183 files changed, 1601 insertions, 1044 deletions
diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index e6b72d355151..68c0f517c60e 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -124,12 +124,11 @@ the default being 204800 sectors (or 100MB).
 Updating on-disk metadata
 -------------------------
-On-disk metadata is committed every time a REQ_SYNC or REQ_FUA bio is
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
-written.  If no such requests are made then commits will occur every
+If no such requests are made then commits will occur every second.  This
-second.  This means the cache behaves like a physical disk that has a
+means the cache behaves like a physical disk that has a volatile write
-write cache (the same is true of the thin-provisioning target).  If
+cache.  If power is lost you may lose some recent writes.  The metadata
-power is lost you may lose some recent writes.  The metadata should
+should always be consistent in spite of any crash.
-always be consistent in spite of any crash.
 The 'dirty' state for a cache block changes far too frequently for us
 to keep updating it on the fly.  So we treat it as a hint.  In normal
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 8a7a3d46e0da..05a27e9442bd 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -116,6 +116,35 @@ Resuming a device with a new table itself triggers an event so the
 userspace daemon can use this to detect a situation where a new table
 already exceeds the threshold.
+A low water mark for the metadata device is maintained in the kernel and
+will trigger a dm event if free space on the metadata device drops below
+it.
+Updating on-disk metadata
+-------------------------
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
+If no such requests are made then commits will occur every second.  This
+means the thin-provisioning target behaves like a physical disk that has
+a volatile write cache.  If power is lost you may lose some recent
+writes.  The metadata should always be consistent in spite of any crash.
+If data space is exhausted the pool will either error or queue IO
+according to the configuration (see: error_if_no_space).  If metadata
+space is exhausted or a metadata operation fails: the pool will error IO
+until the pool is taken offline and repair is performed to 1) fix any
+potential inconsistencies and 2) clear the flag that imposes repair.
+Once the pool's metadata device is repaired it may be resized, which
+will allow the pool to return to normal operation.  Note that if a pool
+is flagged as needing repair, the pool's data and metadata devices
+cannot be resized until repair is performed.  It should also be noted
+that when the pool's metadata space is exhausted the current metadata
+transaction is aborted.  Given that the pool will cache IO whose
+completion may have already been acknowledged to upper IO layers
+(e.g. filesystem) it is strongly suggested that consistency checks
+(e.g. fsck) be performed on those layers when repair of the pool is
+required.
 Thin provisioning
 -----------------
@@ -258,10 +287,9 @@ ii) Status
        should register for the event and then check the target's status.
    held metadata root:
-        The location, in sectors, of the metadata root that has been
+        The location, in blocks, of the metadata root that has been
        'held' for userspace read access.  '-' indicates there is no
-        held root.  This feature is not yet implemented so '-' is
+        held root.
-        always returned.
    discard_passdown|no_discard_passdown
        Whether or not discards are actually being passed down to the
diff --git a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
index 9e9e9ef9f852..c119debe6bab 100644
--- a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
@@ -1,4 +1,4 @@
-Broadcom Capri Pin Controller
+Broadcom BCM281xx Pin Controller
 This is a pin controller for the Broadcom BCM281xx SoC family, which includes
 BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
@@ -7,14 +7,14 @@ BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
 Required Properties:
- compatible:   Must be "brcm,capri-pinctrl".
+- compatible:   Must be "brcm,bcm11351-pinctrl"
 - reg:          Base address of the PAD Controller register block and the size
                of the block.
 For example, the following is the bare minimum node:
        pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                reg = <0x35004800 0x430>;
        };
@@ -119,7 +119,7 @@ Optional Properties (for HDMI pins):
 Example:
 // pin controller node
 pinctrl@35004800 {
-        compatible = "brcm,capri-pinctrl";
+        compatible = "brcmbcm11351-pinctrl";
        reg = <0x35004800 0x430>;
        // pin configuration node
diff --git a/MAINTAINERS b/MAINTAINERS
index b359eb056e5c..b3fdb0f004ba 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -474,7 +474,7 @@ F:	net/rxrpc/af_rxrpc.c
 AGPGART DRIVER
 M:      David Airlie <airlied@linux.ie>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6.git
+T:      git git://people.freedesktop.org/~airlied/linux (part of drm maint)
 S:      Maintained
 F:      drivers/char/agp/
 F:      include/linux/agp*
@@ -1738,6 +1738,7 @@ F:	include/uapi/linux/bfs_fs.h
 BLACKFIN ARCHITECTURE
 M:      Steven Miao <realmz6@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net
+T:      git git://git.code.sf.net/p/adi-linux/code
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      arch/blackfin/
@@ -6177,6 +6178,12 @@ S:	Supported
 F:      drivers/block/nvme*
 F:      include/linux/nvme.h
+NXP TDA998X DRM DRIVER
+M:      Russell King <rmk+kernel@arm.linux.org.uk>
+S:      Supported
+F:      drivers/gpu/drm/i2c/tda998x_drv.c
+F:      include/drm/i2c/tda998x.h
 OMAP SUPPORT
 M:      Tony Lindgren <tony@atomide.com>
 L:      linux-omap@vger.kernel.org
diff --git a/Makefile b/Makefile
index 78209ee1f981..1a2628ee5d91 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Shuffling Zombie Juror
 # *DOCUMENTATION*
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 6b58c1de7577..400c663b21c2 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -282,7 +282,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
 #else
        /* if V-P const for loop, PTAG can be written once outside loop */
        if (full_page_op)
-                write_aux_reg(ARC_REG_DC_PTAG, paddr);
+                write_aux_reg(aux_tag, paddr);
 #endif
        while (num_lines-- > 0) {
@@ -296,7 +296,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
                write_aux_reg(aux_cmd, vaddr);
                vaddr += L1_CACHE_BYTES;
 #else
-                write_aux_reg(aux, paddr);
+                write_aux_reg(aux_cmd, paddr);
                paddr += L1_CACHE_BYTES;
 #endif
        }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e25419817791..15949459611f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1578,6 +1578,7 @@ config BL_SWITCHER_DUMMY_IF
 choice
        prompt "Memory split"
+        depends on MMU
        default VMSPLIT_3G
        help
          Select the desired split between kernel and user memory.
@@ -1595,6 +1596,7 @@ endchoice
 config PAGE_OFFSET
        hex
+        default PHYS_OFFSET if !MMU
        default 0x40000000 if VMSPLIT_1G
        default 0x80000000 if VMSPLIT_2G
        default 0xC0000000
@@ -1903,6 +1905,7 @@ config XEN
        depends on ARM && AEABI && OF
        depends on CPU_V7 && !CPU_V6
        depends on !GENERIC_ATOMIC64
+        depends on MMU
        select ARM_PSCI
        select SWIOTLB_XEN
        select ARCH_DMA_ADDR_T_64BIT
diff --git a/arch/arm/boot/compressed/.gitignore b/arch/arm/boot/compressed/.gitignore
index 47279aa96a6a..0714e0334e33 100644
--- a/arch/arm/boot/compressed/.gitignore
+++ b/arch/arm/boot/compressed/.gitignore
@@ -1,4 +1,5 @@
 ashldi3.S
+bswapsdi2.S
 font.c
 lib1funcs.S
 hyp-stub.S
diff --git a/arch/arm/boot/dts/bcm11351.dtsi b/arch/arm/boot/dts/bcm11351.dtsi
index e491b82f8d67..792fde1b7f75 100644
--- a/arch/arm/boot/dts/bcm11351.dtsi
+++ b/arch/arm/boot/dts/bcm11351.dtsi
@@ -147,7 +147,7 @@
        };
        pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                reg = <0x35004800 0x430>;
        };
diff --git a/arch/arm/boot/dts/omap3-gta04.dts b/arch/arm/boot/dts/omap3-gta04.dts
index c551e4af4d83..d3b253bbc885 100644
--- a/arch/arm/boot/dts/omap3-gta04.dts
+++ b/arch/arm/boot/dts/omap3-gta04.dts
@@ -13,7 +13,7 @@
 / {
        model = "OMAP3 GTA04";
-        compatible = "ti,omap3-gta04", "ti,omap3";
+        compatible = "ti,omap3-gta04", "ti,omap36xx", "ti,omap3";
        cpus {
                cpu@0 {
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index 25a2b5f652fd..f2779ac75872 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -14,7 +14,7 @@
 / {
        model = "IGEPv2 (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0020", "ti,omap3";
+        compatible = "isee,omap3-igep0020", "ti,omap36xx", "ti,omap3";
        leds {
                pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
index 145c58cfc8ac..2793749eb1ba 100644
--- a/arch/arm/boot/dts/omap3-igep0030.dts
+++ b/arch/arm/boot/dts/omap3-igep0030.dts
@@ -13,7 +13,7 @@
 / {
        model = "IGEP COM MODULE (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0030", "ti,omap3";
+        compatible = "isee,omap3-igep0030", "ti,omap36xx", "ti,omap3";
        leds {
                pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 10666ca8aee1..d4d2763f4794 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -426,7 +426,7 @@
                };
                rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                        reg = <0x01c25000 0x100>;
                        interrupts = <29>;
                };
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 64961595e8d6..79fd412005b0 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -383,7 +383,7 @@
                };
                rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                        reg = <0x01c25000 0x100>;
                        interrupts = <29>;
                };
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index 320335abfccd..c463fd730c91 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -346,7 +346,7 @@
                };
                rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                        reg = <0x01c25000 0x100>;
                        interrupts = <29>;
                };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 9ff09484847b..6f25cf559ad0 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -454,7 +454,7 @@
                rtc: rtc@01c20d00 {
                        compatible = "allwinner,sun7i-a20-rtc";
                        reg = <0x01c20d00 0x20>;
-                        interrupts = <0 24 1>;
+                        interrupts = <0 24 4>;
                };
                sid: eeprom@01c23800 {
@@ -463,7 +463,7 @@
                };
                rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                        reg = <0x01c25000 0x100>;
                        interrupts = <0 29 4>;
                };
@@ -596,10 +596,10 @@
                hstimer@01c60000 {
                        compatible = "allwinner,sun7i-a20-hstimer";
                        reg = <0x01c60000 0x1000>;
-                        interrupts = <0 81 1>,
+                        interrupts = <0 81 4>,
-                                     <0 82 1>,
+                                     <0 82 4>,
-                                     <0 83 1>,
+                                     <0 83 4>,
-                                     <0 84 1>;
+                                     <0 84 4>;
                        clocks = <&ahb_gates 28>;
                };
diff --git a/arch/arm/configs/tegra_defconfig b/arch/arm/configs/tegra_defconfig
index 00fe9e9710fd..27d69b558c5d 100644
--- a/arch/arm/configs/tegra_defconfig
+++ b/arch/arm/configs/tegra_defconfig
@@ -204,7 +204,10 @@ CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 8756e4bcdba0..4afb376d9c7c 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -30,14 +30,15 @@
 */
 #define UL(x) _AC(x, UL)
+/* PAGE_OFFSET - the virtual address of the start of the kernel image */
+#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
 #ifdef CONFIG_MMU
 /*
- * PAGE_OFFSET - the virtual address of the start of the kernel image
 * TASK_SIZE - the maximum size of a user space task.
 * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area
 */
-#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
 #define TASK_SIZE               (UL(CONFIG_PAGE_OFFSET) - UL(SZ_16M))
 #define TASK_UNMAPPED_BASE      ALIGN(TASK_SIZE / 3, SZ_16M)
@@ -104,10 +105,6 @@
 #define END_MEM                 (UL(CONFIG_DRAM_BASE) + CONFIG_DRAM_SIZE)
 #endif
-#ifndef PAGE_OFFSET
-#define PAGE_OFFSET             PLAT_PHYS_OFFSET
-#endif
 /*
 * The module can be at any place in ram in nommu mode.
 */
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 47cd974e57ea..c96ecacb2021 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -177,6 +177,18 @@ __lookup_processor_type_data:
        .long   __proc_info_end
        .size   __lookup_processor_type_data, . - __lookup_processor_type_data
+__error_lpae:
+#ifdef CONFIG_DEBUG_LL
+        adr     r0, str_lpae
+        bl      printascii
+        b       __error
+str_lpae: .asciz "\nError: Kernel with LPAE support, but CPU does not support LPAE.\n"
+#else
+        b       __error
+#endif
+        .align
+ENDPROC(__error_lpae)
 __error_p:
 #ifdef CONFIG_DEBUG_LL
        adr     r0, str_p1
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 914616e0bdcd..f5f381d91556 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -102,7 +102,7 @@ ENTRY(stext)
        and     r3, r3, #0xf                    @ extract VMSA support
        cmp     r3, #5                          @ long-descriptor translation table format?
 THUMB( it      lo )                            @ force fixup-able long branch encoding
-        blo     __error_p                       @ only classic page table format
+        blo     __error_lpae                    @ only classic page table format
 #endif
 #ifndef CONFIG_XIP_KERNEL
diff --git a/arch/arm/mach-omap2/cclock3xxx_data.c b/arch/arm/mach-omap2/cclock3xxx_data.c
index 3b05aea56d1f..11ed9152e665 100644
--- a/arch/arm/mach-omap2/cclock3xxx_data.c
+++ b/arch/arm/mach-omap2/cclock3xxx_data.c
@@ -433,7 +433,9 @@ static const struct clk_ops dpll4_m5x2_ck_ops = {
        .enable         = &omap2_dflt_clk_enable,
        .disable        = &omap2_dflt_clk_disable,
        .is_enabled     = &omap2_dflt_clk_is_enabled,
+        .set_rate       = &omap3_clkoutx2_set_rate,
        .recalc_rate    = &omap3_clkoutx2_recalc,
+        .round_rate     = &omap3_clkoutx2_round_rate,
 };
 static const struct clk_ops dpll4_m5x2_ck_3630_ops = {
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index 4c158c838d40..01fc710c8181 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -23,6 +23,8 @@
 #include "prm.h"
 #include "clockdomain.h"
+#define MAX_CPUS        2
 /* Machine specific information */
 struct idle_statedata {
        u32 cpu_state;
@@ -48,11 +50,11 @@ static struct idle_statedata omap4_idle_data[] = {
        },
 };
-static struct powerdomain *mpu_pd, *cpu_pd[NR_CPUS];
+static struct powerdomain *mpu_pd, *cpu_pd[MAX_CPUS];
-static struct clockdomain *cpu_clkdm[NR_CPUS];
+static struct clockdomain *cpu_clkdm[MAX_CPUS];
 static atomic_t abort_barrier;
-static bool cpu_done[NR_CPUS];
+static bool cpu_done[MAX_CPUS];
 static struct idle_statedata *state_ptr = &omap4_idle_data[0];
 /* Private functions */
diff --git a/arch/arm/mach-omap2/dpll3xxx.c b/arch/arm/mach-omap2/dpll3xxx.c
index 3185ced807c9..3c418ea54bbe 100644
--- a/arch/arm/mach-omap2/dpll3xxx.c
+++ b/arch/arm/mach-omap2/dpll3xxx.c
@@ -623,6 +623,32 @@ void omap3_dpll_deny_idle(struct clk_hw_omap *clk)
 /* Clock control for DPLL outputs */
+/* Find the parent DPLL for the given clkoutx2 clock */
+static struct clk_hw_omap *omap3_find_clkoutx2_dpll(struct clk_hw *hw)
+{
+        struct clk_hw_omap *pclk = NULL;
+        struct clk *parent;
+        /* Walk up the parents of clk, looking for a DPLL */
+        do {
+                do {
+                        parent = __clk_get_parent(hw->clk);
+                        hw = __clk_get_hw(parent);
+                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
+                if (!hw)
+                        break;
+                pclk = to_clk_hw_omap(hw);
+        } while (pclk && !pclk->dpll_data);
+        /* clk does not have a DPLL as a parent?  error in the clock data */
+        if (!pclk) {
+                WARN_ON(1);
+                return NULL;
+        }
+        return pclk;
+}
 /**
 * omap3_clkoutx2_recalc - recalculate DPLL X2 output virtual clock rate
 * @clk: DPLL output struct clk
@@ -637,27 +663,14 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
        unsigned long rate;
        u32 v;
        struct clk_hw_omap *pclk = NULL;
-        struct clk *parent;
        if (!parent_rate)
                return 0;
-        /* Walk up the parents of clk, looking for a DPLL */
+        pclk = omap3_find_clkoutx2_dpll(hw);
-        do {
-                do {
-                        parent = __clk_get_parent(hw->clk);
-                        hw = __clk_get_hw(parent);
-                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
-                if (!hw)
-                        break;
-                pclk = to_clk_hw_omap(hw);
-        } while (pclk && !pclk->dpll_data);
-        /* clk does not have a DPLL as a parent?  error in the clock data */
+        if (!pclk)
-        if (!pclk) {
-                WARN_ON(1);
                return 0;
-        }
        dd = pclk->dpll_data;
@@ -672,6 +685,55 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
        return rate;
 }
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate)
+{
+        return 0;
+}
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate)
+{
+        const struct dpll_data *dd;
+        u32 v;
+        struct clk_hw_omap *pclk = NULL;
+        if (!*prate)
+                return 0;
+        pclk = omap3_find_clkoutx2_dpll(hw);
+        if (!pclk)
+                return 0;
+        dd = pclk->dpll_data;
+        /* TYPE J does not have a clkoutx2 */
+        if (dd->flags & DPLL_J_TYPE) {
+                *prate = __clk_round_rate(__clk_get_parent(pclk->hw.clk), rate);
+                return *prate;
+        }
+        WARN_ON(!dd->enable_mask);
+        v = omap2_clk_readl(pclk, dd->control_reg) & dd->enable_mask;
+        v >>= __ffs(dd->enable_mask);
+        /* If in bypass, the rate is fixed to the bypass rate*/
+        if (v != OMAP3XXX_EN_DPLL_LOCKED)
+                return *prate;
+        if (__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT) {
+                unsigned long best_parent;
+                best_parent = (rate / 2);
+                *prate = __clk_round_rate(__clk_get_parent(hw->clk),
+                                best_parent);
+        }
+        return *prate * 2;
+}
 /* OMAP3/4 non-CORE DPLL clkops */
 const struct clk_hw_omap_ops clkhwops_omap3_dpll = {
        .allow_idle     = omap3_dpll_allow_idle,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 42d81885c700..1f33f5db10d5 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1947,29 +1947,31 @@ static int _ocp_softreset(struct omap_hwmod *oh)
                goto dis_opt_clks;
        _write_sysconfig(v, oh);
-        ret = _clear_softreset(oh, &v);
-        if (ret)
-                goto dis_opt_clks;
-        _write_sysconfig(v, oh);
        if (oh->class->sysc->srst_udelay)
                udelay(oh->class->sysc->srst_udelay);
        c = _wait_softreset_complete(oh);
-        if (c == MAX_MODULE_SOFTRESET_WAIT)
+        if (c == MAX_MODULE_SOFTRESET_WAIT) {
                pr_warning("omap_hwmod: %s: softreset failed (waited %d usec)\n",
                           oh->name, MAX_MODULE_SOFTRESET_WAIT);
-        else
+                ret = -ETIMEDOUT;
+                goto dis_opt_clks;
+        } else {
                pr_debug("omap_hwmod: %s: softreset in %d usec\n", oh->name, c);
+        }
+        ret = _clear_softreset(oh, &v);
+        if (ret)
+                goto dis_opt_clks;
+        _write_sysconfig(v, oh);
        /*
         * XXX add _HWMOD_STATE_WEDGED for modules that don't come back from
         * _wait_target_ready() or _reset()
         */
-        ret = (c == MAX_MODULE_SOFTRESET_WAIT) ? -ETIMEDOUT : 0;
 dis_opt_clks:
        if (oh->flags & HWMOD_CONTROL_OPT_CLKS_IN_RESET)
                _disable_optional_clocks(oh);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 18f333c440db..810c205d668b 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1365,11 +1365,10 @@ static struct omap_hwmod_class_sysconfig dra7xx_spinlock_sysc = {
        .rev_offs       = 0x0000,
        .sysc_offs      = 0x0010,
        .syss_offs      = 0x0014,
-        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_ENAWAKEUP |
-                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
+                           SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
-                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
+                           SYSS_HAS_RESET_STATUS),
-        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
-                           SIDLE_SMART_WKUP),
        .sysc_fields    = &omap_hwmod_sysc_type1,
 };
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 3d5b24dcd9a4..c33e07e2f0d4 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -22,6 +22,8 @@
 #include "common-board-devices.h"
 #include "dss-common.h"
 #include "control.h"
+#include "omap-secure.h"
+#include "soc.h"
 struct pdata_init {
        const char *compatible;
@@ -169,6 +171,22 @@ static void __init am3517_evm_legacy_init(void)
        omap_ctrl_writel(v, AM35XX_CONTROL_IP_SW_RESET);
        omap_ctrl_readl(AM35XX_CONTROL_IP_SW_RESET); /* OCP barrier */
 }
+static void __init nokia_n900_legacy_init(void)
+{
+        hsmmc2_internal_input_clk();
+        if (omap_type() == OMAP2_DEVICE_TYPE_SEC) {
+                if (IS_ENABLED(CONFIG_ARM_ERRATA_430973)) {
+                        pr_info("RX-51: Enabling ARM errata 430973 workaround\n");
+                        /* set IBE to 1 */
+                        rx51_secure_update_aux_cr(BIT(6), 0);
+                } else {
+                        pr_warning("RX-51: Not enabling ARM errata 430973 workaround\n");
+                        pr_warning("Thumb binaries may crash randomly without this workaround\n");
+                }
+        }
+}
 #endif /* CONFIG_ARCH_OMAP3 */
 #ifdef CONFIG_ARCH_OMAP4
@@ -239,6 +257,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 #endif
 #ifdef CONFIG_ARCH_OMAP3
        OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002030, "48002030.pinmux", &pcs_pdata),
+        OF_DEV_AUXDATA("ti,omap3-padconf", 0x480025a0, "480025a0.pinmux", &pcs_pdata),
        OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002a00, "48002a00.pinmux", &pcs_pdata),
        /* Only on am3517 */
        OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
@@ -259,7 +278,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 static struct pdata_init pdata_quirks[] __initdata = {
 #ifdef CONFIG_ARCH_OMAP3
        { "compulab,omap3-sbc-t3730", omap3_sbc_t3730_legacy_init, },
-        { "nokia,omap3-n900", hsmmc2_internal_input_clk, },
+        { "nokia,omap3-n900", nokia_n900_legacy_init, },
        { "nokia,omap3-n9", hsmmc2_internal_input_clk, },
        { "nokia,omap3-n950", hsmmc2_internal_input_clk, },
        { "isee,omap3-igep0020", omap3_igep0020_legacy_init, },
diff --git a/arch/arm/mach-omap2/prminst44xx.c b/arch/arm/mach-omap2/prminst44xx.c
index 6334b96b4097..280f3c58abe5 100644
--- a/arch/arm/mach-omap2/prminst44xx.c
+++ b/arch/arm/mach-omap2/prminst44xx.c
@@ -183,11 +183,11 @@ void omap4_prminst_global_warm_sw_reset(void)
                                        OMAP4_PRM_RSTCTRL_OFFSET);
        v |= OMAP4430_RST_GLOBAL_WARM_SW_MASK;
        omap4_prminst_write_inst_reg(v, OMAP4430_PRM_PARTITION,
-                                 OMAP4430_PRM_DEVICE_INST,
+                                 dev_inst,
                                 OMAP4_PRM_RSTCTRL_OFFSET);
        /* OCP barrier */
        v = omap4_prminst_read_inst_reg(OMAP4430_PRM_PARTITION,
-                                    OMAP4430_PRM_DEVICE_INST,
+                                    dev_inst,
                                    OMAP4_PRM_RSTCTRL_OFFSET);
 }
diff --git a/arch/arm/mach-sa1100/include/mach/collie.h b/arch/arm/mach-sa1100/include/mach/collie.h
index f33679d2d3ee..50e1d850ee2e 100644
--- a/arch/arm/mach-sa1100/include/mach/collie.h
+++ b/arch/arm/mach-sa1100/include/mach/collie.h
@@ -13,6 +13,8 @@
 #ifndef __ASM_ARCH_COLLIE_H
 #define __ASM_ARCH_COLLIE_H
+#include "hardware.h" /* Gives GPIO_MAX */
 extern void locomolcd_power(int on);
 #define COLLIE_SCOOP_GPIO_BASE  (GPIO_MAX + 1)
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 2b3a56414271..ef69152f9b52 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -264,6 +264,9 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
                        note_page(st, addr, 3, pmd_val(*pmd));
                else
                        walk_pte(st, pmd, addr);
+                if (SECTION_SIZE < PMD_SIZE && pmd_large(pmd[1]))
+                        note_page(st, addr + SECTION_SIZE, 3, pmd_val(pmd[1]));
        }
 }
diff --git a/arch/c6x/include/asm/cache.h b/arch/c6x/include/asm/cache.h
index 09c5a0f5f4d1..86648c083bb4 100644
--- a/arch/c6x/include/asm/cache.h
+++ b/arch/c6x/include/asm/cache.h
@@ -12,6 +12,7 @@
 #define _ASM_C6X_CACHE_H
 #include <linux/irqflags.h>
+#include <linux/init.h>
 /*
 * Cache line size
diff --git a/arch/cris/include/asm/bitops.h b/arch/cris/include/asm/bitops.h
index 184066ceb1f6..053c17b36559 100644
--- a/arch/cris/include/asm/bitops.h
+++ b/arch/cris/include/asm/bitops.h
@@ -144,7 +144,7 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
 * definition, which doesn't have the same semantics.  We don't want to
 * use -fno-builtin, so just hide the name ffs.
