239 files changed, 4513 insertions, 1789 deletions
diff --git a/CREDITS b/CREDITS
index 07e32a87d956..44fce988eaac 100644
--- a/CREDITS
+++ b/CREDITS
@@ -688,10 +688,13 @@ S: Oxfordshire, UK.
 N: Kees Cook
 E: kees@outflux.net
-W: http://outflux.net/
+E: kees@ubuntu.com
-P: 1024D/17063E6D 9FA3 C49C 23C9 D1BC 2E30  1975 1FFF 4BA9 1706 3E6D
+E: keescook@chromium.org
-D: Minor updates to SCSI types, added /proc/pid/maps protection
+W: http://outflux.net/blog/
+P: 4096R/DC6DC026 A5C3 F68F 229D D60F 723E  6E13 8972 F4DF DC6D C026
+D: Various security things, bug fixes, and documentation.
 S: (ask for current address)
+S: Portland, Oregon
 S: USA
 N: Robin Cornelius
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index a0c5c5f4fce6..22152ed148a5 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -315,12 +315,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        CPU-intensive style benchmark, and it can vary highly in
                        a microbenchmark depending on workload and compiler.
-                        1: only for 32-bit processes
+                        32: only for 32-bit processes
-                        2: only for 64-bit processes
+                        64: only for 64-bit processes
                        on: enable for both 32- and 64-bit processes
                        off: disable for both 32- and 64-bit processes
-        amd_iommu=      [HW,X86-84]
+        amd_iommu=      [HW,X86-64]
                        Pass parameters to the AMD IOMMU driver in the system.
                        Possible values are:
                        fullflush - enable flushing of IO/TLB entries when
@@ -329,6 +329,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                    is a lot of faster
                        off       - do not initialize any AMD IOMMU found in
                                    the system
+                        force_isolation - Force device isolation for all
+                                          devices. The IOMMU driver is not
+                                          allowed anymore to lift isolation
+                                          requirements as needed. This option
+                                          does not override iommu=pt
        amijoy.map=     [HW,JOY] Amiga joystick support
                        Map of devices attached to JOY0DAT and JOY1DAT
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index f049a1ca186f..589f2da5d545 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -282,11 +282,11 @@ tcp_max_ssthresh - INTEGER
        Default: 0 (off)
 tcp_max_syn_backlog - INTEGER
-        Maximal number of remembered connection requests, which are
+        Maximal number of remembered connection requests, which have not
-        still did not receive an acknowledgment from connecting client.
+        received an acknowledgment from connecting client.
-        Default value is 1024 for systems with more than 128Mb of memory,
+        The minimal value is 128 for low memory machines, and it will
-        and 128 for low memory machines. If server suffers of overload,
+        increase in proportion to the memory of machine.
-        try to increase this number.
+        If server suffers from overload, try increasing this number.
 tcp_max_tw_buckets - INTEGER
        Maximal number of timewait sockets held by system simultaneously.
diff --git a/Documentation/sound/alsa/soc/machine.txt b/Documentation/sound/alsa/soc/machine.txt
index 3e2ec9cbf397..d50c14df3411 100644
--- a/Documentation/sound/alsa/soc/machine.txt
+++ b/Documentation/sound/alsa/soc/machine.txt
@@ -50,8 +50,7 @@ Machine DAI Configuration
 The machine DAI configuration glues all the codec and CPU DAIs together. It can
 also be used to set up the DAI system clock and for any machine related DAI
 initialisation e.g. the machine audio map can be connected to the codec audio
-map, unconnected codec pins can be set as such. Please see corgi.c, spitz.c
+map, unconnected codec pins can be set as such.
-for examples.
 struct snd_soc_dai_link is used to set up each DAI in your machine. e.g.
@@ -83,8 +82,7 @@ Machine Power Map
 The machine driver can optionally extend the codec power map and to become an
 audio power map of the audio subsystem. This allows for automatic power up/down
 of speaker/HP amplifiers, etc. Codec pins can be connected to the machines jack
-sockets in the machine init function. See soc/pxa/spitz.c and dapm.txt for
+sockets in the machine init function.
-details.
 Machine Controls
diff --git a/MAINTAINERS b/MAINTAINERS
index 447560284996..b9db108f01c8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -511,8 +511,8 @@ M:	Joerg Roedel <joerg.roedel@amd.com>
 L:      iommu@lists.linux-foundation.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu.git
 S:      Supported
-F:      arch/x86/kernel/amd_iommu*.c
+F:      drivers/iommu/amd_iommu*.[ch]
-F:      arch/x86/include/asm/amd_iommu*.h
+F:      include/linux/amd-iommu.h
 AMD MICROCODE UPDATE SUPPORT
 M:      Andreas Herrmann <andreas.herrmann3@amd.com>
@@ -1054,35 +1054,18 @@ ARM/SAMSUNG ARM ARCHITECTURES
 M:      Ben Dooks <ben-linux@fluff.org>
 M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 W:      http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
 F:      arch/arm/plat-s5p/
+F:      arch/arm/mach-s3c24*/
+F:      arch/arm/mach-s3c64xx/
 F:      drivers/*/*s3c2410*
 F:      drivers/*/*/*s3c2410*
+F:      drivers/spi/spi-s3c*
-ARM/S3C2410 ARM ARCHITECTURE
+F:      sound/soc/samsung/*
-M:      Ben Dooks <ben-linux@fluff.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-W:      http://www.fluff.org/ben/linux/
-S:      Maintained
-F:      arch/arm/mach-s3c2410/
-ARM/S3C244x ARM ARCHITECTURE
-M:      Ben Dooks <ben-linux@fluff.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-W:      http://www.fluff.org/ben/linux/
-S:      Maintained
-F:      arch/arm/mach-s3c2440/
-F:      arch/arm/mach-s3c2443/
-ARM/S3C64xx ARM ARCHITECTURE
-M:      Ben Dooks <ben-linux@fluff.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-W:      http://www.fluff.org/ben/linux/
-S:      Maintained
-F:      arch/arm/mach-s3c64xx/
 ARM/S5P EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene.kim@samsung.com>
@@ -4319,8 +4302,9 @@ F:	include/linux/mm.h
 F:      mm/
 MEMORY RESOURCE CONTROLLER
+M:      Johannes Weiner <hannes@cmpxchg.org>
+M:      Michal Hocko <mhocko@suse.cz>
 M:      Balbir Singh <bsingharora@gmail.com>
-M:      Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
 M:      KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
diff --git a/Makefile b/Makefile
index 12aafc20efbd..d1ea73f74c2f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/arm/configs/omap1_defconfig b/arch/arm/configs/omap1_defconfig
index a7e777581378..945a34f2a34d 100644
--- a/arch/arm/configs/omap1_defconfig
+++ b/arch/arm/configs/omap1_defconfig
@@ -48,12 +48,7 @@ CONFIG_MACH_SX1=y
 CONFIG_MACH_NOKIA770=y
 CONFIG_MACH_AMS_DELTA=y
 CONFIG_MACH_OMAP_GENERIC=y
-CONFIG_OMAP_ARM_216MHZ=y
-CONFIG_OMAP_ARM_195MHZ=y
-CONFIG_OMAP_ARM_192MHZ=y
 CONFIG_OMAP_ARM_182MHZ=y
-CONFIG_OMAP_ARM_168MHZ=y
-# CONFIG_OMAP_ARM_60MHZ is not set
 # CONFIG_ARM_THUMB is not set
 CONFIG_PCCARD=y
 CONFIG_OMAP_CF=y
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index c475379199b1..8e9c98edc068 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -353,15 +353,15 @@ validate_group(struct perf_event *event)
        fake_pmu.used_mask = fake_used_mask;
        if (!validate_event(&fake_pmu, leader))
-                return -ENOSPC;
+                return -EINVAL;
        list_for_each_entry(sibling, &leader->sibling_list, group_entry) {
                if (!validate_event(&fake_pmu, sibling))
-                        return -ENOSPC;
+                        return -EINVAL;
        }
        if (!validate_event(&fake_pmu, event))
-                return -ENOSPC;
+                return -EINVAL;
        return 0;
 }
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index 66591fa53e05..ad930688358c 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -83,7 +83,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
 *  USB Device (Gadget)
 * -------------------------------------------------------------------- */
-#ifdef CONFIG_USB_GADGET_AT91
+#ifdef CONFIG_USB_AT91
 static struct at91_udc_data udc_data;
 static struct resource udc_resources[] = {
diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
index b84a9f642f59..0d20677fbef0 100644
--- a/arch/arm/mach-at91/at91sam9260.c
+++ b/arch/arm/mach-at91/at91sam9260.c
@@ -195,9 +195,9 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("t0_clk", "atmel_tcb.0", &tc0_clk),
        CLKDEV_CON_DEV_ID("t1_clk", "atmel_tcb.0", &tc1_clk),
        CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.0", &tc2_clk),
-        CLKDEV_CON_DEV_ID("t3_clk", "atmel_tcb.1", &tc3_clk),
+        CLKDEV_CON_DEV_ID("t0_clk", "atmel_tcb.1", &tc3_clk),
-        CLKDEV_CON_DEV_ID("t4_clk", "atmel_tcb.1", &tc4_clk),
+        CLKDEV_CON_DEV_ID("t1_clk", "atmel_tcb.1", &tc4_clk),
-        CLKDEV_CON_DEV_ID("t5_clk", "atmel_tcb.1", &tc5_clk),
+        CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.1", &tc5_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc_clk),
        /* more usart lookup table for DT entries */
        CLKDEV_CON_DEV_ID("usart", "fffff200.serial", &mck),
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index 25e3464fb07f..629fa9774972 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -84,7 +84,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
 *  USB Device (Gadget)
 * -------------------------------------------------------------------- */
-#ifdef CONFIG_USB_GADGET_AT91
+#ifdef CONFIG_USB_AT91
 static struct at91_udc_data udc_data;
 static struct resource udc_resources[] = {
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index ae78f4d03b73..a178b58b0b9c 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -87,7 +87,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
 *  USB Device (Gadget)
 * -------------------------------------------------------------------- */
-#ifdef CONFIG_USB_GADGET_AT91
+#ifdef CONFIG_USB_AT91
 static struct at91_udc_data udc_data;
 static struct resource udc_resources[] = {
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index ad017eb1f8df..d5fbac9ff4fa 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -92,7 +92,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
 *  USB Device (Gadget)
 * -------------------------------------------------------------------- */
-#ifdef CONFIG_USB_GADGET_AT91
+#ifdef CONFIG_USB_AT91
 static struct at91_udc_data udc_data;
 static struct resource udc_resources[] = {
diff --git a/arch/arm/mach-at91/include/mach/system_rev.h b/arch/arm/mach-at91/include/mach/system_rev.h
index 8f4866045b41..ec164a4124c9 100644
--- a/arch/arm/mach-at91/include/mach/system_rev.h
+++ b/arch/arm/mach-at91/include/mach/system_rev.h
@@ -19,7 +19,7 @@
 #define BOARD_HAVE_NAND_16BIT   (1 << 31)
 static inline int board_have_nand_16bit(void)
 {
-        return system_rev & BOARD_HAVE_NAND_16BIT;
+        return (system_rev & BOARD_HAVE_NAND_16BIT) ? 1 : 0;
 }
 #endif /* __ARCH_SYSTEM_REV_H__ */
diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
index 1d7d24995226..6659a90dbcad 100644
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -753,7 +753,7 @@ static struct snd_platform_data da850_evm_snd_data = {
        .num_serializer = ARRAY_SIZE(da850_iis_serializer_direction),
        .tdm_slots      = 2,
        .serial_dir     = da850_iis_serializer_direction,
-        .asp_chan_q     = EVENTQ_1,
+        .asp_chan_q     = EVENTQ_0,
        .version        = MCASP_VERSION_2,
        .txnumevt       = 1,
        .rxnumevt       = 1,
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index 1918ae711428..46e1f4173b97 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -107,7 +107,7 @@ static struct mtd_partition davinci_nand_partitions[] = {
                /* UBL (a few copies) plus U-Boot */
                .name           = "bootloader",
                .offset         = 0,
-                .size           = 28 * NAND_BLOCK_SIZE,
+                .size           = 30 * NAND_BLOCK_SIZE,
                .mask_flags     = MTD_WRITEABLE, /* force read-only */
        }, {
                /* U-Boot environment */
diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
index e574d7f837a8..635bf7740157 100644
--- a/arch/arm/mach-davinci/board-dm646x-evm.c
+++ b/arch/arm/mach-davinci/board-dm646x-evm.c
@@ -564,7 +564,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
        int val;
        u32 value;
-        if (!vpif_vsclkdis_reg || !cpld_client)
+        if (!vpif_vidclkctl_reg || !cpld_client)
                return -ENXIO;
        val = i2c_smbus_read_byte(cpld_client);
@@ -572,7 +572,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
                return val;
        spin_lock_irqsave(&vpif_reg_lock, flags);
-        value = __raw_readl(vpif_vsclkdis_reg);
+        value = __raw_readl(vpif_vidclkctl_reg);
        if (mux_mode) {
                val &= VPIF_INPUT_TWO_CHANNEL;
                value |= VIDCH1CLK;
@@ -580,7 +580,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
                val |= VPIF_INPUT_ONE_CHANNEL;
                value &= ~VIDCH1CLK;
        }
-        __raw_writel(value, vpif_vsclkdis_reg);
+        __raw_writel(value, vpif_vidclkctl_reg);
        spin_unlock_irqrestore(&vpif_reg_lock, flags);
        err = i2c_smbus_write_byte(cpld_client, val);
diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
index 0b68ed534f8e..af27c130595f 100644
--- a/arch/arm/mach-davinci/dm646x.c
+++ b/arch/arm/mach-davinci/dm646x.c
@@ -161,7 +161,6 @@ static struct clk dsp_clk = {
        .name = "dsp",
        .parent = &pll1_sysclk1,
        .lpsc = DM646X_LPSC_C64X_CPU,
-        .flags = PSC_DSP,
        .usecount = 1,                  /* REVISIT how to disable? */
 };
diff --git a/arch/arm/mach-davinci/include/mach/psc.h b/arch/arm/mach-davinci/include/mach/psc.h
index fa59c097223d..8bc3fc256171 100644
--- a/arch/arm/mach-davinci/include/mach/psc.h
+++ b/arch/arm/mach-davinci/include/mach/psc.h
@@ -233,7 +233,7 @@
 #define PTCMD           0x120
 #define PTSTAT          0x128
 #define PDSTAT          0x200
-#define PDCTL1          0x304
+#define PDCTL           0x300
 #define MDSTAT          0x800
 #define MDCTL           0xA00
@@ -244,7 +244,10 @@
 #define PSC_STATE_ENABLE        3
 #define MDSTAT_STATE_MASK       0x3f
+#define PDSTAT_STATE_MASK       0x1f
 #define MDCTL_FORCE             BIT(31)
+#define PDCTL_NEXT              BIT(1)
+#define PDCTL_EPCGOOD           BIT(8)
 #ifndef __ASSEMBLER__
diff --git a/arch/arm/mach-davinci/psc.c b/arch/arm/mach-davinci/psc.c
index 1fb6bdff38c1..d7e210f4b55c 100644
--- a/arch/arm/mach-davinci/psc.c
+++ b/arch/arm/mach-davinci/psc.c
@@ -52,7 +52,7 @@ int __init davinci_psc_is_clk_active(unsigned int ctlr, unsigned int id)
 void davinci_psc_config(unsigned int domain, unsigned int ctlr,
                unsigned int id, bool enable, u32 flags)
 {
-        u32 epcpr, ptcmd, ptstat, pdstat, pdctl1, mdstat, mdctl;
+        u32 epcpr, ptcmd, ptstat, pdstat, pdctl, mdstat, mdctl;
        void __iomem *psc_base;
        struct davinci_soc_info *soc_info = &davinci_soc_info;
        u32 next_state = PSC_STATE_ENABLE;
@@ -79,11 +79,11 @@ void davinci_psc_config(unsigned int domain, unsigned int ctlr,
                mdctl |= MDCTL_FORCE;
        __raw_writel(mdctl, psc_base + MDCTL + 4 * id);
-        pdstat = __raw_readl(psc_base + PDSTAT);
+        pdstat = __raw_readl(psc_base + PDSTAT + 4 * domain);
-        if ((pdstat & 0x00000001) == 0) {
+        if ((pdstat & PDSTAT_STATE_MASK) == 0) {
-                pdctl1 = __raw_readl(psc_base + PDCTL1);
+                pdctl = __raw_readl(psc_base + PDCTL + 4 * domain);
-                pdctl1 |= 0x1;
+                pdctl |= PDCTL_NEXT;
-                __raw_writel(pdctl1, psc_base + PDCTL1);
+                __raw_writel(pdctl, psc_base + PDCTL + 4 * domain);
                ptcmd = 1 << domain;
                __raw_writel(ptcmd, psc_base + PTCMD);
@@ -92,9 +92,9 @@ void davinci_psc_config(unsigned int domain, unsigned int ctlr,
                        epcpr = __raw_readl(psc_base + EPCPR);
                } while ((((epcpr >> domain) & 1) == 0));
-                pdctl1 = __raw_readl(psc_base + PDCTL1);
+                pdctl = __raw_readl(psc_base + PDCTL + 4 * domain);
-                pdctl1 |= 0x100;
+                pdctl |= PDCTL_EPCGOOD;
-                __raw_writel(pdctl1, psc_base + PDCTL1);
+                __raw_writel(pdctl, psc_base + PDCTL + 4 * domain);
        } else {
                ptcmd = 1 << domain;
                __raw_writel(ptcmd, psc_base + PTCMD);
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 9cd860a27af5..8deb012189b5 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -37,14 +37,15 @@ static void __init imx6q_map_io(void)
        imx6q_clock_map_io();
 }
-static void __init imx6q_gpio_add_irq_domain(struct device_node *np,
+static int __init imx6q_gpio_add_irq_domain(struct device_node *np,
                                struct device_node *interrupt_parent)
 {
-        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS -
+        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS;
-                                   32 * 7; /* imx6q gets 7 gpio ports */
+        gpio_irq_base -= 32;
        irq_domain_add_simple(np, gpio_irq_base);
-        gpio_irq_base += 32;
+        return 0;
 }
 static const struct of_device_id imx6q_irq_match[] __initconst = {
diff --git a/arch/arm/mach-msm/devices-iommu.c b/arch/arm/mach-msm/devices-iommu.c
index 24030d0da6e3..0fb7a17df398 100644
--- a/arch/arm/mach-msm/devices-iommu.c
+++ b/arch/arm/mach-msm/devices-iommu.c
@@ -18,6 +18,7 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/bootmem.h>
+#include <linux/module.h>
 #include <mach/irqs.h>
 #include <mach/iommu.h>
diff --git a/arch/arm/mach-mx5/imx51-dt.c b/arch/arm/mach-mx5/imx51-dt.c
index ccc61585659b..596edd967dbf 100644
--- a/arch/arm/mach-mx5/imx51-dt.c
+++ b/arch/arm/mach-mx5/imx51-dt.c
@@ -44,20 +44,22 @@ static const struct of_dev_auxdata imx51_auxdata_lookup[] __initconst = {
        { /* sentinel */ }
 };
-static void __init imx51_tzic_add_irq_domain(struct device_node *np,
