63 files changed, 608 insertions, 255 deletions

diff --git a/Documentation/block/null_blk.txt b/Documentation/block/null_blk.txt
new file mode 100644
index 000000000000..b2830b435895
--- /dev/null
+++ b/Documentation/block/null_blk.txt
@@ -0,0 +1,72 @@
+Null block device driver
+================================================================================
+
+I. Overview
+
+The null block device (/dev/nullb*) is used for benchmarking the various
+block-layer implementations. It emulates a block device of X gigabytes in size.
+The following instances are possible:
+
+  Single-queue block-layer
+    - Request-based.
+    - Single submission queue per device.
+    - Implements IO scheduling algorithms (CFQ, Deadline, noop).
+  Multi-queue block-layer
+    - Request-based.
+    - Configurable submission queues per device.
+  No block-layer (Known as bio-based)
+    - Bio-based. IO requests are submitted directly to the device driver.
+    - Directly accepts bio data structure and returns them.
+
+All of them have a completion queue for each core in the system.
+
+II. Module parameters applicable for all instances:
+
+queue_mode=[0-2]: Default: 2-Multi-queue
+  Selects which block-layer the module should instantiate with.
+
+  0: Bio-based.
+  1: Single-queue.
+  2: Multi-queue.
+
+home_node=[0--nr_nodes]: Default: NUMA_NO_NODE
+  Selects what CPU node the data structures are allocated from.
+
+gb=[Size in GB]: Default: 250GB
+  The size of the device reported to the system.
+
+bs=[Block size (in bytes)]: Default: 512 bytes
+  The block size reported to the system.
+
+nr_devices=[Number of devices]: Default: 2
+  Number of block devices instantiated. They are instantiated as /dev/nullb0,
+  etc.
+
+irq_mode=[0-2]: Default: 1-Soft-irq
+  The completion mode used for completing IOs to the block-layer.
+
+  0: None.
+  1: Soft-irq. Uses IPI to complete IOs across CPU nodes. Simulates the overhead
+     when IOs are issued from another CPU node than the home the device is
+     connected to.
+  2: Timer: Waits a specific period (completion_nsec) for each IO before
+     completion.
+
+completion_nsec=[ns]: Default: 10.000ns
+  Combined with irq_mode=2 (timer). The time each completion event must wait.
+
+submit_queues=[0..nr_cpus]:
+  The number of submission queues attached to the device driver. If unset, it
+  defaults to 1 on single-queue and bio-based instances. For multi-queue,
+  it is ignored when use_per_node_hctx module parameter is 1.
+
+hw_queue_depth=[0..qdepth]: Default: 64
+  The hardware queue depth of the device.
+
+III: Multi-queue specific parameters
+
+use_per_node_hctx=[0/1]: Default: 0
+  0: The number of submit queues are set to the value of the submit_queues
+     parameter.
+  1: The multi-queue block layer is instantiated with a hardware dispatch
+     queue for each CPU node in the system.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 50680a59a2ff..b9e9bd854298 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1529,6 +1529,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
                         * atapi_dmadir: Enable ATAPI DMADIR bridge support
 
+                        * disable: Disable this device.
+
                         If there are multiple matching configurations changing
                         the same attribute, the last one is used.
 
diff --git a/Makefile b/Makefile
index 14d592cbbc5f..ab80be7a38bc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = One Giant Leap for Frogkind
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index 46e1d7ef163f..9987dd0e9c59 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -241,7 +241,7 @@
 
         sdhi0: sdhi@ee100000 {
                 compatible = "renesas,sdhi-r8a7790";
-                reg = <0 0xee100000 0 0x100>;
+                reg = <0 0xee100000 0 0x200>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 165 4>;
                 cap-sd-highspeed;
@@ -250,7 +250,7 @@
 
         sdhi1: sdhi@ee120000 {
                 compatible = "renesas,sdhi-r8a7790";
-                reg = <0 0xee120000 0 0x100>;
+                reg = <0 0xee120000 0 0x200>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 166 4>;
                 cap-sd-highspeed;
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index 4ec8d82b0492..44a59c3abfb0 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -242,12 +242,18 @@ static void __init ldp_display_init(void)
 
 static int ldp_twl_gpio_setup(struct device *dev, unsigned gpio, unsigned ngpio)
 {
+        int res;
+
         /* LCD enable GPIO */
         ldp_lcd_pdata.enable_gpio = gpio + 7;
 
         /* Backlight enable GPIO */
         ldp_lcd_pdata.backlight_gpio = gpio + 15;
 
+        res = platform_device_register(&ldp_lcd_device);
+        if (res)
+                pr_err("Unable to register LCD: %d\n", res);
+
         return 0;
 }
 
@@ -346,7 +352,6 @@ static struct omap2_hsmmc_info mmc[] __initdata = {
 
 static struct platform_device *ldp_devices[] __initdata = {
         &ldp_gpio_keys_device,
-        &ldp_lcd_device,
 };
 
 #ifdef CONFIG_OMAP_MUX
diff --git a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
index 56cebb05509e..d23c77fadb31 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
@@ -796,7 +796,7 @@ struct omap_hwmod omap2xxx_counter_32k_hwmod = {
 
 /* gpmc */
 static struct omap_hwmod_irq_info omap2xxx_gpmc_irqs[] = {
-        { .irq = 20 },
+        { .irq = 20 + OMAP_INTC_START, },
         { .irq = -1 }
 };
 
@@ -841,7 +841,7 @@ static struct omap_hwmod_class omap2_rng_hwmod_class = {
 };
 
 static struct omap_hwmod_irq_info omap2_rng_mpu_irqs[] = {
-        { .irq = 52 },
+        { .irq = 52 + OMAP_INTC_START, },
         { .irq = -1 }
 };
 
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d33742908f97..4c3b1e6df508 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2165,7 +2165,7 @@ static struct omap_hwmod_class omap3xxx_gpmc_hwmod_class = {
 };
 
 static struct omap_hwmod_irq_info omap3xxx_gpmc_irqs[] = {
-        { .irq = 20 },
+        { .irq = 20 + OMAP_INTC_START, },
         { .irq = -1 }
 };
 
@@ -2999,7 +2999,7 @@ static struct omap_mmu_dev_attr mmu_isp_dev_attr = {
 
 static struct omap_hwmod omap3xxx_mmu_isp_hwmod;
 static struct omap_hwmod_irq_info omap3xxx_mmu_isp_irqs[] = {
-        { .irq = 24 },
+        { .irq = 24 + OMAP_INTC_START, },
         { .irq = -1 }
 };
 
@@ -3041,7 +3041,7 @@ static struct omap_mmu_dev_attr mmu_iva_dev_attr = {
 
 static struct omap_hwmod omap3xxx_mmu_iva_hwmod;
 static struct omap_hwmod_irq_info omap3xxx_mmu_iva_irqs[] = {
-        { .irq = 28 },
+        { .irq = 28 + OMAP_INTC_START, },
         { .irq = -1 }
 };
 
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index db32d5380b11..18f333c440db 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1637,7 +1637,7 @@ static struct omap_hwmod dra7xx_uart1_hwmod = {
         .class          = &dra7xx_uart_hwmod_class,
         .clkdm_name     = "l4per_clkdm",
         .main_clk       = "uart1_gfclk_mux",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP2UART1_FLAGS,
         .prcm = {
                 .omap4 = {
                         .clkctrl_offs = DRA7XX_CM_L4PER_UART1_CLKCTRL_OFFSET,
diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h
index 2a086e8373eb..958cd6af9384 100644
--- a/arch/arm/mach-pxa/include/mach/lubbock.h
+++ b/arch/arm/mach-pxa/include/mach/lubbock.h
@@ -10,6 +10,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <mach/irqs.h>
+
 #define LUBBOCK_ETH_PHYS        PXA_CS3_PHYS
 
 #define LUBBOCK_FPGA_PHYS       PXA_CS2_PHYS
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 958e3cbf0ac2..c18689123023 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -614,6 +614,11 @@ static struct regulator_consumer_supply fixed3v3_power_consumers[] = {
         REGULATOR_SUPPLY("vqmmc", "sh_mmcif"),
 };
 
+/* Fixed 3.3V regulator used by LCD backlight */
+static struct regulator_consumer_supply fixed5v0_power_consumers[] = {
+        REGULATOR_SUPPLY("power", "pwm-backlight.0"),
+};
+
 /* Fixed 3.3V regulator to be used by SDHI0 */
 static struct regulator_consumer_supply vcc_sdhi0_consumers[] = {
         REGULATOR_SUPPLY("vmmc", "sh_mobile_sdhi.0"),
@@ -1196,6 +1201,8 @@ static void __init eva_init(void)
 
         regulator_register_always_on(0, "fixed-3.3V", fixed3v3_power_consumers,
                                      ARRAY_SIZE(fixed3v3_power_consumers), 3300000);
+        regulator_register_always_on(3, "fixed-5.0V", fixed5v0_power_consumers,
+                                     ARRAY_SIZE(fixed5v0_power_consumers), 5000000);
 
         pinctrl_register_mappings(eva_pinctrl_map, ARRAY_SIZE(eva_pinctrl_map));
         pwm_add_table(pwm_lookup, ARRAY_SIZE(pwm_lookup));
diff --git a/arch/arm/mach-shmobile/board-bockw.c b/arch/arm/mach-shmobile/board-bockw.c
index 38611526fe9a..3c4995aebd22 100644
--- a/arch/arm/mach-shmobile/board-bockw.c
+++ b/arch/arm/mach-shmobile/board-bockw.c
@@ -679,7 +679,7 @@ static void __init bockw_init(void)
                         .id             = i,
                         .data           = &rsnd_card_info[i],
                         .size_data      = sizeof(struct asoc_simple_card_info),
-                        .dma_mask       = ~0,
+                        .dma_mask       = DMA_BIT_MASK(32),
                 };
 
                 platform_device_register_full(&cardinfo);
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index dc1ec0dff939..ea04b342c026 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -387,7 +387,8 @@ static void init_intel(struct cpuinfo_x86 *c)
                         set_cpu_cap(c, X86_FEATURE_PEBS);
         }
 