 */
-#define ffs kernel_ffs
+#define ffs(x) kernel_ffs(x)
 #include <asm-generic/bitops/fls.h>
 #include <asm-generic/bitops/__fls.h>
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index a96bcf83a735..20e8a9b21d75 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -98,7 +98,7 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
        /* attempt to allocate a granule's worth of cached memory pages */
        page = alloc_pages_exact_node(nid,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                IA64_GRANULE_SHIFT-PAGE_SHIFT);
        if (!page) {
                mutex_unlock(&uc_pool->add_chunk_mutex);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 8d4c247f1738..af064d28b365 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1048,6 +1048,15 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
        flush_altivec_to_thread(src);
        flush_vsx_to_thread(src);
        flush_spe_to_thread(src);
+        /*
+         * Flush TM state out so we can copy it.  __switch_to_tm() does this
+         * flush but it removes the checkpointed state from the current CPU and
+         * transitions the CPU out of TM mode.  Hence we need to call
+         * tm_recheckpoint_new_task() (on the same task) to restore the
+         * checkpointed state back and the TM mode.
+         */
+        __switch_to_tm(src);
+        tm_recheckpoint_new_task(src);
        *dst = *src;
diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
index 1482327cfeba..d88736fbece6 100644
--- a/arch/powerpc/kernel/reloc_64.S
+++ b/arch/powerpc/kernel/reloc_64.S
@@ -81,6 +81,7 @@ _GLOBAL(relocate)
 6:      blr
+.balign 8
 p_dyn:  .llong  __dynamic_start - 0b
 p_rela: .llong  __rela_dyn_start - 0b
 p_st:   .llong  _stext - 0b
diff --git a/arch/powerpc/platforms/cell/ras.c b/arch/powerpc/platforms/cell/ras.c
index 5ec1e47a0d77..e865d748179b 100644
--- a/arch/powerpc/platforms/cell/ras.c
+++ b/arch/powerpc/platforms/cell/ras.c
@@ -123,7 +123,8 @@ static int __init cbe_ptcal_enable_on_node(int nid, int order)
        area->nid = nid;
        area->order = order;
-        area->pages = alloc_pages_exact_node(area->nid, GFP_KERNEL|GFP_THISNODE,
+        area->pages = alloc_pages_exact_node(area->nid,
+                                                GFP_KERNEL|__GFP_THISNODE,
                                                area->order);
        if (!area->pages) {
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index c026cca5602c..f3aaf231b4e5 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -341,10 +341,6 @@ config X86_USE_3DNOW
        def_bool y
        depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-config X86_OOSTORE
-        def_bool y
-        depends on (MWINCHIP3D || MWINCHIPC6) && MTRR
 #
 # P6_NOPs are a relatively minor optimization that require a family >=
 # 6 processor, except that it is broken on certain VIA chips.
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 04a48903b2eb..69bbb4845020 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -85,11 +85,7 @@
 #else
 # define smp_rmb()      barrier()
 #endif
-#ifdef CONFIG_X86_OOSTORE
+#define smp_wmb()       barrier()
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
 #else /* !SMP */
@@ -100,7 +96,7 @@
 #define set_mb(var, value) do { var = value; barrier(); } while (0)
 #endif /* SMP */
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
 /*
 * For either of these options x86 doesn't have a strong TSO memory
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 3d6b9f81cc68..acd86c850414 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -134,6 +134,7 @@ extern void efi_setup_page_tables(void);
 extern void __init old_map_region(efi_memory_desc_t *md);
 extern void __init runtime_code_page_mkexec(void);
 extern void __init efi_runtime_mkexec(void);
+extern void __init efi_apply_memmap_quirks(void);
 struct efi_setup_data {
        u64 fw_vendor;
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 34f69cb9350a..91d9c69a629e 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -237,7 +237,7 @@ memcpy_toio(volatile void __iomem *dst, const void *src, size_t count)
 static inline void flush_write_buffers(void)
 {
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
        asm volatile("lock; addl $0,0(%%esp)": : :"memory");
 #endif
 }
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index bf156ded74b5..0f62f5482d91 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -26,10 +26,9 @@
 # define LOCK_PTR_REG "D"
 #endif
-#if defined(CONFIG_X86_32) && \
+#if defined(CONFIG_X86_32) && (defined(CONFIG_X86_PPRO_FENCE))
-        (defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE))
 /*
- * On PPro SMP or if we are using OOSTORE, we use a locked operation to unlock
+ * On PPro SMP, we use a locked operation to unlock
 * (PPro errata 66, 92)
 */
 # define UNLOCK_LOCK_PREFIX LOCK_PREFIX
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 8779edab684e..d8fba5c15fbd 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -8,236 +8,6 @@
 #include "cpu.h"
-#ifdef CONFIG_X86_OOSTORE
-static u32 power2(u32 x)
-{
-        u32 s = 1;
-        while (s <= x)
-                s <<= 1;
-        return s >>= 1;
-}
-/*
- * Set up an actual MCR
- */
-static void centaur_mcr_insert(int reg, u32 base, u32 size, int key)
-{
-        u32 lo, hi;
-        hi = base & ~0xFFF;
-        lo = ~(size-1);         /* Size is a power of 2 so this makes a mask */
-        lo &= ~0xFFF;           /* Remove the ctrl value bits */
-        lo |= key;              /* Attribute we wish to set */
-        wrmsr(reg+MSR_IDT_MCR0, lo, hi);
-        mtrr_centaur_report_mcr(reg, lo, hi);   /* Tell the mtrr driver */
-}
-/*
- * Figure what we can cover with MCR's
- *
- * Shortcut: We know you can't put 4Gig of RAM on a winchip
- */
-static u32 ramtop(void)
-{
-        u32 clip = 0xFFFFFFFFUL;
-        u32 top = 0;
-        int i;
-        for (i = 0; i < e820.nr_map; i++) {
-                unsigned long start, end;
-                if (e820.map[i].addr > 0xFFFFFFFFUL)
-                        continue;
-                /*
-                 * Don't MCR over reserved space. Ignore the ISA hole
-                 * we frob around that catastrophe already
-                 */
-                if (e820.map[i].type == E820_RESERVED) {
-                        if (e820.map[i].addr >= 0x100000UL &&
-                            e820.map[i].addr < clip)
-                                clip = e820.map[i].addr;
-                        continue;
-                }
-                start = e820.map[i].addr;
-                end = e820.map[i].addr + e820.map[i].size;
-                if (start >= end)
-                        continue;
-                if (end > top)
-                        top = end;
-        }
-        /*
-         * Everything below 'top' should be RAM except for the ISA hole.
-         * Because of the limited MCR's we want to map NV/ACPI into our
-         * MCR range for gunk in RAM
-         *
-         * Clip might cause us to MCR insufficient RAM but that is an
-         * acceptable failure mode and should only bite obscure boxes with
-         * a VESA hole at 15Mb
-         *
-         * The second case Clip sometimes kicks in is when the EBDA is marked
-         * as reserved. Again we fail safe with reasonable results
-         */
-        if (top > clip)
-                top = clip;
-        return top;
-}
-/*
- * Compute a set of MCR's to give maximum coverage
- */
-static int centaur_mcr_compute(int nr, int key)
-{
-        u32 mem = ramtop();
-        u32 root = power2(mem);
-        u32 base = root;
-        u32 top = root;
-        u32 floor = 0;
-        int ct = 0;
-        while (ct < nr) {
-                u32 fspace = 0;
-                u32 high;
-                u32 low;
-                /*
-                 * Find the largest block we will fill going upwards
-                 */
-                high = power2(mem-top);
-                /*
-                 * Find the largest block we will fill going downwards
-                 */
-                low = base/2;
-                /*
-                 * Don't fill below 1Mb going downwards as there
-                 * is an ISA hole in the way.
-                 */
-                if (base <= 1024*1024)
-                        low = 0;
-                /*
-                 * See how much space we could cover by filling below
-                 * the ISA hole
-                 */
-                if (floor == 0)
-                        fspace = 512*1024;
-                else if (floor == 512*1024)
-                        fspace = 128*1024;
-                /* And forget ROM space */
-                /*
-                 * Now install the largest coverage we get
-                 */
-                if (fspace > high && fspace > low) {
-                        centaur_mcr_insert(ct, floor, fspace, key);
-                        floor += fspace;
-                } else if (high > low) {
-                        centaur_mcr_insert(ct, top, high, key);
-                        top += high;
-                } else if (low > 0) {
-                        base -= low;
-                        centaur_mcr_insert(ct, base, low, key);
-                } else
-                        break;
-                ct++;
-        }
-        /*
-         * We loaded ct values. We now need to set the mask. The caller
-         * must do this bit.
-         */
-        return ct;
-}
-static void centaur_create_optimal_mcr(void)
-{
-        int used;
-        int i;
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining and weak write ordered.
-         *
-         * To experiment with: Linux never uses stack operations for
-         * mmio spaces so we could globally enable stack operation wc
-         *
-         * Load the registers with type 31 - full write combining, all
-         * writes weakly ordered.
-         */
-        used = centaur_mcr_compute(6, 31);
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-static void winchip2_create_optimal_mcr(void)
-{
-        u32 lo, hi;
-        int used;
-        int i;
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining, weak store ordered.
-         *
-         * Load the registers with type 25
-         *      8       -       weak write ordering
-         *      16      -       weak read ordering
-         *      1       -       write combining
-         */
-        used = centaur_mcr_compute(6, 25);
-        /*
-         * Mark the registers we are using.
-         */
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        for (i = 0; i < used; i++)
-                lo |= 1<<(9+i);
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-/*
- * Handle the MCR key on the Winchip 2.
- */
-static void winchip2_unprotect_mcr(void)
-{
-        u32 lo, hi;
-        u32 key;
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        key = (lo>>17) & 7;
-        lo |= key<<6;   /* replace with unlock key */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-static void winchip2_protect_mcr(void)
-{
-        u32 lo, hi;
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-#endif /* CONFIG_X86_OOSTORE */
 #define ACE_PRESENT     (1 << 6)
 #define ACE_ENABLED     (1 << 7)
 #define ACE_FCR         (1 << 28)       /* MSR_VIA_FCR */
@@ -362,20 +132,6 @@ static void init_centaur(struct cpuinfo_x86 *c)
                        fcr_clr = DPDC;
                        printk(KERN_NOTICE "Disabling bugged TSC.\n");
                        clear_cpu_cap(c, X86_FEATURE_TSC);
-#ifdef CONFIG_X86_OOSTORE
-                        centaur_create_optimal_mcr();
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         *
-                         * The C6 original lacks weak read order
-                         *
-                         * Note 0x120 is write only on Winchip 1
-                         */
-                        wrmsr(MSR_IDT_MCR_CTRL, 0x01F0001F, 0);
-#endif
                        break;
                case 8:
                        switch (c->x86_mask) {
@@ -392,40 +148,12 @@ static void init_centaur(struct cpuinfo_x86 *c)
                        fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                  E2MMX|EAMD3D;
                        fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                        break;
                case 9:
                        name = "3";
                        fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                  E2MMX|EAMD3D;
                        fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                        break;
                default:
                        name = "??";
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 81ba27679f18..f36bd42d6f0c 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -544,6 +544,10 @@ ENDPROC(early_idt_handlers)
        /* This is global to keep gas from relaxing the jumps */
 ENTRY(early_idt_handler)
        cld
+        cmpl $2,(%esp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
        cmpl $2,%ss:early_recursion_flag
        je hlt_loop
        incl %ss:early_recursion_flag
@@ -594,8 +598,9 @@ ex_entry:
        pop %edx
        pop %ecx
        pop %eax
-        addl $8,%esp            /* drop vector number and error code */
        decl %ss:early_recursion_flag
+is_nmi:
+        addl $8,%esp            /* drop vector number and error code */
        iret
 ENDPROC(early_idt_handler)
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index e1aabdb314c8..a468c0a65c42 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -343,6 +343,9 @@ early_idt_handlers:
 ENTRY(early_idt_handler)
        cld
+        cmpl $2,(%rsp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
        cmpl $2,early_recursion_flag(%rip)
        jz  1f
        incl early_recursion_flag(%rip)
@@ -405,8 +408,9 @@ ENTRY(early_idt_handler)
        popq %rdx
        popq %rcx
        popq %rax
-        addq $16,%rsp           # drop vector number and error code
        decl early_recursion_flag(%rip)
+is_nmi:
+        addq $16,%rsp           # drop vector number and error code
        INTERRUPT_RETURN
 ENDPROC(early_idt_handler)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 06853e670354..ce72964b2f46 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1239,14 +1239,8 @@ void __init setup_arch(char **cmdline_p)
        register_refined_jiffies(CLOCK_TICK_RATE);
 #ifdef CONFIG_EFI
-        /* Once setup is done above, unmap the EFI memory map on
+        if (efi_enabled(EFI_BOOT))
-         * mismatched firmware/kernel archtectures since there is no
+                efi_apply_memmap_quirks();
-         * support for runtime services.
-         */
-        if (efi_enabled(EFI_BOOT) && !efi_is_native()) {
-                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
-                efi_unmap_memmap();
-        }
 #endif
 }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e81df8fce027..2de1bc09a8d4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3002,10 +3002,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
        u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
        /* instruction emulation calls kvm_set_cr8() */
        r = cr_interception(svm);
-        if (irqchip_in_kernel(svm->vcpu.kvm)) {
+        if (irqchip_in_kernel(svm->vcpu.kvm))
-                clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
                return r;
-        }
        if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
                return r;
        kvm_run->exit_reason = KVM_EXIT_SET_TPR;
@@ -3567,6 +3565,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
        if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
                return;
+        clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
        if (irr == -1)
                return;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 6dea040cc3a1..a10c8c792161 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1020,13 +1020,17 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
 * This routine handles page faults.  It determines the address,
 * and the problem, and then passes it off to one of the appropriate
 * routines.
+ *
+ * This function must have noinline because both callers
+ * {,trace_}do_page_fault() have notrace on. Having this an actual function
+ * guarantees there's a function trace entry.
 */
-static void __kprobes
+static void __kprobes noinline
-__do_page_fault(struct pt_regs *regs, unsigned long error_code)
+__do_page_fault(struct pt_regs *regs, unsigned long error_code,
+                unsigned long address)
 {
        struct vm_area_struct *vma;
        struct task_struct *tsk;
-        unsigned long address;
        struct mm_struct *mm;
        int fault;
        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -1034,9 +1038,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
        tsk = current;
        mm = tsk->mm;
-        /* Get the faulting address: */
-        address = read_cr2();
        /*
         * Detect and handle instructions that would cause a page fault for
         * both a tracked kernel page and a userspace page.
@@ -1248,32 +1249,50 @@ good_area:
        up_read(&mm->mmap_sem);
 }
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        unsigned long address = read_cr2(); /* Get the faulting address */
        enum ctx_state prev_state;
+        /*
+         * We must have this function tagged with __kprobes, notrace and call
+         * read_cr2() before calling anything else. To avoid calling any kind
+         * of tracing machinery before we've observed the CR2 value.
+         *
+         * exception_{enter,exit}() contain all sorts of tracepoints.
+         */
        prev_state = exception_enter();
-        __do_page_fault(regs, error_code);
+        __do_page_fault(regs, error_code, address);
        exception_exit(prev_state);
 }
-static void trace_page_fault_entries(struct pt_regs *regs,
+#ifdef CONFIG_TRACING
+static void trace_page_fault_entries(unsigned long address, struct pt_regs *regs,
                                     unsigned long error_code)
 {
        if (user_mode(regs))
-                trace_page_fault_user(read_cr2(), regs, error_code);
+                trace_page_fault_user(address, regs, error_code);
        else
-                trace_page_fault_kernel(read_cr2(), regs, error_code);
+                trace_page_fault_kernel(address, regs, error_code);
 }
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        /*
+         * The exception_enter and tracepoint processing could
+         * trigger another page faults (user space callchain
+         * reading) and destroy the original cr2 value, so read
+         * the faulting address now.
+         */
+        unsigned long address = read_cr2();
        enum ctx_state prev_state;
        prev_state = exception_enter();
-        trace_page_fault_entries(regs, error_code);
+        trace_page_fault_entries(address, regs, error_code);
-        __do_page_fault(regs, error_code);
+        __do_page_fault(regs, error_code, address);
        exception_exit(prev_state);
 }
+#endif /* CONFIG_TRACING */
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 1a201ac7cef8..b97acecf3fd9 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -52,6 +52,7 @@
 #include <asm/tlbflush.h>
 #include <asm/x86_init.h>
 #include <asm/rtc.h>
+#include <asm/uv/uv.h>
 #define EFI_DEBUG
@@ -1210,3 +1211,22 @@ static int __init parse_efi_cmdline(char *str)
        return 0;
 }
 early_param("efi", parse_efi_cmdline);
+void __init efi_apply_memmap_quirks(void)
+{
+        /*
+         * Once setup is done earlier, unmap the EFI memory map on mismatched
+         * firmware/kernel architectures since there is no support for runtime
+         * services.
+         */
+        if (!efi_is_native()) {
+                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
+                efi_unmap_memmap();
+        }
+        /*
+         * UV doesn't support the new EFI pagetable mapping yet.
+         */
+        if (is_uv_system())
+                set_bit(EFI_OLD_MEMMAP, &x86_efi_facility);
+}
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index 7d01b8c56c00..cc04e67bfd05 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -40,11 +40,7 @@
 #define smp_rmb()       barrier()
 #endif /* CONFIG_X86_PPRO_FENCE */
-#ifdef CONFIG_X86_OOSTORE
-#define smp_wmb()       wmb()
-#else /* CONFIG_X86_OOSTORE */
 #define smp_wmb()       barrier()
-#endif /* CONFIG_X86_OOSTORE */
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
diff --git a/block/blk-exec.c b/block/blk-exec.c
index c68613bb4c79..dbf4502b1d67 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -65,7 +65,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
         * be resued after dying flag is set
         */
        if (q->mq_ops) {
-                blk_mq_insert_request(q, rq, at_head, true);
+                blk_mq_insert_request(rq, at_head, true, false);
                return;
        }
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 66e2b697f5db..f598f794c3c6 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -137,7 +137,7 @@ static void mq_flush_run(struct work_struct *work)
        rq = container_of(work, struct request, mq_flush_work);
        memset(&rq->csd, 0, sizeof(rq->csd));
-        blk_mq_run_request(rq, true, false);
+        blk_mq_insert_request(rq, false, true, false);
 }
 static bool blk_flush_queue_rq(struct request *rq)
@@ -411,7 +411,7 @@ void blk_insert_flush(struct request *rq)
        if ((policy & REQ_FSEQ_DATA) &&
            !(policy & (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH))) {
                if (q->mq_ops) {
-                        blk_mq_run_request(rq, false, true);
+                        blk_mq_insert_request(rq, false, false, true);
                } else
                        list_add_tail(&rq->queuelist, &q->queue_head);
                return;
diff --git a/block/blk-mq-cpu.c b/block/blk-mq-cpu.c
index 3146befb56aa..136ef8643bba 100644
--- a/block/blk-mq-cpu.c
+++ b/block/blk-mq-cpu.c
@@ -11,7 +11,7 @@
 #include "blk-mq.h"
 static LIST_HEAD(blk_mq_cpu_notify_list);
-static DEFINE_SPINLOCK(blk_mq_cpu_notify_lock);
+static DEFINE_RAW_SPINLOCK(blk_mq_cpu_notify_lock);
 static int blk_mq_main_cpu_notify(struct notifier_block *self,
                                  unsigned long action, void *hcpu)
@@ -19,12 +19,12 @@ static int blk_mq_main_cpu_notify(struct notifier_block *self,
        unsigned int cpu = (unsigned long) hcpu;
        struct blk_mq_cpu_notifier *notify;
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
        list_for_each_entry(notify, &blk_mq_cpu_notify_list, list)
                notify->notify(notify->data, action, cpu);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
        return NOTIFY_OK;
 }
@@ -32,16 +32,16 @@ void blk_mq_register_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
        BUG_ON(!notifier->notify);
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
        list_add_tail(&notifier->list, &blk_mq_cpu_notify_list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 void blk_mq_unregister_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
        list_del(&notifier->list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 void blk_mq_init_cpu_notifier(struct blk_mq_cpu_notifier *notifier,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1fa9dd153fde..883f72089015 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -73,8 +73,8 @@ static void blk_mq_hctx_mark_pending(struct blk_mq_hw_ctx *hctx,
                set_bit(ctx->index_hw, hctx->ctx_map);
 }
-static struct request *blk_mq_alloc_rq(struct blk_mq_hw_ctx *hctx, gfp_t gfp,
+static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
-                                       bool reserved)
+                                              gfp_t gfp, bool reserved)
 {
        struct request *rq;
        unsigned int tag;
@@ -193,12 +193,6 @@ static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
        ctx->rq_dispatched[rw_is_sync(rw_flags)]++;
 }
-static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
-                                              gfp_t gfp, bool reserved)
-{
-        return blk_mq_alloc_rq(hctx, gfp, reserved);
-}
 static struct request *blk_mq_alloc_request_pinned(struct request_queue *q,
                                                   int rw, gfp_t gfp,
                                                   bool reserved)
@@ -289,38 +283,10 @@ void blk_mq_free_request(struct request *rq)
        __blk_mq_free_request(hctx, ctx, rq);
 }
-static void blk_mq_bio_endio(struct request *rq, struct bio *bio, int error)
+bool blk_mq_end_io_partial(struct request *rq, int error, unsigned int nr_bytes)
-{
-        if (error)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        else if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
-                error = -EIO;
-        if (unlikely(rq->cmd_flags & REQ_QUIET))
-                set_bit(BIO_QUIET, &bio->bi_flags);
-        /* don't actually finish bio if it's part of flush sequence */
-        if (!(rq->cmd_flags & REQ_FLUSH_SEQ))
-                bio_endio(bio, error);
-}
-void blk_mq_end_io(struct request *rq, int error)
 {
-        struct bio *bio = rq->bio;
+        if (blk_update_request(rq, error, blk_rq_bytes(rq)))
-        unsigned int bytes = 0;
+                return true;
-        trace_block_rq_complete(rq->q, rq);
-        while (bio) {
-                struct bio *next = bio->bi_next;
-                bio->bi_next = NULL;
-                bytes += bio->bi_iter.bi_size;
-                blk_mq_bio_endio(rq, bio, error);
-                bio = next;
-        }
-        blk_account_io_completion(rq, bytes);
        blk_account_io_done(rq);
@@ -328,8 +294,9 @@ void blk_mq_end_io(struct request *rq, int error)
                rq->end_io(rq, error);
        else
                blk_mq_free_request(rq);
+        return false;
 }
-EXPORT_SYMBOL(blk_mq_end_io);
+EXPORT_SYMBOL(blk_mq_end_io_partial);
 static void __blk_mq_complete_request_remote(void *data)
 {
@@ -730,60 +697,27 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
        blk_mq_add_timer(rq);
 }
-void blk_mq_insert_request(struct request_queue *q, struct request *rq,
+void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
-                           bool at_head, bool run_queue)
+                bool async)
 {
+        struct request_queue *q = rq->q;
        struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
+        struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;
+        current_ctx = blk_mq_get_ctx(q);
+        if (!cpu_online(ctx->cpu))
+                rq->mq_ctx = ctx = current_ctx;
-        ctx = rq->mq_ctx;
        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA)) {
+        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA) &&
+            !(rq->cmd_flags & (REQ_FLUSH_SEQ))) {
                blk_insert_flush(rq);
        } else {
-                current_ctx = blk_mq_get_ctx(q);
-                if (!cpu_online(ctx->cpu)) {
-                        ctx = current_ctx;
-                        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-                        rq->mq_ctx = ctx;
-                }
                spin_lock(&ctx->lock);
                __blk_mq_insert_request(hctx, rq, at_head);
                spin_unlock(&ctx->lock);
-                blk_mq_put_ctx(current_ctx);
-        }
-        if (run_queue)
-                __blk_mq_run_hw_queue(hctx);
-}
-EXPORT_SYMBOL(blk_mq_insert_request);
-/*
- * This is a special version of blk_mq_insert_request to bypass FLUSH request
- * check. Should only be used internally.