+static int __init imx51_tzic_add_irq_domain(struct device_node *np,
                                struct device_node *interrupt_parent)
 {
        irq_domain_add_simple(np, 0);
+        return 0;
 }
-static void __init imx51_gpio_add_irq_domain(struct device_node *np,
+static int __init imx51_gpio_add_irq_domain(struct device_node *np,
                                struct device_node *interrupt_parent)
 {
-        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS -
+        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS;
-                                   32 * 4; /* imx51 gets 4 gpio ports */
+        gpio_irq_base -= 32;
        irq_domain_add_simple(np, gpio_irq_base);
-        gpio_irq_base += 32;
+        return 0;
 }
 static const struct of_device_id imx51_irq_match[] __initconst = {
diff --git a/arch/arm/mach-mx5/imx53-dt.c b/arch/arm/mach-mx5/imx53-dt.c
index ccaa0b81b768..85bfd5ff21b0 100644
--- a/arch/arm/mach-mx5/imx53-dt.c
+++ b/arch/arm/mach-mx5/imx53-dt.c
@@ -48,20 +48,22 @@ static const struct of_dev_auxdata imx53_auxdata_lookup[] __initconst = {
        { /* sentinel */ }
 };
-static void __init imx53_tzic_add_irq_domain(struct device_node *np,
+static int __init imx53_tzic_add_irq_domain(struct device_node *np,
                                struct device_node *interrupt_parent)
 {
        irq_domain_add_simple(np, 0);
+        return 0;
 }
-static void __init imx53_gpio_add_irq_domain(struct device_node *np,
+static int __init imx53_gpio_add_irq_domain(struct device_node *np,
                                struct device_node *interrupt_parent)
 {
-        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS -
+        static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS;
-                                   32 * 7; /* imx53 gets 7 gpio ports */
+        gpio_irq_base -= 32;
        irq_domain_add_simple(np, gpio_irq_base);
-        gpio_irq_base += 32;
+        return 0;
 }
 static const struct of_device_id imx53_irq_match[] __initconst = {
diff --git a/arch/arm/mach-mxs/include/mach/mx28.h b/arch/arm/mach-mxs/include/mach/mx28.h
index 75d86118b76a..30c7990f3c01 100644
--- a/arch/arm/mach-mxs/include/mach/mx28.h
+++ b/arch/arm/mach-mxs/include/mach/mx28.h
@@ -104,8 +104,8 @@
 #define MX28_INT_CAN1                   9
 #define MX28_INT_LRADC_TOUCH            10
 #define MX28_INT_HSADC                  13
-#define MX28_INT_IRADC_THRESH0          14
+#define MX28_INT_LRADC_THRESH0          14
-#define MX28_INT_IRADC_THRESH1          15
+#define MX28_INT_LRADC_THRESH1          15
 #define MX28_INT_LRADC_CH0              16
 #define MX28_INT_LRADC_CH1              17
 #define MX28_INT_LRADC_CH2              18
diff --git a/arch/arm/mach-mxs/include/mach/mxs.h b/arch/arm/mach-mxs/include/mach/mxs.h
index 0d2d2b470998..bde5f6634747 100644
--- a/arch/arm/mach-mxs/include/mach/mxs.h
+++ b/arch/arm/mach-mxs/include/mach/mxs.h
@@ -30,6 +30,7 @@
 */
 #define cpu_is_mx23()           (                                       \
                machine_is_mx23evk() ||                                 \
+                machine_is_stmp378x() ||                                \
                0)
 #define cpu_is_mx28()           (                                       \
                machine_is_mx28evk() ||                                 \
diff --git a/arch/arm/mach-mxs/mach-m28evk.c b/arch/arm/mach-mxs/mach-m28evk.c
index 3b1681e4f49a..6b00577b7025 100644
--- a/arch/arm/mach-mxs/mach-m28evk.c
+++ b/arch/arm/mach-mxs/mach-m28evk.c
@@ -361,6 +361,6 @@ static struct sys_timer m28evk_timer = {
 MACHINE_START(M28EVK, "DENX M28 EVK")
        .map_io         = mx28_map_io,
        .init_irq       = mx28_init_irq,
-        .init_machine   = m28evk_init,
        .timer          = &m28evk_timer,
+        .init_machine   = m28evk_init,
 MACHINE_END
diff --git a/arch/arm/mach-mxs/mach-stmp378x_devb.c b/arch/arm/mach-mxs/mach-stmp378x_devb.c
index 177e53123a02..6834dea38c04 100644
--- a/arch/arm/mach-mxs/mach-stmp378x_devb.c
+++ b/arch/arm/mach-mxs/mach-stmp378x_devb.c
@@ -115,6 +115,6 @@ static struct sys_timer stmp378x_dvb_timer = {
 MACHINE_START(STMP378X, "STMP378X")
        .map_io         = mx23_map_io,
        .init_irq       = mx23_init_irq,
-        .init_machine   = stmp378x_dvb_init,
        .timer          = &stmp378x_dvb_timer,
+        .init_machine   = stmp378x_dvb_init,
 MACHINE_END
diff --git a/arch/arm/mach-mxs/module-tx28.c b/arch/arm/mach-mxs/module-tx28.c
index 0fcff47009cf..9a7b08b2a925 100644
--- a/arch/arm/mach-mxs/module-tx28.c
+++ b/arch/arm/mach-mxs/module-tx28.c
@@ -66,11 +66,11 @@ static const iomux_cfg_t tx28_fec1_pads[] __initconst = {
        MX28_PAD_ENET0_CRS__ENET1_RX_EN,
 };
-static struct fec_platform_data tx28_fec0_data = {
+static const struct fec_platform_data tx28_fec0_data __initconst = {
        .phy = PHY_INTERFACE_MODE_RMII,
 };
-static struct fec_platform_data tx28_fec1_data = {
+static const struct fec_platform_data tx28_fec1_data __initconst = {
        .phy = PHY_INTERFACE_MODE_RMII,
 };
diff --git a/arch/arm/mach-omap1/clock_data.c b/arch/arm/mach-omap1/clock_data.c
index 1297bb58869c..9ff90a744a21 100644
--- a/arch/arm/mach-omap1/clock_data.c
+++ b/arch/arm/mach-omap1/clock_data.c
@@ -16,6 +16,8 @@
 #include <linux/kernel.h>
 #include <linux/clk.h>
+#include <linux/cpufreq.h>
+#include <linux/delay.h>
 #include <linux/io.h>
 #include <asm/mach-types.h>  /* for machine_is_* */
@@ -927,16 +929,22 @@ int __init omap1_clk_init(void)
 void __init omap1_clk_late_init(void)
 {
-        if (ck_dpll1.rate >= OMAP1_DPLL1_SANE_VALUE)
+        unsigned long rate = ck_dpll1.rate;
+        if (rate >= OMAP1_DPLL1_SANE_VALUE)
                return;
+        /* System booting at unusable rate, force reprogramming of DPLL1 */
+        ck_dpll1_p->rate = 0;
        /* Find the highest supported frequency and enable it */
        if (omap1_select_table_rate(&virtual_ck_mpu, ~0)) {
                pr_err("System frequencies not set, using default. Check your config.\n");
                omap_writew(0x2290, DPLL_CTL);
-                omap_writew(cpu_is_omap7xx() ? 0x3005 : 0x1005, ARM_CKCTL);
+                omap_writew(cpu_is_omap7xx() ? 0x2005 : 0x0005, ARM_CKCTL);
                ck_dpll1.rate = OMAP1_DPLL1_SANE_VALUE;
        }
        propagate_rate(&ck_dpll1);
        omap1_show_rates();
+        loops_per_jiffy = cpufreq_scale(loops_per_jiffy, rate, ck_dpll1.rate);
 }
diff --git a/arch/arm/mach-prima2/pm.c b/arch/arm/mach-prima2/pm.c
index cb53160f6c5d..26ebb57719df 100644
--- a/arch/arm/mach-prima2/pm.c
+++ b/arch/arm/mach-prima2/pm.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/suspend.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
diff --git a/arch/arm/mach-prima2/prima2.c b/arch/arm/mach-prima2/prima2.c
index ef555c041962..a12b689a8702 100644
--- a/arch/arm/mach-prima2/prima2.c
+++ b/arch/arm/mach-prima2/prima2.c
@@ -8,6 +8,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <asm/sizes.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <linux/of.h>
diff --git a/arch/arm/mach-s3c64xx/dev-spi.c b/arch/arm/mach-s3c64xx/dev-spi.c
index 5e6b42089eb4..3341fd118723 100644
--- a/arch/arm/mach-s3c64xx/dev-spi.c
+++ b/arch/arm/mach-s3c64xx/dev-spi.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/export.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <linux/gpio.h>
diff --git a/arch/arm/mach-s3c64xx/s3c6400.c b/arch/arm/mach-s3c64xx/s3c6400.c
index 7a3bc32df425..51c00f2453c6 100644
--- a/arch/arm/mach-s3c64xx/s3c6400.c
+++ b/arch/arm/mach-s3c64xx/s3c6400.c
@@ -70,7 +70,7 @@ void __init s3c6400_init_irq(void)
        s3c64xx_init_irq(~0 & ~(0xf << 5), ~0);
 }
-struct sysdev_class s3c6400_sysclass = {
+static struct sysdev_class s3c6400_sysclass = {
        .name   = "s3c6400-core",
 };
diff --git a/arch/arm/mach-s3c64xx/setup-fb-24bpp.c b/arch/arm/mach-s3c64xx/setup-fb-24bpp.c
index 83d2afb79e9f..2cf80026c58d 100644
--- a/arch/arm/mach-s3c64xx/setup-fb-24bpp.c
+++ b/arch/arm/mach-s3c64xx/setup-fb-24bpp.c
@@ -20,7 +20,7 @@
 #include <plat/fb.h>
 #include <plat/gpio-cfg.h>
-extern void s3c64xx_fb_gpio_setup_24bpp(void)
+void s3c64xx_fb_gpio_setup_24bpp(void)
 {
        s3c_gpio_cfgrange_nopull(S3C64XX_GPI(0), 16, S3C_GPIO_SFN(2));
        s3c_gpio_cfgrange_nopull(S3C64XX_GPJ(0), 12, S3C_GPIO_SFN(2));
diff --git a/arch/arm/mach-sa1100/Makefile.boot b/arch/arm/mach-sa1100/Makefile.boot
index 5a616f6e5612..f7951aa04562 100644
--- a/arch/arm/mach-sa1100/Makefile.boot
+++ b/arch/arm/mach-sa1100/Makefile.boot
@@ -1,5 +1,5 @@
-ifeq ($(CONFIG_ARCH_SA1100),y)
+ifeq ($(CONFIG_SA1111),y)
-   zreladdr-$(CONFIG_SA1111)            += 0xc0208000
+   zreladdr-y   += 0xc0208000
 else
   zreladdr-y   += 0xc0008000
 endif
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 43f984e93970..303192fc9260 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -350,10 +350,12 @@
 #define __NR_clock_adjtime      342
 #define __NR_syncfs             343
 #define __NR_setns              344
+#define __NR_process_vm_readv   345
+#define __NR_process_vm_writev  346
 #ifdef __KERNEL__
-#define NR_syscalls             345
+#define NR_syscalls             347
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index c468f2edaa85..ce827b376110 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -365,4 +365,6 @@ ENTRY(sys_call_table)
        .long sys_clock_adjtime
        .long sys_syncfs
        .long sys_setns
+        .long sys_process_vm_readv      /* 345 */
+        .long sys_process_vm_writev
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 4f2971bcf8e5..315fc0b250f8 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -623,7 +623,7 @@ static int mipspmu_event_init(struct perf_event *event)
        if (!atomic_inc_not_zero(&active_events)) {
                if (atomic_read(&active_events) > MIPS_MAX_HWEVENTS) {
                        atomic_dec(&active_events);
-                        return -ENOSPC;
+                        return -EINVAL;
                }
                mutex_lock(&pmu_reserve_mutex);
@@ -732,15 +732,15 @@ static int validate_group(struct perf_event *event)
        memset(&fake_cpuc, 0, sizeof(fake_cpuc));
        if (!validate_event(&fake_cpuc, leader))
-                return -ENOSPC;
+                return -EINVAL;
        list_for_each_entry(sibling, &leader->sibling_list, group_entry) {
                if (!validate_event(&fake_cpuc, sibling))
-                        return -ENOSPC;
+                        return -EINVAL;
        }
        if (!validate_event(&fake_cpuc, event))
-                return -ENOSPC;
+                return -EINVAL;
        return 0;
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 524d23b8610c..4f289ff0b7fe 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -599,10 +599,10 @@ static inline pgste_t pgste_update_all(pte_t *ptep, pgste_t pgste)
        skey = page_get_storage_key(address);
        bits = skey & (_PAGE_CHANGED | _PAGE_REFERENCED);
        /* Clear page changed & referenced bit in the storage key */
-        if (bits) {
+        if (bits & _PAGE_CHANGED)
-                skey ^= bits;
+                page_set_storage_key(address, skey ^ bits, 1);
-                page_set_storage_key(address, skey, 1);
+        else if (bits)
-        }
+                page_reset_referenced(address);
        /* Transfer page changed & referenced bit to guest bits in pgste */
        pgste_val(pgste) |= bits << 48;         /* RCP_GR_BIT & RCP_GC_BIT */
        /* Get host changed & referenced bits from pgste */
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 450931a45b68..573bc29551ef 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -296,13 +296,6 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                     ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))))
                        /* Invalid psw mask. */
                        return -EINVAL;
-                if (addr == (addr_t) &dummy->regs.psw.addr)
-                        /*
-                         * The debugger changed the instruction address,
-                         * reset system call restart, see signal.c:do_signal
-                         */
-                        task_thread_info(child)->system_call = 0;
                *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
        } else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) {
@@ -614,11 +607,6 @@ static int __poke_user_compat(struct task_struct *child,
                        /* Transfer 31 bit amode bit to psw mask. */
                        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_BA) |
                                (__u64)(tmp & PSW32_ADDR_AMODE);
-                        /*
-                         * The debugger changed the instruction address,
-                         * reset system call restart, see signal.c:do_signal
-                         */
-                        task_thread_info(child)->system_call = 0;
                } else {
                        /* gpr 0-15 */
                        *(__u32*)((addr_t) &regs->psw + addr*2 + 4) = tmp;
@@ -905,6 +893,14 @@ static int s390_last_break_get(struct task_struct *target,
        return 0;
 }
+static int s390_last_break_set(struct task_struct *target,
+                               const struct user_regset *regset,
+                               unsigned int pos, unsigned int count,
+                               const void *kbuf, const void __user *ubuf)
+{
+        return 0;
+}
 #endif
 static int s390_system_call_get(struct task_struct *target,
@@ -951,6 +947,7 @@ static const struct user_regset s390_regsets[] = {
                .size = sizeof(long),
                .align = sizeof(long),
                .get = s390_last_break_get,
+                .set = s390_last_break_set,
        },
 #endif
        [REGSET_SYSTEM_CALL] = {
@@ -1116,6 +1113,14 @@ static int s390_compat_last_break_get(struct task_struct *target,
        return 0;
 }
+static int s390_compat_last_break_set(struct task_struct *target,
+                                      const struct user_regset *regset,
+                                      unsigned int pos, unsigned int count,
+                                      const void *kbuf, const void __user *ubuf)
+{
+        return 0;
+}
 static const struct user_regset s390_compat_regsets[] = {
        [REGSET_GENERAL] = {
                .core_note_type = NT_PRSTATUS,
@@ -1139,6 +1144,7 @@ static const struct user_regset s390_compat_regsets[] = {
                .size = sizeof(long),
                .align = sizeof(long),
                .get = s390_compat_last_break_get,
+                .set = s390_compat_last_break_set,
        },
        [REGSET_SYSTEM_CALL] = {
                .core_note_type = NT_S390_SYSTEM_CALL,
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index e58a462949b1..e54c4ff8abaa 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -579,7 +579,7 @@ static unsigned long __init find_crash_base(unsigned long crash_size,
                *msg = "first memory chunk must be at least crashkernel size";
                return 0;
        }
-        if (is_kdump_kernel() && (crash_size == OLDMEM_SIZE))
+        if (OLDMEM_BASE && crash_size == OLDMEM_SIZE)
                return OLDMEM_BASE;
        for (i = MEMORY_CHUNKS - 1; i >= 0; i--) {
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 05a85bc14c98..7f6f9f354545 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -460,9 +460,9 @@ void do_signal(struct pt_regs *regs)
                                                     regs->svc_code >> 16);
                                break;
                        }
-                        /* No longer in a system call */
-                        clear_thread_flag(TIF_SYSCALL);
                }
+                /* No longer in a system call */
+                clear_thread_flag(TIF_SYSCALL);
                if ((is_compat_task() ?
                     handle_signal32(signr, &ka, &info, oldset, regs) :
@@ -486,6 +486,7 @@ void do_signal(struct pt_regs *regs)
        }
        /* No handlers present - check for system call restart */
+        clear_thread_flag(TIF_SYSCALL);
        if (current_thread_info()->system_call) {
                regs->svc_code = current_thread_info()->system_call;
                switch (regs->gprs[2]) {
@@ -500,9 +501,6 @@ void do_signal(struct pt_regs *regs)
                        regs->gprs[2] = regs->orig_gpr2;
                        set_thread_flag(TIF_SYSCALL);
                        break;
-                default:
-                        clear_thread_flag(TIF_SYSCALL);
-                        break;
                }
        }
diff --git a/arch/tile/include/asm/irq.h b/arch/tile/include/asm/irq.h
index 94e9a511de84..f80f8ceabc67 100644
--- a/arch/tile/include/asm/irq.h
+++ b/arch/tile/include/asm/irq.h
@@ -74,16 +74,6 @@ enum {
 */
 void tile_irq_activate(unsigned int irq, int tile_irq_type);
-/*
- * For onboard, non-PCI (e.g. TILE_IRQ_PERCPU) devices, drivers know
- * how to use enable/disable_percpu_irq() to manage interrupts on each
- * core.  We can't use the generic enable/disable_irq() because they
- * use a single reference count per irq, rather than per cpu per irq.
- */
-void enable_percpu_irq(unsigned int irq);
-void disable_percpu_irq(unsigned int irq);
 void setup_irq_regs(void);
 #endif /* _ASM_TILE_IRQ_H */
diff --git a/arch/tile/kernel/irq.c b/arch/tile/kernel/irq.c
index aa0134db2dd6..02e628065012 100644
--- a/arch/tile/kernel/irq.c
+++ b/arch/tile/kernel/irq.c
@@ -152,14 +152,13 @@ void tile_dev_intr(struct pt_regs *regs, int intnum)
 * Remove an irq from the disabled mask.  If we're in an interrupt
 * context, defer enabling the HW interrupt until we leave.
 */
-void enable_percpu_irq(unsigned int irq)
+static void tile_irq_chip_enable(struct irq_data *d)
 {
-        get_cpu_var(irq_disable_mask) &= ~(1UL << irq);
+        get_cpu_var(irq_disable_mask) &= ~(1UL << d->irq);
        if (__get_cpu_var(irq_depth) == 0)
-                unmask_irqs(1UL << irq);
+                unmask_irqs(1UL << d->irq);
        put_cpu_var(irq_disable_mask);
 }
-EXPORT_SYMBOL(enable_percpu_irq);
 /*
 * Add an irq to the disabled mask.  We disable the HW interrupt
@@ -167,13 +166,12 @@ EXPORT_SYMBOL(enable_percpu_irq);
 * in an interrupt context, the return path is careful to avoid
 * unmasking a newly disabled interrupt.