-        if (c->x86 == 6 && c->x86_model == 29 && cpu_has_clflush)
+        if (c->x86 == 6 && cpu_has_clflush &&
+            (c->x86_model == 29 || c->x86_model == 46 || c->x86_model == 47))
                 set_cpu_cap(c, X86_FEATURE_CLFLUSH_MONITOR);
 
 #ifdef CONFIG_X86_64
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index ba6cf8e9aa0a..b91ce75bd35d 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -335,9 +335,22 @@ static struct kobj_type blk_mq_hw_ktype = {
 void blk_mq_unregister_disk(struct gendisk *disk)
 {
         struct request_queue *q = disk->queue;
+        struct blk_mq_hw_ctx *hctx;
+        struct blk_mq_ctx *ctx;
+        int i, j;
+
+        queue_for_each_hw_ctx(q, hctx, i) {
+                hctx_for_each_ctx(hctx, ctx, j) {
+                        kobject_del(&ctx->kobj);
+                        kobject_put(&ctx->kobj);
+                }
+                kobject_del(&hctx->kobj);
+                kobject_put(&hctx->kobj);
+        }
 
         kobject_uevent(&q->mq_kobj, KOBJ_REMOVE);
         kobject_del(&q->mq_kobj);
+        kobject_put(&q->mq_kobj);
 
         kobject_put(&disk_to_dev(disk)->kobj);
 }
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5d9248526d78..4770de5707b9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -348,7 +348,6 @@ source "drivers/acpi/apei/Kconfig"
 config ACPI_EXTLOG
         tristate "Extended Error Log support"
         depends on X86_MCE && X86_LOCAL_APIC
-        select EFI
         select UEFI_CPER
         default n
         help
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 6745fe137b9e..e60390597372 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -162,6 +162,7 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
         { "80860F14", (unsigned long)&byt_sdio_dev_desc },
         { "80860F41", (unsigned long)&byt_i2c_dev_desc },
         { "INT33B2", },
+        { "INT33FC", },
 
         { "INT3430", (unsigned long)&lpt_dev_desc },
         { "INT3431", (unsigned long)&lpt_dev_desc },
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 786294bb682c..3650b2183227 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -2,7 +2,6 @@ config ACPI_APEI
         bool "ACPI Platform Error Interface (APEI)"
         select MISC_FILESYSTEMS
         select PSTORE
-        select EFI
         select UEFI_CPER
         depends on X86
         help
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 14f1e9506338..c0ed4f273cf2 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1238,15 +1238,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
-        /* AHCI controllers often implement SFF compatible interface.
-         * Grab all PCI BARs just in case.
-         */
-        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
-        if (rc == -EBUSY)
-                pcim_pin_device(pdev);
-        if (rc)
-                return rc;
-
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == 0x2652 || pdev->device == 0x2653)) {
                 u8 map;
@@ -1263,6 +1254,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
+        /* AHCI controllers often implement SFF compatible interface.
+         * Grab all PCI BARs just in case.
+         */
+        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
+        if (rc == -EBUSY)
+                pcim_pin_device(pdev);
+        if (rc)
+                return rc;
+
         hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
         if (!hpriv)
                 return -ENOMEM;
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index ae2d73fe321e..3e23e9941dad 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -113,7 +113,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
         /*
          * set PHY Paremeters, two steps to configure the GPR13,
          * one write for rest of parameters, mask of first write
-         * is 0x07fffffd, and the other one write for setting
+         * is 0x07ffffff, and the other one write for setting
          * the mpll_clk_en.
          */
         regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK
@@ -124,6 +124,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
                         | IMX6Q_GPR13_SATA_TX_ATTEN_MASK
                         | IMX6Q_GPR13_SATA_TX_BOOST_MASK
                         | IMX6Q_GPR13_SATA_TX_LVL_MASK
+                        | IMX6Q_GPR13_SATA_MPLL_CLK_EN
                         | IMX6Q_GPR13_SATA_TX_EDGE_RATE
                         , IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB
                         | IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 75b93678bbcd..1393a5890ed5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2149,9 +2149,16 @@ static int ata_dev_config_ncq(struct ata_device *dev,
                                     "failed to get NCQ Send/Recv Log Emask 0x%x\n",
                                     err_mask);
                 } else {
+                        u8 *cmds = dev->ncq_send_recv_cmds;
+
                         dev->flags |= ATA_DFLAG_NCQ_SEND_RECV;
-                        memcpy(dev->ncq_send_recv_cmds, ap->sector_buf,
-                                ATA_LOG_NCQ_SEND_RECV_SIZE);
+                        memcpy(cmds, ap->sector_buf, ATA_LOG_NCQ_SEND_RECV_SIZE);
+
+                        if (dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) {
+                                ata_dev_dbg(dev, "disabling queued TRIM support\n");
+                                cmds[ATA_LOG_NCQ_SEND_RECV_DSM_OFFSET] &=
+                                        ~ATA_LOG_NCQ_SEND_RECV_DSM_TRIM;
+                        }
                 }
         }
 
@@ -4156,6 +4163,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                 ATA_HORKAGE_FIRMWARE_WARN },
 
+        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
         /* Blacklist entries taken from Silicon Image 3124/3132
            Windows driver .inf file - also several Linux problem reports */
         { "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
@@ -4202,6 +4212,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
+        /* devices that don't properly handle queued TRIM commands */
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+
         /* End Marker */
         { }
 };
@@ -6519,6 +6533,7 @@ static int __init ata_parse_force_one(char **cur,
                 { "norst",      .lflags         = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST },
                 { "rstonce",    .lflags         = ATA_LFLAG_RST_ONCE },
                 { "atapi_dmadir", .horkage_on   = ATA_HORKAGE_ATAPI_DMADIR },
+                { "disable",    .horkage_on     = ATA_HORKAGE_DISABLE },
         };
         char *start = *cur, *p = *cur;
         char *id, *val, *endp;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ab58556d347c..377eb889f555 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3872,6 +3872,27 @@ void ata_scsi_hotplug(struct work_struct *work)
                 return;
         }
 
+        /*
+         * XXX - UGLY HACK
+         *
+         * The block layer suspend/resume path is fundamentally broken due
+         * to freezable kthreads and workqueue and may deadlock if a block
+         * device gets removed while resume is in progress.  I don't know
+         * what the solution is short of removing freezable kthreads and
+         * workqueues altogether.
+         *
+         * The following is an ugly hack to avoid kicking off device
+         * removal while freezer is active.  This is a joke but does avoid
+         * this particular deadlock scenario.
+         *
+         * https://bugzilla.kernel.org/show_bug.cgi?id=62801
+         * http://marc.info/?l=linux-kernel&m=138695698516487
+         */
+#ifdef CONFIG_FREEZER
+        while (pm_freezing)
+                msleep(10);
+#endif
+
         DPRINTK("ENTER\n");
         mutex_lock(&ap->scsi_scan_mutex);
 
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index f370fc13aea5..a2e69d26266d 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1,4 +1,5 @@
 #include <linux/module.h>
+
 #include <linux/moduleparam.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
@@ -65,7 +66,7 @@ enum {
         NULL_Q_MQ               = 2,
 };
 
-static int submit_queues = 1;
+static int submit_queues;
 module_param(submit_queues, int, S_IRUGO);
 MODULE_PARM_DESC(submit_queues, "Number of submission queues");
 
@@ -101,9 +102,9 @@ static int hw_queue_depth = 64;
 module_param(hw_queue_depth, int, S_IRUGO);
 MODULE_PARM_DESC(hw_queue_depth, "Queue depth for each hardware queue. Default: 64");
 
-static bool use_per_node_hctx = true;
+static bool use_per_node_hctx = false;
 module_param(use_per_node_hctx, bool, S_IRUGO);
-MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: true");
+MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: false");
 
 static void put_tag(struct nullb_queue *nq, unsigned int tag)
 {
@@ -346,8 +347,37 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq)
 
 static struct blk_mq_hw_ctx *null_alloc_hctx(struct blk_mq_reg *reg, unsigned int hctx_index)
 {
-        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL,
-                                hctx_index);
+        int b_size = DIV_ROUND_UP(reg->nr_hw_queues, nr_online_nodes);
+        int tip = (reg->nr_hw_queues % nr_online_nodes);
+        int node = 0, i, n;
+
+        /*
+         * Split submit queues evenly wrt to the number of nodes. If uneven,
+         * fill the first buckets with one extra, until the rest is filled with
+         * no extra.
+         */
+        for (i = 0, n = 1; i < hctx_index; i++, n++) {
+                if (n % b_size == 0) {
+                        n = 0;
+                        node++;
+
+                        tip--;
+                        if (!tip)
+                                b_size = reg->nr_hw_queues / nr_online_nodes;
+                }
+        }
+
+        /*
+         * A node might not be online, therefore map the relative node id to the
+         * real node id.
+         */
+        for_each_online_node(n) {
+                if (!node)
+                        break;
+                node--;
+        }
+
+        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL, n);
 }
 
 static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
@@ -355,16 +385,24 @@ static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
         kfree(hctx);
 }
 
+static void null_init_queue(struct nullb *nullb, struct nullb_queue *nq)
+{
+        BUG_ON(!nullb);
+        BUG_ON(!nq);
+
+        init_waitqueue_head(&nq->wait);
+        nq->queue_depth = nullb->queue_depth;
+}
+
 static int null_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
                           unsigned int index)
 {
         struct nullb *nullb = data;
         struct nullb_queue *nq = &nullb->queues[index];
 
