26 files changed, 156 insertions, 103 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 53cc13c82cb1..b17587d9412f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3666,11 +3666,12 @@ F:	Documentation/networking/README.ipw2200
 F:      drivers/net/wireless/ipw2x00/
 
 INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
-M:      Joseph Cihula <joseph.cihula@intel.com>
+M:      Richard L Maliszewski <richard.l.maliszewski@intel.com>
+M:      Gang Wei <gang.wei@intel.com>
 M:      Shane Wang <shane.wang@intel.com>
 L:      tboot-devel@lists.sourceforge.net
 W:      http://tboot.sourceforge.net
-T:      Mercurial http://www.bughost.org/repos.hg/tboot.hg
+T:      hg http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot
 S:      Supported
 F:      Documentation/intel_txt.txt
 F:      include/linux/tboot.h
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index d07c9f7fded6..0c03411c59eb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -449,6 +449,14 @@ static void nbd_clear_que(struct nbd_device *nbd)
                 req->errors++;
                 nbd_end_request(req);
         }
+
+        while (!list_empty(&nbd->waiting_queue)) {
+                req = list_entry(nbd->waiting_queue.next, struct request,
+                                 queuelist);
+                list_del_init(&req->queuelist);
+                req->errors++;
+                nbd_end_request(req);
+        }
 }
 
 
@@ -598,6 +606,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd->file = NULL;
                 nbd_clear_que(nbd);
                 BUG_ON(!list_empty(&nbd->queue_head));
+                BUG_ON(!list_empty(&nbd->waiting_queue));
                 if (file)
                         fput(file);
                 return 0;
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 1201a15784c3..db713c0dfba4 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -552,7 +552,7 @@ EXPORT_SYMBOL_GPL(hwspin_lock_request_specific);
  */
 int hwspin_lock_free(struct hwspinlock *hwlock)
 {
-        struct device *dev = hwlock->bank->dev;
+        struct device *dev;
         struct hwspinlock *tmp;
         int ret;
 
@@ -561,6 +561,7 @@ int hwspin_lock_free(struct hwspinlock *hwlock)
                 return -EINVAL;
         }
 
+        dev = hwlock->bank->dev;
         mutex_lock(&hwspinlock_tree_lock);
 
         /* make sure the hwspinlock is used */
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 51f42061dae9..6cfd4d8fd0bd 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1361,11 +1361,11 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         struct tid_info *t = dev->rdev.lldi.tids;
 
         ep = lookup_tid(t, tid);
-        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         if (!ep) {
                 printk(KERN_WARNING MOD "Abort rpl to freed endpoint\n");
                 return 0;
         }
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case ABORTING:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index cb5b7f7d4d38..b29a4246ef41 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -2219,7 +2219,6 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
         u32 wqe_idx;
 
         if (!qp->wqe_wr_id_tbl[tail].signaled) {
-                expand = true;  /* CQE cannot be consumed yet */
                 *polled = false;    /* WC cannot be consumed yet */
         } else {
                 ibwc->status = IB_WC_SUCCESS;
@@ -2227,10 +2226,11 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
                 ibwc->qp = &qp->ibqp;
                 ocrdma_update_wc(qp, ibwc, tail);
                 *polled = true;
-                wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
-                if (tail != wqe_idx)
-                        expand = true; /* Coalesced CQE can't be consumed yet */
         }
+        wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
+        if (tail != wqe_idx)
+                expand = true; /* Coalesced CQE can't be consumed yet */
+
         ocrdma_hwq_inc_tail(&qp->sq);
         return expand;
 }
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 19f1e6c45fb6..ccb119143d20 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -471,9 +471,10 @@ static int subn_get_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                 if (port_num != port) {
                         ibp = to_iport(ibdev, port_num);
                         ret = check_mkey(ibp, smp, 0);
-                        if (ret)
+                        if (ret) {
                                 ret = IB_MAD_RESULT_FAILURE;
                                 goto bail;
+                        }
                 }
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ca43901ed861..0af216d21f87 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -262,7 +262,10 @@ struct ipoib_ethtool_st {
         u16     max_coalesced_frames;
 };
 