 */
-void disable_percpu_irq(unsigned int irq)
+static void tile_irq_chip_disable(struct irq_data *d)
 {
-        get_cpu_var(irq_disable_mask) |= (1UL << irq);
+        get_cpu_var(irq_disable_mask) |= (1UL << d->irq);
-        mask_irqs(1UL << irq);
+        mask_irqs(1UL << d->irq);
        put_cpu_var(irq_disable_mask);
 }
-EXPORT_SYMBOL(disable_percpu_irq);
 /* Mask an interrupt. */
 static void tile_irq_chip_mask(struct irq_data *d)
@@ -209,6 +207,8 @@ static void tile_irq_chip_eoi(struct irq_data *d)
 static struct irq_chip tile_irq_chip = {
        .name = "tile_irq_chip",
+        .irq_enable = tile_irq_chip_enable,
+        .irq_disable = tile_irq_chip_disable,
        .irq_ack = tile_irq_chip_ack,
        .irq_eoi = tile_irq_chip_eoi,
        .irq_mask = tile_irq_chip_mask,
diff --git a/arch/tile/kernel/pci-dma.c b/arch/tile/kernel/pci-dma.c
index 658f2ce426a4..b3ed19f8779c 100644
--- a/arch/tile/kernel/pci-dma.c
+++ b/arch/tile/kernel/pci-dma.c
@@ -15,6 +15,7 @@
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
+#include <linux/export.h>
 #include <asm/tlbflush.h>
 #include <asm/homecache.h>
diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
index 2a8014cb1ff5..9d610d3fb11e 100644
--- a/arch/tile/kernel/pci.c
+++ b/arch/tile/kernel/pci.c
@@ -24,6 +24,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
+#include <linux/export.h>
 #include <asm/processor.h>
 #include <asm/sections.h>
diff --git a/arch/tile/kernel/sysfs.c b/arch/tile/kernel/sysfs.c
index b671a86f4515..602908268093 100644
--- a/arch/tile/kernel/sysfs.c
+++ b/arch/tile/kernel/sysfs.c
@@ -18,6 +18,7 @@
 #include <linux/cpu.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
+#include <linux/stat.h>
 #include <hv/hypervisor.h>
 /* Return a string queried from the hypervisor, truncated to page size. */
diff --git a/arch/tile/lib/exports.c b/arch/tile/lib/exports.c
index a87d2a859ba9..2a81d32de0da 100644
--- a/arch/tile/lib/exports.c
+++ b/arch/tile/lib/exports.c
@@ -39,6 +39,9 @@ EXPORT_SYMBOL(finv_user_asm);
 EXPORT_SYMBOL(current_text_addr);
 EXPORT_SYMBOL(dump_stack);
+/* arch/tile/kernel/head.S */
+EXPORT_SYMBOL(empty_zero_page);
 /* arch/tile/lib/, various memcpy files */
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(__copy_to_user_inatomic);
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index cbe6f4f9eca3..1cc6ae477c98 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -449,9 +449,12 @@ void homecache_free_pages(unsigned long addr, unsigned int order)
        VM_BUG_ON(!virt_addr_valid((void *)addr));
        page = virt_to_page((void *)addr);
        if (put_page_testzero(page)) {
-                int pages = (1 << order);
                homecache_change_page_home(page, order, initial_page_home());
-                while (pages--)
+                if (order == 0) {
-                        __free_page(page++);
+                        free_hot_cold_page(page, 0);
+                } else {
+                        init_page_count(page);
+                        __free_pages(page, order);
+                }
        }
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cb9a1044a771..efb42949cc09 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -390,7 +390,7 @@ config X86_INTEL_CE
          This option compiles in support for the CE4100 SOC for settop
          boxes and media devices.
-config X86_INTEL_MID
+config X86_WANT_INTEL_MID
        bool "Intel MID platform support"
        depends on X86_32
        depends on X86_EXTENDED_PLATFORM
@@ -399,7 +399,10 @@ config X86_INTEL_MID
          systems which do not have the PCI legacy interfaces (Moorestown,
          Medfield). If you are building for a PC class system say N here.
-if X86_INTEL_MID
+if X86_WANT_INTEL_MID
+config X86_INTEL_MID
+        bool
 config X86_MRST
       bool "Moorestown MID platform"
@@ -411,6 +414,7 @@ config X86_MRST
        select SPI
        select INTEL_SCU_IPC
        select X86_PLATFORM_DEVICES
+        select X86_INTEL_MID
        ---help---
          Moorestown is Intel's Low Power Intel Architecture (LPIA) based Moblin
          Internet Device(MID) platform. Moorestown consists of two chips:
diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
index 908b96957d88..c9547033e38e 100644
--- a/arch/x86/include/asm/e820.h
+++ b/arch/x86/include/asm/e820.h
@@ -53,6 +53,13 @@
 */
 #define E820_RESERVED_KERN        128
+/*
+ * Address ranges that need to be mapped by the kernel direct
+ * mapping. This is used to make sure regions such as
+ * EFI_RUNTIME_SERVICES_DATA are directly mapped. See setup_arch().
+ */
+#define E820_RESERVED_EFI         129
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
 struct e820entry {
@@ -115,6 +122,7 @@ static inline void early_memtest(unsigned long start, unsigned long end)
 }
 #endif
+extern unsigned long e820_end_pfn(unsigned long limit_pfn, unsigned type);
 extern unsigned long e820_end_of_ram_pfn(void);
 extern unsigned long e820_end_of_low_ram_pfn(void);
 extern u64 early_reserve_e820(u64 startt, u64 sizet, u64 align);
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 7093e4a6a0bc..b8d8bfcd44a9 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -33,8 +33,6 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 #define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
        efi_call_virt(f, a1, a2, a3, a4, a5, a6)
-#define efi_ioremap(addr, size, type)           ioremap_cache(addr, size)
 #else /* !CONFIG_X86_32 */
 extern u64 efi_call0(void *fp);
@@ -84,9 +82,6 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
        efi_call6((void *)(efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
                  (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
-extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
-                                 u32 type);
 #endif /* CONFIG_X86_32 */
 extern int add_efi_memmap;
diff --git a/arch/x86/include/asm/intel_scu_ipc.h b/arch/x86/include/asm/intel_scu_ipc.h
index 4420993acc47..925b605eb5c6 100644
--- a/arch/x86/include/asm/intel_scu_ipc.h
+++ b/arch/x86/include/asm/intel_scu_ipc.h
@@ -3,11 +3,15 @@
 #include <linux/notifier.h>
-#define IPCMSG_VRTC     0xFA     /* Set vRTC device */
+#define IPCMSG_WARM_RESET       0xF0
+#define IPCMSG_COLD_RESET       0xF1
-/* Command id associated with message IPCMSG_VRTC */
+#define IPCMSG_SOFT_RESET       0xF2
-#define IPC_CMD_VRTC_SETTIME      1 /* Set time */
+#define IPCMSG_COLD_BOOT        0xF3
-#define IPC_CMD_VRTC_SETALARM     2 /* Set alarm */
+#define IPCMSG_VRTC             0xFA     /* Set vRTC device */
+        /* Command id associated with message IPCMSG_VRTC */
+        #define IPC_CMD_VRTC_SETTIME      1 /* Set time */
+        #define IPC_CMD_VRTC_SETALARM     2 /* Set alarm */
 /* Read single register */
 int intel_scu_ipc_ioread8(u16 addr, u8 *data);
diff --git a/arch/x86/include/asm/mrst.h b/arch/x86/include/asm/mrst.h
index e6283129c821..93f79094c224 100644
--- a/arch/x86/include/asm/mrst.h
+++ b/arch/x86/include/asm/mrst.h
@@ -31,11 +31,20 @@ enum mrst_cpu_type {
 };
 extern enum mrst_cpu_type __mrst_cpu_chip;
+#ifdef CONFIG_X86_INTEL_MID
 static inline enum mrst_cpu_type mrst_identify_cpu(void)
 {
        return __mrst_cpu_chip;
 }
+#else /* !CONFIG_X86_INTEL_MID */
+#define mrst_identify_cpu()    (0)
+#endif /* !CONFIG_X86_INTEL_MID */
 enum mrst_timer_options {
        MRST_TIMER_DEFAULT,
        MRST_TIMER_APBT_ONLY,
diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
index 084ef95274cd..95203d40ffdd 100644
--- a/arch/x86/include/asm/msr.h
+++ b/arch/x86/include/asm/msr.h
@@ -169,7 +169,14 @@ static inline int wrmsr_safe(unsigned msr, unsigned low, unsigned high)
        return native_write_msr_safe(msr, low, high);
 }
-/* rdmsr with exception handling */
+/*
+ * rdmsr with exception handling.
+ *
+ * Please note that the exception handling works only after we've
+ * switched to the "smart" #GP handler in trap_init() which knows about
+ * exception tables - using this macro earlier than that causes machine
+ * hangs on boxes which do not implement the @msr in the first argument.
+ */
 #define rdmsr_safe(msr, p1, p2)                                 \
 ({                                                              \
        int __err;                                              \
diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
index fa7b9176b76c..431793e5d484 100644
--- a/arch/x86/include/asm/timer.h
+++ b/arch/x86/include/asm/timer.h
@@ -32,6 +32,22 @@ extern int no_timer_check;
 *  (mathieu.desnoyers@polymtl.ca)
 *
 *                      -johnstul@us.ibm.com "math is hard, lets go shopping!"
+ *
+ * In:
+ *
+ * ns = cycles * cyc2ns_scale / SC
+ *
+ * Although we may still have enough bits to store the value of ns,
+ * in some cases, we may not have enough bits to store cycles * cyc2ns_scale,
+ * leading to an incorrect result.
+ *
+ * To avoid this, we can decompose 'cycles' into quotient and remainder
+ * of division by SC.  Then,
+ *
+ * ns = (quot * SC + rem) * cyc2ns_scale / SC
+ *    = quot * cyc2ns_scale + (rem * cyc2ns_scale) / SC
+ *
+ *                      - sqazi@google.com
 */
 DECLARE_PER_CPU(unsigned long, cyc2ns);
@@ -41,9 +57,14 @@ DECLARE_PER_CPU(unsigned long long, cyc2ns_offset);
 static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
 {
+        unsigned long long quot;
+        unsigned long long rem;
        int cpu = smp_processor_id();
        unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
-        ns += cyc * per_cpu(cyc2ns, cpu) >> CYC2NS_SCALE_FACTOR;
+        quot = (cyc >> CYC2NS_SCALE_FACTOR);
+        rem = cyc & ((1ULL << CYC2NS_SCALE_FACTOR) - 1);
+        ns += quot * per_cpu(cyc2ns, cpu) +
+                ((rem * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR);
        return ns;
 }
diff --git a/arch/x86/include/asm/uv/uv_mmrs.h b/arch/x86/include/asm/uv/uv_mmrs.h
index 10474fb1185d..cf1d73643f60 100644
--- a/arch/x86/include/asm/uv/uv_mmrs.h
+++ b/arch/x86/include/asm/uv/uv_mmrs.h
@@ -57,6 +57,7 @@
 #define UV1_HUB_PART_NUMBER     0x88a5
 #define UV2_HUB_PART_NUMBER     0x8eb8
+#define UV2_HUB_PART_NUMBER_X   0x1111
 /* Compat: if this #define is present, UV headers support UV2 */
 #define UV2_HUB_IS_SUPPORTED    1
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 62ae3001ae02..9d59bbacd4e3 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -93,6 +93,8 @@ static int __init early_get_pnodeid(void)
        if (node_id.s.part_number == UV2_HUB_PART_NUMBER)
                uv_min_hub_revision_id += UV2_HUB_REVISION_BASE - 1;
+        if (node_id.s.part_number == UV2_HUB_PART_NUMBER_X)
+                uv_min_hub_revision_id += UV2_HUB_REVISION_BASE - 1;
        uv_hub_info->hub_revision = uv_min_hub_revision_id;
        pnode = (node_id.s.node_id >> 1) & ((1 << m_n_config.s.n_skt) - 1);
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index a71efcdbb092..97b26356e9ee 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -547,6 +547,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
                if (tmp != mask_lo) {
                        printk(KERN_WARNING "mtrr: your BIOS has configured an incorrect mask, fixing it.\n");
+                        add_taint(TAINT_FIRMWARE_WORKAROUND);
                        mask_lo = tmp;
                }
        }
@@ -693,6 +694,7 @@ static void prepare_set(void) __acquires(set_atomicity_lock)
        /* Disable MTRRs, and set the default type to uncached */
        mtrr_wrmsr(MSR_MTRRdefType, deftype_lo & ~0xcff, deftype_hi);
+        wbinvd();
 }
 static void post_set(void) __releases(set_atomicity_lock)
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 640891014b2a..2bda212a0010 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -312,12 +312,8 @@ int x86_setup_perfctr(struct perf_event *event)
                        return -EOPNOTSUPP;
        }
-        /*
-         * Do not allow config1 (extended registers) to propagate,
-         * there's no sane user-space generalization yet:
-         */
        if (attr->type == PERF_TYPE_RAW)
-                return 0;
+                return x86_pmu_extra_regs(event->attr.config, event);
        if (attr->type == PERF_TYPE_HW_CACHE)
                return set_ext_hw_attr(hwc, event);
@@ -588,7 +584,7 @@ done:
                                x86_pmu.put_event_constraints(cpuc, cpuc->event_list[i]);
                }
        }
-        return num ? -ENOSPC : 0;
+        return num ? -EINVAL : 0;
 }
 /*
@@ -607,7 +603,7 @@ static int collect_events(struct cpu_hw_events *cpuc, struct perf_event *leader,
        if (is_x86_event(leader)) {
                if (n >= max_count)
-                        return -ENOSPC;
+                        return -EINVAL;
                cpuc->event_list[n] = leader;
                n++;
        }
@@ -620,7 +616,7 @@ static int collect_events(struct cpu_hw_events *cpuc, struct perf_event *leader,
                        continue;
                if (n >= max_count)
-                        return -ENOSPC;
+                        return -EINVAL;
                cpuc->event_list[n] = event;
                n++;
@@ -1316,7 +1312,7 @@ static int validate_event(struct perf_event *event)
        c = x86_pmu.get_event_constraints(fake_cpuc, event);
        if (!c || !c->weight)
-                ret = -ENOSPC;
+                ret = -EINVAL;
        if (x86_pmu.put_event_constraints)
                x86_pmu.put_event_constraints(fake_cpuc, event);
@@ -1341,7 +1337,7 @@ static int validate_group(struct perf_event *event)
 {
        struct perf_event *leader = event->group_leader;
        struct cpu_hw_events *fake_cpuc;
-        int ret = -ENOSPC, n;
+        int ret = -EINVAL, n;
        fake_cpuc = allocate_fake_cpuc();
        if (IS_ERR(fake_cpuc))
diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
index ab6343d21825..3b8a2d30d14e 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -199,8 +199,7 @@ static int force_ibs_eilvt_setup(void)
                goto out;
        }
-        pr_err(FW_BUG "using offset %d for IBS interrupts\n", offset);
+        pr_info("IBS: LVT offset %d assigned\n", offset);
-        pr_err(FW_BUG "workaround enabled for IBS LVT offset\n");
        return 0;
 out:
@@ -265,19 +264,23 @@ perf_ibs_cpu_notifier(struct notifier_block *self, unsigned long action, void *h
 static __init int amd_ibs_init(void)
 {
        u32 caps;
-        int ret;
+        int ret = -EINVAL;
        caps = __get_ibs_caps();
        if (!caps)
                return -ENODEV; /* ibs not supported by the cpu */
-        if (!ibs_eilvt_valid()) {
+        /*
-                ret = force_ibs_eilvt_setup();
+         * Force LVT offset assignment for family 10h: The offsets are
-                if (ret) {
+         * not assigned by the BIOS for this family, so the OS is
-                        pr_err("Failed to setup IBS, %d\n", ret);
+         * responsible for doing it. If the OS assignment fails, fall
-                        return ret;
+         * back to BIOS settings and try to setup this.
-                }
+         */
-        }
+        if (boot_cpu_data.x86 == 0x10)
+                force_ibs_eilvt_setup();
+        if (!ibs_eilvt_valid())
+                goto out;
        get_online_cpus();
        ibs_caps = caps;
@@ -287,7 +290,11 @@ static __init int amd_ibs_init(void)
        smp_call_function(setup_APIC_ibs, NULL, 1);
        put_online_cpus();
-        return perf_event_ibs_init();
+        ret = perf_event_ibs_init();
+out:
+        if (ret)
+                pr_err("Failed to setup IBS, %d\n", ret);
+        return ret;
 }
 /* Since we need the pci subsystem to init ibs we can't do this earlier: */
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 2be5ebe99872..8d601b18bf9f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1545,6 +1545,13 @@ static void intel_clovertown_quirks(void)
        x86_pmu.pebs_constraints = NULL;
 }
+static void intel_sandybridge_quirks(void)
+{
+        printk(KERN_WARNING "PEBS disabled due to CPU errata.\n");
+        x86_pmu.pebs = 0;
+        x86_pmu.pebs_constraints = NULL;
+}
 __init int intel_pmu_init(void)
 {
        union cpuid10_edx edx;
@@ -1694,6 +1701,7 @@ __init int intel_pmu_init(void)
                break;
        case 42: /* SandyBridge */
+                x86_pmu.quirks = intel_sandybridge_quirks;
        case 45: /* SandyBridge, "Romely-EP" */
                memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                       sizeof(hw_cache_event_ids));
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index c0d238f49db8..73da6b64f5b7 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -493,6 +493,7 @@ static int intel_pmu_pebs_fixup_ip(struct pt_regs *regs)
        unsigned long from = cpuc->lbr_entries[0].from;
        unsigned long old_to, to = cpuc->lbr_entries[0].to;
        unsigned long ip = regs->ip;
+        int is_64bit = 0;
        /*
         * We don't need to fixup if the PEBS assist is fault like
@@ -544,7 +545,10 @@ static int intel_pmu_pebs_fixup_ip(struct pt_regs *regs)
                } else
                        kaddr = (void *)to;
-                kernel_insn_init(&insn, kaddr);
+#ifdef CONFIG_X86_64
+                is_64bit = kernel_ip(to) || !test_thread_flag(TIF_IA32);
+#endif
+                insn_init(&insn, kaddr, is_64bit);
                insn_get_length(&insn);
                to += insn.length;
        } while (to < ip);
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index 492bf1358a7c..ef484d9d0a25 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -1268,7 +1268,7 @@ reserve:
        }
 done:
-        return num ? -ENOSPC : 0;
+        return num ? -EINVAL : 0;
 }
 static __initconst const struct x86_pmu p4_pmu = {
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 303a0e48f076..65ffd110a81b 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -135,6 +135,7 @@ static void __init e820_print_type(u32 type)
                printk(KERN_CONT "(usable)");
                break;
        case E820_RESERVED:
+        case E820_RESERVED_EFI:
                printk(KERN_CONT "(reserved)");
                break;
        case E820_ACPI:
@@ -783,7 +784,7 @@ u64 __init early_reserve_e820(u64 startt, u64 sizet, u64 align)
 /*
 * Find the highest page frame number we have available
 */
-static unsigned long __init e820_end_pfn(unsigned long limit_pfn, unsigned type)
+unsigned long __init e820_end_pfn(unsigned long limit_pfn, unsigned type)
 {
        int i;
        unsigned long last_pfn = 0;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b946a9eac7d9..1bb0bf4d92cd 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -1049,6 +1049,14 @@ int hpet_rtc_timer_init(void)
 }
 EXPORT_SYMBOL_GPL(hpet_rtc_timer_init);
+static void hpet_disable_rtc_channel(void)
+{
+        unsigned long cfg;
+        cfg = hpet_readl(HPET_T1_CFG);
+        cfg &= ~HPET_TN_ENABLE;
+        hpet_writel(cfg, HPET_T1_CFG);
+}
 /*
 * The functions below are called from rtc driver.