-        init_waitqueue_head(&nq->wait);
-        nq->queue_depth = nullb->queue_depth;
-        nullb->nr_queues++;
         hctx->driver_data = nq;
+        null_init_queue(nullb, nq);
+        nullb->nr_queues++;
 
         return 0;
 }
@@ -417,13 +455,13 @@ static int setup_commands(struct nullb_queue *nq)
 
         nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
         if (!nq->cmds)
-                return 1;
+                return -ENOMEM;
 
         tag_size = ALIGN(nq->queue_depth, BITS_PER_LONG) / BITS_PER_LONG;
         nq->tag_map = kzalloc(tag_size * sizeof(unsigned long), GFP_KERNEL);
         if (!nq->tag_map) {
                 kfree(nq->cmds);
-                return 1;
+                return -ENOMEM;
         }
 
         for (i = 0; i < nq->queue_depth; i++) {
@@ -454,33 +492,37 @@ static void cleanup_queues(struct nullb *nullb)
 
 static int setup_queues(struct nullb *nullb)
 {
-        struct nullb_queue *nq;
-        int i;
-
-        nullb->queues = kzalloc(submit_queues * sizeof(*nq), GFP_KERNEL);
+        nullb->queues = kzalloc(submit_queues * sizeof(struct nullb_queue),
+                                                                GFP_KERNEL);
         if (!nullb->queues)
-                return 1;
+                return -ENOMEM;
 
         nullb->nr_queues = 0;
         nullb->queue_depth = hw_queue_depth;
 
-        if (queue_mode == NULL_Q_MQ)
-                return 0;
+        return 0;
+}
+
+static int init_driver_queues(struct nullb *nullb)
+{
+        struct nullb_queue *nq;
+        int i, ret = 0;
 
         for (i = 0; i < submit_queues; i++) {
                 nq = &nullb->queues[i];
-                init_waitqueue_head(&nq->wait);
-                nq->queue_depth = hw_queue_depth;
-                if (setup_commands(nq))
-                        break;
+
+                null_init_queue(nullb, nq);
+
+                ret = setup_commands(nq);
+                if (ret)
+                        goto err_queue;
                 nullb->nr_queues++;
         }
 
-        if (i == submit_queues)
-                return 0;
-
+        return 0;
+err_queue:
         cleanup_queues(nullb);
-        return 1;
+        return ret;
 }
 
 static int null_add_dev(void)
@@ -518,11 +560,13 @@ static int null_add_dev(void)
         } else if (queue_mode == NULL_Q_BIO) {
                 nullb->q = blk_alloc_queue_node(GFP_KERNEL, home_node);
                 blk_queue_make_request(nullb->q, null_queue_bio);
+                init_driver_queues(nullb);
         } else {
                 nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                 blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                 if (nullb->q)
                         blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
+                init_driver_queues(nullb);
         }
 
         if (!nullb->q)
@@ -579,7 +623,13 @@ static int __init null_init(void)
         }
 #endif
 
-        if (submit_queues > nr_cpu_ids)
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
+                if (submit_queues < nr_online_nodes) {
+                        pr_warn("null_blk: submit_queues param is set to %u.",
+                                                        nr_online_nodes);
+                        submit_queues = nr_online_nodes;
+                }
+        } else if (submit_queues > nr_cpu_ids)
                 submit_queues = nr_cpu_ids;
         else if (!submit_queues)
                 submit_queues = 1;
diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
index 9199c93be926..eb6e1e0e8db2 100644
--- a/drivers/block/skd_main.c
+++ b/drivers/block/skd_main.c
@@ -5269,7 +5269,7 @@ const char *skd_skdev_state_to_str(enum skd_drvr_state state)
         }
 }
 
-const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
+static const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
 {
         switch (state) {
         case SKD_MSG_STATE_IDLE:
@@ -5281,7 +5281,7 @@ const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
         }
 }
 
-const char *skd_skreq_state_to_str(enum skd_req_state state)
+static const char *skd_skreq_state_to_str(enum skd_req_state state)
 {
         switch (state) {
         case SKD_REQ_STATE_IDLE:
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 02d534da22dd..16d7b4ac94be 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -828,6 +828,12 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
         int ret = 0;
 
         memcpy(&new_policy, policy, sizeof(*policy));
+
+        /* Use the default policy if its valid. */
+        if (cpufreq_driver->setpolicy)
+                cpufreq_parse_governor(policy->governor->name,
+                                        &new_policy.policy, NULL);
+
         /* assure that the starting sequence is run in cpufreq_set_policy */
         policy->governor = NULL;
 
@@ -845,8 +851,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
 
 #ifdef CONFIG_HOTPLUG_CPU
 static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
-                                  unsigned int cpu, struct device *dev,
-                                  bool frozen)
+                                  unsigned int cpu, struct device *dev)
 {
         int ret = 0;
         unsigned long flags;
@@ -877,11 +882,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                 }
         }
 
-        /* Don't touch sysfs links during light-weight init */
-        if (!frozen)
-                ret = sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-
-        return ret;
+        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
 }
 #endif
 
@@ -926,6 +927,27 @@ err_free_policy:
         return NULL;
 }
 
+static void cpufreq_policy_put_kobj(struct cpufreq_policy *policy)
+{
+        struct kobject *kobj;
+        struct completion *cmp;
+
+        down_read(&policy->rwsem);
+        kobj = &policy->kobj;
+        cmp = &policy->kobj_unregister;
+        up_read(&policy->rwsem);
+        kobject_put(kobj);
+
+        /*
+         * We need to make sure that the underlying kobj is
+         * actually not referenced anymore by anybody before we
+         * proceed with unloading.
+         */
+        pr_debug("waiting for dropping of refcount\n");
+        wait_for_completion(cmp);
+        pr_debug("wait complete\n");
+}
+
 static void cpufreq_policy_free(struct cpufreq_policy *policy)
 {
         free_cpumask_var(policy->related_cpus);
@@ -986,7 +1008,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
         list_for_each_entry(tpolicy, &cpufreq_policy_list, policy_list) {
                 if (cpumask_test_cpu(cpu, tpolicy->related_cpus)) {
                         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev, frozen);
+                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev);
                         up_read(&cpufreq_rwsem);
                         return ret;
                 }
@@ -1096,7 +1118,10 @@ err_get_freq:
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
 err_set_policy_cpu:
+        if (frozen)
+                cpufreq_policy_put_kobj(policy);
         cpufreq_policy_free(policy);
+
 nomem_out:
         up_read(&cpufreq_rwsem);
 
@@ -1118,7 +1143,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 }
 
 static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
-                                           unsigned int old_cpu, bool frozen)
+                                           unsigned int old_cpu)
 {
         struct device *cpu_dev;
         int ret;
@@ -1126,10 +1151,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
         /* first sibling now owns the new sysfs dir */
         cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu));
 
-        /* Don't touch sysfs files during light-weight tear-down */
-        if (frozen)
-                return cpu_dev->id;
-
         sysfs_remove_link(&cpu_dev->kobj, "cpufreq");
         ret = kobject_move(&policy->kobj, &cpu_dev->kobj);
         if (ret) {
@@ -1196,7 +1217,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                 if (!frozen)
                         sysfs_remove_link(&dev->kobj, "cpufreq");
         } else if (cpus > 1) {
-                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
+                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                 if (new_cpu >= 0) {
                         update_policy_cpu(policy, new_cpu);
 
@@ -1218,8 +1239,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
         int ret;
         unsigned long flags;
         struct cpufreq_policy *policy;
-        struct kobject *kobj;
-        struct completion *cmp;
 
         read_lock_irqsave(&cpufreq_driver_lock, flags);
         policy = per_cpu(cpufreq_cpu_data, cpu);
@@ -1249,22 +1268,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                         }
                 }
 
-                if (!frozen) {
-                        down_read(&policy->rwsem);
-                        kobj = &policy->kobj;
-                        cmp = &policy->kobj_unregister;
-                        up_read(&policy->rwsem);
-                        kobject_put(kobj);
-
-                        /*
-                         * We need to make sure that the underlying kobj is
-                         * actually not referenced anymore by anybody before we
-                         * proceed with unloading.
-                         */
-                        pr_debug("waiting for dropping of refcount\n");
-                        wait_for_completion(cmp);
-                        pr_debug("wait complete\n");
-                }
+                if (!frozen)
+                        cpufreq_policy_put_kobj(policy);
 
                 /*
                  * Perform the ->exit() even during light-weight tear-down,
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 299fad6b5867..5373dc5b6011 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -14,3 +14,4 @@ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
 
 obj-$(CONFIG_GOOGLE_FIRMWARE)   += google/
 obj-$(CONFIG_EFI)               += efi/
+obj-$(CONFIG_UEFI_CPER)         += efi/
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 3150aa4874e8..6aecbc86ec94 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -36,7 +36,7 @@ config EFI_VARS_PSTORE_DEFAULT_DISABLE
           backend for pstore by default. This setting can be overridden
           using the efivars module's pstore_disable parameter.
 
-config UEFI_CPER
-        def_bool n
-
 endmenu
+
+config UEFI_CPER
+        bool
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
index 9ba156d3c775..6c2a41ec21ba 100644
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -1,7 +1,7 @@
 #
 # Makefile for linux kernel
 #
-obj-y                                   += efi.o vars.o
+obj-$(CONFIG_EFI)                       += efi.o vars.o
 obj-$(CONFIG_EFI_VARS)                  += efivars.o
 obj-$(CONFIG_EFI_VARS_PSTORE)           += efi-pstore.o
 obj-$(CONFIG_UEFI_CPER)                 += cper.o
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 92d1206482a6..f80b700f821c 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -377,6 +377,9 @@ static int intel_idle(struct cpuidle_device *dev,
 
         if (!current_set_polling_and_test()) {
 
+                if (this_cpu_has(X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
+
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
                 if (!need_resched())
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c47c2034ca71..0717940ec3b5 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -181,9 +181,16 @@ static void add_ref(struct iw_cm_id *cm_id)
 static void rem_ref(struct iw_cm_id *cm_id)
 {
         struct iwcm_id_private *cm_id_priv;
+        int cb_destroy;
+
         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
-        if (iwcm_deref_id(cm_id_priv) &&
-            test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags)) {
+
+        /*
+         * Test bit before deref in case the cm_id gets freed on another
+         * thread.
+         */
+        cb_destroy = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
+        if (iwcm_deref_id(cm_id_priv) && cb_destroy) {
                 BUG_ON(!list_empty(&cm_id_priv->work_list));
                 free_cm_id(cm_id_priv);
         }
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bdc842e9faef..a283274a5a09 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -49,12 +49,20 @@
 