- */
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async)
-{
-        struct request_queue *q = rq->q;
-        struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
-        current_ctx = blk_mq_get_ctx(q);
-        ctx = rq->mq_ctx;
-        if (!cpu_online(ctx->cpu)) {
-                ctx = current_ctx;
-                rq->mq_ctx = ctx;
        }
-        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-        /* ctx->cpu might be offline */
-        spin_lock(&ctx->lock);
-        __blk_mq_insert_request(hctx, rq, false);
-        spin_unlock(&ctx->lock);
        blk_mq_put_ctx(current_ctx);
@@ -926,6 +860,8 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
        ctx = blk_mq_get_ctx(q);
        hctx = q->mq_ops->map_queue(q, ctx->cpu);
+        if (is_sync)
+                rw |= REQ_SYNC;
        trace_block_getrq(q, bio, rw);
        rq = __blk_mq_alloc_request(hctx, GFP_ATOMIC, false);
        if (likely(rq))
diff --git a/block/blk-mq.h b/block/blk-mq.h
index ed0035cd458e..72beba1f9d55 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -23,7 +23,6 @@ struct blk_mq_ctx {
 };
 void __blk_mq_complete_request(struct request *rq);
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async);
 void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_init_flush(struct request_queue *q);
 void blk_mq_drain_queue(struct request_queue *q);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 959d41acc108..d7d32c28829b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -67,6 +67,8 @@ enum ec_command {
 #define ACPI_EC_DELAY           500     /* Wait 500ms max. during EC ops */
 #define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
 #define ACPI_EC_MSI_UDELAY      550     /* Wait 550us for MSI EC */
+#define ACPI_EC_CLEAR_MAX       100     /* Maximum number of events to query
+                                         * when trying to clear the EC */
 enum {
        EC_FLAGS_QUERY_PENDING,         /* Query is pending */
@@ -116,6 +118,7 @@ EXPORT_SYMBOL(first_ec);
 static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
+static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 /* --------------------------------------------------------------------------
                             Transaction Management
@@ -440,6 +443,29 @@ acpi_handle ec_get_handle(void)
 EXPORT_SYMBOL(ec_get_handle);
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+/*
+ * Clears stale _Q events that might have accumulated in the EC.
+ * Run with locked ec mutex.
+ */
+static void acpi_ec_clear(struct acpi_ec *ec)
+{
+        int i, status;
+        u8 value = 0;
+        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+                status = acpi_ec_query_unlocked(ec, &value);
+                if (status || !value)
+                        break;
+        }
+        if (unlikely(i == ACPI_EC_CLEAR_MAX))
+                pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
+        else
+                pr_info("%d stale EC events cleared\n", i);
+}
 void acpi_ec_block_transactions(void)
 {
        struct acpi_ec *ec = first_ec;
@@ -463,6 +489,10 @@ void acpi_ec_unblock_transactions(void)
        mutex_lock(&ec->mutex);
        /* Allow transactions to be carried out again */
        clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
+        if (EC_FLAGS_CLEAR_ON_RESUME)
+                acpi_ec_clear(ec);
        mutex_unlock(&ec->mutex);
 }
@@ -821,6 +851,13 @@ static int acpi_ec_add(struct acpi_device *device)
        /* EC is fully operational, allow queries */
        clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+        /* Clear stale _Q events if hardware might require that */
+        if (EC_FLAGS_CLEAR_ON_RESUME) {
+                mutex_lock(&ec->mutex);
+                acpi_ec_clear(ec);
+                mutex_unlock(&ec->mutex);
+        }
        return ret;
 }
@@ -922,6 +959,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
        return 0;
 }
+/*
+ * On some hardware it is necessary to clear events accumulated by the EC during
+ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
+ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
+ *
+ * Ideally, the EC should also be instructed NOT to accumulate events during
+ * sleep (which Windows seems to do somehow), but the interface to control this
+ * behaviour is not known at this time.
+ *
+ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
+ * however it is very likely that other Samsung models are affected.
+ *
+ * On systems which don't accumulate _Q events during sleep, this extra check
+ * should be harmless.
+ */
+static int ec_clear_on_resume(const struct dmi_system_id *id)
+{
+        pr_debug("Detected system needing EC poll on resume.\n");
+        EC_FLAGS_CLEAR_ON_RESUME = 1;
+        return 0;
+}
 static struct dmi_system_id ec_dmi_table[] __initdata = {
        {
        ec_skip_dsdt_scan, "Compal JFL92", {
@@ -965,6 +1026,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
        ec_validate_ecdt, "ASUS hardware", {
        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
        DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+        {
+        ec_clear_on_resume, "Samsung hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
        {},
 };
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index b7201fc6f1e1..0bdacc5e26a3 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
        switch (ares->type) {
        case ACPI_RESOURCE_TYPE_MEMORY24:
                memory24 = &ares->data.memory24;
+                if (!memory24->address_length)
+                        return false;
                acpi_dev_get_memresource(res, memory24->minimum,
                                         memory24->address_length,
                                         memory24->write_protect);
                break;
        case ACPI_RESOURCE_TYPE_MEMORY32:
                memory32 = &ares->data.memory32;
+                if (!memory32->address_length)
+                        return false;
                acpi_dev_get_memresource(res, memory32->minimum,
                                         memory32->address_length,
                                         memory32->write_protect);
                break;
        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                fixed_memory32 = &ares->data.fixed_memory32;
+                if (!fixed_memory32->address_length)
+                        return false;
                acpi_dev_get_memresource(res, fixed_memory32->address,
                                         fixed_memory32->address_length,
                                         fixed_memory32->write_protect);
@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
        switch (ares->type) {
        case ACPI_RESOURCE_TYPE_IO:
                io = &ares->data.io;
+                if (!io->address_length)
+                        return false;
                acpi_dev_get_ioresource(res, io->minimum,
                                        io->address_length,
                                        io->io_decode);
                break;
        case ACPI_RESOURCE_TYPE_FIXED_IO:
                fixed_io = &ares->data.fixed_io;
+                if (!fixed_io->address_length)
+                        return false;
                acpi_dev_get_ioresource(res, fixed_io->address,
                                        fixed_io->address_length,
                                        ACPI_DECODE_10);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1a3dbd1b196e..8cb2522d592a 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4175,6 +4175,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+        { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
        /* Blacklist entries taken from Silicon Image 3124/3132
           Windows driver .inf file - also several Linux problem reports */
@@ -4224,7 +4225,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* devices that don't properly handle queued TRIM commands */
        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b52e9a6d6aad..54174cb32feb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -53,7 +53,7 @@
 #define MTIP_FTL_REBUILD_TIMEOUT_MS     2400000
 /* unaligned IO handling */
-#define MTIP_MAX_UNALIGNED_SLOTS        8
+#define MTIP_MAX_UNALIGNED_SLOTS        2
 /* Macro to extract the tag bit number from a tag value. */
 #define MTIP_TAG_BIT(tag)       (tag & 0x1F)
diff --git a/drivers/clk/shmobile/clk-rcar-gen2.c b/drivers/clk/shmobile/clk-rcar-gen2.c
index dd272a0d1446..99c27b1c625b 100644
--- a/drivers/clk/shmobile/clk-rcar-gen2.c
+++ b/drivers/clk/shmobile/clk-rcar-gen2.c
@@ -26,6 +26,8 @@ struct rcar_gen2_cpg {
        void __iomem *reg;
 };
+#define CPG_FRQCRB                      0x00000004
+#define CPG_FRQCRB_KICK                 BIT(31)
 #define CPG_SDCKCR                      0x00000074
 #define CPG_PLL0CR                      0x000000d8
 #define CPG_FRQCRC                      0x000000e0
@@ -45,6 +47,7 @@ struct rcar_gen2_cpg {
 struct cpg_z_clk {
        struct clk_hw hw;
        void __iomem *reg;
+        void __iomem *kick_reg;
 };
 #define to_z_clk(_hw)   container_of(_hw, struct cpg_z_clk, hw)
@@ -83,17 +86,45 @@ static int cpg_z_clk_set_rate(struct clk_hw *hw, unsigned long rate,
 {
        struct cpg_z_clk *zclk = to_z_clk(hw);
        unsigned int mult;
-        u32 val;
+        u32 val, kick;
+        unsigned int i;
        mult = div_u64((u64)rate * 32, parent_rate);
        mult = clamp(mult, 1U, 32U);
+        if (clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK)
+                return -EBUSY;
        val = clk_readl(zclk->reg);
        val &= ~CPG_FRQCRC_ZFC_MASK;
        val |= (32 - mult) << CPG_FRQCRC_ZFC_SHIFT;
        clk_writel(val, zclk->reg);
-        return 0;
+        /*
+         * Set KICK bit in FRQCRB to update hardware setting and wait for
+         * clock change completion.
+         */
+        kick = clk_readl(zclk->kick_reg);
+        kick |= CPG_FRQCRB_KICK;
+        clk_writel(kick, zclk->kick_reg);
+        /*
+         * Note: There is no HW information about the worst case latency.
+         *
+         * Using experimental measurements, it seems that no more than
+         * ~10 iterations are needed, independently of the CPU rate.
+         * Since this value might be dependant of external xtal rate, pll1
+         * rate or even the other emulation clocks rate, use 1000 as a
+         * "super" safe value.
+         */
+        for (i = 1000; i; i--) {
+                if (!(clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK))
+                        return 0;
+                cpu_relax();
+        }
+        return -ETIMEDOUT;
 }
 static const struct clk_ops cpg_z_clk_ops = {
@@ -120,6 +151,7 @@ static struct clk * __init cpg_z_clk_register(struct rcar_gen2_cpg *cpg)
        init.num_parents = 1;
        zclk->reg = cpg->reg + CPG_FRQCRC;
+        zclk->kick_reg = cpg->reg + CPG_FRQCRB;
        zclk->hw.init = &init;
        clk = clk_register(NULL, &zclk->hw);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index cb003a6b72c8..cf485d928903 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1109,6 +1109,21 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                goto err_set_policy_cpu;
        }
+        /* related cpus should atleast have policy->cpus */
+        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
+        /*
+         * affected cpus must always be the one, which are online. We aren't
+         * managing offline cpus here.
+         */
+        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
+        if (!frozen) {
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
+        down_write(&policy->rwsem);
        write_lock_irqsave(&cpufreq_driver_lock, flags);
        for_each_cpu(j, policy->cpus)
                per_cpu(cpufreq_cpu_data, j) = policy;
@@ -1162,20 +1177,6 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                }
        }
-        /* related cpus should atleast have policy->cpus */
-        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
-        /*
-         * affected cpus must always be the one, which are online. We aren't
-         * managing offline cpus here.
-         */
-        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-        if (!frozen) {
-                policy->user_policy.min = policy->min;
-                policy->user_policy.max = policy->max;
-        }
        blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                     CPUFREQ_START, policy);
@@ -1206,6 +1207,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                policy->user_policy.policy = policy->policy;
                policy->user_policy.governor = policy->governor;
        }
+        up_write(&policy->rwsem);
        kobject_uevent(&policy->kobj, KOBJ_ADD);
        up_read(&cpufreq_rwsem);
@@ -1546,23 +1548,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
 */
 unsigned int cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
        unsigned int ret_freq = 0;
-        if (cpufreq_disabled() || !cpufreq_driver)
+        if (policy) {
-                return -ENOENT;
+                down_read(&policy->rwsem);
+                ret_freq = __cpufreq_get(cpu);
-        BUG_ON(!policy);
+                up_read(&policy->rwsem);
-        if (!down_read_trylock(&cpufreq_rwsem))
-                return 0;
-        down_read(&policy->rwsem);
-        ret_freq = __cpufreq_get(cpu);
-        up_read(&policy->rwsem);
+                cpufreq_cpu_put(policy);
-        up_read(&cpufreq_rwsem);
+        }
        return ret_freq;
 }
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index de4aa409abe2..2c6d5e118ac1 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -916,7 +916,7 @@ static int lookup_existing_device(struct device *dev, void *data)
                old->config_rom_retries = 0;
                fw_notice(card, "rediscovered device %s\n", dev_name(dev));
-                PREPARE_DELAYED_WORK(&old->work, fw_device_update);
+                old->workfn = fw_device_update;
                fw_schedule_device_work(old, 0);
                if (current_node == card->root_node)
@@ -1075,7 +1075,7 @@ static void fw_device_init(struct work_struct *work)
        if (atomic_cmpxchg(&device->state,
                           FW_DEVICE_INITIALIZING,
                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
-                PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                device->workfn = fw_device_shutdown;
                fw_schedule_device_work(device, SHUTDOWN_DELAY);
        } else {
                fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n",
@@ -1196,13 +1196,20 @@ static void fw_device_refresh(struct work_struct *work)
                  dev_name(&device->device), fw_rcode_string(ret));
 gone:
        atomic_set(&device->state, FW_DEVICE_GONE);
-        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+        device->workfn = fw_device_shutdown;
        fw_schedule_device_work(device, SHUTDOWN_DELAY);
 out:
        if (node_id == card->root_node->node_id)
                fw_schedule_bm_work(card, 0);
 }
+static void fw_device_workfn(struct work_struct *work)
+{
+        struct fw_device *device = container_of(to_delayed_work(work),
+                                                struct fw_device, work);
+        device->workfn(work);
+}
 void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 {
        struct fw_device *device;
@@ -1252,7 +1259,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 * power-up after getting plugged in.  We schedule the
                 * first config rom scan half a second after bus reset.
                 */
-                INIT_DELAYED_WORK(&device->work, fw_device_init);
+                device->workfn = fw_device_init;
+                INIT_DELAYED_WORK(&device->work, fw_device_workfn);
                fw_schedule_device_work(device, INITIAL_DELAY);
                break;
@@ -1268,7 +1276,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                if (atomic_cmpxchg(&device->state,
                            FW_DEVICE_RUNNING,
                            FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
+                        device->workfn = fw_device_refresh;
                        fw_schedule_device_work(device,
                                device->is_local ? 0 : INITIAL_DELAY);
                }
@@ -1283,7 +1291,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                smp_wmb();  /* update node_id before generation */
                device->generation = card->generation;
                if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_update);
+                        device->workfn = fw_device_update;
                        fw_schedule_device_work(device, 0);
                }
                break;
@@ -1308,7 +1316,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                device = node->data;
                if (atomic_xchg(&device->state,
                                FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                        device->workfn = fw_device_shutdown;
                        fw_schedule_device_work(device,
                                list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                }
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 6b895986dc22..4af0a7bad7f2 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
        if (rcode == RCODE_COMPLETE) {
                fwnet_transmit_packet_done(ptask);
        } else {
-                fwnet_transmit_packet_failed(ptask);
                if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
                        dev_err(&ptask->dev->netdev->dev,
                                "fwnet_write_complete failed: %x (skipped %d)\n",
@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
                        errors_skipped = 0;
                        last_rcode = rcode;
-                } else
+                } else {
                        errors_skipped++;
+                }
+                fwnet_transmit_packet_failed(ptask);
        }
 }
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 6f74d8d3f700..8db663219560 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -290,7 +290,6 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 #define QUIRK_NO_MSI                    0x10
 #define QUIRK_TI_SLLZ059                0x20
 #define QUIRK_IR_WAKE                   0x40
-#define QUIRK_PHY_LCTRL_TIMEOUT         0x80
 /* In case of multiple matches in ohci_quirks[], only the first one is used. */
 static const struct {
@@ -303,10 +302,7 @@ static const struct {
                QUIRK_BE_HEADERS},
        {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
-                QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI},
+                QUIRK_NO_MSI},
-        {PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID,
-                QUIRK_PHY_LCTRL_TIMEOUT},
        {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
                QUIRK_RESET_PACKET},
@@ -353,7 +349,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0"
        ", disable MSI = "              __stringify(QUIRK_NO_MSI)
        ", TI SLLZ059 erratum = "       __stringify(QUIRK_TI_SLLZ059)
        ", IR wake unreliable = "       __stringify(QUIRK_IR_WAKE)
-        ", phy LCtrl timeout = "        __stringify(QUIRK_PHY_LCTRL_TIMEOUT)
        ")");
 #define OHCI_PARAM_DEBUG_AT_AR          1
@@ -2299,9 +2294,6 @@ static int ohci_enable(struct fw_card *card,
         * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but
         * cannot actually use the phy at that time.  These need tens of
         * millisecods pause between LPS write and first phy access too.
-         *
-         * But do not wait for 50msec on Agere/LSI cards.  Their phy
-         * arbitration state machine may time out during such a long wait.
         */
        reg_write(ohci, OHCI1394_HCControlSet,
@@ -2309,11 +2301,8 @@ static int ohci_enable(struct fw_card *card,
                  OHCI1394_HCControl_postedWriteEnable);
        flush_writes(ohci);
-        if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT))
+        for (lps = 0, i = 0; !lps && i < 3; i++) {
                msleep(50);
-        for (lps = 0, i = 0; !lps && i < 150; i++) {
-                msleep(1);
                lps = reg_read(ohci, OHCI1394_HCControlSet) &
                      OHCI1394_HCControl_LPS;
        }
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..7aef911fdc71 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -146,6 +146,7 @@ struct sbp2_logical_unit {
         */
        int generation;
        int retries;
+        work_func_t workfn;
        struct delayed_work work;
        bool has_sdev;
        bool blocked;
@@ -864,7 +865,7 @@ static void sbp2_login(struct work_struct *work)
        /* set appropriate retry limit(s) in BUSY_TIMEOUT register */
        sbp2_set_busy_timeout(lu);
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
+        lu->workfn = sbp2_reconnect;
        sbp2_agent_reset(lu);
        /* This was a re-login. */
@@ -918,7 +919,7 @@ static void sbp2_login(struct work_struct *work)
         * If a bus reset happened, sbp2_update will have requeued
         * lu->work already.  Reset the work from reconnect to login.
         */
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
 }
 static void sbp2_reconnect(struct work_struct *work)
@@ -952,7 +953,7 @@ static void sbp2_reconnect(struct work_struct *work)
                    lu->retries++ >= 5) {
                        dev_err(tgt_dev(tgt), "failed to reconnect\n");
                        lu->retries = 0;
-                        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+                        lu->workfn = sbp2_login;
                }
                sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
@@ -972,6 +973,13 @@ static void sbp2_reconnect(struct work_struct *work)
        sbp2_conditionally_unblock(lu);
 }
+static void sbp2_lu_workfn(struct work_struct *work)
+{
+        struct sbp2_logical_unit *lu = container_of(to_delayed_work(work),
+                                                struct sbp2_logical_unit, work);
+        lu->workfn(work);
+}
 static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
 {
        struct sbp2_logical_unit *lu;
@@ -998,7 +1006,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
        lu->blocked  = false;
        ++tgt->dont_block;
        INIT_LIST_HEAD(&lu->orb_list);
-        INIT_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
+        INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn);
        list_add_tail(&lu->link, &tgt->lu_list);
        return 0;
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index acf3a36c9ebc..32982da82694 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -68,15 +68,7 @@ void __armada_drm_queue_unref_work(struct drm_device *dev,
 {
        struct armada_private *priv = dev->dev_private;
-        /*
+        WARN_ON(!kfifo_put(&priv->fb_unref, fb));
-         * Yes, we really must jump through these hoops just to store a
-         * _pointer_ to something into the kfifo.  This is utterly insane
-         * and idiotic, because it kfifo requires the _data_ pointed to by
-         * the pointer const, not the pointer itself.  Not only that, but
-         * you have to pass a pointer _to_ the pointer you want stored.
-         */
-        const struct drm_framebuffer *silly_api_alert = fb;
-        WARN_ON(!kfifo_put(&priv->fb_unref, &silly_api_alert));
        schedule_work(&priv->fb_unref_work);
 }
diff --git a/drivers/gpu/drm/bochs/Kconfig b/drivers/gpu/drm/bochs/Kconfig
index c8fcf12019f0..5f8b0c2b9a44 100644
--- a/drivers/gpu/drm/bochs/Kconfig
+++ b/drivers/gpu/drm/bochs/Kconfig
@@ -2,6 +2,7 @@ config DRM_BOCHS
        tristate "DRM Support for bochs dispi vga interface (qemu stdvga)"
        depends on DRM && PCI
        select DRM_KMS_HELPER
+        select DRM_KMS_FB_HELPER
        select FB_SYS_FILLRECT
        select FB_SYS_COPYAREA
        select FB_SYS_IMAGEBLIT
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 04f1f02c4019..ec7bb0fc71bc 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -403,7 +403,7 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 void intel_detect_pch(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct pci_dev *pch;
+        struct pci_dev *pch = NULL;
        /* In all current cases, num_pipes is equivalent to the PCH_NOP setting
         * (which really amounts to a PCH but no South Display).
@@ -424,12 +424,9 @@ void intel_detect_pch(struct drm_device *dev)
         * all the ISA bridge devices and check for the first match, instead
         * of only checking the first one.
         */
-        pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
+        while ((pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, pch))) {
-        while (pch) {
-                struct pci_dev *curr = pch;
                if (pch->vendor == PCI_VENDOR_ID_INTEL) {
-                        unsigned short id;
+                        unsigned short id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
-                        id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
                        dev_priv->pch_id = id;
                        if (id == INTEL_PCH_IBX_DEVICE_ID_TYPE) {
@@ -461,18 +458,16 @@ void intel_detect_pch(struct drm_device *dev)
                                DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
                                WARN_ON(!IS_HASWELL(dev));
                                WARN_ON(!IS_ULT(dev));
-                        } else {
+                        } else
-                                goto check_next;
+                                continue;
-                        }
-                        pci_dev_put(pch);
                        break;
                }
-check_next:
-                pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, curr);
-                pci_dev_put(curr);
        }
        if (!pch)
-                DRM_DEBUG_KMS("No PCH found?\n");
+                DRM_DEBUG_KMS("No PCH found.\n");
+        pci_dev_put(pch);
 }
 bool i915_semaphore_is_enabled(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 1a24e84f2315..d58b4e287e32 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -82,9 +82,22 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
        r = devm_request_mem_region(dev->dev, base, dev_priv->gtt.stolen_size,
                                    "Graphics Stolen Memory");
        if (r == NULL) {
-                DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+                /*
-                          base, base + (uint32_t)dev_priv->gtt.stolen_size);
+                 * One more attempt but this time requesting region from
-                base = 0;
+                 * base + 1, as we have seen that this resolves the region
+                 * conflict with the PCI Bus.