 * Return 0 if HPET is not being used.
@@ -1060,6 +1068,9 @@ int hpet_mask_rtc_irq_bit(unsigned long bit_mask)
                return 0;
        hpet_rtc_flags &= ~bit_mask;
+        if (unlikely(!hpet_rtc_flags))
+                hpet_disable_rtc_channel();
        return 1;
 }
 EXPORT_SYMBOL_GPL(hpet_mask_rtc_irq_bit);
@@ -1125,15 +1136,11 @@ EXPORT_SYMBOL_GPL(hpet_rtc_dropped_irq);
 static void hpet_rtc_timer_reinit(void)
 {
-        unsigned int cfg, delta;
+        unsigned int delta;
        int lost_ints = -1;
-        if (unlikely(!hpet_rtc_flags)) {
+        if (unlikely(!hpet_rtc_flags))
-                cfg = hpet_readl(HPET_T1_CFG);
+                hpet_disable_rtc_channel();
-                cfg &= ~HPET_TN_ENABLE;
-                hpet_writel(cfg, HPET_T1_CFG);
-                return;
-        }
        if (!(hpet_rtc_flags & RTC_PIE) || hpet_pie_limit)
                delta = hpet_default_delta;
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index acf8fbf8fbda..69bca468c47a 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -38,6 +38,9 @@ static inline void stack_overflow_check(struct pt_regs *regs)
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
        u64 curbase = (u64)task_stack_page(current);
+        if (user_mode_vm(regs))
+                return;
        WARN_ONCE(regs->sp >= curbase &&
                  regs->sp <= curbase + THREAD_SIZE &&
                  regs->sp <  curbase + sizeof(struct thread_info) +
diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
index f2d2a664e797..9d46f5e43b51 100644
--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/microcode_core.c
@@ -256,7 +256,7 @@ static int __init microcode_dev_init(void)
        return 0;
 }
-static void microcode_dev_exit(void)
+static void __exit microcode_dev_exit(void)
 {
        misc_deregister(&microcode_dev);
 }
@@ -519,10 +519,8 @@ static int __init microcode_init(void)
        microcode_pdev = platform_device_register_simple("microcode", -1,
                                                         NULL, 0);
-        if (IS_ERR(microcode_pdev)) {
+        if (IS_ERR(microcode_pdev))
-                microcode_dev_exit();
                return PTR_ERR(microcode_pdev);
-        }
        get_online_cpus();
        mutex_lock(&microcode_mutex);
@@ -532,14 +530,12 @@ static int __init microcode_init(void)
        mutex_unlock(&microcode_mutex);
        put_online_cpus();
-        if (error) {
+        if (error)
-                platform_device_unregister(microcode_pdev);
+                goto out_pdev;
-                return error;
-        }
        error = microcode_dev_init();
        if (error)
-                return error;
+                goto out_sysdev_driver;
        register_syscore_ops(&mc_syscore_ops);
        register_hotcpu_notifier(&mc_cpu_notifier);
@@ -548,6 +544,20 @@ static int __init microcode_init(void)
                " <tigran@aivazian.fsnet.co.uk>, Peter Oruba\n");
        return 0;
+out_sysdev_driver:
+        get_online_cpus();
+        mutex_lock(&microcode_mutex);
+        sysdev_driver_unregister(&cpu_sysdev_class, &mc_sysdev_driver);
+        mutex_unlock(&microcode_mutex);
+        put_online_cpus();
+out_pdev:
+        platform_device_unregister(microcode_pdev);
+        return error;
 }
 module_init(microcode_init);
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 9103b89c145a..0741b062a304 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -95,8 +95,8 @@ static void __init MP_bus_info(struct mpc_bus *m)
        }
 #endif
+        set_bit(m->busid, mp_bus_not_pci);
        if (strncmp(str, BUSTYPE_ISA, sizeof(BUSTYPE_ISA) - 1) == 0) {
-                set_bit(m->busid, mp_bus_not_pci);
 #if defined(CONFIG_EISA) || defined(CONFIG_MCA)
                mp_bus_id_to_type[m->busid] = MP_BUS_ISA;
 #endif
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index b78643d0f9a5..03920a15a632 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -553,4 +553,17 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC,
                        quirk_amd_nb_node);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_LINK,
                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F0,
+                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F1,
+                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F2,
+                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3,
+                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4,
+                        quirk_amd_nb_node);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F5,
+                        quirk_amd_nb_node);
 #endif
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e334be1182b9..37a458b521a6 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -124,7 +124,7 @@ __setup("reboot=", reboot_setup);
 */
 /*
- * Some machines require the "reboot=b"  commandline option,
+ * Some machines require the "reboot=b" or "reboot=k"  commandline options,
 * this quirk makes that automatic.
 */
 static int __init set_bios_reboot(const struct dmi_system_id *d)
@@ -136,6 +136,15 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
        return 0;
 }
+static int __init set_kbd_reboot(const struct dmi_system_id *d)
+{
+        if (reboot_type != BOOT_KBD) {
+                reboot_type = BOOT_KBD;
+                printk(KERN_INFO "%s series board detected. Selecting KBD-method for reboot.\n", d->ident);
+        }
+        return 0;
+}
 static struct dmi_system_id __initdata reboot_dmi_table[] = {
        {       /* Handle problems with rebooting on Dell E520's */
                .callback = set_bios_reboot,
@@ -295,7 +304,7 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                },
        },
        { /* Handle reboot issue on Acer Aspire one */
-                .callback = set_bios_reboot,
+                .callback = set_kbd_reboot,
                .ident = "Acer Aspire One A110",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
@@ -443,6 +452,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6420"),
                },
        },
+        {       /* Handle problems with rebooting on the OptiPlex 990. */
+                .callback = set_pci_reboot,
+                .ident = "Dell OptiPlex 990",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
+                },
+        },
        { }
 };
diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index 348ce016a835..af6db6ec5b2a 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -12,6 +12,7 @@
 #include <asm/vsyscall.h>
 #include <asm/x86_init.h>
 #include <asm/time.h>
+#include <asm/mrst.h>
 #ifdef CONFIG_X86_32
 /*
@@ -242,6 +243,10 @@ static __init int add_rtc_cmos(void)
        if (of_have_populated_dt())
                return 0;
+        /* Intel MID platforms don't have ioport rtc */
+        if (mrst_identify_cpu())
+                return -ENODEV;
        platform_device_register(&rtc_device);
        dev_info(&rtc_device.dev,
                 "registered platform RTC device (no PNP device found)\n");
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cf0ef986cb6d..9a9e40fb091c 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -691,6 +691,8 @@ early_param("reservelow", parse_reservelow);
 void __init setup_arch(char **cmdline_p)
 {
+        unsigned long end_pfn;
 #ifdef CONFIG_X86_32
        memcpy(&boot_cpu_data, &new_cpu_data, sizeof(new_cpu_data));
        visws_early_detect();
@@ -932,7 +934,24 @@ void __init setup_arch(char **cmdline_p)
        init_gbpages();
        /* max_pfn_mapped is updated here */
-        max_low_pfn_mapped = init_memory_mapping(0, max_low_pfn<<PAGE_SHIFT);
+        end_pfn = max_low_pfn;
+#ifdef CONFIG_X86_64
+        /*
+         * There may be regions after the last E820_RAM region that we
+         * want to include in the kernel direct mapping, such as
+         * EFI_RUNTIME_SERVICES_DATA.
+         */
+        if (efi_enabled) {
+                unsigned long efi_end;
+                efi_end = e820_end_pfn(MAXMEM>>PAGE_SHIFT, E820_RESERVED_EFI);
+                if (efi_end > max_low_pfn)
+                        end_pfn = efi_end;
+        }
+#endif
+        max_low_pfn_mapped = init_memory_mapping(0, end_pfn << PAGE_SHIFT);
        max_pfn_mapped = max_low_pfn_mapped;
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index ea305856151c..dd74e46828c0 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -201,6 +201,8 @@ static noinline int gup_huge_pud(pud_t pud, unsigned long addr,
        do {
                VM_BUG_ON(compound_head(page) != head);
                pages[*nr] = page;
+                if (PageTail(page))
+                        get_huge_page_tail(page);
                (*nr)++;
                page++;
                refs++;
diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
index b49962662101..f4f29b19fac5 100644
--- a/arch/x86/mm/highmem_32.c
+++ b/arch/x86/mm/highmem_32.c
@@ -45,6 +45,7 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
        BUG_ON(!pte_none(*(kmap_pte-idx)));
        set_pte(kmap_pte-idx, mk_pte(page, prot));
+        arch_flush_lazy_mmu_mode();
        return (void *)vaddr;
 }
@@ -88,6 +89,7 @@ void __kunmap_atomic(void *kvaddr)
                 */
                kpte_clear_flush(kmap_pte-idx, vaddr);
                kmap_atomic_idx_pop();
+                arch_flush_lazy_mmu_mode();
        }
 #ifdef CONFIG_DEBUG_HIGHMEM
        else {
diff --git a/arch/x86/oprofile/init.c b/arch/x86/oprofile/init.c
index cdfe4c54deca..f148cf652678 100644
--- a/arch/x86/oprofile/init.c
+++ b/arch/x86/oprofile/init.c
@@ -21,6 +21,7 @@ extern int op_nmi_timer_init(struct oprofile_operations *ops);
 extern void op_nmi_exit(void);
 extern void x86_backtrace(struct pt_regs * const regs, unsigned int depth);
+static int nmi_timer;
 int __init oprofile_arch_init(struct oprofile_operations *ops)
 {
@@ -31,8 +32,9 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
 #ifdef CONFIG_X86_LOCAL_APIC
        ret = op_nmi_init(ops);
 #endif
+        nmi_timer = (ret != 0);
 #ifdef CONFIG_X86_IO_APIC
-        if (ret < 0)
+        if (nmi_timer)
                ret = op_nmi_timer_init(ops);
 #endif
        ops->backtrace = x86_backtrace;
@@ -44,6 +46,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
 void oprofile_arch_exit(void)
 {
 #ifdef CONFIG_X86_LOCAL_APIC
-        op_nmi_exit();
+        if (!nmi_timer)
+                op_nmi_exit();
 #endif
 }
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 37718f0f053d..c9718a16be15 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -323,10 +323,13 @@ static void __init do_add_efi_memmap(void)
                case EFI_UNUSABLE_MEMORY:
                        e820_type = E820_UNUSABLE;
                        break;
+                case EFI_RUNTIME_SERVICES_DATA:
+                        e820_type = E820_RESERVED_EFI;
+                        break;
                default:
                        /*
                         * EFI_RESERVED_TYPE EFI_RUNTIME_SERVICES_CODE
-                         * EFI_RUNTIME_SERVICES_DATA EFI_MEMORY_MAPPED_IO
+                         * EFI_MEMORY_MAPPED_IO
                         * EFI_MEMORY_MAPPED_IO_PORT_SPACE EFI_PAL_CODE
                         */
                        e820_type = E820_RESERVED;
@@ -671,10 +674,21 @@ void __init efi_enter_virtual_mode(void)
                end_pfn = PFN_UP(end);
                if (end_pfn <= max_low_pfn_mapped
                    || (end_pfn > (1UL << (32 - PAGE_SHIFT))
-                        && end_pfn <= max_pfn_mapped))
+                        && end_pfn <= max_pfn_mapped)) {
                        va = __va(md->phys_addr);
-                else
-                        va = efi_ioremap(md->phys_addr, size, md->type);
+                        if (!(md->attribute & EFI_MEMORY_WB)) {
+                                addr = (u64) (unsigned long)va;
+                                npages = md->num_pages;
+                                memrange_efi_to_native(&addr, &npages);
+                                set_memory_uc(addr, npages);
+                        }
+                } else {
+                        if (!(md->attribute & EFI_MEMORY_WB))
+                                va = ioremap_nocache(md->phys_addr, size);
+                        else
+                                va = ioremap_cache(md->phys_addr, size);
+                }
                md->virt_addr = (u64) (unsigned long) va;
@@ -684,13 +698,6 @@ void __init efi_enter_virtual_mode(void)
                        continue;
                }
-                if (!(md->attribute & EFI_MEMORY_WB)) {
-                        addr = md->virt_addr;
-                        npages = md->num_pages;
-                        memrange_efi_to_native(&addr, &npages);
-                        set_memory_uc(addr, npages);
-                }
                systab = (u64) (unsigned long) efi_phys.systab;
                if (md->phys_addr <= systab && systab < end) {
                        systab += md->virt_addr - md->phys_addr;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index ac3aa54e2654..312250c6b2de 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -80,20 +80,3 @@ void __init efi_call_phys_epilog(void)
        local_irq_restore(efi_flags);
        early_code_mapping_set_exec(0);
 }
-void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
-                                 u32 type)
-{
-        unsigned long last_map_pfn;
-        if (type == EFI_MEMORY_MAPPED_IO)
-                return ioremap(phys_addr, size);
-        last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
-        if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size) {
-                unsigned long top = last_map_pfn << PAGE_SHIFT;
-                efi_ioremap(top, size - (top - phys_addr), type);
-        }
-        return (void __iomem *)__va(phys_addr);
-}
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index b1489a06a49d..ad4ec1cb097e 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -76,6 +76,20 @@ struct sfi_rtc_table_entry sfi_mrtc_array[SFI_MRTC_MAX];
 EXPORT_SYMBOL_GPL(sfi_mrtc_array);
 int sfi_mrtc_num;
+static void mrst_power_off(void)
+{
+        if (__mrst_cpu_chip == MRST_CPU_CHIP_LINCROFT)
+                intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 1);
+}
+static void mrst_reboot(void)
+{
+        if (__mrst_cpu_chip == MRST_CPU_CHIP_LINCROFT)
+                intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 0);
+        else
+                intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0);
+}
 /* parse all the mtimer info to a static mtimer array */
 static int __init sfi_parse_mtmr(struct sfi_table_header *table)
 {
@@ -265,17 +279,6 @@ static int mrst_i8042_detect(void)
        return 0;
 }
-/* Reboot and power off are handled by the SCU on a MID device */
-static void mrst_power_off(void)
-{
-        intel_scu_ipc_simple_command(0xf1, 1);
-}
-static void mrst_reboot(void)
-{
-        intel_scu_ipc_simple_command(0xf1, 0);
-}
 /*
 * Moorestown does not have external NMI source nor port 0x61 to report
 * NMI status. The possible NMI sources are from pmu as a result of NMI
@@ -484,6 +487,46 @@ static void __init *max7315_platform_data(void *info)
        return max7315;
 }
+static void *tca6416_platform_data(void *info)
+{
+        static struct pca953x_platform_data tca6416;
+        struct i2c_board_info *i2c_info = info;
+        int gpio_base, intr;
+        char base_pin_name[SFI_NAME_LEN + 1];
+        char intr_pin_name[SFI_NAME_LEN + 1];
+        strcpy(i2c_info->type, "tca6416");
+        strcpy(base_pin_name, "tca6416_base");
+        strcpy(intr_pin_name, "tca6416_int");
+        gpio_base = get_gpio_by_name(base_pin_name);
+        intr = get_gpio_by_name(intr_pin_name);
+        if (gpio_base == -1)
+                return NULL;
+        tca6416.gpio_base = gpio_base;
+        if (intr != -1) {
+                i2c_info->irq = intr + MRST_IRQ_OFFSET;
+                tca6416.irq_base = gpio_base + MRST_IRQ_OFFSET;
+        } else {
+                i2c_info->irq = -1;
+                tca6416.irq_base = -1;
+        }
+        return &tca6416;
+}
+static void *mpu3050_platform_data(void *info)
+{
+        struct i2c_board_info *i2c_info = info;
+        int intr = get_gpio_by_name("mpu3050_int");
+        if (intr == -1)
+                return NULL;
+        i2c_info->irq = intr + MRST_IRQ_OFFSET;
+        return NULL;
+}
 static void __init *emc1403_platform_data(void *info)
 {
        static short intr2nd_pdata;
@@ -646,12 +689,15 @@ static void *msic_ocd_platform_data(void *info)
 static const struct devs_id __initconst device_ids[] = {
        {"bma023", SFI_DEV_TYPE_I2C, 1, &no_platform_data},
        {"pmic_gpio", SFI_DEV_TYPE_SPI, 1, &pmic_gpio_platform_data},
+        {"pmic_gpio", SFI_DEV_TYPE_IPC, 1, &pmic_gpio_platform_data},
        {"spi_max3111", SFI_DEV_TYPE_SPI, 0, &max3111_platform_data},
        {"i2c_max7315", SFI_DEV_TYPE_I2C, 1, &max7315_platform_data},
        {"i2c_max7315_2", SFI_DEV_TYPE_I2C, 1, &max7315_platform_data},
+        {"tca6416", SFI_DEV_TYPE_I2C, 1, &tca6416_platform_data},
        {"emc1403", SFI_DEV_TYPE_I2C, 1, &emc1403_platform_data},
        {"i2c_accel", SFI_DEV_TYPE_I2C, 0, &lis331dl_platform_data},
        {"pmic_audio", SFI_DEV_TYPE_IPC, 1, &no_platform_data},
+        {"mpu3050", SFI_DEV_TYPE_I2C, 1, &mpu3050_platform_data},
        /* MSIC subdevices */
        {"msic_battery", SFI_DEV_TYPE_IPC, 1, &msic_battery_platform_data},
diff --git a/drivers/base/core.c b/drivers/base/core.c
index d8b3d89db043..919daa7cd5b1 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1743,8 +1743,10 @@ void device_shutdown(void)
                 */
                list_del_init(&dev->kobj.entry);
                spin_unlock(&devices_kset->list_lock);
-                /* Disable all device's runtime power management */
-                pm_runtime_disable(dev);
+                /* Don't allow any more runtime suspends */
+                pm_runtime_get_noresume(dev);
+                pm_runtime_barrier(dev);
                if (dev->bus && dev->bus->shutdown) {
                        dev_dbg(dev, "shutdown\n");
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index dbcb0bcfd8da..4e018d6a7639 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -18,7 +18,7 @@ obj-$(CONFIG_ARCH_DAVINCI)	+= gpio-davinci.o
 obj-$(CONFIG_GPIO_EP93XX)       += gpio-ep93xx.o
 obj-$(CONFIG_GPIO_IT8761E)      += gpio-it8761e.o
 obj-$(CONFIG_GPIO_JANZ_TTL)     += gpio-janz-ttl.o
-obj-$(CONFIG_MACH_KS8695)       += gpio-ks8695.o
+obj-$(CONFIG_ARCH_KS8695)       += gpio-ks8695.o
 obj-$(CONFIG_GPIO_LANGWELL)     += gpio-langwell.o
 obj-$(CONFIG_ARCH_LPC32XX)      += gpio-lpc32xx.o
 obj-$(CONFIG_GPIO_MAX730X)      += gpio-max730x.o
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 8359dc777041..60ff1b63b568 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2026,8 +2026,13 @@ i915_wait_request(struct intel_ring_buffer *ring,
         * to handle this, the waiter on a request often wants an associated
         * buffer to have made it to the inactive list, and we would need
         * a separate wait queue to handle that.
+         *
+         * To avoid a recursion with the ilk VT-d workaround (that calls
+         * gpu_idle when unbinding objects with interruptible==false) don't
+         * retire requests in that case (because it might call unbind if the
+         * active list holds the last reference to the object).