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
         do {                                                            \
-                (udata)->inbuf  = (void __user *) (ibuf);               \
+                (udata)->inbuf  = (const void __user *) (ibuf);         \
                 (udata)->outbuf = (void __user *) (obuf);               \
                 (udata)->inlen  = (ilen);                               \
                 (udata)->outlen = (olen);                               \
         } while (0)
 
+#define INIT_UDATA_BUF_OR_NULL(udata, ibuf, obuf, ilen, olen)                   \
+        do {                                                                    \
+                (udata)->inbuf  = (ilen) ? (const void __user *) (ibuf) : NULL; \
+                (udata)->outbuf = (olen) ? (void __user *) (obuf) : NULL;       \
+                (udata)->inlen  = (ilen);                                       \
+                (udata)->outlen = (olen);                                       \
+        } while (0)
+
 /*
  * Our lifetime rules for these structs are the following:
  *
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 65f6e7dc380c..f1cc83855af6 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2593,6 +2593,9 @@ out_put:
 static int kern_spec_to_ib_spec(struct ib_uverbs_flow_spec *kern_spec,
                                 union ib_flow_spec *ib_spec)
 {
+        if (kern_spec->reserved)
+                return -EINVAL;
+
         ib_spec->type = kern_spec->type;
 
         switch (ib_spec->type) {
@@ -2646,6 +2649,9 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         void *ib_spec;
         int i;
 
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
+
         if (ucore->outlen < sizeof(resp))
                 return -ENOSPC;
 
@@ -2671,6 +2677,10 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
             (cmd.flow_attr.num_of_specs * sizeof(struct ib_uverbs_flow_spec)))
                 return -EINVAL;
 
+        if (cmd.flow_attr.reserved[0] ||
+            cmd.flow_attr.reserved[1])
+                return -EINVAL;
+
         if (cmd.flow_attr.num_of_specs) {
                 kern_flow_attr = kmalloc(sizeof(*kern_flow_attr) + cmd.flow_attr.size,
                                          GFP_KERNEL);
@@ -2731,6 +2741,7 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         if (cmd.flow_attr.size || (i != flow_attr->num_of_specs)) {
                 pr_warn("create flow failed, flow %d: %d bytes left from uverb cmd\n",
                         i, cmd.flow_attr.size);
+                err = -EINVAL;
                 goto err_free;
         }
         flow_id = ib_create_flow(qp, flow_attr, IB_FLOW_DOMAIN_USER);
@@ -2791,10 +2802,16 @@ int ib_uverbs_ex_destroy_flow(struct ib_uverbs_file *file,
         struct ib_uobject               *uobj;
         int                             ret;
 
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
+
         ret = ib_copy_from_udata(&cmd, ucore, sizeof(cmd));
         if (ret)
                 return ret;
 
+        if (cmd.comp_mask)
+                return -EINVAL;
+
         uobj = idr_write_uobj(&ib_uverbs_rule_idr, cmd.flow_handle,
                               file->ucontext);
         if (!uobj)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 34386943ebcf..08219fb3338b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -668,25 +668,30 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 if ((hdr.in_words + ex_hdr.provider_in_words) * 8 != count)
                         return -EINVAL;
 
+                if (ex_hdr.cmd_hdr_reserved)
+                        return -EINVAL;
+
                 if (ex_hdr.response) {
                         if (!hdr.out_words && !ex_hdr.provider_out_words)
                                 return -EINVAL;
+
+                        if (!access_ok(VERIFY_WRITE,
+                                       (void __user *) (unsigned long) ex_hdr.response,
+                                       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+                                return -EFAULT;
                 } else {
                         if (hdr.out_words || ex_hdr.provider_out_words)
                                 return -EINVAL;
                 }
 
-                INIT_UDATA(&ucore,
-                           (hdr.in_words) ? buf : 0,
-                           (unsigned long)ex_hdr.response,
-                           hdr.in_words * 8,
-                           hdr.out_words * 8);
-
-                INIT_UDATA(&uhw,
-                           (ex_hdr.provider_in_words) ? buf + ucore.inlen : 0,
-                           (ex_hdr.provider_out_words) ? (unsigned long)ex_hdr.response + ucore.outlen : 0,
-                           ex_hdr.provider_in_words * 8,
-                           ex_hdr.provider_out_words * 8);
+                INIT_UDATA_BUF_OR_NULL(&ucore, buf, (unsigned long) ex_hdr.response,
+                                       hdr.in_words * 8, hdr.out_words * 8);
+
+                INIT_UDATA_BUF_OR_NULL(&uhw,
+                                       buf + ucore.inlen,
+                                       (unsigned long) ex_hdr.response + ucore.outlen,
+                                       ex_hdr.provider_in_words * 8,
+                                       ex_hdr.provider_out_words * 8);
 
                 err = uverbs_ex_cmd_table[command](file,
                                                    &ucore,
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 4cb8eb24497c..84e45006451c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -173,7 +173,7 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
         return ret;
 }
 
-int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+static int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 {
         u32 remain = len;
         u32 dmalen;
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 2b46bf1d7e40..4c9852d92b0a 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -421,9 +421,11 @@ out:
 
         if (watermark <= WATERMARK_METADATA) {
                 SET_GC_MARK(b, GC_MARK_METADATA);
+                SET_GC_MOVE(b, 0);
                 b->prio = BTREE_PRIO;
         } else {
                 SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
+                SET_GC_MOVE(b, 0);
                 b->prio = INITIAL_PRIO;
         }
 
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 4beb55a0ff30..754f43177483 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -197,7 +197,7 @@ struct bucket {
         uint8_t         disk_gen;
         uint8_t         last_gc; /* Most out of date gen in the btree */
         uint8_t         gc_gen;
-        uint16_t        gc_mark;
+        uint16_t        gc_mark; /* Bitfield used by GC. See below for field */
 };
 
 /*
@@ -209,7 +209,8 @@ BITMASK(GC_MARK,	 struct bucket, gc_mark, 0, 2);
 #define GC_MARK_RECLAIMABLE     0
 #define GC_MARK_DIRTY           1
 #define GC_MARK_METADATA        2
-BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 14);
+BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 13);
+BITMASK(GC_MOVE, struct bucket, gc_mark, 15, 1);
 
 #include "journal.h"
 #include "stats.h"
@@ -372,14 +373,14 @@ struct cached_dev {
         unsigned char           writeback_percent;
         unsigned                writeback_delay;
 
-        int                     writeback_rate_change;
-        int64_t                 writeback_rate_derivative;
         uint64_t                writeback_rate_target;
+        int64_t                 writeback_rate_proportional;
+        int64_t                 writeback_rate_derivative;
+        int64_t                 writeback_rate_change;
 
         unsigned                writeback_rate_update_seconds;
         unsigned                writeback_rate_d_term;
         unsigned                writeback_rate_p_term_inverse;
-        unsigned                writeback_rate_d_smooth;
 };
 
 enum alloc_watermarks {
@@ -445,7 +446,6 @@ struct cache {
          * call prio_write() to keep gens from wrapping.
          */
         uint8_t                 need_save_prio;
-        unsigned                gc_move_threshold;
 
         /*
          * If nonzero, we know we aren't going to find any buckets to invalidate
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 5e2765aadce1..31bb53fcc67a 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1561,6 +1561,28 @@ size_t bch_btree_gc_finish(struct cache_set *c)
                 SET_GC_MARK(PTR_BUCKET(c, &c->uuid_bucket, i),
                             GC_MARK_METADATA);
 
+        /* don't reclaim buckets to which writeback keys point */
+        rcu_read_lock();
+        for (i = 0; i < c->nr_uuids; i++) {
+                struct bcache_device *d = c->devices[i];
+                struct cached_dev *dc;
+                struct keybuf_key *w, *n;
+                unsigned j;
+
+                if (!d || UUID_FLASH_ONLY(&c->uuids[i]))
+                        continue;
+                dc = container_of(d, struct cached_dev, disk);
+
+                spin_lock(&dc->writeback_keys.lock);
+                rbtree_postorder_for_each_entry_safe(w, n,
+                                        &dc->writeback_keys.keys, node)
+                        for (j = 0; j < KEY_PTRS(&w->key); j++)
+                                SET_GC_MARK(PTR_BUCKET(c, &w->key, j),
+                                            GC_MARK_DIRTY);
+                spin_unlock(&dc->writeback_keys.lock);
+        }
+        rcu_read_unlock();
+
         for_each_cache(ca, c, i) {
                 uint64_t *i;
 
@@ -1817,7 +1839,8 @@ static bool fix_overlapping_extents(struct btree *b, struct bkey *insert,
                         if (KEY_START(k) > KEY_START(insert) + sectors_found)
                                 goto check_failed;
 
-                        if (KEY_PTRS(replace_key) != KEY_PTRS(k))
+                        if (KEY_PTRS(k) != KEY_PTRS(replace_key) ||
+                            KEY_DIRTY(k) != KEY_DIRTY(replace_key))
                                 goto check_failed;
 
                         /* skip past gen */
@@ -2217,7 +2240,7 @@ struct btree_insert_op {
         struct bkey     *replace_key;
 };
 
-int btree_insert_fn(struct btree_op *b_op, struct btree *b)
+static int btree_insert_fn(struct btree_op *b_op, struct btree *b)
 {
         struct btree_insert_op *op = container_of(b_op,
                                         struct btree_insert_op, op);
diff --git a/drivers/md/bcache/movinggc.c b/drivers/md/bcache/movinggc.c
index 7c1275e66025..f2f0998c4a91 100644
--- a/drivers/md/bcache/movinggc.c
+++ b/drivers/md/bcache/movinggc.c
@@ -25,10 +25,9 @@ static bool moving_pred(struct keybuf *buf, struct bkey *k)
         unsigned i;
 
         for (i = 0; i < KEY_PTRS(k); i++) {
-                struct cache *ca = PTR_CACHE(c, k, i);
                 struct bucket *g = PTR_BUCKET(c, k, i);
 
-                if (GC_SECTORS_USED(g) < ca->gc_move_threshold)
+                if (GC_MOVE(g))
                         return true;
         }
 