+struct ipoib_neigh_table;
+
 struct ipoib_neigh_hash {
+        struct ipoib_neigh_table       *ntbl;
         struct ipoib_neigh __rcu      **buckets;
         struct rcu_head                 rcu;
         u32                             mask;
@@ -271,9 +274,9 @@ struct ipoib_neigh_hash {
 
 struct ipoib_neigh_table {
         struct ipoib_neigh_hash __rcu  *htbl;
-        rwlock_t                        rwlock;
         atomic_t                        entries;
         struct completion               flushed;
+        struct completion               deleted;
 };
 
 /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 3e2085a3ee47..1e19b5ae7c47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -546,15 +546,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
         struct ipoib_neigh *neigh;
         unsigned long flags;
 
+        spin_lock_irqsave(&priv->lock, flags);
         neigh = ipoib_neigh_alloc(daddr, dev);
         if (!neigh) {
+                spin_unlock_irqrestore(&priv->lock, flags);
                 ++dev->stats.tx_dropped;
                 dev_kfree_skb_any(skb);
                 return;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         path = __path_find(dev, daddr + 4);
         if (!path) {
                 path = path_rec_create(dev, daddr + 4);
@@ -863,10 +863,10 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         if (test_bit(IPOIB_STOP_NEIGH_GC, &priv->flags))
                 return;
 
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -883,16 +883,14 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* was the neigh idle for two GC periods */
                         if (time_after(neigh_obsolete, neigh->alive)) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from path/mc list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -902,7 +900,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         }
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_reap_neigh(struct work_struct *work)
@@ -947,10 +945,8 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         struct ipoib_neigh *neigh;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
         if (!htbl) {
                 neigh = NULL;
                 goto out_unlock;
@@ -961,10 +957,10 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
          */
         hash_val = ipoib_addr_hash(htbl, daddr);
         for (neigh = rcu_dereference_protected(htbl->buckets[hash_val],
-                                               lockdep_is_held(&ntbl->rwlock));
+                                               lockdep_is_held(&priv->lock));
              neigh != NULL;
              neigh = rcu_dereference_protected(neigh->hnext,
-                                               lockdep_is_held(&ntbl->rwlock))) {
+                                               lockdep_is_held(&priv->lock))) {
                 if (memcmp(daddr, neigh->daddr, INFINIBAND_ALEN) == 0) {
                         /* found, take one ref on behalf of the caller */
                         if (!atomic_inc_not_zero(&neigh->refcnt)) {
@@ -987,12 +983,11 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         /* put in hash */
         rcu_assign_pointer(neigh->hnext,
                            rcu_dereference_protected(htbl->buckets[hash_val],
-                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                     lockdep_is_held(&priv->lock)));
         rcu_assign_pointer(htbl->buckets[hash_val], neigh);
         atomic_inc(&ntbl->entries);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
 
         return neigh;
 }
@@ -1040,35 +1035,29 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
         struct ipoib_neigh *n;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
-                goto out_unlock;
+                return;
 
         hash_val = ipoib_addr_hash(htbl, neigh->daddr);
         np = &htbl->buckets[hash_val];
         for (n = rcu_dereference_protected(*np,
-                                            lockdep_is_held(&ntbl->rwlock));
+                                            lockdep_is_held(&priv->lock));
              n != NULL;
              n = rcu_dereference_protected(*np,
-                                        lockdep_is_held(&ntbl->rwlock))) {
+                                        lockdep_is_held(&priv->lock))) {
                 if (n == neigh) {
                         /* found */
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
-                        goto out_unlock;
+                        return;
                 } else {
                         np = &n->hnext;
                 }
         }
-
-out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
-
 }
 
 static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
@@ -1080,7 +1069,6 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
 
         clear_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
         ntbl->htbl = NULL;
-        rwlock_init(&ntbl->rwlock);
         htbl = kzalloc(sizeof(*htbl), GFP_KERNEL);
         if (!htbl)
                 return -ENOMEM;
@@ -1095,6 +1083,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
         htbl->mask = (size - 1);
         htbl->buckets = buckets;
         ntbl->htbl = htbl;
+        htbl->ntbl = ntbl;
         atomic_set(&ntbl->entries, 0);
 