+                 * This is a BIOS w/a: Some BIOS wrap stolen in the root
+                 * PCI bus, but have an off-by-one error. Hence retry the
+                 * reservation starting from 1 instead of 0.
+                 */
+                r = devm_request_mem_region(dev->dev, base + 1,
+                                            dev_priv->gtt.stolen_size - 1,
+                                            "Graphics Stolen Memory");
+                if (r == NULL) {
+                        DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+                                  base, base + (uint32_t)dev_priv->gtt.stolen_size);
+                        base = 0;
+                }
        }
        return base;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 4c1672809493..9b8a7c7ea7fc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1092,12 +1092,12 @@ static void assert_cursor(struct drm_i915_private *dev_priv,
        struct drm_device *dev = dev_priv->dev;
        bool cur_state;
-        if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
+        if (IS_845G(dev) || IS_I865G(dev))
-                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
-        else if (IS_845G(dev) || IS_I865G(dev))
                cur_state = I915_READ(_CURACNTR) & CURSOR_ENABLE;
-        else
+        else if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev))
                cur_state = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
+        else
+                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
        WARN(cur_state != state,
             "cursor on pipe %c assertion failure (expected %s, current %s)\n",
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 6db0d9d17f47..ee3181ebcc92 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -845,7 +845,7 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
 {
        struct drm_device *dev = intel_hdmi_to_dev(hdmi);
-        if (IS_G4X(dev))
+        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
                return 165000;
        else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                return 300000;
@@ -899,8 +899,8 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
         * outputs. We also need to check that the higher clock still fits
         * within limits.
         */
-        if (pipe_config->pipe_bpp > 8*3 && clock_12bpc <= portclock_limit
+        if (pipe_config->pipe_bpp > 8*3 && intel_hdmi->has_hdmi_sink &&
-            && HAS_PCH_SPLIT(dev)) {
+            clock_12bpc <= portclock_limit && HAS_PCH_SPLIT(dev)) {
                DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
                desired_bpp = 12*3;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 350de359123a..079ea38f14d9 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -698,7 +698,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
                freq /= 0xff;
        ctl = freq << 17;
-        if (IS_GEN2(dev) && panel->backlight.combination_mode)
+        if (panel->backlight.combination_mode)
                ctl |= BLM_LEGACY_MODE;
        if (IS_PINEVIEW(dev) && panel->backlight.active_low_pwm)
                ctl |= BLM_POLARITY_PNV;
@@ -979,7 +979,7 @@ static int i9xx_setup_backlight(struct intel_connector *connector)
        ctl = I915_READ(BLC_PWM_CTL);
-        if (IS_GEN2(dev))
+        if (IS_GEN2(dev) || IS_I915GM(dev) || IS_I945GM(dev))
                panel->backlight.combination_mode = ctl & BLM_LEGACY_MODE;
        if (IS_PINEVIEW(dev))
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d77cc81900f9..e1fc35a72656 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3493,6 +3493,8 @@ static void valleyview_setup_pctx(struct drm_device *dev)
        u32 pcbr;
        int pctx_size = 24*1024;
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
        pcbr = I915_READ(VLV_PCBR);
        if (pcbr) {
                /* BIOS set it up already, grab the pre-alloc'd space */
@@ -3542,8 +3544,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                I915_WRITE(GTFIFODBG, gtfifodbg);
        }
-        valleyview_setup_pctx(dev);
        /* If VLV, Forcewake all wells, else re-direct to regular path */
        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
@@ -4395,6 +4395,8 @@ void intel_enable_gt_powersave(struct drm_device *dev)
                ironlake_enable_rc6(dev);
                intel_init_emon(dev);
        } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
+                if (IS_VALLEYVIEW(dev))
+                        valleyview_setup_pctx(dev);
                /*
                 * PCU communication is slow and this doesn't need to be
                 * done at any specific time, so do this out of our fast path
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2cec2ab02f80..607dc14d195e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1314,7 +1314,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                        }
                        if (is_dp)
                                args.v5.ucLaneNum = dp_lane_count;
-                        else if (radeon_encoder->pixel_clock > 165000)
+                        else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock))
                                args.v5.ucLaneNum = 8;
                        else
                                args.v5.ucLaneNum = 4;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6419ca7cd37..e22be8458d92 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3046,7 +3046,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 }
 /**
- * cik_select_se_sh - select which SE, SH to address
+ * cik_get_rb_disabled - computes the mask of disabled RBs
 *
 * @rdev: radeon_device pointer
 * @max_rb_num: max RBs (render backends) for the asic
@@ -7902,7 +7902,8 @@ int cik_resume(struct radeon_device *rdev)
        /* init golden registers */
        cik_init_golden_registers(rdev);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = cik_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 8a2c010b7dc5..27b0ff16082e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -5299,7 +5299,8 @@ int evergreen_resume(struct radeon_device *rdev)
        /* init golden registers */
        evergreen_init_golden_registers(rdev);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = evergreen_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_smc.h b/drivers/gpu/drm/radeon/evergreen_smc.h
index 76ada8cfe902..3a03ba37d043 100644
--- a/drivers/gpu/drm/radeon/evergreen_smc.h
+++ b/drivers/gpu/drm/radeon/evergreen_smc.h
@@ -57,7 +57,7 @@ typedef struct SMC_Evergreen_MCRegisters SMC_Evergreen_MCRegisters;
 #define EVERGREEN_SMC_FIRMWARE_HEADER_LOCATION 0x100
-#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x0
+#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x8
 #define EVERGREEN_SMC_FIRMWARE_HEADER_stateTable      0xC
 #define EVERGREEN_SMC_FIRMWARE_HEADER_mcRegisterTable 0x20
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index ea932ac66fc6..bf6300cfd62d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2105,7 +2105,8 @@ int cayman_resume(struct radeon_device *rdev)
        /* init golden registers */
        ni_init_golden_registers(rdev);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = cayman_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index ef024ce3f7cc..3cc78bb66042 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3942,8 +3942,6 @@ int r100_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = r100_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 7c63ef840e86..0b658b34b33a 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1430,8 +1430,6 @@ int r300_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = r300_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3768aab2710b..802b19220a21 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -325,8 +325,6 @@ int r420_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = r420_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index e209eb75024f..98d6053c36c6 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -240,8 +240,6 @@ int r520_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = r520_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cdbc4171fe73..647ef4079217 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2968,7 +2968,8 @@ int r600_resume(struct radeon_device *rdev)
        /* post card */
        atom_asic_init(rdev->mode_info.atom_context);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = r600_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index b012cbbc3ed5..044bc98fb459 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1521,13 +1521,16 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        if (r)
                DRM_ERROR("ib ring test failed (%d).\n", r);
-        if (rdev->pm.dpm_enabled) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
                /* do dpm late init */
                r = radeon_pm_late_init(rdev);
                if (r) {
                        rdev->pm.dpm_enabled = false;
                        DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
                }
+        } else {
+                /* resume old pm late */
+                radeon_pm_resume(rdev);
        }
        radeon_restore_bios_scratch_regs(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 77f5b0c3edb8..040a2a10ea17 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -714,6 +714,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
                DRM_ERROR("Failed initializing VRAM heap.\n");
                return r;
        }
+        /* Change the size here instead of the init above so only lpfn is affected */
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        r = radeon_bo_create(rdev, 256 * 1024, PAGE_SIZE, true,
                             RADEON_GEM_DOMAIN_VRAM,
                             NULL, &rdev->stollen_vga_memory);
@@ -935,7 +938,7 @@ static ssize_t radeon_ttm_gtt_read(struct file *f, char __user *buf,
        while (size) {
                loff_t p = *pos / PAGE_SIZE;
                unsigned off = *pos & ~PAGE_MASK;
-                ssize_t cur_size = min(size, PAGE_SIZE - off);
+                size_t cur_size = min_t(size_t, size, PAGE_SIZE - off);
                struct page *page;
                void *ptr;
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b5c2369cda2f..130d5cc50d43 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -474,8 +474,6 @@ int rs400_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = rs400_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index fdcde7693032..72d3616de08e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -1048,8 +1048,6 @@ int rs600_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = rs600_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 35950738bd5e..3462b64369bf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -756,8 +756,6 @@ int rs690_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = rs690_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 98e8138ff779..237dd29d9f1c 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -586,8 +586,6 @@ int rv515_resume(struct radeon_device *rdev)
        /* Initialize surface registers */
        radeon_surface_init(rdev);
-        radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r =  rv515_startup(rdev);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 4e37a42305d8..fef310773aad 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1811,7 +1811,8 @@ int rv770_resume(struct radeon_device *rdev)
        /* init golden registers */
        rv770_init_golden_registers(rdev);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = rv770_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 83578324e5d1..9a124d0608b3 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6618,7 +6618,8 @@ int si_resume(struct radeon_device *rdev)
        /* init golden registers */
        si_init_golden_registers(rdev);
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
        rdev->accel_working = true;
        r = si_startup(rdev);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index d18d08a076e8..8ee228e9ab5a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -492,12 +492,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
        isert_conn->state = ISER_CONN_INIT;
        INIT_LIST_HEAD(&isert_conn->conn_accept_node);
        init_completion(&isert_conn->conn_login_comp);
-        init_waitqueue_head(&isert_conn->conn_wait);
+        init_completion(&isert_conn->conn_wait);
-        init_waitqueue_head(&isert_conn->conn_wait_comp_err);
+        init_completion(&isert_conn->conn_wait_comp_err);
        kref_init(&isert_conn->conn_kref);
        kref_get(&isert_conn->conn_kref);
        mutex_init(&isert_conn->conn_mutex);
-        mutex_init(&isert_conn->conn_comp_mutex);
        spin_lock_init(&isert_conn->conn_lock);
        cma_id->context = isert_conn;
@@ -688,11 +687,11 @@ isert_disconnect_work(struct work_struct *work)
        pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
        mutex_lock(&isert_conn->conn_mutex);
-        isert_conn->state = ISER_CONN_DOWN;
+        if (isert_conn->state == ISER_CONN_UP)
+                isert_conn->state = ISER_CONN_TERMINATING;
        if (isert_conn->post_recv_buf_count == 0 &&
            atomic_read(&isert_conn->post_send_buf_count) == 0) {
-                pr_debug("Calling wake_up(&isert_conn->conn_wait);\n");
                mutex_unlock(&isert_conn->conn_mutex);
                goto wake_up;
        }
@@ -712,7 +711,7 @@ isert_disconnect_work(struct work_struct *work)
        mutex_unlock(&isert_conn->conn_mutex);
 wake_up:
-        wake_up(&isert_conn->conn_wait);
+        complete(&isert_conn->conn_wait);
        isert_put_conn(isert_conn);
 }
@@ -888,16 +887,17 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
         * Coalesce send completion interrupts by only setting IB_SEND_SIGNALED
         * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
         */
-        mutex_lock(&isert_conn->conn_comp_mutex);
+        mutex_lock(&isert_conn->conn_mutex);
-        if (coalesce &&
+        if (coalesce && isert_conn->state == ISER_CONN_UP &&
            ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+                tx_desc->llnode_active = true;
                llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
-                mutex_unlock(&isert_conn->conn_comp_mutex);
+                mutex_unlock(&isert_conn->conn_mutex);
                return;
        }
        isert_conn->conn_comp_batch = 0;
        tx_desc->comp_llnode_batch = llist_del_all(&isert_conn->conn_comp_llist);
-        mutex_unlock(&isert_conn->conn_comp_mutex);
+        mutex_unlock(&isert_conn->conn_mutex);
        send_wr->send_flags = IB_SEND_SIGNALED;
 }
@@ -1464,7 +1464,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
        case ISCSI_OP_SCSI_CMD:
                spin_lock_bh(&conn->cmd_lock);
                if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                if (cmd->data_direction == DMA_TO_DEVICE)
@@ -1476,7 +1476,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
        case ISCSI_OP_SCSI_TMFUNC:
                spin_lock_bh(&conn->cmd_lock);
                if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                transport_generic_free_cmd(&cmd->se_cmd, 0);
@@ -1486,7 +1486,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
        case ISCSI_OP_TEXT:
                spin_lock_bh(&conn->cmd_lock);
                if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                /*
@@ -1549,6 +1549,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
        iscsit_stop_dataout_timer(cmd);
        device->unreg_rdma_mem(isert_cmd, isert_conn);
        cmd->write_data_done = wr->cur_rdma_length;
+        wr->send_wr_num = 0;
        pr_debug("Cmd: %p RDMA_READ comp calling execute_cmd\n", isert_cmd);
        spin_lock_bh(&cmd->istate_lock);
@@ -1589,7 +1590,7 @@ isert_do_control_comp(struct work_struct *work)
                pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
                /*
                 * Call atomic_dec(&isert_conn->post_send_buf_count)
-                 * from isert_free_conn()
+                 * from isert_wait_conn()
                 */
                isert_conn->logout_posted = true;
                iscsit_logout_post_handler(cmd, cmd->conn);
@@ -1613,6 +1614,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                          struct ib_device *ib_dev)
 {
        struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
+        struct isert_rdma_wr *wr = &isert_cmd->rdma_wr;
        if (cmd->i_state == ISTATE_SEND_TASKMGTRSP ||
            cmd->i_state == ISTATE_SEND_LOGOUTRSP ||
@@ -1624,7 +1626,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                queue_work(isert_comp_wq, &isert_cmd->comp_work);
                return;
        }
-        atomic_dec(&isert_conn->post_send_buf_count);
+        atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
        cmd->i_state = ISTATE_SENT_STATUS;
        isert_completion_put(tx_desc, isert_cmd, ib_dev);
@@ -1662,7 +1664,7 @@ __isert_send_completion(struct iser_tx_desc *tx_desc,
        case ISER_IB_RDMA_READ:
                pr_debug("isert_send_completion: Got ISER_IB_RDMA_READ:\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
                isert_completion_rdma_read(tx_desc, isert_cmd);
                break;
        default:
@@ -1691,31 +1693,76 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
 }
 static void
-isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
+isert_cq_drain_comp_llist(struct isert_conn *isert_conn, struct ib_device *ib_dev)
+{
+        struct llist_node *llnode;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
+        mutex_lock(&isert_conn->conn_mutex);
+        llnode = llist_del_all(&isert_conn->conn_comp_llist);
+        isert_conn->conn_comp_batch = 0;
+        mutex_unlock(&isert_conn->conn_mutex);
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
+        }
+}
+static void
+isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
 {
        struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+        struct llist_node *llnode = tx_desc->comp_llnode_batch;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
-        if (tx_desc) {
+        while (llnode) {
-                struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
-                if (!isert_cmd)
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
-                        isert_unmap_tx_desc(tx_desc, ib_dev);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
-                else
-                        isert_completion_put(tx_desc, isert_cmd, ib_dev);
        }
+        tx_desc->comp_llnode_batch = NULL;
-        if (isert_conn->post_recv_buf_count == 0 &&
+        if (!isert_cmd)
-            atomic_read(&isert_conn->post_send_buf_count) == 0) {
+                isert_unmap_tx_desc(tx_desc, ib_dev);
-                pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+        else
-                pr_debug("Calling wake_up from isert_cq_comp_err\n");
+                isert_completion_put(tx_desc, isert_cmd, ib_dev);
+}
-                mutex_lock(&isert_conn->conn_mutex);
+static void
-                if (isert_conn->state != ISER_CONN_DOWN)
+isert_cq_rx_comp_err(struct isert_conn *isert_conn)
-                        isert_conn->state = ISER_CONN_TERMINATING;
+{
-                mutex_unlock(&isert_conn->conn_mutex);
+        struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct iscsi_conn *conn = isert_conn->conn;
-                wake_up(&isert_conn->conn_wait_comp_err);
+        if (isert_conn->post_recv_buf_count)
+                return;
+        isert_cq_drain_comp_llist(isert_conn, ib_dev);
+        if (conn->sess) {
+                target_sess_cmd_list_set_waiting(conn->sess->se_sess);
+                target_wait_for_sess_cmds(conn->sess->se_sess);
        }
+        while (atomic_read(&isert_conn->post_send_buf_count))
+                msleep(3000);
+        mutex_lock(&isert_conn->conn_mutex);
+        isert_conn->state = ISER_CONN_DOWN;
+        mutex_unlock(&isert_conn->conn_mutex);
+        complete(&isert_conn->conn_wait_comp_err);
 }
 static void
@@ -1740,8 +1787,14 @@ isert_cq_tx_work(struct work_struct *work)
                        pr_debug("TX wc.status != IB_WC_SUCCESS >>>>>>>>>>>>>>\n");
                        pr_debug("TX wc.status: 0x%08x\n", wc.status);
                        pr_debug("TX wc.vendor_err: 0x%08x\n", wc.vendor_err);
-                        atomic_dec(&isert_conn->post_send_buf_count);
-                        isert_cq_comp_err(tx_desc, isert_conn);
+                        if (wc.wr_id != ISER_FASTREG_LI_WRID) {
+                                if (tx_desc->llnode_active)
+                                        continue;
+                                atomic_dec(&isert_conn->post_send_buf_count);
+                                isert_cq_tx_comp_err(tx_desc, isert_conn);
+                        }
                }
        }
@@ -1784,7 +1837,7 @@ isert_cq_rx_work(struct work_struct *work)
                                         wc.vendor_err);
                        }
                        isert_conn->post_recv_buf_count--;
-                        isert_cq_comp_err(NULL, isert_conn);
+                        isert_cq_rx_comp_err(isert_conn);
                }
        }
@@ -2202,6 +2255,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
        if (!fr_desc->valid) {
                memset(&inv_wr, 0, sizeof(inv_wr));
+                inv_wr.wr_id = ISER_FASTREG_LI_WRID;
                inv_wr.opcode = IB_WR_LOCAL_INV;
                inv_wr.ex.invalidate_rkey = fr_desc->data_mr->rkey;
                wr = &inv_wr;
@@ -2212,6 +2266,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
        /* Prepare FASTREG WR */
        memset(&fr_wr, 0, sizeof(fr_wr));
+        fr_wr.wr_id = ISER_FASTREG_LI_WRID;
        fr_wr.opcode = IB_WR_FAST_REG_MR;
        fr_wr.wr.fast_reg.iova_start =
                fr_desc->data_frpl->page_list[0] + page_off;
@@ -2377,12 +2432,12 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
        isert_init_send_wr(isert_conn, isert_cmd,
                           &isert_cmd->tx_desc.send_wr, true);
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
        rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
        if (rc) {
                pr_warn("ib_post_send() failed for IB_WR_RDMA_WRITE\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
        }
        pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data READ\n",
                 isert_cmd);
@@ -2410,12 +2465,12 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
                return rc;
        }
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num, &isert_conn->post_send_buf_count);
        rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
        if (rc) {
                pr_warn("ib_post_send() failed for IB_WR_RDMA_READ\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
        }
        pr_debug("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
                 isert_cmd);
@@ -2702,22 +2757,11 @@ isert_free_np(struct iscsi_np *np)
        kfree(isert_np);
 }
-static int isert_check_state(struct isert_conn *isert_conn, int state)
+static void isert_wait_conn(struct iscsi_conn *conn)
-{
-        int ret;
-        mutex_lock(&isert_conn->conn_mutex);
-        ret = (isert_conn->state == state);
-        mutex_unlock(&isert_conn->conn_mutex);
-        return ret;
-}
-static void isert_free_conn(struct iscsi_conn *conn)
 {
        struct isert_conn *isert_conn = conn->context;
-        pr_debug("isert_free_conn: Starting \n");
+        pr_debug("isert_wait_conn: Starting \n");
        /*
         * Decrement post_send_buf_count for special case when called
         * from isert_do_control_comp() -> iscsit_logout_post_handler()
@@ -2727,38 +2771,29 @@ static void isert_free_conn(struct iscsi_conn *conn)
                atomic_dec(&isert_conn->post_send_buf_count);
        if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) {
-                pr_debug("Calling rdma_disconnect from isert_free_conn\n");
+                pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
                rdma_disconnect(isert_conn->conn_cm_id);
        }
        /*
         * Only wait for conn_wait_comp_err if the isert_conn made it
         * into full feature phase..
         */
-        if (isert_conn->state == ISER_CONN_UP) {
-                pr_debug("isert_free_conn: Before wait_event comp_err %d\n",
-                         isert_conn->state);
-                mutex_unlock(&isert_conn->conn_mutex);
-                wait_event(isert_conn->conn_wait_comp_err,
-                          (isert_check_state(isert_conn, ISER_CONN_TERMINATING)));
-                wait_event(isert_conn->conn_wait,
-                          (isert_check_state(isert_conn, ISER_CONN_DOWN)));
-                isert_put_conn(isert_conn);
-                return;
-        }
        if (isert_conn->state == ISER_CONN_INIT) {
                mutex_unlock(&isert_conn->conn_mutex);
-                isert_put_conn(isert_conn);
                return;
        }
-        pr_debug("isert_free_conn: wait_event conn_wait %d\n",
+        if (isert_conn->state == ISER_CONN_UP)
-                 isert_conn->state);
+                isert_conn->state = ISER_CONN_TERMINATING;
        mutex_unlock(&isert_conn->conn_mutex);
-        wait_event(isert_conn->conn_wait,
+        wait_for_completion(&isert_conn->conn_wait_comp_err);
-                  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
+        wait_for_completion(&isert_conn->conn_wait);
+}
+static void isert_free_conn(struct iscsi_conn *conn)
+{
+        struct isert_conn *isert_conn = conn->context;
        isert_put_conn(isert_conn);
 }
@@ -2771,6 +2806,7 @@ static struct iscsit_transport iser_target_transport = {
        .iscsit_setup_np        = isert_setup_np,
        .iscsit_accept_np       = isert_accept_np,
        .iscsit_free_np         = isert_free_np,
+        .iscsit_wait_conn       = isert_wait_conn,
        .iscsit_free_conn       = isert_free_conn,
        .iscsit_get_login_rx    = isert_get_login_rx,
        .iscsit_put_login_tx    = isert_put_login_tx,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 708a069002f3..f6ae7f5dd408 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -6,6 +6,7 @@
 #define ISERT_RDMA_LISTEN_BACKLOG       10
 #define ISCSI_ISER_SG_TABLESIZE         256
+#define ISER_FASTREG_LI_WRID            0xffffffffffffffffULL
 enum isert_desc_type {
        ISCSI_TX_CONTROL,
@@ -45,6 +46,7 @@ struct iser_tx_desc {
        struct isert_cmd *isert_cmd;
        struct llist_node *comp_llnode_batch;
        struct llist_node comp_llnode;
+        bool            llnode_active;
        struct ib_send_wr send_wr;
 } __packed;
@@ -116,8 +118,8 @@ struct isert_conn {
        struct isert_device     *conn_device;
        struct work_struct      conn_logout_work;
        struct mutex            conn_mutex;
-        wait_queue_head_t       conn_wait;
+        struct completion       conn_wait;
-        wait_queue_head_t       conn_wait_comp_err;
+        struct completion       conn_wait_comp_err;
        struct kref             conn_kref;
        struct list_head        conn_fr_pool;
        int                     conn_fr_pool_size;
@@ -126,7 +128,6 @@ struct isert_conn {
 #define ISERT_COMP_BATCH_COUNT  8
        int                     conn_comp_batch;
        struct llist_head       conn_comp_llist;
-        struct mutex            conn_comp_mutex;
 };
 #define ISERT_MAX_CQ 64
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 9a06fe883766..95ad936e6048 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -254,16 +254,6 @@ config DM_THIN_PROVISIONING
       ---help---
         Provides thin provisioning and snapshots that share a data store.
-config DM_DEBUG_BLOCK_STACK_TRACING
-        boolean "Keep stack trace of persistent data block lock holders"
-        depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
-        select STACKTRACE
-        ---help---
-          Enable this for messages that may help debug problems with the
-          block manager locking used by thin provisioning and caching.