@@ -65,11 +64,16 @@ static void write_moving_finish(struct closure *cl)
 
 static void read_moving_endio(struct bio *bio, int error)
 {
+        struct bbio *b = container_of(bio, struct bbio, bio);
         struct moving_io *io = container_of(bio->bi_private,
                                             struct moving_io, cl);
 
         if (error)
                 io->op.error = error;
+        else if (!KEY_DIRTY(&b->key) &&
+                 ptr_stale(io->op.c, &b->key, 0)) {
+                io->op.error = -EINTR;
+        }
 
         bch_bbio_endio(io->op.c, bio, error, "reading data to move");
 }
@@ -141,6 +145,11 @@ static void read_moving(struct cache_set *c)
                 if (!w)
                         break;
 
+                if (ptr_stale(c, &w->key, 0)) {
+                        bch_keybuf_del(&c->moving_gc_keys, w);
+                        continue;
+                }
+
                 io = kzalloc(sizeof(struct moving_io) + sizeof(struct bio_vec)
                              * DIV_ROUND_UP(KEY_SIZE(&w->key), PAGE_SECTORS),
                              GFP_KERNEL);
@@ -184,7 +193,8 @@ static bool bucket_cmp(struct bucket *l, struct bucket *r)
 
 static unsigned bucket_heap_top(struct cache *ca)
 {
-        return GC_SECTORS_USED(heap_peek(&ca->heap));
+        struct bucket *b;
+        return (b = heap_peek(&ca->heap)) ? GC_SECTORS_USED(b) : 0;
 }
 
 void bch_moving_gc(struct cache_set *c)
@@ -226,9 +236,8 @@ void bch_moving_gc(struct cache_set *c)
                         sectors_to_move -= GC_SECTORS_USED(b);
                 }
 
-                ca->gc_move_threshold = bucket_heap_top(ca);
-
-                pr_debug("threshold %u", ca->gc_move_threshold);
+                while (heap_pop(&ca->heap, b, bucket_cmp))
+                        SET_GC_MOVE(b, 1);
         }
 
         mutex_unlock(&c->bucket_lock);
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index dec15cd2d797..c57bfa071a57 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1676,7 +1676,7 @@ err:
 static bool can_attach_cache(struct cache *ca, struct cache_set *c)
 {
         return ca->sb.block_size        == c->sb.block_size &&
-                ca->sb.bucket_size      == c->sb.block_size &&
+                ca->sb.bucket_size      == c->sb.bucket_size &&
                 ca->sb.nr_in_set        == c->sb.nr_in_set;
 }
 
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 80d4c2bee18a..a1f85612f0b3 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -83,7 +83,6 @@ rw_attribute(writeback_rate);
 rw_attribute(writeback_rate_update_seconds);
 rw_attribute(writeback_rate_d_term);
 rw_attribute(writeback_rate_p_term_inverse);
-rw_attribute(writeback_rate_d_smooth);
 read_attribute(writeback_rate_debug);
 
 read_attribute(stripe_size);
@@ -129,31 +128,41 @@ SHOW(__bch_cached_dev)
         var_printf(writeback_running,   "%i");
         var_print(writeback_delay);
         var_print(writeback_percent);
-        sysfs_print(writeback_rate,     dc->writeback_rate.rate);
+        sysfs_hprint(writeback_rate,    dc->writeback_rate.rate << 9);
 
         var_print(writeback_rate_update_seconds);
         var_print(writeback_rate_d_term);
         var_print(writeback_rate_p_term_inverse);
-        var_print(writeback_rate_d_smooth);
 
         if (attr == &sysfs_writeback_rate_debug) {
+                char rate[20];
                 char dirty[20];
-                char derivative[20];
                 char target[20];
-                bch_hprint(dirty,
-                           bcache_dev_sectors_dirty(&dc->disk) << 9);
-                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                char proportional[20];
+                char derivative[20];
+                char change[20];
+                s64 next_io;
+
+                bch_hprint(rate,        dc->writeback_rate.rate << 9);
+                bch_hprint(dirty,       bcache_dev_sectors_dirty(&dc->disk) << 9);
                 bch_hprint(target,      dc->writeback_rate_target << 9);
+                bch_hprint(proportional,dc->writeback_rate_proportional << 9);
+                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                bch_hprint(change,      dc->writeback_rate_change << 9);
+
+                next_io = div64_s64(dc->writeback_rate.next - local_clock(),
+                                    NSEC_PER_MSEC);
 
                 return sprintf(buf,
-                               "rate:\t\t%u\n"
-                               "change:\t\t%i\n"
+                               "rate:\t\t%s/sec\n"
                                "dirty:\t\t%s\n"
+                               "target:\t\t%s\n"
+                               "proportional:\t%s\n"
                                "derivative:\t%s\n"
-                               "target:\t\t%s\n",
-                               dc->writeback_rate.rate,
-                               dc->writeback_rate_change,
-                               dirty, derivative, target);
+                               "change:\t\t%s/sec\n"
+                               "next io:\t%llims\n",
+                               rate, dirty, target, proportional,
+                               derivative, change, next_io);
         }
 
         sysfs_hprint(dirty_data,
@@ -189,6 +198,7 @@ STORE(__cached_dev)
         struct kobj_uevent_env *env;
 
 #define d_strtoul(var)          sysfs_strtoul(var, dc->var)
+#define d_strtoul_nonzero(var)  sysfs_strtoul_clamp(var, dc->var, 1, INT_MAX)
 #define d_strtoi_h(var)         sysfs_hatoi(var, dc->var)
 
         sysfs_strtoul(data_csum,        dc->disk.data_csum);
@@ -197,16 +207,15 @@ STORE(__cached_dev)
         d_strtoul(writeback_metadata);
         d_strtoul(writeback_running);
         d_strtoul(writeback_delay);
-        sysfs_strtoul_clamp(writeback_rate,
-                            dc->writeback_rate.rate, 1, 1000000);
+
         sysfs_strtoul_clamp(writeback_percent, dc->writeback_percent, 0, 40);
 
-        d_strtoul(writeback_rate_update_seconds);
+        sysfs_strtoul_clamp(writeback_rate,
+                            dc->writeback_rate.rate, 1, INT_MAX);
+
+        d_strtoul_nonzero(writeback_rate_update_seconds);
         d_strtoul(writeback_rate_d_term);
-        d_strtoul(writeback_rate_p_term_inverse);
-        sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
-                            dc->writeback_rate_p_term_inverse, 1, INT_MAX);
-        d_strtoul(writeback_rate_d_smooth);
+        d_strtoul_nonzero(writeback_rate_p_term_inverse);
 
         d_strtoi_h(sequential_cutoff);
         d_strtoi_h(readahead);
@@ -313,7 +322,6 @@ static struct attribute *bch_cached_dev_files[] = {
         &sysfs_writeback_rate_update_seconds,
         &sysfs_writeback_rate_d_term,
         &sysfs_writeback_rate_p_term_inverse,
-        &sysfs_writeback_rate_d_smooth,
         &sysfs_writeback_rate_debug,
         &sysfs_dirty_data,
         &sysfs_stripe_size,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 462214eeacbe..bb37618e7664 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -209,7 +209,13 @@ uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
         uint64_t now = local_clock();
 
-        d->next += div_u64(done, d->rate);
+        d->next += div_u64(done * NSEC_PER_SEC, d->rate);
+
+        if (time_before64(now + NSEC_PER_SEC, d->next))
+                d->next = now + NSEC_PER_SEC;
+
+        if (time_after64(now - NSEC_PER_SEC * 2, d->next))
+                d->next = now - NSEC_PER_SEC * 2;
 
         return time_after64(d->next, now)
                 ? div_u64(d->next - now, NSEC_PER_SEC / HZ)
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 362c4b3f8b4a..1030c6020e98 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -110,7 +110,7 @@ do {									\
         _r;                                                             \
 })
 
-#define heap_peek(h)    ((h)->size ? (h)->data[0] : NULL)
+#define heap_peek(h)    ((h)->used ? (h)->data[0] : NULL)
 
 #define heap_full(h)    ((h)->used == (h)->size)
 
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 99053b1251be..6c44fe059c27 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -30,38 +30,40 @@ static void __update_writeback_rate(struct cached_dev *dc)
 
         /* PD controller */
 
-        int change = 0;
-        int64_t error;
         int64_t dirty = bcache_dev_sectors_dirty(&dc->disk);
         int64_t derivative = dirty - dc->disk.sectors_dirty_last;
+        int64_t proportional = dirty - target;
+        int64_t change;
 
         dc->disk.sectors_dirty_last = dirty;
 
-        derivative *= dc->writeback_rate_d_term;
-        derivative = clamp(derivative, -dirty, dirty);
+        /* Scale to sectors per second */
 
-        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
-                              dc->writeback_rate_d_smooth, 0);
+        proportional *= dc->writeback_rate_update_seconds;
+        proportional = div_s64(proportional, dc->writeback_rate_p_term_inverse);
 
-        /* Avoid divide by zero */
-        if (!target)
-                goto out;
+        derivative = div_s64(derivative, dc->writeback_rate_update_seconds);
 
-        error = div64_s64((dirty + derivative - target) << 8, target);
+        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+                              (dc->writeback_rate_d_term /
+                               dc->writeback_rate_update_seconds) ?: 1, 0);
+
+        derivative *= dc->writeback_rate_d_term;
+        derivative = div_s64(derivative, dc->writeback_rate_p_term_inverse);
 
-        change = div_s64((dc->writeback_rate.rate * error) >> 8,
-                         dc->writeback_rate_p_term_inverse);
+        change = proportional + derivative;
 
         /* Don't increase writeback rate if the device isn't keeping up */
         if (change > 0 &&
             time_after64(local_clock(),
-                         dc->writeback_rate.next + 10 * NSEC_PER_MSEC))
+                         dc->writeback_rate.next + NSEC_PER_MSEC))
                 change = 0;
 
         dc->writeback_rate.rate =
-                clamp_t(int64_t, dc->writeback_rate.rate + change,
+                clamp_t(int64_t, (int64_t) dc->writeback_rate.rate + change,
                         1, NSEC_PER_MSEC);
-out:
+
+        dc->writeback_rate_proportional = proportional;
         dc->writeback_rate_derivative = derivative;
         dc->writeback_rate_change = change;
         dc->writeback_rate_target = target;
@@ -87,15 +89,11 @@ static void update_writeback_rate(struct work_struct *work)
 