         /* start garbage collection */
@@ -1111,9 +1100,11 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
                                                     struct ipoib_neigh_hash,
                                                     rcu);
         struct ipoib_neigh __rcu **buckets = htbl->buckets;
+        struct ipoib_neigh_table *ntbl = htbl->ntbl;
 
         kfree(buckets);
         kfree(htbl);
+        complete(&ntbl->deleted);
 }
 
 void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
@@ -1125,10 +1116,10 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
         int i;
 
         /* remove all neigh connected to a given path or mcast */
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -1138,16 +1129,14 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* delete neighs belong to this parent */
                         if (!memcmp(gid, neigh->daddr + 4, sizeof (union ib_gid))) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from parent list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -1156,7 +1145,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 }
         }
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
@@ -1164,37 +1153,44 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
         struct ipoib_neigh_table *ntbl = &priv->ntbl;
         struct ipoib_neigh_hash *htbl;
         unsigned long flags;
-        int i;
+        int i, wait_flushed = 0;
 
-        write_lock_bh(&ntbl->rwlock);
+        init_completion(&priv->ntbl.flushed);
+
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
                 goto out_unlock;
 
+        wait_flushed = atomic_read(&priv->ntbl.entries);
+        if (!wait_flushed)
+                goto free_htbl;
+
         for (i = 0; i < htbl->size; i++) {
                 struct ipoib_neigh *neigh;
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                       lockdep_is_held(&priv->lock))) != NULL) {
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         /* remove from path/mc list */
-                        spin_lock_irqsave(&priv->lock, flags);
                         list_del(&neigh->list);
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                 }
         }
 
+free_htbl:
         rcu_assign_pointer(ntbl->htbl, NULL);
         call_rcu(&htbl->rcu, neigh_hash_free_rcu);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        if (wait_flushed)
+                wait_for_completion(&priv->ntbl.flushed);
 }
 
 static void ipoib_neigh_hash_uninit(struct net_device *dev)
@@ -1203,7 +1199,7 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         int stopped;
 
         ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
-        init_completion(&priv->ntbl.flushed);
+        init_completion(&priv->ntbl.deleted);
         set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
 
         /* Stop GC if called at init fail need to cancel work */
@@ -1211,10 +1207,9 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         if (!stopped)
                 cancel_delayed_work(&priv->neigh_reap_task);
 
-        if (atomic_read(&priv->ntbl.entries)) {
-                ipoib_flush_neighs(priv);
-                wait_for_completion(&priv->ntbl.flushed);
-        }
+        ipoib_flush_neighs(priv);
+
+        wait_for_completion(&priv->ntbl.deleted);
 }
 
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 13f4aa7593c8..75367249f447 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -707,9 +707,7 @@ out:
                 neigh = ipoib_neigh_get(dev, daddr);
                 spin_lock_irqsave(&priv->lock, flags);
                 if (!neigh) {
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         neigh = ipoib_neigh_alloc(daddr, dev);
-                        spin_lock_irqsave(&priv->lock, flags);
                         if (neigh) {
                                 kref_get(&mcast->ah->ref);
                                 neigh->ah       = mcast->ah;
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index daf417923661..31d02649be41 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -227,9 +227,10 @@ int mlx4_UNMAP_ICM_AUX(struct mlx4_dev *dev)
                         MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 }
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
+        u32 i = (obj & (table->num_obj - 1)) /
+                        (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
         int ret = 0;
 
         mutex_lock(&table->mutex);
@@ -262,16 +263,18 @@ out:
         return ret;
 }
 
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i;
+        u32 i;
+        u64 offset;
 
         i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
 
         mutex_lock(&table->mutex);
 
         if (--table->icm[i]->refcount == 0) {
-                mlx4_UNMAP_ICM(dev, table->virt + i * MLX4_TABLE_CHUNK_SIZE,
+                offset = (u64) i * MLX4_TABLE_CHUNK_SIZE;
+                mlx4_UNMAP_ICM(dev, table->virt + offset,
                                MLX4_TABLE_CHUNK_SIZE / MLX4_ICM_PAGE_SIZE);
                 mlx4_free_icm(dev, table->icm[i], table->coherent);
                 table->icm[i] = NULL;
@@ -280,9 +283,11 @@ void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
         mutex_unlock(&table->mutex);
 }
 