-          If unsure, say N.
 config DM_CACHE
       tristate "Cache target (EXPERIMENTAL)"
       depends on BLK_DEV_DM
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 1e018e986610..0e385e40909e 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -872,7 +872,7 @@ static void mq_destroy(struct dm_cache_policy *p)
 {
        struct mq_policy *mq = to_mq_policy(p);
-        kfree(mq->table);
+        vfree(mq->table);
        epool_exit(&mq->cache_pool);
        epool_exit(&mq->pre_cache_pool);
        kfree(mq);
@@ -1245,7 +1245,7 @@ static struct dm_cache_policy *mq_create(dm_cblock_t cache_size,
        mq->nr_buckets = next_power(from_cblock(cache_size) / 2, 16);
        mq->hash_bits = ffs(mq->nr_buckets) - 1;
-        mq->table = kzalloc(sizeof(*mq->table) * mq->nr_buckets, GFP_KERNEL);
+        mq->table = vzalloc(sizeof(*mq->table) * mq->nr_buckets);
        if (!mq->table)
                goto bad_alloc_table;
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index afc3d017de4c..d6e88178d22c 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -546,6 +546,9 @@ static int read_exceptions(struct pstore *ps,
                r = insert_exceptions(ps, area, callback, callback_context,
                                      &full);
+                if (!full)
+                        memcpy(ps->area, area, ps->store->chunk_size << SECTOR_SHIFT);
                dm_bufio_release(bp);
                dm_bufio_forget(client, chunk);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index baa87ff12816..fb9efc829182 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -76,7 +76,7 @@
 #define THIN_SUPERBLOCK_MAGIC 27022010
 #define THIN_SUPERBLOCK_LOCATION 0
-#define THIN_VERSION 1
+#define THIN_VERSION 2
 #define THIN_METADATA_CACHE_SIZE 64
 #define SECTOR_TO_BLOCK_SHIFT 3
@@ -1755,3 +1755,38 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
        return r;
 }
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+{
+        int r;
+        struct dm_block *sblock;
+        struct thin_disk_superblock *disk_super;
+        down_write(&pmd->root_lock);
+        pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+        r = superblock_lock(pmd, &sblock);
+        if (r) {
+                DMERR("couldn't read superblock");
+                goto out;
+        }
+        disk_super = dm_block_data(sblock);
+        disk_super->flags = cpu_to_le32(pmd->flags);
+        dm_bm_unlock(sblock);
+out:
+        up_write(&pmd->root_lock);
+        return r;
+}
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd)
+{
+        bool needs_check;
+        down_read(&pmd->root_lock);
+        needs_check = pmd->flags & THIN_METADATA_NEEDS_CHECK_FLAG;
+        up_read(&pmd->root_lock);
+        return needs_check;
+}
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 82ea384d36ff..e3c857db195a 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -25,6 +25,11 @@
 /*----------------------------------------------------------------*/
+/*
+ * Thin metadata superblock flags.
+ */
+#define THIN_METADATA_NEEDS_CHECK_FLAG (1 << 0)
 struct dm_pool_metadata;
 struct dm_thin_device;
@@ -202,6 +207,12 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                        dm_sm_threshold_fn fn,
                                        void *context);
+/*
+ * Updates the superblock immediately.
+ */
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd);
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd);
 /*----------------------------------------------------------------*/
 #endif
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 7e84baccf0ad..be70d38745f7 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -130,10 +130,11 @@ static void build_virtual_key(struct dm_thin_device *td, dm_block_t b,
 struct dm_thin_new_mapping;
 /*
- * The pool runs in 3 modes.  Ordered in degraded order for comparisons.
+ * The pool runs in 4 modes.  Ordered in degraded order for comparisons.
 */
 enum pool_mode {
        PM_WRITE,               /* metadata may be changed */
+        PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
        PM_READ_ONLY,           /* metadata may not be changed */
        PM_FAIL,                /* all I/O fails */
 };
@@ -198,7 +199,6 @@ struct pool {
 };
 static enum pool_mode get_pool_mode(struct pool *pool);
-static void out_of_data_space(struct pool *pool);
 static void metadata_operation_failed(struct pool *pool, const char *op, int r);
 /*
@@ -226,6 +226,7 @@ struct thin_c {
        struct pool *pool;
        struct dm_thin_device *td;
+        bool requeue_mode:1;
 };
 /*----------------------------------------------------------------*/
@@ -369,14 +370,18 @@ struct dm_thin_endio_hook {
        struct dm_thin_new_mapping *overwrite_mapping;
 };
-static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
+static void requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 {
        struct bio *bio;
        struct bio_list bios;
+        unsigned long flags;
        bio_list_init(&bios);
+        spin_lock_irqsave(&tc->pool->lock, flags);
        bio_list_merge(&bios, master);
        bio_list_init(master);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
        while ((bio = bio_list_pop(&bios))) {
                struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
@@ -391,12 +396,26 @@ static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 static void requeue_io(struct thin_c *tc)
 {
        struct pool *pool = tc->pool;
+        requeue_bio_list(tc, &pool->deferred_bios);
+        requeue_bio_list(tc, &pool->retry_on_resume_list);
+}
+static void error_retry_list(struct pool *pool)
+{
+        struct bio *bio;
        unsigned long flags;
+        struct bio_list bios;
+        bio_list_init(&bios);
        spin_lock_irqsave(&pool->lock, flags);
-        __requeue_bio_list(tc, &pool->deferred_bios);
+        bio_list_merge(&bios, &pool->retry_on_resume_list);
-        __requeue_bio_list(tc, &pool->retry_on_resume_list);
+        bio_list_init(&pool->retry_on_resume_list);
        spin_unlock_irqrestore(&pool->lock, flags);
+        while ((bio = bio_list_pop(&bios)))
+                bio_io_error(bio);
 }
 /*
@@ -925,13 +944,15 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
        }
 }
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
        int r;
        dm_block_t free_blocks;
        struct pool *pool = tc->pool;
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (WARN_ON(get_pool_mode(pool) != PM_WRITE))
                return -EINVAL;
        r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
@@ -958,7 +979,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                }
                if (!free_blocks) {
-                        out_of_data_space(pool);
+                        set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
                        return -ENOSPC;
                }
        }
@@ -988,15 +1009,32 @@ static void retry_on_resume(struct bio *bio)
        spin_unlock_irqrestore(&pool->lock, flags);
 }
-static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+static bool should_error_unserviceable_bio(struct pool *pool)
 {
-        /*
+        enum pool_mode m = get_pool_mode(pool);
-         * When pool is read-only, no cell locking is needed because
-         * nothing is changing.
+        switch (m) {
-         */
+        case PM_WRITE:
-        WARN_ON_ONCE(get_pool_mode(pool) != PM_READ_ONLY);
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool is in PM_WRITE mode");
+                return true;
+        case PM_OUT_OF_DATA_SPACE:
+                return pool->pf.error_if_no_space;
-        if (pool->pf.error_if_no_space)
+        case PM_READ_ONLY:
+        case PM_FAIL:
+                return true;
+        default:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool has an unknown mode");
+                return true;
+        }
+}
+static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+{
+        if (should_error_unserviceable_bio(pool))
                bio_io_error(bio);
        else
                retry_on_resume(bio);
@@ -1007,11 +1045,20 @@ static void retry_bios_on_resume(struct pool *pool, struct dm_bio_prison_cell *c
        struct bio *bio;
        struct bio_list bios;
+        if (should_error_unserviceable_bio(pool)) {
+                cell_error(pool, cell);
+                return;
+        }
        bio_list_init(&bios);
        cell_release(pool, cell, &bios);
-        while ((bio = bio_list_pop(&bios)))
+        if (should_error_unserviceable_bio(pool))
-                handle_unserviceable_bio(pool, bio);
+                while ((bio = bio_list_pop(&bios)))
+                        bio_io_error(bio);
+        else
+                while ((bio = bio_list_pop(&bios)))
+                        retry_on_resume(bio);
 }
 static void process_discard(struct thin_c *tc, struct bio *bio)
@@ -1296,6 +1343,11 @@ static void process_bio_read_only(struct thin_c *tc, struct bio *bio)
        }
 }
+static void process_bio_success(struct thin_c *tc, struct bio *bio)
+{
+        bio_endio(bio, 0);
+}
 static void process_bio_fail(struct thin_c *tc, struct bio *bio)
 {
        bio_io_error(bio);
@@ -1328,6 +1380,11 @@ static void process_deferred_bios(struct pool *pool)
                struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
                struct thin_c *tc = h->tc;
+                if (tc->requeue_mode) {
+                        bio_endio(bio, DM_ENDIO_REQUEUE);
+                        continue;
+                }
                /*
                 * If we've got no free new_mapping structs, and processing
                 * this bio might require one, we pause until there are some
@@ -1394,51 +1451,134 @@ static void do_waker(struct work_struct *ws)
 /*----------------------------------------------------------------*/
+struct noflush_work {
+        struct work_struct worker;
+        struct thin_c *tc;
+        atomic_t complete;
+        wait_queue_head_t wait;
+};
+static void complete_noflush_work(struct noflush_work *w)
+{
+        atomic_set(&w->complete, 1);
+        wake_up(&w->wait);
+}
+static void do_noflush_start(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = true;
+        requeue_io(w->tc);
+        complete_noflush_work(w);
+}
+static void do_noflush_stop(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = false;
+        complete_noflush_work(w);
+}
+static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
+{
+        struct noflush_work w;
+        INIT_WORK(&w.worker, fn);
+        w.tc = tc;
+        atomic_set(&w.complete, 0);
+        init_waitqueue_head(&w.wait);
+        queue_work(tc->pool->wq, &w.worker);
+        wait_event(w.wait, atomic_read(&w.complete));
+}
+/*----------------------------------------------------------------*/
 static enum pool_mode get_pool_mode(struct pool *pool)
 {
        return pool->pf.mode;
 }
+static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
+{
+        dm_table_event(pool->ti->table);
+        DMINFO("%s: switching pool to %s mode",
+               dm_device_name(pool->pool_md), new_mode);
+}
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 {
-        int r;
+        struct pool_c *pt = pool->ti->private;
-        enum pool_mode old_mode = pool->pf.mode;
+        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
+        enum pool_mode old_mode = get_pool_mode(pool);
+        /*
+         * Never allow the pool to transition to PM_WRITE mode if user
+         * intervention is required to verify metadata and data consistency.
+         */
+        if (new_mode == PM_WRITE && needs_check) {
+                DMERR("%s: unable to switch pool to write mode until repaired.",
+                      dm_device_name(pool->pool_md));
+                if (old_mode != new_mode)
+                        new_mode = old_mode;
+                else
+                        new_mode = PM_READ_ONLY;
+        }
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.
+         */
+        if (old_mode == PM_FAIL)
+                new_mode = old_mode;
        switch (new_mode) {
        case PM_FAIL:
                if (old_mode != new_mode)
-                        DMERR("%s: switching pool to failure mode",
+                        notify_of_pool_mode_change(pool, "failure");
-                              dm_device_name(pool->pool_md));
                dm_pool_metadata_read_only(pool->pmd);
                pool->process_bio = process_bio_fail;
                pool->process_discard = process_bio_fail;
                pool->process_prepared_mapping = process_prepared_mapping_fail;
                pool->process_prepared_discard = process_prepared_discard_fail;
+                error_retry_list(pool);
                break;
        case PM_READ_ONLY:
                if (old_mode != new_mode)
-                        DMERR("%s: switching pool to read-only mode",
+                        notify_of_pool_mode_change(pool, "read-only");
-                              dm_device_name(pool->pool_md));
+                dm_pool_metadata_read_only(pool->pmd);
-                r = dm_pool_abort_metadata(pool->pmd);
+                pool->process_bio = process_bio_read_only;
-                if (r) {
+                pool->process_discard = process_bio_success;
-                        DMERR("%s: aborting transaction failed",
+                pool->process_prepared_mapping = process_prepared_mapping_fail;
-                              dm_device_name(pool->pool_md));
+                pool->process_prepared_discard = process_prepared_discard_passdown;
-                        new_mode = PM_FAIL;
-                        set_pool_mode(pool, new_mode);
+                error_retry_list(pool);
-                } else {
+                break;
-                        dm_pool_metadata_read_only(pool->pmd);
-                        pool->process_bio = process_bio_read_only;
+        case PM_OUT_OF_DATA_SPACE:
-                        pool->process_discard = process_discard;
+                /*
-                        pool->process_prepared_mapping = process_prepared_mapping_fail;
+                 * Ideally we'd never hit this state; the low water mark
-                        pool->process_prepared_discard = process_prepared_discard_passdown;
+                 * would trigger userland to extend the pool before we
-                }
+                 * completely run out of data space.  However, many small
+                 * IOs to unprovisioned space can consume data space at an
+                 * alarming rate.  Adjust your low water mark if you're
+                 * frequently seeing this mode.
+                 */
+                if (old_mode != new_mode)
+                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_discard;
+                pool->process_prepared_mapping = process_prepared_mapping;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
                break;
        case PM_WRITE:
                if (old_mode != new_mode)
-                        DMINFO("%s: switching pool to write mode",
+                        notify_of_pool_mode_change(pool, "write");
-                               dm_device_name(pool->pool_md));
                dm_pool_metadata_read_write(pool->pmd);
                pool->process_bio = process_bio;
                pool->process_discard = process_discard;
@@ -1448,32 +1588,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
        }
        pool->pf.mode = new_mode;
+        /*
+         * The pool mode may have changed, sync it so bind_control_target()
+         * doesn't cause an unexpected mode transition on resume.
+         */
+        pt->adjusted_pf.mode = new_mode;
 }
-/*
+static void abort_transaction(struct pool *pool)
- * Rather than calling set_pool_mode directly, use these which describe the
- * reason for mode degradation.
- */
-static void out_of_data_space(struct pool *pool)
 {
-        DMERR_LIMIT("%s: no free data space available.",
+        const char *dev_name = dm_device_name(pool->pool_md);
-                    dm_device_name(pool->pool_md));
-        set_pool_mode(pool, PM_READ_ONLY);
+        DMERR_LIMIT("%s: aborting current metadata transaction", dev_name);
+        if (dm_pool_abort_metadata(pool->pmd)) {
+                DMERR("%s: failed to abort metadata transaction", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
+        if (dm_pool_metadata_set_needs_check(pool->pmd)) {
+                DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
 }
 static void metadata_operation_failed(struct pool *pool, const char *op, int r)
 {
-        dm_block_t free_blocks;
        DMERR_LIMIT("%s: metadata operation '%s' failed: error = %d",
                    dm_device_name(pool->pool_md), op, r);
-        if (r == -ENOSPC &&
+        abort_transaction(pool);
-            !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
-            !free_blocks)
-                DMERR_LIMIT("%s: no free metadata space available.",
-                            dm_device_name(pool->pool_md));
        set_pool_mode(pool, PM_READ_ONLY);
 }
@@ -1524,6 +1667,11 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
        thin_hook_bio(tc, bio);
+        if (tc->requeue_mode) {
+                bio_endio(bio, DM_ENDIO_REQUEUE);
+                return DM_MAPIO_SUBMITTED;
+        }
        if (get_pool_mode(tc->pool) == PM_FAIL) {
                bio_io_error(bio);
                return DM_MAPIO_SUBMITTED;
@@ -1687,7 +1835,7 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
        /*
         * We want to make sure that a pool in PM_FAIL mode is never upgraded.
         */
-        enum pool_mode old_mode = pool->pf.mode;
+        enum pool_mode old_mode = get_pool_mode(pool);
        enum pool_mode new_mode = pt->adjusted_pf.mode;
        /*
@@ -1701,16 +1849,6 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
        pool->pf = pt->adjusted_pf;
        pool->low_water_blocks = pt->low_water_blocks;
-        /*
-         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
-         * not going to recover without a thin_repair.  So we never let the
-         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
-         * may have been due to a lack of metadata or data space, and may
-         * now work (ie. if the underlying devices have been resized).
-         */
-        if (old_mode == PM_FAIL)
-                new_mode = old_mode;
        set_pool_mode(pool, new_mode);
        return 0;
@@ -2253,6 +2391,12 @@ static int maybe_resize_data_dev(struct dm_target *ti, bool *need_commit)
                return -EINVAL;
        } else if (data_size > sb_data_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the data device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
                if (sb_data_size)
                        DMINFO("%s: growing the data device from %llu to %llu blocks",
                               dm_device_name(pool->pool_md),
@@ -2294,6 +2438,12 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                return -EINVAL;
        } else if (metadata_dev_size > sb_metadata_dev_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the metadata device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
                warn_if_metadata_device_too_big(pool->md_dev);
                DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                       dm_device_name(pool->pool_md),
@@ -2681,7 +2831,9 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                else
                        DMEMIT("- ");
-                if (pool->pf.mode == PM_READ_ONLY)
+                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                        DMEMIT("out_of_data_space ");
+                else if (pool->pf.mode == PM_READ_ONLY)
                        DMEMIT("ro ");
                else
                        DMEMIT("rw ");
@@ -2795,7 +2947,7 @@ static struct target_type pool_target = {
        .name = "thin-pool",
        .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                    DM_TARGET_IMMUTABLE,
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
        .module = THIS_MODULE,
        .ctr = pool_ctr,
        .dtr = pool_dtr,
@@ -2997,10 +3149,23 @@ static int thin_endio(struct dm_target *ti, struct bio *bio, int err)
        return 0;
 }
-static void thin_postsuspend(struct dm_target *ti)
+static void thin_presuspend(struct dm_target *ti)
 {
+        struct thin_c *tc = ti->private;
        if (dm_noflush_suspending(ti))
-                requeue_io((struct thin_c *)ti->private);
+                noflush_work(tc, do_noflush_start);
+}
+static void thin_postsuspend(struct dm_target *ti)
+{
+        struct thin_c *tc = ti->private;
+        /*
+         * The dm_noflush_suspending flag has been cleared by now, so
+         * unfortunately we must always run this.
+         */
+        noflush_work(tc, do_noflush_stop);
 }
 /*
@@ -3085,12 +3250,13 @@ static int thin_iterate_devices(struct dm_target *ti,
 static struct target_type thin_target = {
        .name = "thin",
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
        .module = THIS_MODULE,
        .ctr = thin_ctr,
        .dtr = thin_dtr,
        .map = thin_map,
        .end_io = thin_endio,
+        .presuspend = thin_presuspend,
        .postsuspend = thin_postsuspend,
        .status = thin_status,
        .iterate_devices = thin_iterate_devices,
diff --git a/drivers/md/persistent-data/Kconfig b/drivers/md/persistent-data/Kconfig
index 19b268795415..0c2dec7aec20 100644
--- a/drivers/md/persistent-data/Kconfig
+++ b/drivers/md/persistent-data/Kconfig
@@ -6,3 +6,13 @@ config DM_PERSISTENT_DATA
       ---help---
         Library providing immutable on-disk data structure support for
         device-mapper targets such as the thin provisioning target.
+config DM_DEBUG_BLOCK_STACK_TRACING
+       boolean "Keep stack trace of persistent data block lock holders"
+       depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
+       select STACKTRACE
+       ---help---
+         Enable this for messages that may help debug problems with the
+         block manager locking used by thin provisioning and caching.
+         If unsure, say N.
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index e9bdd462f4f5..786b689bdfc7 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -91,6 +91,69 @@ struct block_op {
        dm_block_t block;
 };
+struct bop_ring_buffer {
+        unsigned begin;
+        unsigned end;
+        struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1];
+};
+static void brb_init(struct bop_ring_buffer *brb)
+{
+        brb->begin = 0;
+        brb->end = 0;
+}
+static bool brb_empty(struct bop_ring_buffer *brb)
+{
+        return brb->begin == brb->end;
+}
+static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old)
+{
+        unsigned r = old + 1;
+        return (r >= (sizeof(brb->bops) / sizeof(*brb->bops))) ? 0 : r;
+}
+static int brb_push(struct bop_ring_buffer *brb,
+                    enum block_op_type type, dm_block_t b)
+{
+        struct block_op *bop;
+        unsigned next = brb_next(brb, brb->end);
+        /*
+         * We don't allow the last bop to be filled, this way we can
+         * differentiate between full and empty.
+         */
+        if (next == brb->begin)
+                return -ENOMEM;
+        bop = brb->bops + brb->end;
+        bop->type = type;
+        bop->block = b;
+        brb->end = next;
+        return 0;
+}
+static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+{
+        struct block_op *bop;
+        if (brb_empty(brb))
+                return -ENODATA;
+        bop = brb->bops + brb->begin;
+        result->type = bop->type;
+        result->block = bop->block;
+        brb->begin = brb_next(brb, brb->begin);
+        return 0;
+}
+/*----------------------------------------------------------------*/
 struct sm_metadata {
        struct dm_space_map sm;
@@ -101,25 +164,20 @@ struct sm_metadata {
        unsigned recursion_count;
        unsigned allocated_this_transaction;
-        unsigned nr_uncommitted;
+        struct bop_ring_buffer uncommitted;
-        struct block_op uncommitted[MAX_RECURSIVE_ALLOCATIONS];
        struct threshold threshold;
 };
 static int add_bop(struct sm_metadata *smm, enum block_op_type type, dm_block_t b)
 {
-        struct block_op *op;
+        int r = brb_push(&smm->uncommitted, type, b);
-        if (smm->nr_uncommitted == MAX_RECURSIVE_ALLOCATIONS) {
+        if (r) {
                DMERR("too many recursive allocations");
                return -ENOMEM;
        }
-        op = smm->uncommitted + smm->nr_uncommitted++;
-        op->type = type;
-        op->block = b;
        return 0;
 }
@@ -158,11 +216,17 @@ static int out(struct sm_metadata *smm)
                return -ENOMEM;
        }
-        if (smm->recursion_count == 1 && smm->nr_uncommitted) {
+        if (smm->recursion_count == 1) {
-                while (smm->nr_uncommitted && !r) {
+                while (!brb_empty(&smm->uncommitted)) {
-                        smm->nr_uncommitted--;
+                        struct block_op bop;
-                        r = commit_bop(smm, smm->uncommitted +
-                                       smm->nr_uncommitted);
+                        r = brb_pop(&smm->uncommitted, &bop);
+                        if (r) {
+                                DMERR("bug in bop ring buffer");
+                                break;
+                        }
+                        r = commit_bop(smm, &bop);
                        if (r)
                                break;
                }
@@ -217,7 +281,8 @@ static int sm_metadata_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
 static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
                                 uint32_t *result)
 {
-        int r, i;
+        int r;
+        unsigned i;
        struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
        unsigned adjustment = 0;
@@ -225,8 +290,10 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
         * We may have some uncommitted adjustments to add.  This list
         * should always be really short.
         */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
+        for (i = smm->uncommitted.begin;
-                struct block_op *op = smm->uncommitted + i;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+                struct block_op *op = smm->uncommitted.bops + i;
                if (op->block != b)
                        continue;
@@ -254,7 +321,8 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
 static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
                                              dm_block_t b, int *result)
 {
-        int r, i, adjustment = 0;
+        int r, adjustment = 0;
+        unsigned i;
        struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
        uint32_t rc;
@@ -262,8 +330,11 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
         * We may have some uncommitted adjustments to add.  This list
         * should always be really short.