         */
-        if (ret == 0)
+        if (ret == 0 && dev_priv->mm.interruptible)
                i915_gem_retire_requests_ring(ring);
        return ret;
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 06e413e6a920..4b27efa4405b 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -233,13 +233,12 @@ u16 radeon_encoder_get_dp_bridge_encoder_id(struct drm_encoder *encoder)
                switch (radeon_encoder->encoder_id) {
                case ENCODER_OBJECT_ID_TRAVIS:
                case ENCODER_OBJECT_ID_NUTMEG:
-                        return true;
+                        return radeon_encoder->encoder_id;
                default:
-                        return false;
+                        return ENCODER_OBJECT_ID_NONE;
                }
        }
+        return ENCODER_OBJECT_ID_NONE;
-        return false;
 }
 void radeon_panel_mode_fixup(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 3f6343502d1f..5ff561d4e0b4 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -140,7 +140,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
                goto out_clips;
        }
-        clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
+        clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
        if (clips == NULL) {
                DRM_ERROR("Failed to allocate clip rect list.\n");
                ret = -ENOMEM;
@@ -232,7 +232,7 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
                goto out_clips;
        }
-        clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
+        clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
        if (clips == NULL) {
                DRM_ERROR("Failed to allocate clip rect list.\n");
                ret = -ENOMEM;
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 5414253b185a..6bea6962f8ee 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -34,7 +34,9 @@ config AMD_IOMMU
        bool "AMD IOMMU support"
        select SWIOTLB
        select PCI_MSI
-        select PCI_IOV
+        select PCI_ATS
+        select PCI_PRI
+        select PCI_PASID
        select IOMMU_API
        depends on X86_64 && PCI && ACPI
        ---help---
@@ -58,6 +60,15 @@ config AMD_IOMMU_STATS
          information to userspace via debugfs.
          If unsure, say N.
+config AMD_IOMMU_V2
+        tristate "AMD IOMMU Version 2 driver (EXPERIMENTAL)"
+        depends on AMD_IOMMU && PROFILING && EXPERIMENTAL
+        select MMU_NOTIFIER
+        ---help---
+          This option enables support for the AMD IOMMUv2 features of the IOMMU
+          hardware. Select this option if you want to use devices that support
+          the the PCI PRI and PASID interface.
 # Intel IOMMU support
 config DMAR_TABLE
        bool
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 2f4448794bc7..0e36b4934aff 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -1,6 +1,7 @@
 obj-$(CONFIG_IOMMU_API) += iommu.o
 obj-$(CONFIG_MSM_IOMMU) += msm_iommu.o msm_iommu_dev.o
 obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o
+obj-$(CONFIG_AMD_IOMMU_V2) += amd_iommu_v2.o
 obj-$(CONFIG_DMAR_TABLE) += dmar.o
 obj-$(CONFIG_INTEL_IOMMU) += iova.o intel-iommu.o
 obj-$(CONFIG_IRQ_REMAP) += intr_remapping.o
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 4ee277a8521a..a7cbcd46af9e 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -17,6 +17,7 @@
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
+#include <linux/ratelimit.h>
 #include <linux/pci.h>
 #include <linux/pci-ats.h>
 #include <linux/bitmap.h>
@@ -28,6 +29,8 @@
 #include <linux/iommu.h>
 #include <linux/delay.h>
 #include <linux/amd-iommu.h>
+#include <linux/notifier.h>
+#include <linux/export.h>
 #include <asm/msidef.h>
 #include <asm/proto.h>
 #include <asm/iommu.h>
@@ -41,6 +44,24 @@
 #define LOOP_TIMEOUT    100000
+/*
+ * This bitmap is used to advertise the page sizes our hardware support
+ * to the IOMMU core, which will then use this information to split
+ * physically contiguous memory regions it is mapping into page sizes
+ * that we support.
+ *
+ * Traditionally the IOMMU core just handed us the mappings directly,
+ * after making sure the size is an order of a 4KiB page and that the
+ * mapping has natural alignment.
+ *
+ * To retain this behavior, we currently advertise that we support
+ * all page sizes that are an order of 4KiB.
+ *
+ * If at some point we'd like to utilize the IOMMU core's new behavior,
+ * we could change this to advertise the real page sizes we support.
+ */
+#define AMD_IOMMU_PGSIZES       (~0xFFFUL)
 static DEFINE_RWLOCK(amd_iommu_devtable_lock);
 /* A list of preallocated protection domains */
@@ -59,6 +80,9 @@ static struct protection_domain *pt_domain;
 static struct iommu_ops amd_iommu_ops;
+static ATOMIC_NOTIFIER_HEAD(ppr_notifier);
+int amd_iommu_max_glx_val = -1;
 /*
 * general struct to manage commands send to an IOMMU
 */
@@ -67,6 +91,7 @@ struct iommu_cmd {
 };
 static void update_domain(struct protection_domain *domain);
+static int __init alloc_passthrough_domain(void);
 /****************************************************************************
 *
@@ -147,6 +172,33 @@ static struct iommu_dev_data *get_dev_data(struct device *dev)
        return dev->archdata.iommu;
 }
+static bool pci_iommuv2_capable(struct pci_dev *pdev)
+{
+        static const int caps[] = {
+                PCI_EXT_CAP_ID_ATS,
+                PCI_PRI_CAP,
+                PCI_PASID_CAP,
+        };
+        int i, pos;
+        for (i = 0; i < 3; ++i) {
+                pos = pci_find_ext_capability(pdev, caps[i]);
+                if (pos == 0)
+                        return false;
+        }
+        return true;
+}
+static bool pdev_pri_erratum(struct pci_dev *pdev, u32 erratum)
+{
+        struct iommu_dev_data *dev_data;
+        dev_data = get_dev_data(&pdev->dev);
+        return dev_data->errata & (1 << erratum) ? true : false;
+}
 /*
 * In this function the list of preallocated protection domains is traversed to
 * find the domain for a specific device
@@ -204,6 +256,7 @@ static bool check_device(struct device *dev)
 static int iommu_init_device(struct device *dev)
 {
+        struct pci_dev *pdev = to_pci_dev(dev);
        struct iommu_dev_data *dev_data;
        u16 alias;
@@ -228,6 +281,13 @@ static int iommu_init_device(struct device *dev)
                dev_data->alias_data = alias_data;
        }
+        if (pci_iommuv2_capable(pdev)) {
+                struct amd_iommu *iommu;
+                iommu              = amd_iommu_rlookup_table[dev_data->devid];
+                dev_data->iommu_v2 = iommu->is_iommu_v2;
+        }
        dev->archdata.iommu = dev_data;
        return 0;
@@ -317,6 +377,11 @@ DECLARE_STATS_COUNTER(domain_flush_single);
 DECLARE_STATS_COUNTER(domain_flush_all);
 DECLARE_STATS_COUNTER(alloced_io_mem);
 DECLARE_STATS_COUNTER(total_map_requests);
+DECLARE_STATS_COUNTER(complete_ppr);
+DECLARE_STATS_COUNTER(invalidate_iotlb);
+DECLARE_STATS_COUNTER(invalidate_iotlb_all);
+DECLARE_STATS_COUNTER(pri_requests);
 static struct dentry *stats_dir;
 static struct dentry *de_fflush;
@@ -351,6 +416,10 @@ static void amd_iommu_stats_init(void)
        amd_iommu_stats_add(&domain_flush_all);
        amd_iommu_stats_add(&alloced_io_mem);
        amd_iommu_stats_add(&total_map_requests);
+        amd_iommu_stats_add(&complete_ppr);
+        amd_iommu_stats_add(&invalidate_iotlb);
+        amd_iommu_stats_add(&invalidate_iotlb_all);
+        amd_iommu_stats_add(&pri_requests);
 }
 #endif
@@ -365,8 +434,8 @@ static void dump_dte_entry(u16 devid)
 {
        int i;
-        for (i = 0; i < 8; ++i)
+        for (i = 0; i < 4; ++i)
-                pr_err("AMD-Vi: DTE[%d]: %08x\n", i,
+                pr_err("AMD-Vi: DTE[%d]: %016llx\n", i,
                        amd_iommu_dev_table[devid].data[i]);
 }
@@ -461,12 +530,84 @@ static void iommu_poll_events(struct amd_iommu *iommu)
        spin_unlock_irqrestore(&iommu->lock, flags);
 }
+static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u32 head)
+{
+        struct amd_iommu_fault fault;
+        volatile u64 *raw;
+        int i;
+        INC_STATS_COUNTER(pri_requests);
+        raw = (u64 *)(iommu->ppr_log + head);
+        /*
+         * Hardware bug: Interrupt may arrive before the entry is written to
+         * memory. If this happens we need to wait for the entry to arrive.
+         */
+        for (i = 0; i < LOOP_TIMEOUT; ++i) {
+                if (PPR_REQ_TYPE(raw[0]) != 0)
+                        break;
+                udelay(1);
+        }
+        if (PPR_REQ_TYPE(raw[0]) != PPR_REQ_FAULT) {
+                pr_err_ratelimited("AMD-Vi: Unknown PPR request received\n");
+                return;
+        }
+        fault.address   = raw[1];
+        fault.pasid     = PPR_PASID(raw[0]);
+        fault.device_id = PPR_DEVID(raw[0]);
+        fault.tag       = PPR_TAG(raw[0]);
+        fault.flags     = PPR_FLAGS(raw[0]);
+        /*
+         * To detect the hardware bug we need to clear the entry
+         * to back to zero.
+         */
+        raw[0] = raw[1] = 0;
+        atomic_notifier_call_chain(&ppr_notifier, 0, &fault);
+}
+static void iommu_poll_ppr_log(struct amd_iommu *iommu)
+{
+        unsigned long flags;
+        u32 head, tail;
+        if (iommu->ppr_log == NULL)
+                return;
+        spin_lock_irqsave(&iommu->lock, flags);
+        head = readl(iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
+        tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
+        while (head != tail) {
+                /* Handle PPR entry */
+                iommu_handle_ppr_entry(iommu, head);
+                /* Update and refresh ring-buffer state*/
+                head = (head + PPR_ENTRY_SIZE) % PPR_LOG_SIZE;
+                writel(head, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
+                tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
+        }
+        /* enable ppr interrupts again */
+        writel(MMIO_STATUS_PPR_INT_MASK, iommu->mmio_base + MMIO_STATUS_OFFSET);
+        spin_unlock_irqrestore(&iommu->lock, flags);
+}
 irqreturn_t amd_iommu_int_thread(int irq, void *data)
 {
        struct amd_iommu *iommu;
-        for_each_iommu(iommu)
+        for_each_iommu(iommu) {
                iommu_poll_events(iommu);
+                iommu_poll_ppr_log(iommu);
+        }
        return IRQ_HANDLED;
 }
@@ -595,6 +736,60 @@ static void build_inv_iotlb_pages(struct iommu_cmd *cmd, u16 devid, int qdep,
                cmd->data[2] |= CMD_INV_IOMMU_PAGES_SIZE_MASK;
 }
+static void build_inv_iommu_pasid(struct iommu_cmd *cmd, u16 domid, int pasid,
+                                  u64 address, bool size)
+{
+        memset(cmd, 0, sizeof(*cmd));
+        address &= ~(0xfffULL);
+        cmd->data[0]  = pasid & PASID_MASK;
+        cmd->data[1]  = domid;
+        cmd->data[2]  = lower_32_bits(address);
+        cmd->data[3]  = upper_32_bits(address);
+        cmd->data[2] |= CMD_INV_IOMMU_PAGES_PDE_MASK;
+        cmd->data[2] |= CMD_INV_IOMMU_PAGES_GN_MASK;
+        if (size)
+                cmd->data[2] |= CMD_INV_IOMMU_PAGES_SIZE_MASK;
+        CMD_SET_TYPE(cmd, CMD_INV_IOMMU_PAGES);
+}
+static void build_inv_iotlb_pasid(struct iommu_cmd *cmd, u16 devid, int pasid,
+                                  int qdep, u64 address, bool size)
+{
+        memset(cmd, 0, sizeof(*cmd));
+        address &= ~(0xfffULL);
+        cmd->data[0]  = devid;
+        cmd->data[0] |= (pasid & 0xff) << 16;
+        cmd->data[0] |= (qdep  & 0xff) << 24;
+        cmd->data[1]  = devid;
+        cmd->data[1] |= ((pasid >> 8) & 0xfff) << 16;
+        cmd->data[2]  = lower_32_bits(address);
+        cmd->data[2] |= CMD_INV_IOMMU_PAGES_GN_MASK;
+        cmd->data[3]  = upper_32_bits(address);
+        if (size)
+                cmd->data[2] |= CMD_INV_IOMMU_PAGES_SIZE_MASK;
+        CMD_SET_TYPE(cmd, CMD_INV_IOTLB_PAGES);
+}
+static void build_complete_ppr(struct iommu_cmd *cmd, u16 devid, int pasid,
+                               int status, int tag, bool gn)
+{
+        memset(cmd, 0, sizeof(*cmd));
+        cmd->data[0]  = devid;
+        if (gn) {
+                cmd->data[1]  = pasid & PASID_MASK;
+                cmd->data[2]  = CMD_INV_IOMMU_PAGES_GN_MASK;
+        }
+        cmd->data[3]  = tag & 0x1ff;
+        cmd->data[3] |= (status & PPR_STATUS_MASK) << PPR_STATUS_SHIFT;
+        CMD_SET_TYPE(cmd, CMD_COMPLETE_PPR);
+}
 static void build_inv_all(struct iommu_cmd *cmd)
 {
        memset(cmd, 0, sizeof(*cmd));
@@ -1496,6 +1691,48 @@ static void free_pagetable(struct protection_domain *domain)
        domain->pt_root = NULL;
 }
+static void free_gcr3_tbl_level1(u64 *tbl)
+{
+        u64 *ptr;
+        int i;
+        for (i = 0; i < 512; ++i) {
+                if (!(tbl[i] & GCR3_VALID))
+                        continue;
+                ptr = __va(tbl[i] & PAGE_MASK);
+                free_page((unsigned long)ptr);
+        }
+}
+static void free_gcr3_tbl_level2(u64 *tbl)
+{
+        u64 *ptr;
+        int i;
+        for (i = 0; i < 512; ++i) {
+                if (!(tbl[i] & GCR3_VALID))
+                        continue;
+                ptr = __va(tbl[i] & PAGE_MASK);
+                free_gcr3_tbl_level1(ptr);
+        }
+}
+static void free_gcr3_table(struct protection_domain *domain)
+{
+        if (domain->glx == 2)
+                free_gcr3_tbl_level2(domain->gcr3_tbl);
+        else if (domain->glx == 1)
+                free_gcr3_tbl_level1(domain->gcr3_tbl);
+        else if (domain->glx != 0)
+                BUG();
+        free_page((unsigned long)domain->gcr3_tbl);
+}
 /*
 * Free a domain, only used if something went wrong in the
 * allocation path and we need to free an already allocated page table
@@ -1582,20 +1819,52 @@ static bool dma_ops_domain(struct protection_domain *domain)
 static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats)
 {
-        u64 pte_root = virt_to_phys(domain->pt_root);
+        u64 pte_root = 0;
-        u32 flags = 0;
+        u64 flags = 0;
+        if (domain->mode != PAGE_MODE_NONE)
+                pte_root = virt_to_phys(domain->pt_root);
        pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK)
                    << DEV_ENTRY_MODE_SHIFT;
        pte_root |= IOMMU_PTE_IR | IOMMU_PTE_IW | IOMMU_PTE_P | IOMMU_PTE_TV;
+        flags = amd_iommu_dev_table[devid].data[1];
        if (ats)
                flags |= DTE_FLAG_IOTLB;
-        amd_iommu_dev_table[devid].data[3] |= flags;
+        if (domain->flags & PD_IOMMUV2_MASK) {
-        amd_iommu_dev_table[devid].data[2]  = domain->id;
+                u64 gcr3 = __pa(domain->gcr3_tbl);
-        amd_iommu_dev_table[devid].data[1]  = upper_32_bits(pte_root);
+                u64 glx  = domain->glx;
-        amd_iommu_dev_table[devid].data[0]  = lower_32_bits(pte_root);
+                u64 tmp;
+                pte_root |= DTE_FLAG_GV;
+                pte_root |= (glx & DTE_GLX_MASK) << DTE_GLX_SHIFT;
+                /* First mask out possible old values for GCR3 table */
+                tmp = DTE_GCR3_VAL_B(~0ULL) << DTE_GCR3_SHIFT_B;
+                flags    &= ~tmp;
+                tmp = DTE_GCR3_VAL_C(~0ULL) << DTE_GCR3_SHIFT_C;
+                flags    &= ~tmp;
+                /* Encode GCR3 table into DTE */
+                tmp = DTE_GCR3_VAL_A(gcr3) << DTE_GCR3_SHIFT_A;
+                pte_root |= tmp;
+                tmp = DTE_GCR3_VAL_B(gcr3) << DTE_GCR3_SHIFT_B;
+                flags    |= tmp;
+                tmp = DTE_GCR3_VAL_C(gcr3) << DTE_GCR3_SHIFT_C;
+                flags    |= tmp;
+        }
+        flags &= ~(0xffffUL);
+        flags |= domain->id;
+        amd_iommu_dev_table[devid].data[1]  = flags;
+        amd_iommu_dev_table[devid].data[0]  = pte_root;
 }
 static void clear_dte_entry(u16 devid)
@@ -1603,7 +1872,6 @@ static void clear_dte_entry(u16 devid)
        /* remove entry from the device table seen by the hardware */
        amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
        amd_iommu_dev_table[devid].data[1] = 0;
-        amd_iommu_dev_table[devid].data[2] = 0;
        amd_iommu_apply_erratum_63(devid);
 }
@@ -1696,6 +1964,93 @@ out_unlock:
        return ret;
 }
+static void pdev_iommuv2_disable(struct pci_dev *pdev)
+{
+        pci_disable_ats(pdev);
+        pci_disable_pri(pdev);
+        pci_disable_pasid(pdev);
+}
+/* FIXME: Change generic reset-function to do the same */
+static int pri_reset_while_enabled(struct pci_dev *pdev)
+{
+        u16 control;
+        int pos;
+        pos = pci_find_ext_capability(pdev, PCI_PRI_CAP);
+        if (!pos)
+                return -EINVAL;
+        pci_read_config_word(pdev, pos + PCI_PRI_CONTROL_OFF, &control);
+        control |= PCI_PRI_RESET;
+        pci_write_config_word(pdev, pos + PCI_PRI_CONTROL_OFF, control);
+        return 0;
+}
+static int pdev_iommuv2_enable(struct pci_dev *pdev)
+{
+        bool reset_enable;
+        int reqs, ret;
+        /* FIXME: Hardcode number of outstanding requests for now */
+        reqs = 32;
+        if (pdev_pri_erratum(pdev, AMD_PRI_DEV_ERRATUM_LIMIT_REQ_ONE))
+                reqs = 1;
+        reset_enable = pdev_pri_erratum(pdev, AMD_PRI_DEV_ERRATUM_ENABLE_RESET);
+        /* Only allow access to user-accessible pages */
+        ret = pci_enable_pasid(pdev, 0);
+        if (ret)
+                goto out_err;
+        /* First reset the PRI state of the device */
+        ret = pci_reset_pri(pdev);
+        if (ret)
+                goto out_err;
+        /* Enable PRI */
+        ret = pci_enable_pri(pdev, reqs);
+        if (ret)
+                goto out_err;
+        if (reset_enable) {
+                ret = pri_reset_while_enabled(pdev);
+                if (ret)
+                        goto out_err;
+        }
+        ret = pci_enable_ats(pdev, PAGE_SHIFT);
+        if (ret)
+                goto out_err;
+        return 0;
+out_err:
+        pci_disable_pri(pdev);
+        pci_disable_pasid(pdev);
+        return ret;
+}
+/* FIXME: Move this to PCI code */
+#define PCI_PRI_TLP_OFF         (1 << 2)
+bool pci_pri_tlp_required(struct pci_dev *pdev)
+{
+        u16 control;
+        int pos;
+        pos = pci_find_ext_capability(pdev, PCI_PRI_CAP);
+        if (!pos)
+                return false;
+        pci_read_config_word(pdev, pos + PCI_PRI_CONTROL_OFF, &control);
+        return (control & PCI_PRI_TLP_OFF) ? true : false;
+}
 /*
 * If a device is not yet associated with a domain, this function does
 * assigns it visible for the hardware
@@ -1710,7 +2065,18 @@ static int attach_device(struct device *dev,
        dev_data = get_dev_data(dev);
-        if (amd_iommu_iotlb_sup && pci_enable_ats(pdev, PAGE_SHIFT) == 0) {
+        if (domain->flags & PD_IOMMUV2_MASK) {
+                if (!dev_data->iommu_v2 || !dev_data->passthrough)
+                        return -EINVAL;
+                if (pdev_iommuv2_enable(pdev) != 0)
+                        return -EINVAL;
+                dev_data->ats.enabled = true;
+                dev_data->ats.qdep    = pci_ats_queue_depth(pdev);
+                dev_data->pri_tlp     = pci_pri_tlp_required(pdev);
+        } else if (amd_iommu_iotlb_sup &&
+                   pci_enable_ats(pdev, PAGE_SHIFT) == 0) {
                dev_data->ats.enabled = true;
                dev_data->ats.qdep    = pci_ats_queue_depth(pdev);
        }
@@ -1760,7 +2126,7 @@ static void __detach_device(struct iommu_dev_data *dev_data)
         * passthrough domain if it is detached from any other domain.