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
-        uint64_t ret;
-
         if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) ||
             !dc->writeback_percent)
                 return 0;
 
-        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
-
-        return min_t(uint64_t, ret, HZ);
+        return bch_next_delay(&dc->writeback_rate, sectors);
 }
 
 struct dirty_io {
@@ -241,7 +239,7 @@ static void read_dirty(struct cached_dev *dc)
                 if (KEY_START(&w->key) != dc->last_read ||
                     jiffies_to_msecs(delay) > 50)
                         while (!kthread_should_stop() && delay)
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
 
                 dc->last_read   = KEY_OFFSET(&w->key);
 
@@ -438,7 +436,7 @@ static int bch_writeback_thread(void *arg)
                         while (delay &&
                                !kthread_should_stop() &&
                                !test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                 }
         }
 
@@ -476,6 +474,8 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
 
         bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
                            sectors_dirty_init_fn, 0);
+
+        dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
 }
 
 int bch_cached_dev_writeback_init(struct cached_dev *dc)
@@ -490,18 +490,15 @@ int bch_cached_dev_writeback_init(struct cached_dev *dc)
         dc->writeback_delay             = 30;
         dc->writeback_rate.rate         = 1024;
 
-        dc->writeback_rate_update_seconds = 30;
-        dc->writeback_rate_d_term       = 16;
-        dc->writeback_rate_p_term_inverse = 64;
-        dc->writeback_rate_d_smooth     = 8;
+        dc->writeback_rate_update_seconds = 5;
+        dc->writeback_rate_d_term       = 30;
+        dc->writeback_rate_p_term_inverse = 6000;
 
         dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
                                               "bcache_writeback");
         if (IS_ERR(dc->writeback_thread))
                 return PTR_ERR(dc->writeback_thread);
 
-        set_task_state(dc->writeback_thread, TASK_INTERRUPTIBLE);
-
         INIT_DELAYED_WORK(&dc->writeback_rate_update, update_writeback_rate);
         schedule_delayed_work(&dc->writeback_rate_update,
                               dc->writeback_rate_update_seconds * HZ);
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index 2832576d8b12..114f5ef4b73a 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -512,6 +512,7 @@ static const struct dev_pm_ops byt_gpio_pm_ops = {
 
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
         { "INT33B2", 0 },
+        { "INT33FC", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, byt_gpio_acpi_match);
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 2a786c504460..3c6768378a94 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -833,6 +833,11 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
         return 0;
 }
 
+static const struct x86_cpu_id energy_unit_quirk_ids[] = {
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
+        {}
+};
+
 static int rapl_check_unit(struct rapl_package *rp, int cpu)
 {
         u64 msr_val;
@@ -853,8 +858,11 @@ static int rapl_check_unit(struct rapl_package *rp, int cpu)
          * time unit: 1/time_unit_divisor Seconds
          */
         value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit_divisor = 1 << value;
-
+        /* some CPUs have different way to calculate energy unit */
+        if (x86_match_cpu(energy_unit_quirk_ids))
+                rp->energy_unit_divisor = 1000000 / (1 << value);
+        else
+                rp->energy_unit_divisor = 1 << value;
 
         value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
         rp->power_unit_divisor = 1 << value;
@@ -941,6 +949,7 @@ static void package_power_limit_irq_restore(int package_id)
 static const struct x86_cpu_id rapl_ids[] = {
         { X86_VENDOR_INTEL, 6, 0x2a},/* SNB */
         { X86_VENDOR_INTEL, 6, 0x2d},/* SNB EP */
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
         { X86_VENDOR_INTEL, 6, 0x3a},/* IVB */
         { X86_VENDOR_INTEL, 6, 0x45},/* HSW */
         /* TODO: Add more CPU IDs after testing */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index c444654fc33f..5c4a95b516cf 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -285,7 +285,7 @@ static void update_balloon_size(struct virtio_balloon *vb)
 {
         __le32 actual = cpu_to_le32(vb->num_pages);
 
-        virtio_cwrite(vb->vdev, struct virtio_balloon_config, num_pages,
+        virtio_cwrite(vb->vdev, struct virtio_balloon_config, actual,
                       &actual);
 }
 
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 288534920fe5..20d6697bd638 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1493,6 +1493,7 @@ static ssize_t ext2_quota_write(struct super_block *sb, int type,
                                 sb->s_blocksize - offset : towrite;
 
                 tmp_bh.b_state = 0;
+                tmp_bh.b_size = sb->s_blocksize;
                 err = ext2_get_block(inode, blk, &tmp_bh, 1);
                 if (err < 0)
                         goto out;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e6185031c1cc..ece55565b9cd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -268,6 +268,16 @@ struct ext4_io_submit {
 /* Translate # of blks to # of clusters */
 #define EXT4_NUM_B2C(sbi, blks) (((blks) + (sbi)->s_cluster_ratio - 1) >> \
                                  (sbi)->s_cluster_bits)
+/* Mask out the low bits to get the starting block of the cluster */
+#define EXT4_PBLK_CMASK(s, pblk) ((pblk) &                              \
+                                  ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_CMASK(s, lblk) ((lblk) &                              \
+                                  ~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
+/* Get the cluster offset */
+#define EXT4_PBLK_COFF(s, pblk) ((pblk) &                               \
+                                 ((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_COFF(s, lblk) ((lblk) &                               \
+                                 ((ext4_lblk_t) (s)->s_cluster_ratio - 1))
 
 /*
  * Structure of a blocks group descriptor
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 17ac112ab101..3fe29de832c8 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -259,6 +259,15 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
                 if (WARN_ON_ONCE(err)) {
                         ext4_journal_abort_handle(where, line, __func__, bh,
                                                   handle, err);
+                        ext4_error_inode(inode, where, line,
+                                         bh->b_blocknr,
+                                         "journal_dirty_metadata failed: "
+                                         "handle type %u started at line %u, "
+                                         "credits %u/%u, errcode %d",
+                                         handle->h_type,
+                                         handle->h_line_no,
+                                         handle->h_requested_credits,
+                                         handle->h_buffer_credits, err);
                 }
         } else {
                 if (inode)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35f65cf4f318..4410cc3d6ee2 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -360,8 +360,10 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 {
         ext4_fsblk_t block = ext4_ext_pblock(ext);
         int len = ext4_ext_get_actual_len(ext);
+        ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+        ext4_lblk_t last = lblock + len - 1;
 
-        if (len == 0)
+        if (lblock > last)
                 return 0;
         return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
 }
@@ -387,11 +389,26 @@ static int ext4_valid_extent_entries(struct inode *inode,
         if (depth == 0) {
                 /* leaf entries */
                 struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
+                struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+                ext4_fsblk_t pblock = 0;
+                ext4_lblk_t lblock = 0;
+                ext4_lblk_t prev = 0;
+                int len = 0;
                 while (entries) {
                         if (!ext4_valid_extent(inode, ext))
                                 return 0;
+
+                        /* Check for overlapping extents */
+                        lblock = le32_to_cpu(ext->ee_block);
+                        len = ext4_ext_get_actual_len(ext);
+                        if ((lblock <= prev) && prev) {
+                                pblock = ext4_ext_pblock(ext);
+                                es->s_last_error_block = cpu_to_le64(pblock);
+                                return 0;
+                        }
                         ext++;
                         entries--;
+                        prev = lblock + len - 1;
                 }
         } else {
                 struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
@@ -1834,8 +1851,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
         depth = ext_depth(inode);
         if (!path[depth].p_ext)
                 goto out;
-        b2 = le32_to_cpu(path[depth].p_ext->ee_block);
-        b2 &= ~(sbi->s_cluster_ratio - 1);
+        b2 = EXT4_LBLK_CMASK(sbi, le32_to_cpu(path[depth].p_ext->ee_block));
 
         /*
          * get the next allocated block if the extent in the path
@@ -1845,7 +1861,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
                 b2 = ext4_ext_next_allocated_block(path);
                 if (b2 == EXT_MAX_BLOCKS)
                         goto out;
-                b2 &= ~(sbi->s_cluster_ratio - 1);
+                b2 = EXT4_LBLK_CMASK(sbi, b2);
         }
 
         /* check for wrap through zero on extent logical start block*/
@@ -2504,7 +2520,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                  * extent, we have to mark the cluster as used (store negative
                  * cluster number in partial_cluster).
                  */
-                unaligned = pblk & (sbi->s_cluster_ratio - 1);
+                unaligned = EXT4_PBLK_COFF(sbi, pblk);
                 if (unaligned && (ee_len == num) &&
                     (*partial_cluster != -((long long)EXT4_B2C(sbi, pblk))))
                         *partial_cluster = EXT4_B2C(sbi, pblk);
@@ -2598,7 +2614,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                          * accidentally freeing it later on
                          */
                         pblk = ext4_ext_pblock(ex);
-                        if (pblk & (sbi->s_cluster_ratio - 1))
+                        if (EXT4_PBLK_COFF(sbi, pblk))
                                 *partial_cluster =
                                         -((long long)EXT4_B2C(sbi, pblk));
                         ex--;
@@ -3753,7 +3769,7 @@ int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         ext4_lblk_t lblk_start, lblk_end;
-        lblk_start = lblk & (~(sbi->s_cluster_ratio - 1));
+        lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
         lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
 
         return ext4_find_delalloc_range(inode, lblk_start, lblk_end);
@@ -3812,9 +3828,9 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
         trace_ext4_get_reserved_cluster_alloc(inode, lblk_start, num_blks);
 
         /* Check towards left side */
-        c_offset = lblk_start & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start);
         if (c_offset) {
-                lblk_from = lblk_start & (~(sbi->s_cluster_ratio - 1));
+                lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
                 lblk_to = lblk_from + c_offset - 1;
 
                 if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
@@ -3822,7 +3838,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
         }
 