         */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
+        for (i = smm->uncommitted.begin;
-                struct block_op *op = smm->uncommitted + i;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+                struct block_op *op = smm->uncommitted.bops + i;
                if (op->block != b)
                        continue;
@@ -671,7 +742,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
        smm->begin = superblock + 1;
        smm->recursion_count = 0;
        smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
        threshold_init(&smm->threshold);
        memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
@@ -715,7 +786,7 @@ int dm_sm_metadata_open(struct dm_space_map *sm,
        smm->begin = 0;
        smm->recursion_count = 0;
        smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
        threshold_init(&smm->threshold);
        memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index b9e2000969f0..95c894482fdd 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -240,7 +240,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
        nid = cpu_to_node(cpu);
        page = alloc_pages_exact_node(nid,
-                                      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                      GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                      pg_order);
        if (page == NULL) {
                dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index d2e6fdb25e28..054e59ca6946 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,20 +1029,12 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->mii.phy_id = 0x03;
        dev->mii.supports_gmii = 1;
-        if (usb_device_no_sg_constraint(dev->udev))
-                dev->can_dma_sg = 1;
        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                              NETIF_F_RXCSUM;
        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                                 NETIF_F_RXCSUM;
-        if (dev->can_dma_sg) {
-                dev->net->features |= NETIF_F_SG | NETIF_F_TSO;
-                dev->net->hw_features |= NETIF_F_SG | NETIF_F_TSO;
-        }
        /* Enable checksum offload */
        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 00660cc502c5..38901665c770 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -162,8 +162,6 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
                avail = *r;
                pci_clip_resource_to_region(bus, &avail, region);
-                if (!resource_size(&avail))
-                        continue;
                /*
                 * "min" is typically PCIBIOS_MIN_IO or PCIBIOS_MIN_MEM to
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6b05f6134b68..fdbc294821e6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1192,6 +1192,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                return err;
        pci_fixup_device(pci_fixup_enable, dev);
+        if (dev->msi_enabled || dev->msix_enabled)
+                return 0;
        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
        if (pin) {
                pci_read_config_word(dev, PCI_COMMAND, &cmd);
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be361b7cd30f..1e4e69384baa 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -217,7 +217,7 @@ config PINCTRL_IMX28
        select PINCTRL_MXS
 config PINCTRL_MSM
-        tristate
+        bool
        select PINMUX
        select PINCONF
        select GENERIC_PINCONF
diff --git a/drivers/pinctrl/pinctrl-capri.c b/drivers/pinctrl/pinctrl-capri.c
index 4669c53f99b0..eb2500212147 100644
--- a/drivers/pinctrl/pinctrl-capri.c
+++ b/drivers/pinctrl/pinctrl-capri.c
@@ -1435,7 +1435,7 @@ int __init capri_pinctrl_probe(struct platform_device *pdev)
 }
 static struct of_device_id capri_pinctrl_of_match[] = {
-        { .compatible = "brcm,capri-pinctrl", },
+        { .compatible = "brcm,bcm11351-pinctrl", },
        { },
 };
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index 9ccf681dad2f..f9fabe9bf47d 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/gpio.h>
 #include <linux/irqdomain.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -584,7 +585,7 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
        spin_lock_irqsave(&pctl->lock, flags);
        regval = readl(pctl->membase + reg);
-        regval &= ~IRQ_CFG_IRQ_MASK;
+        regval &= ~(IRQ_CFG_IRQ_MASK << index);
        writel(regval | (mode << index), pctl->membase + reg);
        spin_unlock_irqrestore(&pctl->lock, flags);
@@ -665,6 +666,7 @@ static struct irq_chip sunxi_pinctrl_irq_chip = {
 static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
        struct sunxi_pinctrl *pctl = irq_get_handler_data(irq);
        const unsigned long reg = readl(pctl->membase + IRQ_STATUS_REG);
@@ -674,10 +676,12 @@ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
        if (reg) {
                int irqoffset;
+                chained_irq_enter(chip, desc);
                for_each_set_bit(irqoffset, &reg, SUNXI_IRQ_NUMBER) {
                        int pin_irq = irq_find_mapping(pctl->domain, irqoffset);
                        generic_handle_irq(pin_irq);
                }
+                chained_irq_exit(chip, desc);
        }
 }
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index 01c494f8a14f..552b0e97077a 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -511,7 +511,7 @@ static inline u32 sunxi_pull_offset(u16 pin)
 static inline u32 sunxi_irq_cfg_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CFG_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CFG_IRQ_PER_REG * 0x04;
        return reg + IRQ_CFG_REG;
 }
@@ -523,7 +523,7 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
 static inline u32 sunxi_irq_ctrl_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG * 0x04;
        return reg + IRQ_CTRL_REG;
 }
@@ -535,7 +535,7 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
 static inline u32 sunxi_irq_status_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG;
+        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG * 0x04;
        return reg + IRQ_STATUS_REG;
 }
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 77d103fe39d9..567d6918d50b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -89,7 +89,8 @@ enum {
        /* GPSR6 */
        FN_IP13_10, FN_IP13_11, FN_IP13_12, FN_IP13_13, FN_IP13_14,
-        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19, FN_IP13_22, FN_IP13_24_23,
+        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19,
+        FN_IP13_22, FN_IP13_24_23, FN_SD1_CLK,
        FN_IP13_25, FN_IP13_26, FN_IP13_27, FN_IP13_30_28, FN_IP14_1_0,
        FN_IP14_2, FN_IP14_3, FN_IP14_4, FN_IP14_5, FN_IP14_6, FN_IP14_7,
        FN_IP14_10_8, FN_IP14_13_11, FN_IP14_16_14, FN_IP14_19_17,
@@ -788,6 +789,7 @@ static const u16 pinmux_data[] = {
        PINMUX_DATA(USB1_PWEN_MARK, FN_USB1_PWEN),
        PINMUX_DATA(USB1_OVC_MARK, FN_USB1_OVC),
        PINMUX_DATA(DU0_DOTCLKIN_MARK, FN_DU0_DOTCLKIN),
+        PINMUX_DATA(SD1_CLK_MARK, FN_SD1_CLK),
        /* IPSR0 */
        PINMUX_IPSR_DATA(IP0_0, D0),
@@ -3825,7 +3827,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                GP_6_11_FN, FN_IP13_25,
                GP_6_10_FN, FN_IP13_24_23,
                GP_6_9_FN, FN_IP13_22,
-                0, 0,
+                GP_6_8_FN, FN_SD1_CLK,
                GP_6_7_FN, FN_IP13_21_19,
                GP_6_6_FN, FN_IP13_18_16,
                GP_6_5_FN, FN_IP13_15,
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index a0d6152701cd..617a4916b50f 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -598,7 +598,7 @@ static unsigned int sirfsoc_gpio_irq_startup(struct irq_data *d)
 {
        struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
-        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq))
+        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE))
                dev_err(bank->chip.gc.dev,
                        "unable to lock HW IRQ %lu for IRQ\n",
                        d->hwirq);
@@ -611,7 +611,7 @@ static void sirfsoc_gpio_irq_shutdown(struct irq_data *d)
        struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
        sirfsoc_gpio_irq_mask(d);
-        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq);
+        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE);
 }
 static struct irq_chip sirfsoc_irq_chip = {
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 31534b51715a..c3b2fb9b6713 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -132,9 +132,9 @@ static int ath79_spi_setup_cs(struct spi_device *spi)
                flags = GPIOF_DIR_OUT;
                if (spi->mode & SPI_CS_HIGH)
-                        flags |= GPIOF_INIT_HIGH;
-                else
                        flags |= GPIOF_INIT_LOW;
+                else
+                        flags |= GPIOF_INIT_HIGH;
                status = gpio_request_one(cdata->gpio, flags,
                                          dev_name(&spi->dev));
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index b0842f751016..5d7b07f08326 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1455,6 +1455,14 @@ static int atmel_spi_suspend(struct device *dev)
 {
        struct spi_master       *master = dev_get_drvdata(dev);
        struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
+        /* Stop the queue running */
+        ret = spi_master_suspend(master);
+        if (ret) {
+                dev_warn(dev, "cannot suspend master\n");
+                return ret;
+        }
        clk_disable_unprepare(as->clk);
        return 0;
@@ -1464,9 +1472,16 @@ static int atmel_spi_resume(struct device *dev)
 {
        struct spi_master       *master = dev_get_drvdata(dev);
        struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
        clk_prepare_enable(as->clk);
-        return 0;
+        /* Start the queue running */
+        ret = spi_master_resume(master);
+        if (ret)
+                dev_err(dev, "problem starting queue (%d)\n", ret);
+        return ret;
 }
 static SIMPLE_DEV_PM_OPS(atmel_spi_pm_ops, atmel_spi_suspend, atmel_spi_resume);
diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index cabed8f9119e..28ae470397a9 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -514,7 +514,8 @@ static int mcfqspi_resume(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 static int mcfqspi_runtime_suspend(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
        clk_disable(mcfqspi->clk);
@@ -523,7 +524,8 @@ static int mcfqspi_runtime_suspend(struct device *dev)
 static int mcfqspi_runtime_resume(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
        clk_enable(mcfqspi->clk);
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index ec79f726672a..a25392065d9b 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -420,7 +420,6 @@ static int dspi_suspend(struct device *dev)
 static int dspi_resume(struct device *dev)
 {
        struct spi_master *master = dev_get_drvdata(dev);
        struct fsl_dspi *dspi = spi_master_get_devdata(master);
@@ -504,7 +503,7 @@ static int dspi_probe(struct platform_device *pdev)
        clk_prepare_enable(dspi->clk);
        init_waitqueue_head(&dspi->waitq);
-        platform_set_drvdata(pdev, dspi);
+        platform_set_drvdata(pdev, master);
        ret = spi_bitbang_start(&dspi->bitbang);
        if (ret != 0) {
@@ -525,7 +524,8 @@ out_master_put:
 static int dspi_remove(struct platform_device *pdev)
 {
-        struct fsl_dspi *dspi = platform_get_drvdata(pdev);
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct fsl_dspi *dspi = spi_master_get_devdata(master);
        /* Disconnect from the SPI framework */
        spi_bitbang_stop(&dspi->bitbang);
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index a5474ef9d2a0..47f15d97e7fa 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -948,8 +948,8 @@ static int spi_imx_remove(struct platform_device *pdev)
        spi_bitbang_stop(&spi_imx->bitbang);
        writel(0, spi_imx->base + MXC_CSPICTRL);
-        clk_disable_unprepare(spi_imx->clk_ipg);
+        clk_unprepare(spi_imx->clk_ipg);
-        clk_disable_unprepare(spi_imx->clk_per);
+        clk_unprepare(spi_imx->clk_per);
        spi_master_put(master);
        return 0;
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 2e7f38c7a961..88eb57e858b3 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -915,7 +915,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
        /* Set Tx DMA */
        param = &dma->param_tx;
        param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2; /* Tx = 0, 2 */
+        param->chan_id = data->ch * 2; /* Tx = 0, 2 */;
        param->tx_reg = data->io_base_addr + PCH_SPDWR;
        param->width = width;
        chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -930,7 +930,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
        /* Set Rx DMA */
        param = &dma->param_rx;
        param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2 + 1; /* Rx = Tx + 1 */
+        param->chan_id = data->ch * 2 + 1; /* Rx = Tx + 1 */;
        param->rx_reg = data->io_base_addr + PCH_SPDRR;
        param->width = width;
        chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -1452,6 +1452,11 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
        pch_spi_set_master_mode(master);
+        if (use_dma) {
+                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
+                pch_alloc_dma_buf(board_dat, data);
+        }
        ret = spi_register_master(master);
        if (ret != 0) {
                dev_err(&plat_dev->dev,
@@ -1459,14 +1464,10 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
                goto err_spi_register_master;
        }
-        if (use_dma) {
-                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
-                pch_alloc_dma_buf(board_dat, data);
-        }
        return 0;
 err_spi_register_master:
+        pch_free_dma_buf(board_dat, data);
        free_irq(board_dat->pdev->irq, data);
 err_request_irq:
        pch_spi_free_resources(board_dat, data);
diff --git a/drivers/staging/cxt1e1/linux.c b/drivers/staging/cxt1e1/linux.c
index 4a08e16e42f7..79206cb3fb94 100644
--- a/drivers/staging/cxt1e1/linux.c
+++ b/drivers/staging/cxt1e1/linux.c
@@ -866,6 +866,8 @@ c4_ioctl (struct net_device *ndev, struct ifreq *ifr, int cmd)
            _IOC_SIZE (iocmd));
 #endif
    iolen = _IOC_SIZE (iocmd);
+    if (iolen > sizeof(arg))
+        return -EFAULT;
    data = ifr->ifr_data + sizeof (iocmd);
    if (copy_from_user (&arg, data, iolen))
        return -EFAULT;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 7f1a7ce4b771..b83ec378d04f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -785,7 +785,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
        spin_unlock_bh(&conn->cmd_lock);
        list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                iscsit_free_cmd(cmd, false);
        }
 }
@@ -3708,7 +3708,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
                break;
        case ISTATE_REMOVE:
                spin_lock_bh(&conn->cmd_lock);
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                iscsit_free_cmd(cmd, false);
@@ -4151,7 +4151,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
        spin_lock_bh(&conn->cmd_lock);
        list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                iscsit_increment_maxcmdsn(cmd, sess);
@@ -4196,6 +4196,10 @@ int iscsit_close_connection(
        iscsit_stop_timers_for_cmds(conn);
        iscsit_stop_nopin_response_timer(conn);
        iscsit_stop_nopin_timer(conn);
+        if (conn->conn_transport->iscsit_wait_conn)
+                conn->conn_transport->iscsit_wait_conn(conn);
        iscsit_free_queue_reqs_for_conn(conn);
        /*
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 33be1fb1df32..4ca8fd2a70db 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -138,7 +138,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                list_for_each_entry_safe(cmd, cmd_tmp,
                                &cr->conn_recovery_cmd_list, i_conn_node) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                        cmd->conn = NULL;
                        spin_unlock(&cr->conn_recovery_cmd_lock);
                        iscsit_free_cmd(cmd, true);
@@ -160,7 +160,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                list_for_each_entry_safe(cmd, cmd_tmp,
                                &cr->conn_recovery_cmd_list, i_conn_node) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                        cmd->conn = NULL;
                        spin_unlock(&cr->conn_recovery_cmd_lock);
                        iscsit_free_cmd(cmd, true);
@@ -216,7 +216,7 @@ int iscsit_remove_cmd_from_connection_recovery(
        }
        cr = cmd->cr;
-        list_del(&cmd->i_conn_node);
+        list_del_init(&cmd->i_conn_node);
        return --cr->cmd_count;
 }
@@ -297,7 +297,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
                if (!(cmd->cmd_flags & ICF_OOO_CMDSN))
                        continue;
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                iscsit_free_cmd(cmd, true);
@@ -335,7 +335,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
        /*
         * Only perform connection recovery on ISCSI_OP_SCSI_CMD or
         * ISCSI_OP_NOOP_OUT opcodes.  For all other opcodes call
-         * list_del(&cmd->i_conn_node); to release the command to the
+         * list_del_init(&cmd->i_conn_node); to release the command to the
         * session pool and remove it from the connection's list.
         *
         * Also stop the DataOUT timer, which will be restarted after
@@ -351,7 +351,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                                " CID: %hu\n", cmd->iscsi_opcode,
                                cmd->init_task_tag, cmd->cmd_sn, conn->cid);
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                        spin_unlock_bh(&conn->cmd_lock);
                        iscsit_free_cmd(cmd, true);
                        spin_lock_bh(&conn->cmd_lock);
@@ -371,7 +371,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                 */
                if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
                     iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                        spin_unlock_bh(&conn->cmd_lock);
                        iscsit_free_cmd(cmd, true);
                        spin_lock_bh(&conn->cmd_lock);
@@ -393,7 +393,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                cmd->sess = conn->sess;
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                spin_unlock_bh(&conn->cmd_lock);
                iscsit_free_all_datain_reqs(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 39761837608d..44a5471de00f 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -137,7 +137,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np(
        list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
                spin_lock(&tpg->tpg_state_lock);
-                if (tpg->tpg_state == TPG_STATE_FREE) {
+                if (tpg->tpg_state != TPG_STATE_ACTIVE) {
                        spin_unlock(&tpg->tpg_state_lock);
                        continue;
                }
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 42f18fc1067b..77e6531fb0a1 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1079,25 +1079,31 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
        left = sectors * dev->prot_length;
        for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
+                unsigned int psg_len, copied = 0;
-                len = min(psg->length, left);
-                if (offset >= sg->length) {
-                        sg = sg_next(sg);
-                        offset = 0;
-                }
                paddr = kmap_atomic(sg_page(psg)) + psg->offset;
-                addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
+                psg_len = min(left, psg->length);
+                while (psg_len) {
-                if (read)
+                        len = min(psg_len, sg->length - offset);
-                        memcpy(paddr, addr, len);
+                        addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
-                else
-                        memcpy(addr, paddr, len);
+                        if (read)
+                                memcpy(paddr + copied, addr, len);
-                left -= len;
+                        else
-                offset += len;
+                                memcpy(addr, paddr + copied, len);
+                        left -= len;
+                        offset += len;
+                        copied += len;
+                        psg_len -= len;
+                        if (offset >= sg->length) {
+                                sg = sg_next(sg);
+                                offset = 0;
+                        }
+                        kunmap_atomic(addr);
+                }
                kunmap_atomic(paddr);
-                kunmap_atomic(addr);
        }
 }
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 35c066489a19..5f88d767671e 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -136,6 +136,7 @@ config SPEAR_THERMAL
 config RCAR_THERMAL
        tristate "Renesas R-Car thermal driver"
        depends on ARCH_SHMOBILE || COMPILE_TEST
+        depends on HAS_IOMEM
        help
          Enable this to plug the R-Car thermal sensor driver into the Linux
          thermal framework.
@@ -210,8 +211,16 @@ config ACPI_INT3403_THERMAL
        tristate "ACPI INT3403 thermal driver"
        depends on X86 && ACPI
        help
-          This driver uses ACPI INT3403 device objects. If present, it will
+          Newer laptops and tablets that use ACPI may have thermal sensors
-          register each INT3403 thermal sensor as a thermal zone.
+          outside the core CPU/SOC for thermal safety reasons. These
+          temperature sensors are also exposed for the OS to use via the so
+          called INT3403 ACPI object. This driver will, on devices that have
+          such sensors, expose the temperature information from these sensors
+          to userspace via the normal thermal framework. This means that a wide
+          range of applications and GUI widgets can show this information to
+          the user or use this information for making decisions. For example,
+          the Intel Thermal Daemon can use this information to allow the user
+          to select his laptop to run without turning on the fans.
 menu "Texas Instruments thermal drivers"
 source "drivers/thermal/ti-soc-thermal/Kconfig"
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 338a88bf6662..71b0ec0c370d 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -56,10 +56,15 @@ static LIST_HEAD(thermal_governor_list);
 static DEFINE_MUTEX(thermal_list_lock);
 static DEFINE_MUTEX(thermal_governor_lock);
+static struct thermal_governor *def_governor;
 static struct thermal_governor *__find_governor(const char *name)
 {
        struct thermal_governor *pos;
+        if (!name || !name[0])
+                return def_governor;
        list_for_each_entry(pos, &thermal_governor_list, governor_list)
                if (!strnicmp(name, pos->name, THERMAL_NAME_LENGTH))
                        return pos;
@@ -82,17 +87,23 @@ int thermal_register_governor(struct thermal_governor *governor)
        if (__find_governor(governor->name) == NULL) {
                err = 0;
                list_add(&governor->governor_list, &thermal_governor_list);
+                if (!def_governor && !strncmp(governor->name,
+                        DEFAULT_THERMAL_GOVERNOR, THERMAL_NAME_LENGTH))
+                        def_governor = governor;
        }
        mutex_lock(&thermal_list_lock);
        list_for_each_entry(pos, &thermal_tz_list, node) {
+                /*
+                 * only thermal zones with specified tz->tzp->governor_name
+                 * may run with tz->govenor unset
+                 */
                if (pos->governor)
                        continue;
-                if (pos->tzp)
-                        name = pos->tzp->governor_name;
+                name = pos->tzp->governor_name;
-                else
-                        name = DEFAULT_THERMAL_GOVERNOR;
                if (!strnicmp(name, governor->name, THERMAL_NAME_LENGTH))
                        pos->governor = governor;
        }
@@ -342,8 +353,8 @@ static void monitor_thermal_zone(struct thermal_zone_device *tz)
 static void handle_non_critical_trips(struct thermal_zone_device *tz,
                        int trip, enum thermal_trip_type trip_type)
 {
-        if (tz->governor)
+        tz->governor ? tz->governor->throttle(tz, trip) :
-                tz->governor->throttle(tz, trip);
+                       def_governor->throttle(tz, trip);
 }
 static void handle_critical_trips(struct thermal_zone_device *tz,
@@ -1107,7 +1118,7 @@ __thermal_cooling_device_register(struct device_node *np,
        INIT_LIST_HEAD(&cdev->thermal_instances);
        cdev->np = np;
        cdev->ops = ops;
-        cdev->updated = true;
+        cdev->updated = false;
        cdev->device.class = &thermal_class;
        cdev->devdata = devdata;
        dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
@@ -1533,7 +1544,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
        if (tz->tzp)
                tz->governor = __find_governor(tz->tzp->governor_name);
        else
-                tz->governor = __find_governor(DEFAULT_THERMAL_GOVERNOR);
+                tz->governor = def_governor;
        mutex_unlock(&thermal_governor_lock);
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index 972e1c73722a..081fd7e6a9f0 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -68,6 +68,10 @@ struct phy_dev_entry {
        struct thermal_zone_device *tzone;
 };
+static const struct thermal_zone_params pkg_temp_tz_params = {
+        .no_hwmon       = true,
+};
 /* List maintaining number of package instances */
 static LIST_HEAD(phy_dev_list);
 static DEFINE_MUTEX(phy_dev_list_mutex);
@@ -394,7 +398,6 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
        int err;
        u32 tj_max;
        struct phy_dev_entry *phy_dev_entry;
-        char buffer[30];
        int thres_count;
        u32 eax, ebx, ecx, edx;
        u8 *temp;
@@ -440,13 +443,11 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
        phy_dev_entry->first_cpu = cpu;
        phy_dev_entry->tj_max = tj_max;
        phy_dev_entry->ref_cnt = 1;
-        snprintf(buffer, sizeof(buffer), "pkg-temp-%d\n",
+        phy_dev_entry->tzone = thermal_zone_device_register("x86_pkg_temp",
-                                        phy_dev_entry->phys_proc_id);
-        phy_dev_entry->tzone = thermal_zone_device_register(buffer,
                        thres_count,
                        (thres_count == MAX_NUMBER_OF_TRIPS) ?
                                0x03 : 0x01,
-                        phy_dev_entry, &tzone_ops, NULL, 0, 0);
+                        phy_dev_entry, &tzone_ops, &pkg_temp_tz_params, 0, 0);
        if (IS_ERR(phy_dev_entry->tzone)) {
                err = PTR_ERR(phy_dev_entry->tzone);
                goto err_ret_free;
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 8d72f0c65937..062967c90b2a 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -717,6 +717,10 @@ int usb_get_configuration(struct usb_device *dev)
                        result = -ENOMEM;
                        goto err;
                }
+                if (dev->quirks & USB_QUIRK_DELAY_INIT)
+                        msleep(100);
                result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                    bigbuffer, length);
                if (result < 0) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 8f37063c0a49..739ee8e8bdfd 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -47,6 +47,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Microsoft LifeCam-VX700 v2.0 */
        { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Logitech HD Pro Webcams C920 and C930e */
+        { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
        /* Logitech Quickcam Fusion */
        { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6fe577d46fa2..924a6ccdb622 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4733,6 +4733,9 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
        /* Accept arbitrarily long scatter-gather lists */
        hcd->self.sg_tablesize = ~0;
+        /* support to build packet from discontinuous buffers */
+        hcd->self.no_sg_constraint = 1;
        /* XHCI controllers don't stop the ep queue on short packets :| */
        hcd->self.no_stop_on_short = 1;
@@ -4757,14 +4760,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                /* xHCI private pointer was set in xhci_pci_probe for the second
                 * registered roothub.
                 */
-                xhci = hcd_to_xhci(hcd);
-                /*
-                 * Support arbitrarily aligned sg-list entries on hosts without
-                 * TD fragment rules (which are currently unsupported).