         * Make sure we can deassign from the pt_domain itself.
         */
-        if (iommu_pass_through &&
+        if (dev_data->passthrough &&
            (dev_data->domain == NULL && domain != pt_domain))
                __attach_device(dev_data, pt_domain);
 }
@@ -1770,20 +2136,24 @@ static void __detach_device(struct iommu_dev_data *dev_data)
 */
 static void detach_device(struct device *dev)
 {
+        struct protection_domain *domain;
        struct iommu_dev_data *dev_data;
        unsigned long flags;
        dev_data = get_dev_data(dev);
+        domain   = dev_data->domain;
        /* lock device table */
        write_lock_irqsave(&amd_iommu_devtable_lock, flags);
        __detach_device(dev_data);
        write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
-        if (dev_data->ats.enabled) {
+        if (domain->flags & PD_IOMMUV2_MASK)
+                pdev_iommuv2_disable(to_pci_dev(dev));
+        else if (dev_data->ats.enabled)
                pci_disable_ats(to_pci_dev(dev));
-                dev_data->ats.enabled = false;
-        }
+        dev_data->ats.enabled = false;
 }
 /*
@@ -1818,18 +2188,20 @@ static struct protection_domain *domain_for_device(struct device *dev)
 static int device_change_notifier(struct notifier_block *nb,
                                  unsigned long action, void *data)
 {
-        struct device *dev = data;
-        u16 devid;
-        struct protection_domain *domain;
        struct dma_ops_domain *dma_domain;
+        struct protection_domain *domain;
+        struct iommu_dev_data *dev_data;
+        struct device *dev = data;
        struct amd_iommu *iommu;
        unsigned long flags;
+        u16 devid;
        if (!check_device(dev))
                return 0;
-        devid  = get_device_id(dev);
+        devid    = get_device_id(dev);
-        iommu  = amd_iommu_rlookup_table[devid];
+        iommu    = amd_iommu_rlookup_table[devid];
+        dev_data = get_dev_data(dev);
        switch (action) {
        case BUS_NOTIFY_UNBOUND_DRIVER:
@@ -1838,7 +2210,7 @@ static int device_change_notifier(struct notifier_block *nb,
                if (!domain)
                        goto out;
-                if (iommu_pass_through)
+                if (dev_data->passthrough)
                        break;
                detach_device(dev);
                break;
@@ -2434,8 +2806,9 @@ static int amd_iommu_dma_supported(struct device *dev, u64 mask)
 */
 static void prealloc_protection_domains(void)
 {
-        struct pci_dev *dev = NULL;
+        struct iommu_dev_data *dev_data;
        struct dma_ops_domain *dma_dom;
+        struct pci_dev *dev = NULL;
        u16 devid;
        for_each_pci_dev(dev) {
@@ -2444,6 +2817,16 @@ static void prealloc_protection_domains(void)
                if (!check_device(&dev->dev))
                        continue;
+                dev_data = get_dev_data(&dev->dev);
+                if (!amd_iommu_force_isolation && dev_data->iommu_v2) {
+                        /* Make sure passthrough domain is allocated */
+                        alloc_passthrough_domain();
+                        dev_data->passthrough = true;
+                        attach_device(&dev->dev, pt_domain);
+                        pr_info("AMD-Vi: Using passthough domain for device %s\n",
+                                dev_name(&dev->dev));
+                }
                /* Is there already any domain for it? */
                if (domain_for_device(&dev->dev))
                        continue;
@@ -2474,6 +2857,7 @@ static struct dma_map_ops amd_iommu_dma_ops = {
 static unsigned device_dma_ops_init(void)
 {
+        struct iommu_dev_data *dev_data;
        struct pci_dev *pdev = NULL;
        unsigned unhandled = 0;
@@ -2483,7 +2867,12 @@ static unsigned device_dma_ops_init(void)
                        continue;
                }
-                pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
+                dev_data = get_dev_data(&pdev->dev);
+                if (!dev_data->passthrough)
+                        pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
+                else
+                        pdev->dev.archdata.dma_ops = &nommu_dma_ops;
        }
        return unhandled;
@@ -2610,6 +2999,20 @@ out_err:
        return NULL;
 }
+static int __init alloc_passthrough_domain(void)
+{
+        if (pt_domain != NULL)
+                return 0;
+        /* allocate passthrough domain */
+        pt_domain = protection_domain_alloc();
+        if (!pt_domain)
+                return -ENOMEM;
+        pt_domain->mode = PAGE_MODE_NONE;
+        return 0;
+}
 static int amd_iommu_domain_init(struct iommu_domain *dom)
 {
        struct protection_domain *domain;
@@ -2623,6 +3026,8 @@ static int amd_iommu_domain_init(struct iommu_domain *dom)
        if (!domain->pt_root)
                goto out_free;
+        domain->iommu_domain = dom;
        dom->priv = domain;
        return 0;
@@ -2645,7 +3050,11 @@ static void amd_iommu_domain_destroy(struct iommu_domain *dom)
        BUG_ON(domain->dev_cnt != 0);
-        free_pagetable(domain);
+        if (domain->mode != PAGE_MODE_NONE)
+                free_pagetable(domain);
+        if (domain->flags & PD_IOMMUV2_MASK)
+                free_gcr3_table(domain);
        protection_domain_free(domain);
@@ -2702,13 +3111,15 @@ static int amd_iommu_attach_device(struct iommu_domain *dom,
 }
 static int amd_iommu_map(struct iommu_domain *dom, unsigned long iova,
-                         phys_addr_t paddr, int gfp_order, int iommu_prot)
+                         phys_addr_t paddr, size_t page_size, int iommu_prot)
 {
-        unsigned long page_size = 0x1000UL << gfp_order;
        struct protection_domain *domain = dom->priv;
        int prot = 0;
        int ret;
+        if (domain->mode == PAGE_MODE_NONE)
+                return -EINVAL;
        if (iommu_prot & IOMMU_READ)
                prot |= IOMMU_PROT_IR;
        if (iommu_prot & IOMMU_WRITE)
@@ -2721,13 +3132,14 @@ static int amd_iommu_map(struct iommu_domain *dom, unsigned long iova,
        return ret;
 }
-static int amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
+static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
-                           int gfp_order)
+                           size_t page_size)
 {
        struct protection_domain *domain = dom->priv;
-        unsigned long page_size, unmap_size;
+        size_t unmap_size;
-        page_size  = 0x1000UL << gfp_order;
+        if (domain->mode == PAGE_MODE_NONE)
+                return -EINVAL;
        mutex_lock(&domain->api_lock);
        unmap_size = iommu_unmap_page(domain, iova, page_size);
@@ -2735,7 +3147,7 @@ static int amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
        domain_flush_tlb_pde(domain);
-        return get_order(unmap_size);
+        return unmap_size;
 }
 static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
@@ -2746,6 +3158,9 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
        phys_addr_t paddr;
        u64 *pte, __pte;
+        if (domain->mode == PAGE_MODE_NONE)
+                return iova;
        pte = fetch_pte(domain, iova);
        if (!pte || !IOMMU_PTE_PRESENT(*pte))
@@ -2782,6 +3197,7 @@ static struct iommu_ops amd_iommu_ops = {
        .unmap = amd_iommu_unmap,
        .iova_to_phys = amd_iommu_iova_to_phys,
        .domain_has_cap = amd_iommu_domain_has_cap,
+        .pgsize_bitmap  = AMD_IOMMU_PGSIZES,
 };
 /*****************************************************************************
@@ -2796,21 +3212,23 @@ static struct iommu_ops amd_iommu_ops = {
 int __init amd_iommu_init_passthrough(void)
 {
-        struct amd_iommu *iommu;
+        struct iommu_dev_data *dev_data;
        struct pci_dev *dev = NULL;
+        struct amd_iommu *iommu;
        u16 devid;
+        int ret;
-        /* allocate passthrough domain */
+        ret = alloc_passthrough_domain();
-        pt_domain = protection_domain_alloc();
+        if (ret)
-        if (!pt_domain)
+                return ret;
-                return -ENOMEM;
-        pt_domain->mode |= PAGE_MODE_NONE;
        for_each_pci_dev(dev) {
                if (!check_device(&dev->dev))
                        continue;
+                dev_data = get_dev_data(&dev->dev);
+                dev_data->passthrough = true;
                devid = get_device_id(&dev->dev);
                iommu = amd_iommu_rlookup_table[devid];
@@ -2824,3 +3242,326 @@ int __init amd_iommu_init_passthrough(void)
        return 0;
 }
+/* IOMMUv2 specific functions */
+int amd_iommu_register_ppr_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_register(&ppr_notifier, nb);
+}
+EXPORT_SYMBOL(amd_iommu_register_ppr_notifier);
+int amd_iommu_unregister_ppr_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_unregister(&ppr_notifier, nb);
+}
+EXPORT_SYMBOL(amd_iommu_unregister_ppr_notifier);
+void amd_iommu_domain_direct_map(struct iommu_domain *dom)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        spin_lock_irqsave(&domain->lock, flags);
+        /* Update data structure */
+        domain->mode    = PAGE_MODE_NONE;
+        domain->updated = true;
+        /* Make changes visible to IOMMUs */
+        update_domain(domain);
+        /* Page-table is not visible to IOMMU anymore, so free it */
+        free_pagetable(domain);
+        spin_unlock_irqrestore(&domain->lock, flags);
+}
+EXPORT_SYMBOL(amd_iommu_domain_direct_map);
+int amd_iommu_domain_enable_v2(struct iommu_domain *dom, int pasids)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        int levels, ret;
+        if (pasids <= 0 || pasids > (PASID_MASK + 1))
+                return -EINVAL;
+        /* Number of GCR3 table levels required */
+        for (levels = 0; (pasids - 1) & ~0x1ff; pasids >>= 9)
+                levels += 1;
+        if (levels > amd_iommu_max_glx_val)
+                return -EINVAL;
+        spin_lock_irqsave(&domain->lock, flags);
+        /*
+         * Save us all sanity checks whether devices already in the
+         * domain support IOMMUv2. Just force that the domain has no
+         * devices attached when it is switched into IOMMUv2 mode.
+         */
+        ret = -EBUSY;
+        if (domain->dev_cnt > 0 || domain->flags & PD_IOMMUV2_MASK)
+                goto out;
+        ret = -ENOMEM;
+        domain->gcr3_tbl = (void *)get_zeroed_page(GFP_ATOMIC);
+        if (domain->gcr3_tbl == NULL)
+                goto out;
+        domain->glx      = levels;
+        domain->flags   |= PD_IOMMUV2_MASK;
+        domain->updated  = true;
+        update_domain(domain);
+        ret = 0;
+out:
+        spin_unlock_irqrestore(&domain->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_domain_enable_v2);
+static int __flush_pasid(struct protection_domain *domain, int pasid,
+                         u64 address, bool size)
+{
+        struct iommu_dev_data *dev_data;
+        struct iommu_cmd cmd;
+        int i, ret;
+        if (!(domain->flags & PD_IOMMUV2_MASK))
+                return -EINVAL;
+        build_inv_iommu_pasid(&cmd, domain->id, pasid, address, size);
+        /*
+         * IOMMU TLB needs to be flushed before Device TLB to
+         * prevent device TLB refill from IOMMU TLB
+         */
+        for (i = 0; i < amd_iommus_present; ++i) {
+                if (domain->dev_iommu[i] == 0)
+                        continue;
+                ret = iommu_queue_command(amd_iommus[i], &cmd);
+                if (ret != 0)
+                        goto out;
+        }
+        /* Wait until IOMMU TLB flushes are complete */
+        domain_flush_complete(domain);
+        /* Now flush device TLBs */
+        list_for_each_entry(dev_data, &domain->dev_list, list) {
+                struct amd_iommu *iommu;
+                int qdep;
+                BUG_ON(!dev_data->ats.enabled);
+                qdep  = dev_data->ats.qdep;
+                iommu = amd_iommu_rlookup_table[dev_data->devid];
+                build_inv_iotlb_pasid(&cmd, dev_data->devid, pasid,
+                                      qdep, address, size);
+                ret = iommu_queue_command(iommu, &cmd);
+                if (ret != 0)
+                        goto out;
+        }
+        /* Wait until all device TLBs are flushed */
+        domain_flush_complete(domain);
+        ret = 0;
+out:
+        return ret;
+}
+static int __amd_iommu_flush_page(struct protection_domain *domain, int pasid,
+                                  u64 address)
+{
+        INC_STATS_COUNTER(invalidate_iotlb);
+        return __flush_pasid(domain, pasid, address, false);
+}
+int amd_iommu_flush_page(struct iommu_domain *dom, int pasid,
+                         u64 address)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&domain->lock, flags);
+        ret = __amd_iommu_flush_page(domain, pasid, address);
+        spin_unlock_irqrestore(&domain->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_flush_page);
+static int __amd_iommu_flush_tlb(struct protection_domain *domain, int pasid)
+{
+        INC_STATS_COUNTER(invalidate_iotlb_all);
+        return __flush_pasid(domain, pasid, CMD_INV_IOMMU_ALL_PAGES_ADDRESS,
+                             true);
+}
+int amd_iommu_flush_tlb(struct iommu_domain *dom, int pasid)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&domain->lock, flags);
+        ret = __amd_iommu_flush_tlb(domain, pasid);
+        spin_unlock_irqrestore(&domain->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_flush_tlb);
+static u64 *__get_gcr3_pte(u64 *root, int level, int pasid, bool alloc)
+{
+        int index;
+        u64 *pte;
+        while (true) {
+                index = (pasid >> (9 * level)) & 0x1ff;
+                pte   = &root[index];
+                if (level == 0)
+                        break;
+                if (!(*pte & GCR3_VALID)) {
+                        if (!alloc)
+                                return NULL;
+                        root = (void *)get_zeroed_page(GFP_ATOMIC);
+                        if (root == NULL)
+                                return NULL;
+                        *pte = __pa(root) | GCR3_VALID;
+                }
+                root = __va(*pte & PAGE_MASK);
+                level -= 1;
+        }
+        return pte;
+}
+static int __set_gcr3(struct protection_domain *domain, int pasid,
+                      unsigned long cr3)
+{
+        u64 *pte;
+        if (domain->mode != PAGE_MODE_NONE)
+                return -EINVAL;
+        pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, true);
+        if (pte == NULL)
+                return -ENOMEM;
+        *pte = (cr3 & PAGE_MASK) | GCR3_VALID;
+        return __amd_iommu_flush_tlb(domain, pasid);
+}
+static int __clear_gcr3(struct protection_domain *domain, int pasid)
+{
+        u64 *pte;
+        if (domain->mode != PAGE_MODE_NONE)
+                return -EINVAL;
+        pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, false);
+        if (pte == NULL)
+                return 0;
+        *pte = 0;
+        return __amd_iommu_flush_tlb(domain, pasid);
+}
+int amd_iommu_domain_set_gcr3(struct iommu_domain *dom, int pasid,
+                              unsigned long cr3)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&domain->lock, flags);
+        ret = __set_gcr3(domain, pasid, cr3);
+        spin_unlock_irqrestore(&domain->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_domain_set_gcr3);
+int amd_iommu_domain_clear_gcr3(struct iommu_domain *dom, int pasid)
+{
+        struct protection_domain *domain = dom->priv;
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&domain->lock, flags);
+        ret = __clear_gcr3(domain, pasid);
+        spin_unlock_irqrestore(&domain->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_domain_clear_gcr3);
+int amd_iommu_complete_ppr(struct pci_dev *pdev, int pasid,
+                           int status, int tag)
+{
+        struct iommu_dev_data *dev_data;
+        struct amd_iommu *iommu;
+        struct iommu_cmd cmd;
+        INC_STATS_COUNTER(complete_ppr);
+        dev_data = get_dev_data(&pdev->dev);
+        iommu    = amd_iommu_rlookup_table[dev_data->devid];
+        build_complete_ppr(&cmd, dev_data->devid, pasid, status,
+                           tag, dev_data->pri_tlp);
+        return iommu_queue_command(iommu, &cmd);
+}
+EXPORT_SYMBOL(amd_iommu_complete_ppr);
+struct iommu_domain *amd_iommu_get_v2_domain(struct pci_dev *pdev)
+{
+        struct protection_domain *domain;
+        domain = get_domain(&pdev->dev);