         /* Now check towards right. */
-        c_offset = (lblk_start + num_blks) & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start + num_blks);
         if (allocated_clusters && c_offset) {
                 lblk_from = lblk_start + num_blks;
                 lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
@@ -4030,7 +4046,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
                                      struct ext4_ext_path *path)
 {
         struct ext4_sb_info *sbi = EXT4_SB(sb);
-        ext4_lblk_t c_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        ext4_lblk_t c_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
         ext4_lblk_t ex_cluster_start, ex_cluster_end;
         ext4_lblk_t rr_cluster_start;
         ext4_lblk_t ee_block = le32_to_cpu(ex->ee_block);
@@ -4048,8 +4064,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
             (rr_cluster_start == ex_cluster_start)) {
                 if (rr_cluster_start == ex_cluster_end)
                         ee_start += ee_len - 1;
-                map->m_pblk = (ee_start & ~(sbi->s_cluster_ratio - 1)) +
-                        c_offset;
+                map->m_pblk = EXT4_PBLK_CMASK(sbi, ee_start) + c_offset;
                 map->m_len = min(map->m_len,
                                  (unsigned) sbi->s_cluster_ratio - c_offset);
                 /*
@@ -4203,7 +4218,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
          */
         map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
         newex.ee_block = cpu_to_le32(map->m_lblk);
-        cluster_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        cluster_offset = EXT4_LBLK_CMASK(sbi, map->m_lblk);
 
         /*
          * If we are doing bigalloc, check to see if the extent returned
@@ -4271,7 +4286,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
          * needed so that future calls to get_implied_cluster_alloc()
          * work correctly.
          */
-        offset = map->m_lblk & (sbi->s_cluster_ratio - 1);
+        offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
         ar.len = EXT4_NUM_B2C(sbi, offset+allocated);
         ar.goal -= offset;
         ar.logical -= offset;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 075763474118..61d49ff22c81 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1206,7 +1206,6 @@ static int ext4_journalled_write_end(struct file *file,
  */
 static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         struct ext4_inode_info *ei = EXT4_I(inode);
         unsigned int md_needed;
@@ -1218,7 +1217,6 @@ static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
          * in order to allocate nrblocks
          * worse case is one extent per block
          */
-repeat:
         spin_lock(&ei->i_block_reservation_lock);
         /*
          * ext4_calc_metadata_amount() has side effects, which we have
@@ -1238,10 +1236,6 @@ repeat:
                 ei->i_da_metadata_calc_len = save_len;
                 ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                 spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                 return -ENOSPC;
         }
         ei->i_reserved_meta_blocks += md_needed;
@@ -1255,7 +1249,6 @@ repeat:
  */
 static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         struct ext4_inode_info *ei = EXT4_I(inode);
         unsigned int md_needed;
@@ -1277,7 +1270,6 @@ static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
          * in order to allocate nrblocks
          * worse case is one extent per block
          */
-repeat:
         spin_lock(&ei->i_block_reservation_lock);
         /*
          * ext4_calc_metadata_amount() has side effects, which we have
@@ -1297,10 +1289,6 @@ repeat:
                 ei->i_da_metadata_calc_len = save_len;
                 ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                 spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                 dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1));
                 return -ENOSPC;
         }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 4d113efa024c..04a5c7504be9 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3442,6 +3442,9 @@ static void ext4_mb_pa_callback(struct rcu_head *head)
 {
         struct ext4_prealloc_space *pa;
         pa = container_of(head, struct ext4_prealloc_space, u.pa_rcu);
+
+        BUG_ON(atomic_read(&pa->pa_count));
+        BUG_ON(pa->pa_deleted == 0);
         kmem_cache_free(ext4_pspace_cachep, pa);
 }
 
@@ -3455,11 +3458,13 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
         ext4_group_t grp;
         ext4_fsblk_t grp_blk;
 
-        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
-                return;
-
         /* in this short window concurrent discard can set pa_deleted */
         spin_lock(&pa->pa_lock);
+        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0) {
+                spin_unlock(&pa->pa_lock);
+                return;
+        }
+
         if (pa->pa_deleted == 1) {
                 spin_unlock(&pa->pa_lock);
                 return;
@@ -4121,7 +4126,7 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
         ext4_get_group_no_and_offset(sb, goal, &group, &block);
 
         /* set up allocation goals */
-        ac->ac_b_ex.fe_logical = ar->logical & ~(sbi->s_cluster_ratio - 1);
+        ac->ac_b_ex.fe_logical = EXT4_LBLK_CMASK(sbi, ar->logical);
         ac->ac_status = AC_STATUS_CONTINUE;
         ac->ac_sb = sb;
         ac->ac_inode = ar->inode;
@@ -4663,7 +4668,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
          * blocks at the beginning or the end unless we are explicitly
          * requested to avoid doing so.
          */
-        overflow = block & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_PBLK_COFF(sbi, block);
         if (overflow) {
                 if (flags & EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER) {
                         overflow = sbi->s_cluster_ratio - overflow;
@@ -4677,7 +4682,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
                         count += overflow;
                 }
         }
-        overflow = count & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_LBLK_COFF(sbi, count);
         if (overflow) {
                 if (flags & EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER) {
                         if (count > overflow)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index c977f4e4e63b..1f7784de05b6 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -792,7 +792,7 @@ static void ext4_put_super(struct super_block *sb)
         }
 
         ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
         ext4_release_system_zone(sb);
         ext4_mb_release(sb);
         ext4_ext_release(sb);
@@ -3316,11 +3316,19 @@ int ext4_calculate_overhead(struct super_block *sb)
 }
 
 
-static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
+static ext4_fsblk_t ext4_calculate_resv_clusters(struct super_block *sb)
 {
         ext4_fsblk_t resv_clusters;
 
         /*
+         * There's no need to reserve anything when we aren't using extents.
+         * The space estimates are exact, there are no unwritten extents,
+         * hole punching doesn't need new metadata... This is needed especially
+         * to keep ext2/3 backward compatibility.
+         */
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS))
+                return 0;
+        /*
          * By default we reserve 2% or 4096 clusters, whichever is smaller.
          * This should cover the situations where we can not afford to run
          * out of space like for example punch hole, or converting
@@ -3328,7 +3336,8 @@ static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
          * allocation would require 1, or 2 blocks, higher numbers are
          * very rare.
          */
-        resv_clusters = ext4_blocks_count(sbi->s_es) >> sbi->s_cluster_bits;
+        resv_clusters = ext4_blocks_count(EXT4_SB(sb)->s_es) >>
+                        EXT4_SB(sb)->s_cluster_bits;
 
         do_div(resv_clusters, 50);
         resv_clusters = min_t(ext4_fsblk_t, resv_clusters, 4096);
@@ -4071,10 +4080,10 @@ no_journal:
                          "available");
         }
 
-        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sbi));
+        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sb));
         if (err) {
                 ext4_msg(sb, KERN_ERR, "failed to reserve %llu clusters for "
-                         "reserved pool", ext4_calculate_resv_clusters(sbi));
+                         "reserved pool", ext4_calculate_resv_clusters(sb));
                 goto failed_mount4a;
         }
 
@@ -4184,7 +4193,7 @@ failed_mount_wq:
         }
 failed_mount3:
         ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
         if (sbi->s_flex_groups)
                 ext4_kvfree(sbi->s_flex_groups);
         percpu_counter_destroy(&sbi->s_freeclusters_counter);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 52032647dd4a..5fa344afb49a 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -702,7 +702,7 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
         read_lock(&journal->j_state_lock);
 #ifdef CONFIG_JBD2_DEBUG
         if (!tid_geq(journal->j_commit_request, tid)) {
-                printk(KERN_EMERG
+                printk(KERN_ERR
                        "%s: error: j_commit_request=%d, tid=%d\n",
                        __func__, journal->j_commit_request, tid);
         }
@@ -718,10 +718,8 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
         }
         read_unlock(&journal->j_state_lock);
 
-        if (unlikely(is_journal_aborted(journal))) {
-                printk(KERN_EMERG "journal commit I/O error\n");
+        if (unlikely(is_journal_aborted(journal)))
                 err = -EIO;
-        }
         return err;
 }
 
@@ -1527,13 +1525,13 @@ static int journal_get_superblock(journal_t *journal)
         if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
             JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                 /* Can't have checksum v1 and v2 on at the same time! */
-                printk(KERN_ERR "JBD: Can't enable checksumming v1 and v2 "
+                printk(KERN_ERR "JBD2: Can't enable checksumming v1 and v2 "
                        "at the same time!\n");
                 goto out;
         }
 
         if (!jbd2_verify_csum_type(journal, sb)) {
-                printk(KERN_ERR "JBD: Unknown checksum type\n");
+                printk(KERN_ERR "JBD2: Unknown checksum type\n");
                 goto out;
         }
 
@@ -1541,7 +1539,7 @@ static int journal_get_superblock(journal_t *journal)
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                 journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
                 if (IS_ERR(journal->j_chksum_driver)) {
-                        printk(KERN_ERR "JBD: Cannot load crc32c driver.\n");
+                        printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
                         err = PTR_ERR(journal->j_chksum_driver);
                         journal->j_chksum_driver = NULL;
                         goto out;
@@ -1550,7 +1548,7 @@ static int journal_get_superblock(journal_t *journal)
 
         /* Check superblock checksum */
         if (!jbd2_superblock_csum_verify(journal, sb)) {
-                printk(KERN_ERR "JBD: journal checksum error\n");
+                printk(KERN_ERR "JBD2: journal checksum error\n");
                 goto out;
         }
 