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle)
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+                        dma_addr_t *dma_handle)
 {
-        int idx, offset, dma_offset, i;
+        int offset, dma_offset, i;
+        u64 idx;
         struct mlx4_icm_chunk *chunk;
         struct mlx4_icm *icm;
         struct page *page = NULL;
@@ -292,7 +297,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_han
 
         mutex_lock(&table->mutex);
 
-        idx = (obj & (table->num_obj - 1)) * table->obj_size;
+        idx = (u64) (obj & (table->num_obj - 1)) * table->obj_size;
         icm = table->icm[idx / MLX4_TABLE_CHUNK_SIZE];
         dma_offset = offset = idx % MLX4_TABLE_CHUNK_SIZE;
 
@@ -326,10 +331,11 @@ out:
 }
 
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end)
+                         u32 start, u32 end)
 {
         int inc = MLX4_TABLE_CHUNK_SIZE / table->obj_size;
-        int i, err;
+        int err;
+        u32 i;
 
         for (i = start; i <= end; i += inc) {
                 err = mlx4_table_get(dev, table, i);
@@ -349,9 +355,9 @@ fail:
 }
 
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end)
+                          u32 start, u32 end)
 {
-        int i;
+        u32 i;
 
         for (i = start; i <= end; i += MLX4_TABLE_CHUNK_SIZE / table->obj_size)
                 mlx4_table_put(dev, table, i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index a67744f53506..dee67fa39107 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -71,17 +71,17 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                                 gfp_t gfp_mask, int coherent);
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent);
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end);
+                         u32 start, u32 end);
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end);
+                          u32 start, u32 end);
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                         u64 virt, int obj_size, u32 nobj, int reserved,
                         int use_lowmem, int use_coherent);
 void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table);
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle);
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, dma_addr_t *dma_handle);
 
 static inline void mlx4_icm_first(struct mlx4_icm *icm,
                                   struct mlx4_icm_iter *iter)
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index c5d06fe83bba..9277d945bf48 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        /* ensure interrupts are disabled, bootloaders can be strange */
+        ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
+        if (ret < 0)
+                dev_warn(&pdev->dev, "unable to disable interrupt\n");
+
         /* init cached IRQ enable bits */
         ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
         if (ret < 0)
diff --git a/fs/dcache.c b/fs/dcache.c
index 8086636bf796..16521a9f2038 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
          * Inform try_to_ascend() that we are no longer attached to the
          * dentry tree
          */
-        dentry->d_flags |= DCACHE_DISCONNECTED;
+        dentry->d_flags |= DCACHE_DENTRY_KILLED;
         if (parent)
                 spin_unlock(&parent->d_lock);
         dentry_iput(dentry);
@@ -1048,7 +1048,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq
          * or deletion
          */
         if (new != old->d_parent ||
-                 (old->d_flags & DCACHE_DISCONNECTED) ||
+                 (old->d_flags & DCACHE_DENTRY_KILLED) ||
                  (!locked && read_seqretry(&rename_lock, seq))) {
                 spin_unlock(&new->d_lock);
                 new = NULL;
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index dfafeb2b05a0..eb7cc91b7258 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
 
         err = ERR_PTR(-ENOMEM);
         inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
-        if (h)
-                sysctl_head_finish(h);
-
         if (!inode)
                 goto out;
 
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
         d_add(dentry, inode);
 
 out:
+        if (h)
+                sysctl_head_finish(h);
         sysctl_head_finish(head);
         return err;
 }
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 2f4079175afb..934bc34d5f99 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -49,6 +49,13 @@
 #endif
 #endif
 