+        if (IS_ERR(domain))
+                return NULL;
+        /* Only return IOMMUv2 domains */
+        if (!(domain->flags & PD_IOMMUV2_MASK))
+                return NULL;
+        return domain->iommu_domain;
+}
+EXPORT_SYMBOL(amd_iommu_get_v2_domain);
+void amd_iommu_enable_device_erratum(struct pci_dev *pdev, u32 erratum)
+{
+        struct iommu_dev_data *dev_data;
+        if (!amd_iommu_v2_supported())
+                return;
+        dev_data = get_dev_data(&pdev->dev);
+        dev_data->errata |= (1 << erratum);
+}
+EXPORT_SYMBOL(amd_iommu_enable_device_erratum);
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 82d2410f4205..c7a5d7e14547 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -25,6 +25,7 @@
 #include <linux/interrupt.h>
 #include <linux/msi.h>
 #include <linux/amd-iommu.h>
+#include <linux/export.h>
 #include <asm/pci-direct.h>
 #include <asm/iommu.h>
 #include <asm/gart.h>
@@ -141,6 +142,12 @@ int amd_iommus_present;
 bool amd_iommu_np_cache __read_mostly;
 bool amd_iommu_iotlb_sup __read_mostly = true;
+u32 amd_iommu_max_pasids __read_mostly = ~0;
+bool amd_iommu_v2_present __read_mostly;
+bool amd_iommu_force_isolation __read_mostly;
 /*
 * The ACPI table parsing functions set this variable on an error
 */
@@ -581,21 +588,69 @@ static void __init free_event_buffer(struct amd_iommu *iommu)
        free_pages((unsigned long)iommu->evt_buf, get_order(EVT_BUFFER_SIZE));
 }
+/* allocates the memory where the IOMMU will log its events to */
+static u8 * __init alloc_ppr_log(struct amd_iommu *iommu)
+{
+        iommu->ppr_log = (u8 *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                                get_order(PPR_LOG_SIZE));
+        if (iommu->ppr_log == NULL)
+                return NULL;
+        return iommu->ppr_log;
+}
+static void iommu_enable_ppr_log(struct amd_iommu *iommu)
+{
+        u64 entry;
+        if (iommu->ppr_log == NULL)
+                return;
+        entry = (u64)virt_to_phys(iommu->ppr_log) | PPR_LOG_SIZE_512;
+        memcpy_toio(iommu->mmio_base + MMIO_PPR_LOG_OFFSET,
+                    &entry, sizeof(entry));
+        /* set head and tail to zero manually */
+        writel(0x00, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
+        writel(0x00, iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
+        iommu_feature_enable(iommu, CONTROL_PPFLOG_EN);
+        iommu_feature_enable(iommu, CONTROL_PPR_EN);
+}
+static void __init free_ppr_log(struct amd_iommu *iommu)
+{
+        if (iommu->ppr_log == NULL)
+                return;
+        free_pages((unsigned long)iommu->ppr_log, get_order(PPR_LOG_SIZE));
+}
+static void iommu_enable_gt(struct amd_iommu *iommu)
+{
+        if (!iommu_feature(iommu, FEATURE_GT))
+                return;
+        iommu_feature_enable(iommu, CONTROL_GT_EN);
+}
 /* sets a specific bit in the device table entry. */
 static void set_dev_entry_bit(u16 devid, u8 bit)
 {
-        int i = (bit >> 5) & 0x07;
+        int i = (bit >> 6) & 0x03;
-        int _bit = bit & 0x1f;
+        int _bit = bit & 0x3f;
-        amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
+        amd_iommu_dev_table[devid].data[i] |= (1UL << _bit);
 }
 static int get_dev_entry_bit(u16 devid, u8 bit)
 {
-        int i = (bit >> 5) & 0x07;
+        int i = (bit >> 6) & 0x03;
-        int _bit = bit & 0x1f;
+        int _bit = bit & 0x3f;
-        return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
+        return (amd_iommu_dev_table[devid].data[i] & (1UL << _bit)) >> _bit;
 }
@@ -699,6 +754,32 @@ static void __init init_iommu_from_pci(struct amd_iommu *iommu)
        iommu->features = ((u64)high << 32) | low;
+        if (iommu_feature(iommu, FEATURE_GT)) {
+                int glxval;
+                u32 pasids;
+                u64 shift;
+                shift   = iommu->features & FEATURE_PASID_MASK;
+                shift >>= FEATURE_PASID_SHIFT;
+                pasids  = (1 << shift);
+                amd_iommu_max_pasids = min(amd_iommu_max_pasids, pasids);
+                glxval   = iommu->features & FEATURE_GLXVAL_MASK;
+                glxval >>= FEATURE_GLXVAL_SHIFT;
+                if (amd_iommu_max_glx_val == -1)
+                        amd_iommu_max_glx_val = glxval;
+                else
+                        amd_iommu_max_glx_val = min(amd_iommu_max_glx_val, glxval);
+        }
+        if (iommu_feature(iommu, FEATURE_GT) &&
+            iommu_feature(iommu, FEATURE_PPR)) {
+                iommu->is_iommu_v2   = true;
+                amd_iommu_v2_present = true;
+        }
        if (!is_rd890_iommu(iommu->dev))
                return;
@@ -901,6 +982,7 @@ static void __init free_iommu_one(struct amd_iommu *iommu)
 {
        free_command_buffer(iommu);
        free_event_buffer(iommu);
+        free_ppr_log(iommu);
        iommu_unmap_mmio_space(iommu);
 }
@@ -964,6 +1046,12 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
        init_iommu_from_acpi(iommu, h);
        init_iommu_devices(iommu);
+        if (iommu_feature(iommu, FEATURE_PPR)) {
+                iommu->ppr_log = alloc_ppr_log(iommu);
+                if (!iommu->ppr_log)
+                        return -ENOMEM;
+        }
        if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE))
                amd_iommu_np_cache = true;
@@ -1050,6 +1138,9 @@ static int iommu_setup_msi(struct amd_iommu *iommu)
        iommu->int_enabled = true;
        iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
+        if (iommu->ppr_log != NULL)
+                iommu_feature_enable(iommu, CONTROL_PPFINT_EN);
        return 0;
 }
@@ -1274,6 +1365,8 @@ static void enable_iommus(void)
                iommu_set_device_table(iommu);
                iommu_enable_command_buffer(iommu);
                iommu_enable_event_buffer(iommu);
+                iommu_enable_ppr_log(iommu);
+                iommu_enable_gt(iommu);
                iommu_set_exclusion_range(iommu);
                iommu_init_msi(iommu);
                iommu_enable(iommu);
@@ -1560,6 +1653,8 @@ static int __init parse_amd_iommu_options(char *str)
                        amd_iommu_unmap_flush = true;
                if (strncmp(str, "off", 3) == 0)
                        amd_iommu_disabled = true;
+                if (strncmp(str, "force_isolation", 15) == 0)
+                        amd_iommu_force_isolation = true;
        }
        return 1;
@@ -1572,3 +1667,9 @@ IOMMU_INIT_FINISH(amd_iommu_detect,
                  gart_iommu_hole_init,
                  0,
                  0);
+bool amd_iommu_v2_supported(void)
+{
+        return amd_iommu_v2_present;
+}
+EXPORT_SYMBOL(amd_iommu_v2_supported);
diff --git a/drivers/iommu/amd_iommu_proto.h b/drivers/iommu/amd_iommu_proto.h
index 7ffaa64410b0..1a7f41c6cc66 100644
--- a/drivers/iommu/amd_iommu_proto.h
+++ b/drivers/iommu/amd_iommu_proto.h
@@ -31,6 +31,30 @@ extern int amd_iommu_init_devices(void);
 extern void amd_iommu_uninit_devices(void);
 extern void amd_iommu_init_notifier(void);
 extern void amd_iommu_init_api(void);
+/* IOMMUv2 specific functions */
+struct iommu_domain;
+extern bool amd_iommu_v2_supported(void);
+extern int amd_iommu_register_ppr_notifier(struct notifier_block *nb);
+extern int amd_iommu_unregister_ppr_notifier(struct notifier_block *nb);
+extern void amd_iommu_domain_direct_map(struct iommu_domain *dom);
+extern int amd_iommu_domain_enable_v2(struct iommu_domain *dom, int pasids);
+extern int amd_iommu_flush_page(struct iommu_domain *dom, int pasid,
+                                u64 address);
+extern int amd_iommu_flush_tlb(struct iommu_domain *dom, int pasid);
+extern int amd_iommu_domain_set_gcr3(struct iommu_domain *dom, int pasid,
+                                     unsigned long cr3);
+extern int amd_iommu_domain_clear_gcr3(struct iommu_domain *dom, int pasid);
+extern struct iommu_domain *amd_iommu_get_v2_domain(struct pci_dev *pdev);
+#define PPR_SUCCESS                     0x0
+#define PPR_INVALID                     0x1
+#define PPR_FAILURE                     0xf
+extern int amd_iommu_complete_ppr(struct pci_dev *pdev, int pasid,
+                                  int status, int tag);
 #ifndef CONFIG_AMD_IOMMU_STATS
 static inline void amd_iommu_stats_init(void) { }
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 5b9c5075e81a..6ad8b10b3130 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -69,11 +69,14 @@
 #define MMIO_EXCL_BASE_OFFSET   0x0020
 #define MMIO_EXCL_LIMIT_OFFSET  0x0028
 #define MMIO_EXT_FEATURES       0x0030
+#define MMIO_PPR_LOG_OFFSET     0x0038
 #define MMIO_CMD_HEAD_OFFSET    0x2000
 #define MMIO_CMD_TAIL_OFFSET    0x2008
 #define MMIO_EVT_HEAD_OFFSET    0x2010
 #define MMIO_EVT_TAIL_OFFSET    0x2018
 #define MMIO_STATUS_OFFSET      0x2020
+#define MMIO_PPR_HEAD_OFFSET    0x2030
+#define MMIO_PPR_TAIL_OFFSET    0x2038
 /* Extended Feature Bits */
@@ -87,8 +90,17 @@
 #define FEATURE_HE              (1ULL<<8)
 #define FEATURE_PC              (1ULL<<9)
+#define FEATURE_PASID_SHIFT     32
+#define FEATURE_PASID_MASK      (0x1fULL << FEATURE_PASID_SHIFT)
+#define FEATURE_GLXVAL_SHIFT    14
+#define FEATURE_GLXVAL_MASK     (0x03ULL << FEATURE_GLXVAL_SHIFT)
+#define PASID_MASK              0x000fffff
 /* MMIO status bits */
-#define MMIO_STATUS_COM_WAIT_INT_MASK   0x04
+#define MMIO_STATUS_COM_WAIT_INT_MASK   (1 << 2)
+#define MMIO_STATUS_PPR_INT_MASK        (1 << 6)
 /* event logging constants */
 #define EVENT_ENTRY_SIZE        0x10
@@ -122,18 +134,25 @@
 #define CONTROL_CMDBUF_EN       0x0cULL
 #define CONTROL_PPFLOG_EN       0x0dULL
 #define CONTROL_PPFINT_EN       0x0eULL
+#define CONTROL_PPR_EN          0x0fULL
+#define CONTROL_GT_EN           0x10ULL
 /* command specific defines */
 #define CMD_COMPL_WAIT          0x01
 #define CMD_INV_DEV_ENTRY       0x02
 #define CMD_INV_IOMMU_PAGES     0x03
 #define CMD_INV_IOTLB_PAGES     0x04
+#define CMD_COMPLETE_PPR        0x07
 #define CMD_INV_ALL             0x08
 #define CMD_COMPL_WAIT_STORE_MASK       0x01
 #define CMD_COMPL_WAIT_INT_MASK         0x02
 #define CMD_INV_IOMMU_PAGES_SIZE_MASK   0x01
 #define CMD_INV_IOMMU_PAGES_PDE_MASK    0x02
+#define CMD_INV_IOMMU_PAGES_GN_MASK     0x04
+#define PPR_STATUS_MASK                 0xf
+#define PPR_STATUS_SHIFT                12
 #define CMD_INV_IOMMU_ALL_PAGES_ADDRESS 0x7fffffffffffffffULL
@@ -165,6 +184,23 @@
 #define EVT_BUFFER_SIZE         8192 /* 512 entries */
 #define EVT_LEN_MASK            (0x9ULL << 56)
+/* Constants for PPR Log handling */
+#define PPR_LOG_ENTRIES         512
+#define PPR_LOG_SIZE_SHIFT      56
+#define PPR_LOG_SIZE_512        (0x9ULL << PPR_LOG_SIZE_SHIFT)
+#define PPR_ENTRY_SIZE          16
+#define PPR_LOG_SIZE            (PPR_ENTRY_SIZE * PPR_LOG_ENTRIES)
+#define PPR_REQ_TYPE(x)         (((x) >> 60) & 0xfULL)
+#define PPR_FLAGS(x)            (((x) >> 48) & 0xfffULL)
+#define PPR_DEVID(x)            ((x) & 0xffffULL)
+#define PPR_TAG(x)              (((x) >> 32) & 0x3ffULL)
+#define PPR_PASID1(x)           (((x) >> 16) & 0xffffULL)
+#define PPR_PASID2(x)           (((x) >> 42) & 0xfULL)
+#define PPR_PASID(x)            ((PPR_PASID2(x) << 16) | PPR_PASID1(x))
+#define PPR_REQ_FAULT           0x01
 #define PAGE_MODE_NONE    0x00
 #define PAGE_MODE_1_LEVEL 0x01
 #define PAGE_MODE_2_LEVEL 0x02
@@ -230,7 +266,24 @@
 #define IOMMU_PTE_IR (1ULL << 61)
 #define IOMMU_PTE_IW (1ULL << 62)
-#define DTE_FLAG_IOTLB  0x01
+#define DTE_FLAG_IOTLB  (0x01UL << 32)
+#define DTE_FLAG_GV     (0x01ULL << 55)
+#define DTE_GLX_SHIFT   (56)
+#define DTE_GLX_MASK    (3)
+#define DTE_GCR3_VAL_A(x)       (((x) >> 12) & 0x00007ULL)
+#define DTE_GCR3_VAL_B(x)       (((x) >> 15) & 0x0ffffULL)
+#define DTE_GCR3_VAL_C(x)       (((x) >> 31) & 0xfffffULL)
+#define DTE_GCR3_INDEX_A        0
+#define DTE_GCR3_INDEX_B        1
+#define DTE_GCR3_INDEX_C        1
+#define DTE_GCR3_SHIFT_A        58
+#define DTE_GCR3_SHIFT_B        16
+#define DTE_GCR3_SHIFT_C        43
+#define GCR3_VALID              0x01ULL
 #define IOMMU_PAGE_MASK (((1ULL << 52) - 1) & ~0xfffULL)
 #define IOMMU_PTE_PRESENT(pte) ((pte) & IOMMU_PTE_P)
@@ -257,6 +310,7 @@
                                              domain for an IOMMU */
 #define PD_PASSTHROUGH_MASK     (1UL << 2) /* domain has no page
                                              translation */
+#define PD_IOMMUV2_MASK         (1UL << 3) /* domain has gcr3 table */
 extern bool amd_iommu_dump;
 #define DUMP_printk(format, arg...)                                     \
@@ -285,6 +339,29 @@ extern bool amd_iommu_iotlb_sup;
 #define APERTURE_RANGE_INDEX(a) ((a) >> APERTURE_RANGE_SHIFT)
 #define APERTURE_PAGE_INDEX(a)  (((a) >> 21) & 0x3fULL)
+/*
+ * This struct is used to pass information about
+ * incoming PPR faults around.
+ */
+struct amd_iommu_fault {
+        u64 address;    /* IO virtual address of the fault*/
+        u32 pasid;      /* Address space identifier */
+        u16 device_id;  /* Originating PCI device id */
+        u16 tag;        /* PPR tag */
+        u16 flags;      /* Fault flags */
+};
+#define PPR_FAULT_EXEC  (1 << 1)
+#define PPR_FAULT_READ  (1 << 2)
+#define PPR_FAULT_WRITE (1 << 5)
+#define PPR_FAULT_USER  (1 << 6)
+#define PPR_FAULT_RSVD  (1 << 7)
+#define PPR_FAULT_GN    (1 << 8)
+struct iommu_domain;
 /*
 * This structure contains generic data for  IOMMU protection domains
 * independent of their use.
@@ -297,11 +374,15 @@ struct protection_domain {
        u16 id;                 /* the domain id written to the device table */
        int mode;               /* paging mode (0-6 levels) */
        u64 *pt_root;           /* page table root pointer */
+        int glx;                /* Number of levels for GCR3 table */
+        u64 *gcr3_tbl;          /* Guest CR3 table */
        unsigned long flags;    /* flags to find out type of domain */
        bool updated;           /* complete domain flush required */
        unsigned dev_cnt;       /* devices assigned to this domain */
        unsigned dev_iommu[MAX_IOMMUS]; /* per-IOMMU reference count */
        void *priv;             /* private data */
+        struct iommu_domain *iommu_domain; /* Pointer to generic
+                                              domain structure */
 };
@@ -315,10 +396,15 @@ struct iommu_dev_data {
        struct protection_domain *domain; /* Domain the device is bound to */
        atomic_t bind;                    /* Domain attach reverent count */
        u16 devid;                        /* PCI Device ID */
+        bool iommu_v2;                    /* Device can make use of IOMMUv2 */
+        bool passthrough;                 /* Default for device is pt_domain */
        struct {
                bool enabled;
                int qdep;
        } ats;                            /* ATS state */
+        bool pri_tlp;                     /* PASID TLB required for
+                                             PPR completions */
+        u32 errata;                       /* Bitmap for errata to apply */
 };
 /*
@@ -399,6 +485,9 @@ struct amd_iommu {
        /* Extended features */
        u64 features;
+        /* IOMMUv2 */
+        bool is_iommu_v2;
        /*
         * Capability pointer. There could be more than one IOMMU per PCI
         * device function if there are more than one AMD IOMMU capability
@@ -431,6 +520,9 @@ struct amd_iommu {
        /* MSI number for event interrupt */
        u16 evt_msi_num;
+        /* Base of the PPR log, if present */
+        u8 *ppr_log;
        /* true if interrupts for this IOMMU are already enabled */
        bool int_enabled;
@@ -484,7 +576,7 @@ extern struct list_head amd_iommu_pd_list;
 * Structure defining one entry in the device table
 */
 struct dev_table_entry {
-        u32 data[8];
+        u64 data[4];
 };
 /*
@@ -549,6 +641,16 @@ extern unsigned long *amd_iommu_pd_alloc_bitmap;
 */
 extern bool amd_iommu_unmap_flush;
+/* Smallest number of PASIDs supported by any IOMMU in the system */
+extern u32 amd_iommu_max_pasids;
+extern bool amd_iommu_v2_present;
+extern bool amd_iommu_force_isolation;
+/* Max levels of glxval supported */
+extern int amd_iommu_max_glx_val;
 /* takes bus and device/function and returns the device id
 * FIXME: should that be in generic PCI code? */
 static inline u16 calc_devid(u8 bus, u8 devfn)
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
new file mode 100644
index 000000000000..fe812e2a0474
--- /dev/null
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -0,0 +1,959 @@
+/*
+ * Copyright (C) 2010-2012 Advanced Micro Devices, Inc.
