+++ b/sound/pci/hda/thinkpad_helper.c
@@ -72,7 +72,6 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
                 if (led_set_func(TPACPI_LED_MUTE, false) >= 0) {
                         old_vmaster_hook = spec->vmaster_mute.hook;
                         spec->vmaster_mute.hook = update_tpacpi_mute_led;
-                        spec->vmaster_mute_enum = 1;
                         removefunc = false;
                 }
                 if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 46facfc9aec1..29175346cc4f 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema  */
         case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
         case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+        case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
                 return true;
         }
diff --git a/tools/net/bpf_jit_disasm.c b/tools/net/bpf_jit_disasm.c
index c5baf9c591b7..618c2bcd4eab 100644
--- a/tools/net/bpf_jit_disasm.c
+++ b/tools/net/bpf_jit_disasm.c
@@ -123,6 +123,8 @@ static int get_last_jit_image(char *haystack, size_t hlen,
         assert(ret == 0);
 
         ptr = haystack;
+        memset(pmatch, 0, sizeof(pmatch));
+
         while (1) {
                 ret = regexec(&regex, ptr, 1, pmatch, 0);
                 if (ret == 0) {