@@ -1836,7 +1834,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                         journal->j_chksum_driver = crypto_alloc_shash("crc32c",
                                                                       0, 0);
                         if (IS_ERR(journal->j_chksum_driver)) {
-                                printk(KERN_ERR "JBD: Cannot load crc32c "
+                                printk(KERN_ERR "JBD2: Cannot load crc32c "
                                        "driver.\n");
                                 journal->j_chksum_driver = NULL;
                                 return 0;
@@ -2645,7 +2643,7 @@ static void __exit journal_exit(void)
 #ifdef CONFIG_JBD2_DEBUG
         int n = atomic_read(&nr_journal_heads);
         if (n)
-                printk(KERN_EMERG "JBD2: leaked %d journal_heads!\n", n);
+                printk(KERN_ERR "JBD2: leaked %d journal_heads!\n", n);
 #endif
         jbd2_remove_jbd_stats_proc_entry();
         jbd2_journal_destroy_caches();
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3929c50428b1..3b6bb19d60b1 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -594,7 +594,7 @@ static int do_one_pass(journal_t *journal,
                                                 be32_to_cpu(tmp->h_sequence))) {
                                                 brelse(obh);
                                                 success = -EIO;
-                                                printk(KERN_ERR "JBD: Invalid "
+                                                printk(KERN_ERR "JBD2: Invalid "
                                                        "checksum recovering "
                                                        "block %llu in log\n",
                                                        blocknr);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 7aa9a32573bb..8360674c85bc 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -932,7 +932,7 @@ repeat:
                                         jbd2_alloc(jh2bh(jh)->b_size,
                                                          GFP_NOFS);
                                 if (!frozen_buffer) {
-                                        printk(KERN_EMERG
+                                        printk(KERN_ERR
                                                "%s: OOM for frozen_buffer\n",
                                                __func__);
                                         JBUFFER_TRACE(jh, "oom!");
@@ -1166,7 +1166,7 @@ repeat:
         if (!jh->b_committed_data) {
                 committed_data = jbd2_alloc(jh2bh(jh)->b_size, GFP_NOFS);
                 if (!committed_data) {
-                        printk(KERN_EMERG "%s: No memory for committed data\n",
+                        printk(KERN_ERR "%s: No memory for committed data\n",
                                 __func__);
                         err = -ENOMEM;
                         goto out;
@@ -1290,7 +1290,10 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                  * once a transaction -bzzz
                  */
                 jh->b_modified = 1;
-                J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
+                if (handle->h_buffer_credits <= 0) {
+                        ret = -ENOSPC;
+                        goto out_unlock_bh;
+                }
                 handle->h_buffer_credits--;
         }
 
@@ -1305,7 +1308,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                 JBUFFER_TRACE(jh, "fastpath");
                 if (unlikely(jh->b_transaction !=
                              journal->j_running_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_transaction (%llu, %p, %u) != "
                                "journal->j_running_transaction (%p, %u)",
                                journal->j_devname,
@@ -1332,7 +1335,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                 JBUFFER_TRACE(jh, "already on other transaction");
                 if (unlikely(jh->b_transaction !=
                              journal->j_committing_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_transaction (%llu, %p, %u) != "
                                "journal->j_committing_transaction (%p, %u)",
                                journal->j_devname,
@@ -1345,7 +1348,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                         ret = -EINVAL;
                 }
                 if (unlikely(jh->b_next_transaction != transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_next_transaction (%llu, %p, %u) != "
                                "transaction (%p, %u)",
                                journal->j_devname,
@@ -1373,7 +1376,6 @@ out_unlock_bh:
         jbd2_journal_put_journal_head(jh);
 out:
         JBUFFER_TRACE(jh, "exit");
-        WARN_ON(ret);   /* All errors are bugs, so dump the stack */
         return ret;
 }
 
diff --git a/include/linux/auxvec.h b/include/linux/auxvec.h
index 669fef5c745a..3e0fbe441763 100644
--- a/include/linux/auxvec.h
+++ b/include/linux/auxvec.h
@@ -3,6 +3,6 @@
 
 #include <uapi/linux/auxvec.h>
 
-#define AT_VECTOR_SIZE_BASE 19 /* NEW_AUX_ENT entries in auxiliary table */
+#define AT_VECTOR_SIZE_BASE 20 /* NEW_AUX_ENT entries in auxiliary table */
   /* number of "#define AT_.*" above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} */
 #endif /* _LINUX_AUXVEC_H */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 0e23c26485f4..9b503376738f 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -418,6 +418,7 @@ enum {
         ATA_HORKAGE_DUMP_ID     = (1 << 16),    /* dump IDENTIFY data */
         ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),  /* Set max sects to 65535 */
         ATA_HORKAGE_ATAPI_DMADIR = (1 << 18),   /* device requires dmadir */
+        ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19),    /* don't use queued TRIM */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
index 57e890abe1f0..a5fc7d01aad6 100644
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -69,6 +69,7 @@
         __PCPU_DUMMY_ATTRS char __pcpu_scope_##name;                    \
         extern __PCPU_DUMMY_ATTRS char __pcpu_unique_##name;            \
         __PCPU_DUMMY_ATTRS char __pcpu_unique_##name;                   \
+        extern __PCPU_ATTRS(sec) __typeof__(type) name;                 \
         __PCPU_ATTRS(sec) PER_CPU_DEF_ATTRIBUTES __weak                 \
         __typeof__(type) name
 #else
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 979874c627ee..61e1935c91b1 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -978,7 +978,7 @@ struct ib_uobject {
 };
 
 struct ib_udata {
-        void __user *inbuf;
+        const void __user *inbuf;
         void __user *outbuf;
         size_t       inlen;
         size_t       outlen;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 8b729c278b64..bc1dcabe9217 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -890,6 +890,16 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 struct cgroup *cgrp = dentry->d_fsdata;
 
                 BUG_ON(!(cgroup_is_dead(cgrp)));
+
+                /*
+                 * XXX: cgrp->id is only used to look up css's.  As cgroup
+                 * and css's lifetimes will be decoupled, it should be made
+                 * per-subsystem and moved to css->id so that lookups are
+                 * successful until the target css is released.
+                 */
+                idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+                cgrp->id = -1;
+
                 call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
         } else {
                 struct cfent *cfe = __d_cfe(dentry);
@@ -4268,6 +4278,7 @@ static void css_release(struct percpu_ref *ref)
         struct cgroup_subsys_state *css =
                 container_of(ref, struct cgroup_subsys_state, refcnt);
 
+        rcu_assign_pointer(css->cgroup->subsys[css->ss->subsys_id], NULL);
         call_rcu(&css->rcu_head, css_free_rcu_fn);
 }
 
@@ -4426,14 +4437,6 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
         root->number_of_cgroups++;
 
-        /* each css holds a ref to the cgroup's dentry and the parent css */
-        for_each_root_subsys(root, ss) {
-                struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
-
-                dget(dentry);
-                css_get(css->parent);
-        }
-
         /* hold a ref to the parent's dentry */
         dget(parent->dentry);
 
@@ -4445,6 +4448,13 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                 if (err)
                         goto err_destroy;
 
+                /* each css holds a ref to the cgroup's dentry and parent css */
+                dget(dentry);
+                css_get(css->parent);
+
+                /* mark it consumed for error path */
+                css_ar[ss->subsys_id] = NULL;
+
                 if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
                     parent->parent) {
                         pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
@@ -4491,6 +4501,14 @@ err_free_cgrp:
         return err;
 
 err_destroy:
+        for_each_root_subsys(root, ss) {
+                struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
+
+                if (css) {
+                        percpu_ref_cancel_init(&css->refcnt);
+                        ss->css_free(css);
+                }
+        }
         cgroup_destroy_locked(cgrp);
         mutex_unlock(&cgroup_mutex);
         mutex_unlock(&dentry->d_inode->i_mutex);
@@ -4652,8 +4670,12 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
          * will be invoked to perform the rest of destruction once the
          * percpu refs of all css's are confirmed to be killed.
          */
-        for_each_root_subsys(cgrp->root, ss)
-                kill_css(cgroup_css(cgrp, ss));
+        for_each_root_subsys(cgrp->root, ss) {
+                struct cgroup_subsys_state *css = cgroup_css(cgrp, ss);
+
+                if (css)
+                        kill_css(css);
+        }
 
         /*
          * Mark @cgrp dead.  This prevents further task migration and child
@@ -4722,14 +4744,6 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp)
         /* delete this cgroup from parent->children */
         list_del_rcu(&cgrp->sibling);
 
-        /*
-         * We should remove the cgroup object from idr before its grace
-         * period starts, so we won't be looking up a cgroup while the
-         * cgroup is being freed.
-         */
-        idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
-        cgrp->id = -1;
-
         dput(d);
 
         set_bit(CGRP_RELEASABLE, &parent->flags);
diff --git a/kernel/freezer.c b/kernel/freezer.c
index b462fa197517..aa6a8aadb911 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -19,6 +19,12 @@ EXPORT_SYMBOL(system_freezing_cnt);
 bool pm_freezing;
 bool pm_nosig_freezing;
 
+/*
+ * Temporary export for the deadlock workaround in ata_scsi_hotplug().
+ * Remove once the hack becomes unnecessary.
+ */
+EXPORT_SYMBOL_GPL(pm_freezing);
+
 /* protects freezing and frozen transitions */
 static DEFINE_SPINLOCK(freezer_lock);
 
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 463aa6736751..eacb8bd8cab4 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -81,6 +81,7 @@ void pm_vt_switch_unregister(struct device *dev)
         list_for_each_entry(tmp, &pm_vt_switch_list, head) {
                 if (tmp->dev == dev) {
                         list_del(&tmp->head);
+                        kfree(tmp);
                         break;
                 }
         }
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 32b10f53d0b4..2dcb37736d84 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -82,7 +82,9 @@ kallsyms()
                 kallsymopt="${kallsymopt} --all-symbols"
         fi
 
-        kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
+        if [ -n "${CONFIG_ARM}" ] && [ -n "${CONFIG_PAGE_OFFSET}" ]; then
+                kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
+        fi
 
         local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
                       ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 419491d8e7d2..6625699f497c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4334,8 +4334,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
                                    PEER__RECV, &ad);
-                if (err)
+                if (err) {
                         selinux_netlbl_err(skb, err, 0);
+                        return err;
+                }
         }
 
         if (secmark_active) {
@@ -5586,11 +5588,11 @@ static int selinux_setprocattr(struct task_struct *p,
                 /* Check for ptracing, and update the task SID if ok.
                    Otherwise, leave SID unchanged and fail. */
                 ptsid = 0;
-                task_lock(p);
+                rcu_read_lock();
                 tracer = ptrace_parent(p);
                 if (tracer)
                         ptsid = task_sid(tracer);
-                task_unlock(p);
+                rcu_read_unlock();
 
                 if (tracer) {
                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,