-                 */
-                if (xhci->hci_version < 0x100)
-                        hcd->self.no_sg_constraint = 1;
                return 0;
        }
@@ -4793,9 +4788,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
        if (xhci->hci_version > 0x96)
                xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
-        if (xhci->hci_version < 0x100)
-                hcd->self.no_sg_constraint = 1;
        /* Make sure the HC is halted. */
        retval = xhci_halt(xhci);
        if (retval)
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 0129b78a6908..4f70f383132c 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -458,11 +458,10 @@ static int bio_integrity_verify(struct bio *bio)
        struct blk_integrity_exchg bix;
        struct bio_vec *bv;
        sector_t sector = bio->bi_integrity->bip_iter.bi_sector;
-        unsigned int sectors, total, ret;
+        unsigned int sectors, ret = 0;
        void *prot_buf = bio->bi_integrity->bip_buf;
        int i;
-        ret = total = 0;
        bix.disk_name = bio->bi_bdev->bd_disk->disk_name;
        bix.sector_size = bi->sector_size;
@@ -484,8 +483,6 @@ static int bio_integrity_verify(struct bio *bio)
                sectors = bv->bv_len / bi->sector_size;
                sector += sectors;
                prot_buf += sectors * bi->tuple_size;
-                total += sectors * bi->tuple_size;
-                BUG_ON(total > bio->bi_integrity->bip_iter.bi_size);
                kunmap_atomic(kaddr);
        }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cf32f0393369..c0f3718b77a8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -513,7 +513,7 @@ struct cifs_mnt_data {
 static inline unsigned int
 get_rfc1002_length(void *buf)
 {
-        return be32_to_cpu(*((__be32 *)buf));
+        return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
 }
 static inline void
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 53c15074bb36..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2579,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
        struct cifsInodeInfo *cinode = CIFS_I(inode);
        struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
        ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
-        BUG_ON(iocb->ki_pos != pos);
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
        /*
         * We need to hold the sem to be sure nobody modifies lock list
         * with a brlock that prevents writing.
         */
        down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                     server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
+                                     CIFS_WRITE_OP))
-                mutex_lock(&inode->i_mutex);
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-        if (rc > 0) {
-                ssize_t err;
-                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                if (err < 0)
-                        rc = err;
-        }
        up_read(&cinode->lock_sem);
        return rc;
 }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b37570952846..18cd5650a5fc 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -270,6 +270,26 @@ cifs_rqst_page_to_kvec(struct smb_rqst *rqst, unsigned int idx,
                iov->iov_len = rqst->rq_pagesz;
 }
+static unsigned long
+rqst_len(struct smb_rqst *rqst)
+{
+        unsigned int i;
+        struct kvec *iov = rqst->rq_iov;
+        unsigned long buflen = 0;
+        /* total up iov array first */
+        for (i = 0; i < rqst->rq_nvec; i++)
+                buflen += iov[i].iov_len;
+        /* add in the page array if there is one */
+        if (rqst->rq_npages) {
+                buflen += rqst->rq_pagesz * (rqst->rq_npages - 1);
+                buflen += rqst->rq_tailsz;
+        }
+        return buflen;
+}
 static int
 smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
@@ -277,6 +297,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        struct kvec *iov = rqst->rq_iov;
        int n_vec = rqst->rq_nvec;
        unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned long send_length;
        unsigned int i;
        size_t total_len = 0, sent;
        struct socket *ssocket = server->ssocket;
@@ -285,6 +306,14 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        if (ssocket == NULL)
                return -ENOTSOCK;
+        /* sanity check send length */
+        send_length = rqst_len(rqst);
+        if (send_length != smb_buf_length + 4) {
+                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
+                        send_length, smb_buf_length);
+                return -EIO;
+        }
        cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
        dump_smb(iov[0].iov_base, iov[0].iov_len);
diff --git a/fs/file.c b/fs/file.c
index db25c2bdfe46..60a45e9f5323 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -683,35 +683,65 @@ EXPORT_SYMBOL(fget_raw);
 * The fput_needed flag returned by fget_light should be passed to the
 * corresponding fput_light.
 */
-struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
+static unsigned long __fget_light(unsigned int fd, fmode_t mask)
 {
        struct files_struct *files = current->files;
        struct file *file;
-        *fput_needed = 0;
        if (atomic_read(&files->count) == 1) {
                file = __fcheck_files(files, fd);
-                if (file && (file->f_mode & mask))
+                if (!file || unlikely(file->f_mode & mask))
-                        file = NULL;
+                        return 0;
+                return (unsigned long)file;
        } else {
                file = __fget(fd, mask);
-                if (file)
+                if (!file)
-                        *fput_needed = 1;
+                        return 0;
+                return FDPUT_FPUT | (unsigned long)file;
        }
-        return file;
 }
-struct file *fget_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget(unsigned int fd)
 {
-        return __fget_light(fd, FMODE_PATH, fput_needed);
+        return __fget_light(fd, FMODE_PATH);
 }
-EXPORT_SYMBOL(fget_light);
+EXPORT_SYMBOL(__fdget);
-struct file *fget_raw_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget_raw(unsigned int fd)
 {
-        return __fget_light(fd, 0, fput_needed);
+        return __fget_light(fd, 0);
+}
+unsigned long __fdget_pos(unsigned int fd)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        unsigned long v;
+        if (atomic_read(&files->count) == 1) {
+                file = __fcheck_files(files, fd);
+                v = 0;
+        } else {
+                file = __fget(fd, 0);
+                v = FDPUT_FPUT;
+        }
+        if (!file)
+                return 0;
+        if (file->f_mode & FMODE_ATOMIC_POS) {
+                if (file_count(file) > 1) {
+                        v |= FDPUT_POS_UNLOCK;
+                        mutex_lock(&file->f_pos_lock);
+                }
+        }
+        return v | (unsigned long)file;
 }
+/*
+ * We only lock f_pos if we have threads or if the file might be
+ * shared with another process. In both cases we'll have an elevated
+ * file count (done either by fdget() or by fork()).
+ */
 void set_close_on_exec(unsigned int fd, int flag)
 {
        struct files_struct *files = current->files;
diff --git a/fs/file_table.c b/fs/file_table.c
index 5fff9030be34..5b24008ea4f6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -135,6 +135,7 @@ struct file *get_empty_filp(void)
        atomic_long_set(&f->f_count, 1);
        rwlock_init(&f->f_owner.lock);
        spin_lock_init(&f->f_lock);
+        mutex_init(&f->f_pos_lock);
        eventpoll_init_file(f);
        /* f->f_version: 0 */
        return f;
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 968ce411db53..32602c667b4a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -103,6 +103,8 @@ static int hfsplus_cat_build_record(hfsplus_cat_entry *entry,
                folder = &entry->folder;
                memset(folder, 0, sizeof(*folder));
                folder->type = cpu_to_be16(HFSPLUS_FOLDER);
+                if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+                        folder->flags |= cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT);
                folder->id = cpu_to_be32(inode->i_ino);
                HFSPLUS_I(inode)->create_date =
                        folder->create_date =
@@ -203,6 +205,36 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
        return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
+static void hfsplus_subfolders_inc(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Increment subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 */
+                HFSPLUS_I(dir)->subfolders++;
+        }
+}
+static void hfsplus_subfolders_dec(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Decrement subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 *
+                 * Check for zero. Some subfolders may have been created
+                 * by an implementation ignorant of this counter.
+                 */
+                if (HFSPLUS_I(dir)->subfolders)
+                        HFSPLUS_I(dir)->subfolders--;
+        }
+}
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
                struct qstr *str, struct inode *inode)
 {
@@ -247,6 +279,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                goto err1;
        dir->i_size++;
+        if (S_ISDIR(inode->i_mode))
+                hfsplus_subfolders_inc(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -336,6 +370,8 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                goto out;
        dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -380,6 +416,7 @@ int hfsplus_rename_cat(u32 cnid,
        hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                src_fd.entrylength);
+        type = be16_to_cpu(entry.type);
        /* create new dir entry with the data from the old entry */
        hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
@@ -394,6 +431,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        dst_dir->i_size++;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_inc(dst_dir);
        dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
        /* finally remove the old entry */
@@ -405,6 +444,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        src_dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(src_dir);
        src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
        /* remove old thread entry */
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 08846425b67f..62d571eb69ba 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -242,6 +242,7 @@ struct hfsplus_inode_info {
         */
        sector_t fs_blocks;
        u8 userflags;           /* BSD user file flags */
+        u32 subfolders;         /* Subfolder count (HFSX only) */
        struct list_head open_dir_list;
        loff_t phys_size;
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 8ffb3a8ffe75..5a126828d85e 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -261,7 +261,7 @@ struct hfsplus_cat_folder {
        struct DInfo user_info;
        struct DXInfo finder_info;
        __be32 text_encoding;
-        u32 reserved;
+        __be32 subfolders;      /* Subfolder count in HFSX. Reserved in HFS+. */
 } __packed;
 /* HFS file info (stolen from hfs.h) */
@@ -301,11 +301,13 @@ struct hfsplus_cat_file {
        struct hfsplus_fork_raw rsrc_fork;
 } __packed;
-/* File attribute bits */
+/* File and folder flag bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
 #define HFSPLUS_XATTR_EXISTS            0x0004
 #define HFSPLUS_ACL_EXISTS              0x0008
+#define HFSPLUS_HAS_FOLDER_COUNT        0x0010  /* Folder has subfolder count
+                                                 * (HFSX only) */
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index fa929f325f87..a4f45bd88a63 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -375,6 +375,7 @@ struct inode *hfsplus_new_inode(struct super_block *sb, umode_t mode)
        hip->extent_state = 0;
        hip->flags = 0;
        hip->userflags = 0;
+        hip->subfolders = 0;
        memset(hip->first_extents, 0, sizeof(hfsplus_extent_rec));
        memset(hip->cached_extents, 0, sizeof(hfsplus_extent_rec));
        hip->alloc_blocks = 0;
@@ -494,6 +495,10 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
                inode->i_ctime = hfsp_mt2ut(folder->attribute_mod_date);
                HFSPLUS_I(inode)->create_date = folder->create_date;
                HFSPLUS_I(inode)->fs_blocks = 0;
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        HFSPLUS_I(inode)->subfolders =
+                                be32_to_cpu(folder->subfolders);
+                }
                inode->i_op = &hfsplus_dir_inode_operations;
                inode->i_fop = &hfsplus_dir_operations;
        } else if (type == HFSPLUS_FILE) {
@@ -566,6 +571,10 @@ int hfsplus_cat_write_inode(struct inode *inode)
                folder->content_mod_date = hfsp_ut2mt(inode->i_mtime);
                folder->attribute_mod_date = hfsp_ut2mt(inode->i_ctime);
                folder->valence = cpu_to_be32(inode->i_size - 2);
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        folder->subfolders =
+                                cpu_to_be32(HFSPLUS_I(inode)->subfolders);
+                }
                hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
                                         sizeof(struct hfsplus_cat_folder));
        } else if (HFSPLUS_IS_RSRC(inode)) {
diff --git a/fs/namei.c b/fs/namei.c
index 385f7817bfcc..2f730ef9b4b3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1884,7 +1884,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
                nd->path = f.file->f_path;
                if (flags & LOOKUP_RCU) {
-                        if (f.need_put)
+                        if (f.flags & FDPUT_FPUT)
                                *fp = f.file;
                        nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                        rcu_read_lock();
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index ef792f29f831..5d8ccecf5f5c 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode,
        rcu_read_lock();
        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation == NULL)
+                goto out_enoent;
-        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) {
+        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid))
-                rcu_read_unlock();
+                goto out_enoent;
-                return -ENOENT;
-        }
        nfs_mark_return_delegation(server, delegation);
        rcu_read_unlock();
        nfs_delegation_run_state_manager(clp);
        return 0;
+out_enoent:
+        rcu_read_unlock();
+        return -ENOENT;
 }
 static struct inode *
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 12c8132ad408..b9a35c05b60f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -324,8 +324,9 @@ static void filelayout_read_prepare(struct rpc_task *task, void *data)
                        &rdata->res.seq_res,
                        task))
                return;
-        nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
+        if (nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
-                        rdata->args.lock_context, FMODE_READ);
+                        rdata->args.lock_context, FMODE_READ) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 static void filelayout_read_call_done(struct rpc_task *task, void *data)
@@ -435,8 +436,9 @@ static void filelayout_write_prepare(struct rpc_task *task, void *data)
                        &wdata->res.seq_res,
                        task))
                return;
-        nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
+        if (nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
-                        wdata->args.lock_context, FMODE_WRITE);
+                        wdata->args.lock_context, FMODE_WRITE) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 static void filelayout_write_call_done(struct rpc_task *task, void *data)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2da6a698b8f7..450bfedbe2f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2398,13 +2398,16 @@ static int _nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
        if (nfs4_copy_delegation_stateid(&arg.stateid, inode, fmode)) {
                /* Use that stateid */
-        } else if (truncate && state != NULL && nfs4_valid_open_stateid(state)) {
+        } else if (truncate && state != NULL) {
                struct nfs_lockowner lockowner = {
                        .l_owner = current->files,
                        .l_pid = current->tgid,
                };
-                nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                if (!nfs4_valid_open_stateid(state))
-                                &lockowner);
+                        return -EBADF;
+                if (nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                                &lockowner) == -EIO)
+                        return -EBADF;
        } else
                nfs4_stateid_copy(&arg.stateid, &zero_stateid);
@@ -4011,8 +4014,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid,
 {
        nfs4_stateid current_stateid;
-        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode))
+        /* If the current stateid represents a lost lock, then exit */
-                return false;
+        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode) == -EIO)
+                return true;
        return nfs4_stateid_match(stateid, &current_stateid);
 }
@@ -5828,8 +5832,7 @@ struct nfs_release_lockowner_data {
        struct nfs4_lock_state *lsp;
        struct nfs_server *server;
        struct nfs_release_lockowner_args args;
-        struct nfs4_sequence_args seq_args;
+        struct nfs_release_lockowner_res res;
-        struct nfs4_sequence_res seq_res;
        unsigned long timestamp;
 };
@@ -5837,7 +5840,7 @@ static void nfs4_release_lockowner_prepare(struct rpc_task *task, void *calldata
 {
        struct nfs_release_lockowner_data *data = calldata;
        nfs40_setup_sequence(data->server,
-                                &data->seq_args, &data->seq_res, task);
+                                &data->args.seq_args, &data->res.seq_res, task);
        data->timestamp = jiffies;
 }
@@ -5846,7 +5849,7 @@ static void nfs4_release_lockowner_done(struct rpc_task *task, void *calldata)
        struct nfs_release_lockowner_data *data = calldata;
        struct nfs_server *server = data->server;
-        nfs40_sequence_done(task, &data->seq_res);
+        nfs40_sequence_done(task, &data->res.seq_res);
        switch (task->tk_status) {
        case 0:
@@ -5887,7 +5890,6 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
        data = kmalloc(sizeof(*data), GFP_NOFS);
        if (!data)
                return -ENOMEM;
-        nfs4_init_sequence(&data->seq_args, &data->seq_res, 0);
        data->lsp = lsp;
        data->server = server;
        data->args.lock_owner.clientid = server->nfs_client->cl_clientid;
@@ -5895,6 +5897,8 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
        data->args.lock_owner.s_dev = server->s_dev;
        msg.rpc_argp = &data->args;
+        msg.rpc_resp = &data->res;
+        nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 0);
        rpc_call_async(server->client, &msg, 0, &nfs4_release_lockowner_ops, data);
        return 0;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e1a47217c05e..0deb32105ccf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -974,9 +974,6 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
        else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
                nfs4_stateid_copy(dst, &lsp->ls_stateid);
                ret = 0;
-                smp_rmb();
-                if (!list_empty(&lsp->ls_seqid.list))
-                        ret = -EWOULDBLOCK;
        }
        spin_unlock(&state->state_lock);
        nfs4_put_lock_state(lsp);
@@ -984,10 +981,9 @@ out:
        return ret;
 }
-static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
+static void nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
 {
        const nfs4_stateid *src;
-        int ret;
        int seq;
        do {
@@ -996,12 +992,7 @@ static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
                if (test_bit(NFS_OPEN_STATE, &state->flags))
                        src = &state->open_stateid;
                nfs4_stateid_copy(dst, src);
-                ret = 0;
-                smp_rmb();
-                if (!list_empty(&state->owner->so_seqid.list))
-                        ret = -EWOULDBLOCK;
        } while (read_seqretry(&state->seqlock, seq));
-        return ret;
 }
 /*
@@ -1026,7 +1017,8 @@ int nfs4_select_rw_stateid(nfs4_stateid *dst, struct nfs4_state *state,
                 * choose to use.
                 */
                goto out;
-        ret = nfs4_copy_open_stateid(dst, state);
+        nfs4_copy_open_stateid(dst, state);
+        ret = 0;
 out:
        if (nfs_server_capable(state->inode, NFS_CAP_STATEID_NFSV41))
                dst->seqid = 0;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8450262bcf2a..51632c40e896 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2393,8 +2393,8 @@ out_dio:
        if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
            ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, pos,
+                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
-                                               pos + count - 1);
+                                               *ppos + count - 1);
                if (ret < 0)
                        written = ret;
@@ -2407,8 +2407,8 @@ out_dio:
                }
                if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, pos,
+                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
-                                                      pos + count - 1);
+                                                      *ppos + count - 1);
        }
        /*
diff --git a/fs/open.c b/fs/open.c
index 4b3e1edf2fe4..b9ed8b25c108 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -705,6 +705,10 @@ static int do_dentry_open(struct file *f,
                return 0;
        }
+        /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
+        if (S_ISREG(inode->i_mode))
+                f->f_mode |= FMODE_ATOMIC_POS;
        f->f_op = fops_get(inode->i_fop);
        if (unlikely(WARN_ON(!f->f_op))) {
                error = -ENODEV;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 51507065263b..b9760628e1fd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
        if (rc)
                goto out_mmput;
+        rc = -ENOENT;
        down_read(&mm->mmap_sem);
        vma = find_exact_vma(mm, vm_start, vm_end);
        if (vma && vma->vm_file) {
diff --git a/fs/read_write.c b/fs/read_write.c
index edc5746a902a..54e19b9392dc 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -264,10 +264,22 @@ loff_t vfs_llseek(struct file *file, loff_t offset, int whence)
 }
 EXPORT_SYMBOL(vfs_llseek);
+static inline struct fd fdget_pos(int fd)
+{
+        return __to_fd(__fdget_pos(fd));
+}
+static inline void fdput_pos(struct fd f)
+{
+        if (f.flags & FDPUT_POS_UNLOCK)
+                mutex_unlock(&f.file->f_pos_lock);
+        fdput(f);
+}
 SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
 {
        off_t retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        if (!f.file)
                return -EBADF;
@@ -278,7 +290,7 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
                if (res != (loff_t)retval)
                        retval = -EOVERFLOW;    /* LFS: should only happen on 32 bit platforms */
        }
-        fdput(f);
+        fdput_pos(f);
        return retval;
 }
@@ -498,7 +510,7 @@ static inline void file_pos_write(struct file *file, loff_t pos)
 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -506,7 +518,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
                ret = vfs_read(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
 }
@@ -514,7 +526,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -522,7 +534,7 @@ SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                ret = vfs_write(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
@@ -797,7 +809,7 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -805,7 +817,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_readv(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -817,7 +829,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -825,7 +837,7 @@ SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_writev(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -968,7 +980,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
                const struct compat_iovec __user *,vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -978,7 +990,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
        ret = compat_readv(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
@@ -1035,7 +1047,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
                const struct compat_iovec __user *, vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -1045,7 +1057,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
        ret = compat_writev(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index be85127bfed3..f27000f55a83 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -171,6 +171,11 @@ static inline int kvm_vgic_set_addr(struct kvm *kvm, unsigned long type, u64 add
        return 0;
 }
+static inline int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write)
+{
+        return -ENXIO;
+}
 static inline int kvm_vgic_init(struct kvm *kvm)
 {
        return 0;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index aa865a9a4c4f..ec1464df4c60 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -43,6 +43,7 @@ struct mq_attr;
 struct mqstat;
 struct audit_watch;
 struct audit_tree;
+struct sk_buff;
 struct audit_krule {
        int                     vers_ops;
@@ -463,7 +464,7 @@ extern int audit_filter_user(int type);
 extern int audit_filter_type(int type);
 extern int audit_rule_change(int type, __u32 portid, int seq,
                                void *data, size_t datasz);
-extern int audit_list_rules_send(__u32 portid, int seq);
+extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
 extern u32 audit_enabled;
 #else /* CONFIG_AUDIT */
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 18ba8a627f46..2ff2e8d982be 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -121,8 +121,7 @@ void blk_mq_init_commands(struct request_queue *, void (*init)(void *data, struc
 void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule);
-void blk_mq_insert_request(struct request_queue *, struct request *,
+void blk_mq_insert_request(struct request *, bool, bool, bool);
-                bool, bool);
 void blk_mq_run_queues(struct request_queue *q, bool async);
 void blk_mq_free_request(struct request *rq);
 bool blk_mq_can_queue(struct blk_mq_hw_ctx *);
@@ -134,7 +133,13 @@ struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *, const int ctx_ind
 struct blk_mq_hw_ctx *blk_mq_alloc_single_hw_queue(struct blk_mq_reg *, unsigned int);
 void blk_mq_free_single_hw_queue(struct blk_mq_hw_ctx *, unsigned int);
-void blk_mq_end_io(struct request *rq, int error);
+bool blk_mq_end_io_partial(struct request *rq, int error,
+                unsigned int nr_bytes);
+static inline void blk_mq_end_io(struct request *rq, int error)
+{
+        bool done = !blk_mq_end_io_partial(rq, error, blk_rq_bytes(rq));
+        BUG_ON(!done);
+}
 void blk_mq_complete_request(struct request *rq);
diff --git a/include/linux/clk/ti.h b/include/linux/clk/ti.h
index 092b64168d7f..4a21a872dbbd 100644
--- a/include/linux/clk/ti.h
+++ b/include/linux/clk/ti.h
@@ -245,6 +245,10 @@ long omap2_dpll_round_rate(struct clk_hw *hw, unsigned long target_rate,
 void omap2_init_clk_clkdm(struct clk_hw *clk);
 unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
                                    unsigned long parent_rate);
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate);
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate);
 int omap2_clkops_enable_clkdm(struct clk_hw *hw);
 void omap2_clkops_disable_clkdm(struct clk_hw *hw);
 int omap2_clk_disable_autoidle_all(void);
diff --git a/include/linux/file.h b/include/linux/file.h
index cbacf4faf447..4d69123377a2 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -28,33 +28,36 @@ static inline void fput_light(struct file *file, int fput_needed)
 struct fd {
        struct file *file;
-        int need_put;
+        unsigned int flags;
 };
+#define FDPUT_FPUT       1
+#define FDPUT_POS_UNLOCK 2
 static inline void fdput(struct fd fd)
 {
-        if (fd.need_put)
+        if (fd.flags & FDPUT_FPUT)
                fput(fd.file);
 }
 extern struct file *fget(unsigned int fd);
-extern struct file *fget_light(unsigned int fd, int *fput_needed);
+extern struct file *fget_raw(unsigned int fd);
+extern unsigned long __fdget(unsigned int fd);
+extern unsigned long __fdget_raw(unsigned int fd);
+extern unsigned long __fdget_pos(unsigned int fd);
-static inline struct fd fdget(unsigned int fd)
+static inline struct fd __to_fd(unsigned long v)
 {
-        int b;
+        return (struct fd){(struct file *)(v & ~3),v & 3};
-        struct file *f = fget_light(fd, &b);
-        return (struct fd){f,b};
 }
-extern struct file *fget_raw(unsigned int fd);
+static inline struct fd fdget(unsigned int fd)
-extern struct file *fget_raw_light(unsigned int fd, int *fput_needed);
+{
+        return __to_fd(__fdget(fd));
+}
 static inline struct fd fdget_raw(unsigned int fd)
 {
-        int b;
+        return __to_fd(__fdget_raw(fd));
-        struct file *f = fget_raw_light(fd, &b);
-        return (struct fd){f,b};
 }
 extern int f_dupfd(unsigned int from, struct file *file, unsigned flags);
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 5d7782e42b8f..c3683bdf28fe 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -200,6 +200,7 @@ struct fw_device {
        unsigned irmc:1;
        unsigned bc_implemented:2;
+        work_func_t workfn;
        struct delayed_work work;
        struct fw_attribute_group attribute_group;
 };
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 60829565e552..23b2a35d712e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -123,6 +123,9 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 /* File is opened with O_PATH; almost nothing can be done with it */
 #define FMODE_PATH              ((__force fmode_t)0x4000)
+/* File needs atomic accesses to f_pos */
+#define FMODE_ATOMIC_POS        ((__force fmode_t)0x8000)
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
@@ -780,13 +783,14 @@ struct file {
        const struct file_operations    *f_op;
        /*
-         * Protects f_ep_links, f_flags, f_pos vs i_size in lseek SEEK_CUR.