+#if __GNUC_MINOR__ >= 6
+/*
+ * Tell the optimizer that something else uses this function or variable.
+ */
+#define __visible __attribute__((externally_visible))
+#endif
+
 #if __GNUC_MINOR__ > 0
 #define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 923d093c9cea..f430e4162f41 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -278,6 +278,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 # define __section(S) __attribute__ ((__section__(#S)))
 #endif
 
+#ifndef __visible
+#define __visible
+#endif
+
 /* Are two types/vars the same type (ignoring qualifiers)? */
 #ifndef __same_type
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index caa34e50537e..59200795482e 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -206,6 +206,8 @@ struct dentry_operations {
 #define DCACHE_MANAGED_DENTRY \
         (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
 
+#define DCACHE_DENTRY_KILLED    0x100000
+
 extern seqlock_t rename_lock;
 
 static inline int dname_external(struct dentry *dentry)
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 1ac7f6e405f9..ff9a9f8e0ed9 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -19,7 +19,7 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
 
-#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
+#define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)
 
 struct memory_block {
         unsigned long start_section_nr;
diff --git a/include/net/sock.h b/include/net/sock.h
index 72132aef53fc..adb7da20b5a1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1332,7 +1332,7 @@ static inline bool sk_wmem_schedule(struct sock *sk, int size)
 }
 
 static inline bool
-sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, unsigned int size)
+sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size)
 {
         if (!sk_has_account(sk))
                 return true;
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index b3c7fd554250..6144bab8fd8e 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -232,15 +232,19 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write,
          */
 
         tmp.data = &current->nsproxy->pid_ns->last_pid;
-        return proc_dointvec(&tmp, write, buffer, lenp, ppos);
+        return proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 }
 
+extern int pid_max;
+static int zero = 0;
 static struct ctl_table pid_ns_ctl_table[] = {
         {
                 .procname = "ns_last_pid",
                 .maxlen = sizeof(int),
                 .mode = 0666, /* permissions are checked in the handler */
                 .proc_handler = pid_ns_ctl_handler,
+                .extra1 = &zero,
+                .extra2 = &pid_max,
         },
         { }
 };
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1e1373bcb3e3..b80065a2450a 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1349,8 +1349,16 @@ static void busy_worker_rebind_fn(struct work_struct *work)
         struct worker *worker = container_of(work, struct worker, rebind_work);
         struct global_cwq *gcwq = worker->pool->gcwq;
 
-        if (worker_maybe_bind_and_lock(worker))
-                worker_clr_flags(worker, WORKER_REBIND);
+        worker_maybe_bind_and_lock(worker);
+
+        /*
+         * %WORKER_REBIND must be cleared even if the above binding failed;
+         * otherwise, we may confuse the next CPU_UP cycle or oops / get
+         * stuck by calling idle_worker_rebind() prematurely.  If CPU went
+         * down again inbetween, %WORKER_UNBOUND would be set, so clearing
+         * %WORKER_REBIND is always safe.
+         */
+        worker_clr_flags(worker, WORKER_REBIND);
 
         spin_unlock_irq(&gcwq->lock);
 }
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 3ad25f9d1fc1..6a5b90d0cfd7 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -126,9 +126,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)
         struct mem_section *ms;
         struct page *page, *memmap;
 
-        if (!pfn_valid(start_pfn))
-                return;
-
         section_nr = pfn_to_section_nr(start_pfn);
         ms = __nr_to_section(section_nr);
 
@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat)
         end_pfn = pfn + pgdat->node_spanned_pages;
 
         /* register_section info */
-        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
-                register_page_bootmem_info_section(pfn);
-
+        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
+                /*
+                 * Some platforms can assign the same pfn to multiple nodes - on
+                 * node0 as well as nodeN.  To avoid registering a pfn against
+                 * multiple nodes we check that this pfn does not already
+                 * reside in some other node.
+                 */
+                if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
+                        register_page_bootmem_info_section(pfn);
+        }
 }
 #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c66fb875104a..c13ea7538891 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -584,7 +584,7 @@ static inline void __free_one_page(struct page *page,
                 combined_idx = buddy_idx & page_idx;
                 higher_page = page + (combined_idx - page_idx);
                 buddy_idx = __find_buddy_index(combined_idx, order + 1);
-                higher_buddy = page + (buddy_idx - combined_idx);
+                higher_buddy = higher_page + (buddy_idx - combined_idx);
                 if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
                         list_add_tail(&page->lru,
                                 &zone->free_area[order].free_list[migratetype]);
diff --git a/mm/slab.c b/mm/slab.c
index 811af03a14ef..c6854759bcf1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -983,7 +983,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                 }
 