+         * Protects f_ep_links, f_flags.
         * Must not be taken from IRQ context.
         */
        spinlock_t              f_lock;
        atomic_long_t           f_count;
        unsigned int            f_flags;
        fmode_t                 f_mode;
+        struct mutex            f_pos_lock;
        loff_t                  f_pos;
        struct fown_struct      f_owner;
        const struct cred       *f_cred;
@@ -808,7 +812,7 @@ struct file {
 #ifdef CONFIG_DEBUG_WRITECOUNT
        unsigned long f_mnt_write_state;
 #endif
-};
+} __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
 struct file_handle {
        __u32 handle_bytes;
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 0437439bc047..39b81dc7d01a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -123,6 +123,10 @@ struct vm_area_struct;
                         __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_NOWARN | \
                         __GFP_NO_KSWAPD)
+/*
+ * GFP_THISNODE does not perform any reclaim, you most likely want to
+ * use __GFP_THISNODE to allocate from a given node without fallback!
+ */
 #ifdef CONFIG_NUMA
 #define GFP_THISNODE    (__GFP_THISNODE | __GFP_NOWARN | __GFP_NORETRY)
 #else
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 5f2052c83154..9b61b9bf81ac 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -590,10 +590,10 @@ static inline bool zone_is_empty(struct zone *zone)
 /*
 * The NUMA zonelists are doubled because we need zonelists that restrict the
- * allocations to a single node for GFP_THISNODE.
+ * allocations to a single node for __GFP_THISNODE.
 *
 * [0]  : Zonelist with fallback
- * [1]  : No fallback (GFP_THISNODE)
+ * [1]  : No fallback (__GFP_THISNODE)
 */
 #define MAX_ZONELISTS 2
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index b2fb167b2e6d..5624e4e2763c 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -467,9 +467,14 @@ struct nfs_lockt_res {
 };
 struct nfs_release_lockowner_args {
+        struct nfs4_sequence_args       seq_args;
        struct nfs_lowner       lock_owner;
 };
+struct nfs_release_lockowner_res {
+        struct nfs4_sequence_res        seq_res;
+};
 struct nfs4_delegreturnargs {
        struct nfs4_sequence_args       seq_args;
        const struct nfs_fh *fhandle;
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 9260abdd67df..b5b2df60299e 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -410,7 +410,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
 *
 * %GFP_NOWAIT - Allocation will not sleep.
 *
- * %GFP_THISNODE - Allocate node-local memory only.
+ * %__GFP_THISNODE - Allocate node-local memory only.
 *
 * %GFP_DMA - Allocation suitable for DMA.
 *   Should only be used for kmalloc() caches. Otherwise, use a
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index accc497f8d72..7159a0a933df 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -60,6 +60,12 @@ struct tp_module {
        unsigned int num_tracepoints;
        struct tracepoint * const *tracepoints_ptrs;
 };
+bool trace_module_has_bad_taint(struct module *mod);
+#else
+static inline bool trace_module_has_bad_taint(struct module *mod)
+{
+        return false;
+}
 #endif /* CONFIG_MODULES */
 struct tracepoint_iter {
diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
index ae5a17111968..4483fadfa68d 100644
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -12,6 +12,7 @@ struct iscsit_transport {
        int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *);
        int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *);
        void (*iscsit_free_np)(struct iscsi_np *);
+        void (*iscsit_wait_conn)(struct iscsi_conn *);
        void (*iscsit_free_conn)(struct iscsi_conn *);
        int (*iscsit_get_login_rx)(struct iscsi_conn *, struct iscsi_login *);
        int (*iscsit_put_login_tx)(struct iscsi_conn *, struct iscsi_login *, u32);
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index ddc179b7a105..1fef3e6e9436 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -83,7 +83,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                ),
        TP_fast_assign(
-                __entry->client_id = clnt->cl_clid;
+                __entry->client_id = clnt ? clnt->cl_clid : -1;
                __entry->task_id = task->tk_pid;
                __entry->action = action;
                __entry->runstate = task->tk_runstate;
@@ -91,7 +91,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                __entry->flags = task->tk_flags;
                ),
-        TP_printk("task:%u@%u flags=%4.4x state=%4.4lx status=%d action=%pf",
+        TP_printk("task:%u@%d flags=%4.4x state=%4.4lx status=%d action=%pf",
                __entry->task_id, __entry->client_id,
                __entry->flags,
                __entry->runstate,
diff --git a/kernel/audit.c b/kernel/audit.c
index 34c5a2310fbf..3392d3e0254a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 struct audit_reply {
        __u32 portid;
-        pid_t pid;
+        struct net *net;        
        struct sk_buff *skb;
 };
@@ -500,7 +500,7 @@ int audit_send_list(void *_dest)
 {
        struct audit_netlink_list *dest = _dest;
        struct sk_buff *skb;
-        struct net *net = get_net_ns_by_pid(dest->pid);
+        struct net *net = dest->net;
        struct audit_net *aunet = net_generic(net, audit_net_id);
        /* wait for parent to finish and send an ACK */
@@ -510,6 +510,7 @@ int audit_send_list(void *_dest)
        while ((skb = __skb_dequeue(&dest->q)) != NULL)
                netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
+        put_net(net);
        kfree(dest);
        return 0;
@@ -543,7 +544,7 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
        struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = get_net_ns_by_pid(reply->pid);
+        struct net *net = reply->net;
        struct audit_net *aunet = net_generic(net, audit_net_id);
        mutex_lock(&audit_cmd_mutex);
@@ -552,12 +553,13 @@ static int audit_send_reply_thread(void *arg)
        /* Ignore failure. It'll only happen if the sender goes away,
           because our timeout is set to infinite. */
        netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
+        put_net(net);
        kfree(reply);
        return 0;
 }
 /**
 * audit_send_reply - send an audit reply message via netlink
- * @portid: netlink port to which to send reply
+ * @request_skb: skb of request we are replying to (used to target the reply)
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
@@ -568,9 +570,11 @@ static int audit_send_reply_thread(void *arg)
 * Allocates an skb, builds the netlink message, and sends it to the port id.
 * No failure notifications.
 */
-static void audit_send_reply(__u32 portid, int seq, int type, int done,
+static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
                             int multi, const void *payload, int size)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
        struct sk_buff *skb;
        struct task_struct *tsk;
        struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
@@ -583,8 +587,8 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
        if (!skb)
                goto out;
+        reply->net = get_net(net);
        reply->portid = portid;
-        reply->pid = task_pid_vnr(current);
        reply->skb = skb;
        tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
@@ -673,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb)
        seq = nlmsg_hdr(skb)->nlmsg_seq;
-        audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+        audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
-                         &af, sizeof(af));
        return 0;
 }
@@ -794,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                s.backlog               = skb_queue_len(&audit_skb_queue);
                s.version               = AUDIT_VERSION_LATEST;
                s.backlog_wait_time     = audit_backlog_wait_time;
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+                audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
-                                 &s, sizeof(s));
                break;
        }
        case AUDIT_SET: {
@@ -905,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                           seq, data, nlmsg_len(nlh));
                break;
        case AUDIT_LIST_RULES:
-                err = audit_list_rules_send(NETLINK_CB(skb).portid, seq);
+                err = audit_list_rules_send(skb, seq);
                break;
        case AUDIT_TRIM:
                audit_trim_trees();
@@ -970,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                        memcpy(sig_data->ctx, ctx, len);
                        security_release_secctx(ctx, len);
                }
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
+                audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
-                                0, 0, sig_data, sizeof(*sig_data) + len);
+                                 sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
                break;
        case AUDIT_TTY_GET: {
@@ -983,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                s.log_passwd = tsk->signal->audit_tty_log_passwd;
                spin_unlock(&tsk->sighand->siglock);
-                audit_send_reply(NETLINK_CB(skb).portid, seq,
+                audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
-                                 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                break;
        }
        case AUDIT_TTY_SET: {
diff --git a/kernel/audit.h b/kernel/audit.h
index 57cc64d67718..8df132214606 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -247,7 +247,7 @@ extern void		    audit_panic(const char *message);
 struct audit_netlink_list {
        __u32 portid;
-        pid_t pid;
+        struct net *net;
        struct sk_buff_head q;
 };
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 14a78cca384e..92062fd6cc8c 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -29,6 +29,8 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
 #include "audit.h"
 /*
@@ -1065,11 +1067,13 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data,
 /**
 * audit_list_rules_send - list the audit rules
- * @portid: target portid for netlink audit messages
+ * @request_skb: skb of request we are replying to (used to target the reply)
 * @seq: netlink audit message sequence (serial) number
 */
-int audit_list_rules_send(__u32 portid, int seq)
+int audit_list_rules_send(struct sk_buff *request_skb, int seq)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
        struct task_struct *tsk;
        struct audit_netlink_list *dest;
        int err = 0;
@@ -1083,8 +1087,8 @@ int audit_list_rules_send(__u32 portid, int seq)
        dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
        if (!dest)
                return -ENOMEM;
+        dest->net = get_net(net);
        dest->portid = portid;
-        dest->pid = task_pid_vnr(current);
        skb_queue_head_init(&dest->q);
        mutex_lock(&audit_filter_mutex);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4410ac6a55f1..e6b1b66afe52 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -974,12 +974,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
 *    Temporarilly set tasks mems_allowed to target nodes of migration,
 *    so that the migration code can allocate pages on these nodes.
 *
- *    Call holding cpuset_mutex, so current's cpuset won't change
- *    during this call, as manage_mutex holds off any cpuset_attach()
- *    calls.  Therefore we don't need to take task_lock around the
- *    call to guarantee_online_mems(), as we know no one is changing
- *    our task's cpuset.
- *
 *    While the mm_struct we are migrating is typically from some
 *    other task, the task_struct mems_allowed that we are hacking
 *    is for our current task, which must allocate new pages for that
@@ -996,8 +990,10 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
        do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
+        rcu_read_lock();
        mems_cs = effective_nodemask_cpuset(task_cs(tsk));
        guarantee_online_mems(mems_cs, &tsk->mems_allowed);
+        rcu_read_unlock();
 }
 /*
@@ -2486,9 +2482,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
        task_lock(current);
        cs = nearest_hardwall_ancestor(task_cs(current));
+        allowed = node_isset(node, cs->mems_allowed);
        task_unlock(current);
-        allowed = node_isset(node, cs->mems_allowed);
        mutex_unlock(&callback_mutex);
        return allowed;
 }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index cf68bb36fe58..f14033700c25 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -10,6 +10,7 @@
 #include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_irq.h>
 #include <linux/topology.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 481a13c43b17..d3bf660cb57f 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -802,8 +802,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
 static void wake_threads_waitq(struct irq_desc *desc)
 {
-        if (atomic_dec_and_test(&desc->threads_active) &&
+        if (atomic_dec_and_test(&desc->threads_active))
-            waitqueue_active(&desc->wait_for_threads))
                wake_up(&desc->wait_for_threads);
 }
diff --git a/kernel/profile.c b/kernel/profile.c
index 6631e1ef55ab..ebdd9c1a86b4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -549,14 +549,14 @@ static int create_hash_tables(void)
                struct page *page;
                page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                0);
                if (!page)
                        goto out_cleanup;
                per_cpu(cpu_profile_hits, cpu)[1]
                                = (struct profile_hit *)page_address(page);
                page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                0);
                if (!page)
                        goto out_cleanup;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index e71ffd4eccb5..f3989ceb5cd5 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1777,6 +1777,16 @@ static void trace_module_add_events(struct module *mod)
 {
        struct ftrace_event_call **call, **start, **end;
+        if (!mod->num_trace_events)
+                return;
+        /* Don't add infrastructure for mods without tracepoints */
+        if (trace_module_has_bad_taint(mod)) {
+                pr_err("%s: module has bad taint, not creating trace events\n",
+                       mod->name);
+                return;
+        }
        start = mod->trace_events;
        end = mod->trace_events + mod->num_trace_events;
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 29f26540e9c9..031cc5655a51 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -631,6 +631,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter)
 EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
 #ifdef CONFIG_MODULES
+bool trace_module_has_bad_taint(struct module *mod)
+{
+        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
+}
 static int tracepoint_module_coming(struct module *mod)
 {
        struct tp_module *tp_mod, *iter;
@@ -641,7 +646,7 @@ static int tracepoint_module_coming(struct module *mod)
         * module headers (for forced load), to make sure we don't cause a crash.
         * Staging and out-of-tree GPL modules are fine.
         */
-        if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
+        if (trace_module_has_bad_taint(mod))
                return 0;
        mutex_lock(&tracepoints_mutex);
        tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
diff --git a/mm/Kconfig b/mm/Kconfig
index 2d9f1504d75e..2888024e0b0a 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -575,5 +575,5 @@ config PGTABLE_MAPPING
          then you should select this. This causes zsmalloc to use page table
          mapping rather than copying for object mapping.
-          You can check speed with zsmalloc benchmark[1].
+          You can check speed with zsmalloc benchmark:
-          [1] https://github.com/spartacus06/zsmalloc
+          https://github.com/spartacus06/zsmapbench
diff --git a/mm/compaction.c b/mm/compaction.c
index b48c5259ea33..918577595ea8 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -251,7 +251,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 {
        int nr_scanned = 0, total_isolated = 0;
        struct page *cursor, *valid_page = NULL;
-        unsigned long nr_strict_required = end_pfn - blockpfn;
        unsigned long flags;
        bool locked = false;
@@ -264,11 +263,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                nr_scanned++;
                if (!pfn_valid_within(blockpfn))
-                        continue;
+                        goto isolate_fail;
                if (!valid_page)
                        valid_page = page;
                if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
                /*
                 * The zone lock must be held to isolate freepages.
@@ -289,12 +289,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                /* Recheck this is a buddy page under lock */
                if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
                /* Found a free page, break it into order-0 pages */
                isolated = split_free_page(page);
-                if (!isolated && strict)
-                        break;
                total_isolated += isolated;
                for (i = 0; i < isolated; i++) {
                        list_add(&page->lru, freelist);
@@ -305,7 +303,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                if (isolated) {
                        blockpfn += isolated - 1;
                        cursor += isolated - 1;
+                        continue;
                }
+isolate_fail:
+                if (strict)
+                        break;
+                else
+                        continue;
        }
        trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
@@ -315,7 +321,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
         * pages requested were isolated. If there were any failures, 0 is
         * returned and CMA will fail.
         */
-        if (strict && nr_strict_required > total_isolated)
+        if (strict && blockpfn < end_pfn)
                total_isolated = 0;
        if (locked)
diff --git a/mm/migrate.c b/mm/migrate.c
index 482a33d89134..b494fdb9a636 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1158,7 +1158,7 @@ static struct page *new_page_node(struct page *p, unsigned long private,
                                        pm->node);
        else
                return alloc_pages_exact_node(pm->node,
-                                GFP_HIGHUSER_MOVABLE | GFP_THISNODE, 0);
+                                GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
 }
 /*
@@ -1544,9 +1544,9 @@ static struct page *alloc_misplaced_dst_page(struct page *page,
        struct page *newpage;
        newpage = alloc_pages_exact_node(nid,
-                                         (GFP_HIGHUSER_MOVABLE | GFP_THISNODE |
+                                         (GFP_HIGHUSER_MOVABLE |
-                                          __GFP_NOMEMALLOC | __GFP_NORETRY |
+                                          __GFP_THISNODE | __GFP_NOMEMALLOC |
-                                          __GFP_NOWARN) &
+                                          __GFP_NORETRY | __GFP_NOWARN) &
                                         ~GFP_IOFS, 0);
        return newpage;
@@ -1747,7 +1747,8 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                goto out_dropref;
        new_page = alloc_pages_node(node,
-                (GFP_TRANSHUGE | GFP_THISNODE) & ~__GFP_WAIT, HPAGE_PMD_ORDER);
+                (GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_WAIT,
+                HPAGE_PMD_ORDER);
        if (!new_page)
                goto out_fail;
diff --git a/net/socket.c b/net/socket.c
index 32df5847efa3..a19ae1968d37 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -450,16 +450,17 @@ EXPORT_SYMBOL(sockfd_lookup);
 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
 {
-        struct file *file;
+        struct fd f = fdget(fd);
        struct socket *sock;
        *err = -EBADF;
-        file = fget_light(fd, fput_needed);
+        if (f.file) {
-        if (file) {
+                sock = sock_from_file(f.file, err);
-                sock = sock_from_file(file, err);
+                if (likely(sock)) {
-                if (sock)
+                        *fput_needed = f.flags;
                        return sock;
-                fput_light(file, *fput_needed);
+                }
+                fdput(f);
        }
        return NULL;
 }
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 276e84b8a8e5..10085de886fe 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -330,7 +330,8 @@ static void write_src(void)
                                printf("\tPTR\t_text + %#llx\n",
                                        table[i].addr - _text);
                        else
-                                printf("\tPTR\t%#llx\n", table[i].addr);
+                                printf("\tPTR\t_text - %#llx\n",
+                                        _text - table[i].addr);
                } else {
                        printf("\tPTR\t%#llx\n", table[i].addr);
                }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 40610984a1b5..99a45fdc1bbf 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1502,6 +1502,16 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 #define R_ARM_JUMP24    29
 #endif
+#ifndef R_ARM_THM_CALL
+#define R_ARM_THM_CALL          10
+#endif
+#ifndef R_ARM_THM_JUMP24
+#define R_ARM_THM_JUMP24        30
+#endif
+#ifndef R_ARM_THM_JUMP19
+#define R_ARM_THM_JUMP19        51
+#endif
 static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 {
        unsigned int r_typ = ELF_R_TYPE(r->r_info);
@@ -1515,6 +1525,9 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
        case R_ARM_PC24:
        case R_ARM_CALL:
        case R_ARM_JUMP24:
+        case R_ARM_THM_CALL:
+        case R_ARM_THM_JUMP24:
+        case R_ARM_THM_JUMP19:
                /* From ARM ABI: ((S + A) | T) - P */
                r->r_addend = (int)(long)(elf->hdr +
                              sechdr->sh_offset +
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d46cbc5e335e..2fb2576dc644 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1000,7 +1000,11 @@ static int keyring_detect_cycle_iterator(const void *object,
        kenter("{%d}", key->serial);
-        BUG_ON(key != ctx->match_data);
+        /* We might get a keyring with matching index-key that is nonetheless a
+         * different keyring. */
+        if (key != ctx->match_data)
+                return 0;
        ctx->result = ERR_PTR(-EDEADLK);
        return 1;
 }
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index df3652ad15ef..8ed0bcc01386 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -1026,6 +1026,9 @@ static void ad1884_fixup_thinkpad(struct hda_codec *codec,
                spec->gen.keep_eapd_on = 1;
                spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
                spec->eapd_nid = 0x12;
+                /* Analog PC Beeper - allow firmware/ACPI beeps */
+                spec->beep_amp = HDA_COMPOSE_AMP_VAL(0x20, 3, 3, HDA_INPUT);
+                spec->gen.beep_nid = 0; /* no digital beep */
        }
 }
@@ -1092,6 +1095,7 @@ static int patch_ad1884(struct hda_codec *codec)
        spec = codec->spec;
        spec->gen.mixer_nid = 0x20;
+        spec->gen.mixer_merge_nid = 0x21;
        spec->gen.beep_nid = 0x10;
        set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ec304f3ae3b4..8d0a84436674 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3616,6 +3616,19 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
        }
 }
+static void alc_no_shutup(struct hda_codec *codec)
+{
+}
+static void alc_fixup_no_shutup(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                struct alc_spec *spec = codec->spec;
+                spec->shutup = alc_no_shutup;
+        }
+}
 static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
                                const struct hda_fixup *fix, int action)
 {
@@ -3844,6 +3857,7 @@ enum {
        ALC269_FIXUP_HP_GPIO_LED,
        ALC269_FIXUP_INV_DMIC,
        ALC269_FIXUP_LENOVO_DOCK,
+        ALC269_FIXUP_NO_SHUTUP,
        ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
        ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
        ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4020,6 +4034,10 @@ static const struct hda_fixup alc269_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_inv_dmic_0x12,
        },
+        [ALC269_FIXUP_NO_SHUTUP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_no_shutup,
+        },
        [ALC269_FIXUP_LENOVO_DOCK] = {
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
@@ -4253,6 +4271,7 @@ static const struct hda_fixup alc269_fixups[] = {
 };
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
@@ -4404,6 +4423,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
        SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
        SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -5163,7 +5183,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
-        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_AUTO_MUTE),
        SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
        SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
        SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 75d0ad5d2dcb..647a72cda005 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -1328,6 +1328,9 @@ static int pm860x_probe(struct snd_soc_codec *codec)
        pm860x->codec = codec;
        codec->control_data = pm860x->regmap;
+        ret = snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
+        if (ret)
+                return ret;
        for (i = 0; i < 4; i++) {
                ret = request_threaded_irq(pm860x->irq[i], NULL,
diff --git a/sound/soc/codecs/si476x.c b/sound/soc/codecs/si476x.c
index 52e7cb08434b..fa2b8e07f420 100644
--- a/sound/soc/codecs/si476x.c
+++ b/sound/soc/codecs/si476x.c
@@ -210,7 +210,7 @@ out:
 static int si476x_codec_probe(struct snd_soc_codec *codec)
 {
        codec->control_data = dev_get_regmap(codec->dev->parent, NULL);
-        return 0;
+        return snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
 }
 static struct snd_soc_dai_ops si476x_dai_ops = {
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 3fde9e402710..d163e18d85d4 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -305,7 +305,9 @@ static int __init n810_soc_init(void)
        int err;
        struct device *dev;
-        if (!(machine_is_nokia_n810() || machine_is_nokia_n810_wimax()))
+        if (!of_have_populated_dt() ||
+            (!of_machine_is_compatible("nokia,n810") &&
+             !of_machine_is_compatible("nokia,n810-wimax")))
                return -ENODEV;
        n810_snd_device = platform_device_alloc("soc-audio", -1);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 47e1ce771e65..28522bd03b8e 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1989,6 +1989,7 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card)
                paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
                if (paths < 0) {
+                        dpcm_path_put(&list);
                        dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                        fe->dai_link->name,  "playback");
                        mutex_unlock(&card->mutex);
@@ -2018,6 +2019,7 @@ capture:
                paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
                if (paths < 0) {
+                        dpcm_path_put(&list);
                        dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                        fe->dai_link->name,  "capture");
                        mutex_unlock(&card->mutex);
@@ -2082,6 +2084,7 @@ static int dpcm_fe_dai_open(struct snd_pcm_substream *fe_substream)
        fe->dpcm[stream].runtime = fe_substream->runtime;
        if (dpcm_path_get(fe, stream, &list) <= 0) {
+                dpcm_path_put(&list);
                dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
                        fe->dai_link->name, stream ? "capture" : "playback");
        }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 44b0ba4feab3..1bed780e21d9 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -883,6 +883,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
                }
                break;
+        case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
        case USB_ID(0x046d, 0x0808):
        case USB_ID(0x046d, 0x0809):
        case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index d66418237d21..aa290c0de6f5 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -201,6 +201,7 @@ int main(int argc, char **argv)
        msgque.msq_id = msgget(msgque.key, IPC_CREAT | IPC_EXCL | 0666);
        if (msgque.msq_id == -1) {
+                err = -errno;
                printf("Can't create queue\n");
                goto err_out;
        }