                 /* The caller cannot use PFMEMALLOC objects, find another one */
-                for (i = 1; i < ac->avail; i++) {
+                for (i = 0; i < ac->avail; i++) {
                         /* If a !PFMEMALLOC object is found, swap them */
                         if (!is_obj_pfmemalloc(ac->entry[i])) {
                                 objp = ac->entry[i];
@@ -1000,7 +1000,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                 l3 = cachep->nodelists[numa_mem_id()];
                 if (!list_empty(&l3->slabs_free) && force_refill) {
                         struct slab *slabp = virt_to_slab(objp);
-                        ClearPageSlabPfmemalloc(virt_to_page(slabp->s_mem));
+                        ClearPageSlabPfmemalloc(virt_to_head_page(slabp->s_mem));
                         clear_obj_pfmemalloc(&objp);
                         recheck_pfmemalloc_active(cachep, ac);
                         return objp;
@@ -1032,7 +1032,7 @@ static void *__ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac,
 {
         if (unlikely(pfmemalloc_active)) {
                 /* Some pfmemalloc slabs exist, check if this is one */
-                struct page *page = virt_to_page(objp);
+                struct page *page = virt_to_head_page(objp);
                 if (PageSlabPfmemalloc(page))
                         set_obj_pfmemalloc(&objp);
         }
diff --git a/mm/slub.c b/mm/slub.c
index 8f78e2577031..2fdd96f9e998 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1524,12 +1524,13 @@ static inline void *acquire_slab(struct kmem_cache *s,
 }
 
 static int put_cpu_partial(struct kmem_cache *s, struct page *page, int drain);
+static inline bool pfmemalloc_match(struct page *page, gfp_t gfpflags);
 
 /*
  * Try to allocate a partial slab from a specific node.
  */
-static void *get_partial_node(struct kmem_cache *s,
-                struct kmem_cache_node *n, struct kmem_cache_cpu *c)
+static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
+                                struct kmem_cache_cpu *c, gfp_t flags)
 {
         struct page *page, *page2;
         void *object = NULL;
@@ -1545,9 +1546,13 @@ static void *get_partial_node(struct kmem_cache *s,
 
         spin_lock(&n->list_lock);
         list_for_each_entry_safe(page, page2, &n->partial, lru) {
-                void *t = acquire_slab(s, n, page, object == NULL);
+                void *t;
                 int available;
 
+                if (!pfmemalloc_match(page, flags))
+                        continue;
+
+                t = acquire_slab(s, n, page, object == NULL);
                 if (!t)
                         break;
 
@@ -1614,7 +1619,7 @@ static void *get_any_partial(struct kmem_cache *s, gfp_t flags,
 
                         if (n && cpuset_zone_allowed_hardwall(zone, flags) &&
                                         n->nr_partial > s->min_partial) {
-                                object = get_partial_node(s, n, c);
+                                object = get_partial_node(s, n, c, flags);
                                 if (object) {
                                         /*
                                          * Return the object even if
@@ -1643,7 +1648,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
         void *object;
         int searchnode = (node == NUMA_NO_NODE) ? numa_node_id() : node;
 
-        object = get_partial_node(s, get_node(s, searchnode), c);
+        object = get_partial_node(s, get_node(s, searchnode), c, flags);
         if (object || node != NUMA_NO_NODE)
                 return object;
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8d01243d9560..99b434b674c0 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3102,6 +3102,7 @@ int kswapd_run(int nid)
                 /* failure at boot is fatal */
                 BUG_ON(system_state == SYSTEM_BOOTING);
                 printk("Failed to start kswapd on node %d\n",nid);
+                pgdat->kswapd = NULL;
                 ret = -1;
         }
         return ret;