+ * Author: Joerg Roedel <joerg.roedel@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+#include <linux/mmu_notifier.h>
+#include <linux/amd-iommu.h>
+#include <linux/mm_types.h>
+#include <linux/profile.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/iommu.h>
+#include <linux/wait.h>
+#include <linux/pci.h>
+#include <linux/gfp.h>
+#include "amd_iommu_types.h"
+#include "amd_iommu_proto.h"
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Joerg Roedel <joerg.roedel@amd.com>");
+#define MAX_DEVICES             0x10000
+#define PRI_QUEUE_SIZE          512
+struct pri_queue {
+        atomic_t inflight;
+        bool finish;
+        int status;
+};
+struct pasid_state {
+        struct list_head list;                  /* For global state-list */
+        atomic_t count;                         /* Reference count */
+        struct task_struct *task;               /* Task bound to this PASID */
+        struct mm_struct *mm;                   /* mm_struct for the faults */
+        struct mmu_notifier mn;                 /* mmu_otifier handle */
+        struct pri_queue pri[PRI_QUEUE_SIZE];   /* PRI tag states */
+        struct device_state *device_state;      /* Link to our device_state */
+        int pasid;                              /* PASID index */
+        spinlock_t lock;                        /* Protect pri_queues */
+        wait_queue_head_t wq;                   /* To wait for count == 0 */
+};
+struct device_state {
+        atomic_t count;
+        struct pci_dev *pdev;
+        struct pasid_state **states;
+        struct iommu_domain *domain;
+        int pasid_levels;
+        int max_pasids;
+        amd_iommu_invalid_ppr_cb inv_ppr_cb;
+        spinlock_t lock;
+        wait_queue_head_t wq;
+};
+struct fault {
+        struct work_struct work;
+        struct device_state *dev_state;
+        struct pasid_state *state;
+        struct mm_struct *mm;
+        u64 address;
+        u16 devid;
+        u16 pasid;
+        u16 tag;
+        u16 finish;
+        u16 flags;
+};
+struct device_state **state_table;
+static spinlock_t state_lock;
+/* List and lock for all pasid_states */
+static LIST_HEAD(pasid_state_list);
+static DEFINE_SPINLOCK(ps_lock);
+static struct workqueue_struct *iommu_wq;
+/*
+ * Empty page table - Used between
+ * mmu_notifier_invalidate_range_start and
+ * mmu_notifier_invalidate_range_end
+ */
+static u64 *empty_page_table;
+static void free_pasid_states(struct device_state *dev_state);
+static void unbind_pasid(struct device_state *dev_state, int pasid);
+static int task_exit(struct notifier_block *nb, unsigned long e, void *data);
+static u16 device_id(struct pci_dev *pdev)
+{
+        u16 devid;
+        devid = pdev->bus->number;
+        devid = (devid << 8) | pdev->devfn;
+        return devid;
+}
+static struct device_state *get_device_state(u16 devid)
+{
+        struct device_state *dev_state;
+        unsigned long flags;
+        spin_lock_irqsave(&state_lock, flags);
+        dev_state = state_table[devid];
+        if (dev_state != NULL)
+                atomic_inc(&dev_state->count);
+        spin_unlock_irqrestore(&state_lock, flags);
+        return dev_state;
+}
+static void free_device_state(struct device_state *dev_state)
+{
+        /*
+         * First detach device from domain - No more PRI requests will arrive
+         * from that device after it is unbound from the IOMMUv2 domain.
+         */
+        iommu_detach_device(dev_state->domain, &dev_state->pdev->dev);
+        /* Everything is down now, free the IOMMUv2 domain */
+        iommu_domain_free(dev_state->domain);
+        /* Finally get rid of the device-state */
+        kfree(dev_state);
+}
+static void put_device_state(struct device_state *dev_state)
+{
+        if (atomic_dec_and_test(&dev_state->count))
+                wake_up(&dev_state->wq);
+}
+static void put_device_state_wait(struct device_state *dev_state)
+{
+        DEFINE_WAIT(wait);
+        prepare_to_wait(&dev_state->wq, &wait, TASK_UNINTERRUPTIBLE);
+        if (!atomic_dec_and_test(&dev_state->count))
+                schedule();
+        finish_wait(&dev_state->wq, &wait);
+        free_device_state(dev_state);
+}
+static struct notifier_block profile_nb = {
+        .notifier_call = task_exit,
+};
+static void link_pasid_state(struct pasid_state *pasid_state)
+{
+        spin_lock(&ps_lock);
+        list_add_tail(&pasid_state->list, &pasid_state_list);
+        spin_unlock(&ps_lock);
+}
+static void __unlink_pasid_state(struct pasid_state *pasid_state)
+{
+        list_del(&pasid_state->list);
+}
+static void unlink_pasid_state(struct pasid_state *pasid_state)
+{
+        spin_lock(&ps_lock);
+        __unlink_pasid_state(pasid_state);
+        spin_unlock(&ps_lock);
+}
+/* Must be called under dev_state->lock */
+static struct pasid_state **__get_pasid_state_ptr(struct device_state *dev_state,
+                                                  int pasid, bool alloc)
+{
+        struct pasid_state **root, **ptr;
+        int level, index;
+        level = dev_state->pasid_levels;
+        root  = dev_state->states;
+        while (true) {
+                index = (pasid >> (9 * level)) & 0x1ff;
+                ptr   = &root[index];
+                if (level == 0)
+                        break;
+                if (*ptr == NULL) {
+                        if (!alloc)
+                                return NULL;
+                        *ptr = (void *)get_zeroed_page(GFP_ATOMIC);
+                        if (*ptr == NULL)
+                                return NULL;
+                }
+                root   = (struct pasid_state **)*ptr;
+                level -= 1;
+        }
+        return ptr;
+}
+static int set_pasid_state(struct device_state *dev_state,
+                           struct pasid_state *pasid_state,
+                           int pasid)
+{
+        struct pasid_state **ptr;
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&dev_state->lock, flags);
+        ptr = __get_pasid_state_ptr(dev_state, pasid, true);
+        ret = -ENOMEM;
+        if (ptr == NULL)
+                goto out_unlock;
+        ret = -ENOMEM;
+        if (*ptr != NULL)
+                goto out_unlock;
+        *ptr = pasid_state;
+        ret = 0;
+out_unlock:
+        spin_unlock_irqrestore(&dev_state->lock, flags);
+        return ret;
+}
+static void clear_pasid_state(struct device_state *dev_state, int pasid)
+{
+        struct pasid_state **ptr;
+        unsigned long flags;
+        spin_lock_irqsave(&dev_state->lock, flags);
+        ptr = __get_pasid_state_ptr(dev_state, pasid, true);
+        if (ptr == NULL)
+                goto out_unlock;
+        *ptr = NULL;
+out_unlock:
+        spin_unlock_irqrestore(&dev_state->lock, flags);
+}
+static struct pasid_state *get_pasid_state(struct device_state *dev_state,
+                                           int pasid)
+{
+        struct pasid_state **ptr, *ret = NULL;
+        unsigned long flags;
+        spin_lock_irqsave(&dev_state->lock, flags);
+        ptr = __get_pasid_state_ptr(dev_state, pasid, false);
+        if (ptr == NULL)
+                goto out_unlock;
+        ret = *ptr;
+        if (ret)
+                atomic_inc(&ret->count);
+out_unlock:
+        spin_unlock_irqrestore(&dev_state->lock, flags);
+        return ret;
+}
+static void free_pasid_state(struct pasid_state *pasid_state)
+{
+        kfree(pasid_state);
+}
+static void put_pasid_state(struct pasid_state *pasid_state)
+{
+        if (atomic_dec_and_test(&pasid_state->count)) {
+                put_device_state(pasid_state->device_state);
+                wake_up(&pasid_state->wq);
+        }
+}
+static void put_pasid_state_wait(struct pasid_state *pasid_state)
+{
+        DEFINE_WAIT(wait);
+        prepare_to_wait(&pasid_state->wq, &wait, TASK_UNINTERRUPTIBLE);
+        if (atomic_dec_and_test(&pasid_state->count))
+                put_device_state(pasid_state->device_state);
+        else
+                schedule();
+        finish_wait(&pasid_state->wq, &wait);
+        mmput(pasid_state->mm);
+        free_pasid_state(pasid_state);
+}
+static void __unbind_pasid(struct pasid_state *pasid_state)
+{
+        struct iommu_domain *domain;
+        domain = pasid_state->device_state->domain;
+        amd_iommu_domain_clear_gcr3(domain, pasid_state->pasid);
+        clear_pasid_state(pasid_state->device_state, pasid_state->pasid);
+        /* Make sure no more pending faults are in the queue */
+        flush_workqueue(iommu_wq);
+        mmu_notifier_unregister(&pasid_state->mn, pasid_state->mm);
+        put_pasid_state(pasid_state); /* Reference taken in bind() function */
+}
+static void unbind_pasid(struct device_state *dev_state, int pasid)
+{
+        struct pasid_state *pasid_state;
+        pasid_state = get_pasid_state(dev_state, pasid);
+        if (pasid_state == NULL)
+                return;
+        unlink_pasid_state(pasid_state);
+        __unbind_pasid(pasid_state);
+        put_pasid_state_wait(pasid_state); /* Reference taken in this function */
+}
+static void free_pasid_states_level1(struct pasid_state **tbl)
+{
+        int i;
+        for (i = 0; i < 512; ++i) {
+                if (tbl[i] == NULL)
+                        continue;
+                free_page((unsigned long)tbl[i]);
+        }
+}
+static void free_pasid_states_level2(struct pasid_state **tbl)
+{
+        struct pasid_state **ptr;
+        int i;
+        for (i = 0; i < 512; ++i) {
+                if (tbl[i] == NULL)
+                        continue;
+                ptr = (struct pasid_state **)tbl[i];
+                free_pasid_states_level1(ptr);
+        }
+}
+static void free_pasid_states(struct device_state *dev_state)
+{
+        struct pasid_state *pasid_state;
+        int i;
+        for (i = 0; i < dev_state->max_pasids; ++i) {
+                pasid_state = get_pasid_state(dev_state, i);
+                if (pasid_state == NULL)
+                        continue;
+                put_pasid_state(pasid_state);
+                unbind_pasid(dev_state, i);
+        }
+        if (dev_state->pasid_levels == 2)
+                free_pasid_states_level2(dev_state->states);
+        else if (dev_state->pasid_levels == 1)
+                free_pasid_states_level1(dev_state->states);
+        else if (dev_state->pasid_levels != 0)
+                BUG();
+        free_page((unsigned long)dev_state->states);
+}
+static struct pasid_state *mn_to_state(struct mmu_notifier *mn)
+{
+        return container_of(mn, struct pasid_state, mn);
+}
+static void __mn_flush_page(struct mmu_notifier *mn,
+                            unsigned long address)
+{
+        struct pasid_state *pasid_state;
+        struct device_state *dev_state;
+        pasid_state = mn_to_state(mn);
+        dev_state   = pasid_state->device_state;
+        amd_iommu_flush_page(dev_state->domain, pasid_state->pasid, address);
+}
+static int mn_clear_flush_young(struct mmu_notifier *mn,
+                                struct mm_struct *mm,
+                                unsigned long address)
+{
+        __mn_flush_page(mn, address);
+        return 0;
+}
+static void mn_change_pte(struct mmu_notifier *mn,
+                          struct mm_struct *mm,
+                          unsigned long address,
+                          pte_t pte)
+{
+        __mn_flush_page(mn, address);
+}
+static void mn_invalidate_page(struct mmu_notifier *mn,
+                               struct mm_struct *mm,
+                               unsigned long address)
+{
+        __mn_flush_page(mn, address);
+}
+static void mn_invalidate_range_start(struct mmu_notifier *mn,
+                                      struct mm_struct *mm,
+                                      unsigned long start, unsigned long end)
+{
+        struct pasid_state *pasid_state;
+        struct device_state *dev_state;
+        pasid_state = mn_to_state(mn);
+        dev_state   = pasid_state->device_state;
+        amd_iommu_domain_set_gcr3(dev_state->domain, pasid_state->pasid,
+                                  __pa(empty_page_table));
+}
+static void mn_invalidate_range_end(struct mmu_notifier *mn,
+                                    struct mm_struct *mm,
+                                    unsigned long start, unsigned long end)
+{
+        struct pasid_state *pasid_state;
+        struct device_state *dev_state;
+        pasid_state = mn_to_state(mn);
+        dev_state   = pasid_state->device_state;
+        amd_iommu_domain_set_gcr3(dev_state->domain, pasid_state->pasid,
+                                  __pa(pasid_state->mm->pgd));
+}
+static struct mmu_notifier_ops iommu_mn = {
+        .clear_flush_young      = mn_clear_flush_young,
+        .change_pte             = mn_change_pte,
+        .invalidate_page        = mn_invalidate_page,
+        .invalidate_range_start = mn_invalidate_range_start,
+        .invalidate_range_end   = mn_invalidate_range_end,
+};
+static void set_pri_tag_status(struct pasid_state *pasid_state,
+                               u16 tag, int status)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        pasid_state->pri[tag].status = status;
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
+}
+static void finish_pri_tag(struct device_state *dev_state,
+                           struct pasid_state *pasid_state,
+                           u16 tag)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        if (atomic_dec_and_test(&pasid_state->pri[tag].inflight) &&
+            pasid_state->pri[tag].finish) {
+                amd_iommu_complete_ppr(dev_state->pdev, pasid_state->pasid,
+                                       pasid_state->pri[tag].status, tag);
+                pasid_state->pri[tag].finish = false;
+                pasid_state->pri[tag].status = PPR_SUCCESS;
+        }
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
+}
+static void do_fault(struct work_struct *work)
+{
+        struct fault *fault = container_of(work, struct fault, work);
+        int npages, write;
+        struct page *page;
+        write = !!(fault->flags & PPR_FAULT_WRITE);
+        npages = get_user_pages(fault->state->task, fault->state->mm,
+                                fault->address, 1, write, 0, &page, NULL);
+        if (npages == 1) {
+                put_page(page);
+        } else if (fault->dev_state->inv_ppr_cb) {
+                int status;
+                status = fault->dev_state->inv_ppr_cb(fault->dev_state->pdev,
+                                                      fault->pasid,
+                                                      fault->address,
+                                                      fault->flags);
+                switch (status) {
+                case AMD_IOMMU_INV_PRI_RSP_SUCCESS:
+                        set_pri_tag_status(fault->state, fault->tag, PPR_SUCCESS);
+                        break;
+                case AMD_IOMMU_INV_PRI_RSP_INVALID:
+                        set_pri_tag_status(fault->state, fault->tag, PPR_INVALID);
+                        break;
+                case AMD_IOMMU_INV_PRI_RSP_FAIL:
+                        set_pri_tag_status(fault->state, fault->tag, PPR_FAILURE);
+                        break;
+                default:
+                        BUG();
+                }
+        } else {
+                set_pri_tag_status(fault->state, fault->tag, PPR_INVALID);
+        }
+        finish_pri_tag(fault->dev_state, fault->state, fault->tag);
+        put_pasid_state(fault->state);
+        kfree(fault);
+}
+static int ppr_notifier(struct notifier_block *nb, unsigned long e, void *data)
+{
+        struct amd_iommu_fault *iommu_fault;
+        struct pasid_state *pasid_state;
+        struct device_state *dev_state;
+        unsigned long flags;
+        struct fault *fault;
+        bool finish;
+        u16 tag;
+        int ret;
+        iommu_fault = data;
+        tag         = iommu_fault->tag & 0x1ff;
+        finish      = (iommu_fault->tag >> 9) & 1;
+        ret = NOTIFY_DONE;
+        dev_state = get_device_state(iommu_fault->device_id);
+        if (dev_state == NULL)
+                goto out;
+        pasid_state = get_pasid_state(dev_state, iommu_fault->pasid);
+        if (pasid_state == NULL) {
+                /* We know the device but not the PASID -> send INVALID */
+                amd_iommu_complete_ppr(dev_state->pdev, iommu_fault->pasid,
+                                       PPR_INVALID, tag);
+                goto out_drop_state;
+        }
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        atomic_inc(&pasid_state->pri[tag].inflight);
+        if (finish)
+                pasid_state->pri[tag].finish = true;
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
+        fault = kzalloc(sizeof(*fault), GFP_ATOMIC);
+        if (fault == NULL) {
+                /* We are OOM - send success and let the device re-fault */
+                finish_pri_tag(dev_state, pasid_state, tag);
+                goto out_drop_state;
+        }
+        fault->dev_state = dev_state;
+        fault->address   = iommu_fault->address;
+        fault->state     = pasid_state;
+        fault->tag       = tag;
+        fault->finish    = finish;
+        fault->flags     = iommu_fault->flags;
+        INIT_WORK(&fault->work, do_fault);
+        queue_work(iommu_wq, &fault->work);
+        ret = NOTIFY_OK;
+out_drop_state:
+        put_device_state(dev_state);
+out:
+        return ret;
+}
+static struct notifier_block ppr_nb = {
+        .notifier_call = ppr_notifier,
+};
+static int task_exit(struct notifier_block *nb, unsigned long e, void *data)
+{
+        struct pasid_state *pasid_state;
+        struct task_struct *task;
+        task = data;
+        /*
+         * Using this notifier is a hack - but there is no other choice
+         * at the moment. What I really want is a sleeping notifier that
+         * is called when an MM goes down. But such a notifier doesn't
+         * exist yet. The notifier needs to sleep because it has to make
+         * sure that the device does not use the PASID and the address
+         * space anymore before it is destroyed. This includes waiting
+         * for pending PRI requests to pass the workqueue. The
+         * MMU-Notifiers would be a good fit, but they use RCU and so
+         * they are not allowed to sleep. Lets see how we can solve this
+         * in a more intelligent way in the future.
+         */
+again:
+        spin_lock(&ps_lock);
+        list_for_each_entry(pasid_state, &pasid_state_list, list) {
+                struct device_state *dev_state;
+                int pasid;
+                if (pasid_state->task != task)
+                        continue;
+                /* Drop Lock and unbind */
+                spin_unlock(&ps_lock);
+                dev_state = pasid_state->device_state;
+                pasid     = pasid_state->pasid;
+                unbind_pasid(dev_state, pasid);
+                /* Task may be in the list multiple times */
+                goto again;
+        }
+        spin_unlock(&ps_lock);
+        return NOTIFY_OK;
+}
+int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid,
+                         struct task_struct *task)
+{
+        struct pasid_state *pasid_state;
+        struct device_state *dev_state;
+        u16 devid;
+        int ret;
+        might_sleep();
+        if (!amd_iommu_v2_supported())
+                return -ENODEV;
+        devid     = device_id(pdev);
+        dev_state = get_device_state(devid);
+        if (dev_state == NULL)
+                return -EINVAL;
+        ret = -EINVAL;
+        if (pasid < 0 || pasid >= dev_state->max_pasids)
+                goto out;
+        ret = -ENOMEM;
+        pasid_state = kzalloc(sizeof(*pasid_state), GFP_KERNEL);
+        if (pasid_state == NULL)
+                goto out;
+        atomic_set(&pasid_state->count, 1);
+        init_waitqueue_head(&pasid_state->wq);
+        pasid_state->task         = task;
+        pasid_state->mm           = get_task_mm(task);
+        pasid_state->device_state = dev_state;
+        pasid_state->pasid        = pasid;
+        pasid_state->mn.ops       = &iommu_mn;
+        if (pasid_state->mm == NULL)
+                goto out_free;
+        mmu_notifier_register(&pasid_state->mn, pasid_state->mm);
+        ret = set_pasid_state(dev_state, pasid_state, pasid);
+        if (ret)
+                goto out_unregister;
+        ret = amd_iommu_domain_set_gcr3(dev_state->domain, pasid,
+                                        __pa(pasid_state->mm->pgd));
+        if (ret)
+                goto out_clear_state;
+        link_pasid_state(pasid_state);
+        return 0;
+out_clear_state:
+        clear_pasid_state(dev_state, pasid);
+out_unregister:
+        mmu_notifier_unregister(&pasid_state->mn, pasid_state->mm);
+out_free:
+        free_pasid_state(pasid_state);
+out:
+        put_device_state(dev_state);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_bind_pasid);
+void amd_iommu_unbind_pasid(struct pci_dev *pdev, int pasid)
+{
+        struct device_state *dev_state;
+        u16 devid;
+        might_sleep();
+        if (!amd_iommu_v2_supported())
+                return;
+        devid = device_id(pdev);
+        dev_state = get_device_state(devid);
+        if (dev_state == NULL)
+                return;
+        if (pasid < 0 || pasid >= dev_state->max_pasids)
+                goto out;
+        unbind_pasid(dev_state, pasid);
+out:
+        put_device_state(dev_state);
+}
+EXPORT_SYMBOL(amd_iommu_unbind_pasid);
+int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
+{
+        struct device_state *dev_state;
+        unsigned long flags;
+        int ret, tmp;
+        u16 devid;
+        might_sleep();
+        if (!amd_iommu_v2_supported())
+                return -ENODEV;
+        if (pasids <= 0 || pasids > (PASID_MASK + 1))
+                return -EINVAL;
+        devid = device_id(pdev);
+        dev_state = kzalloc(sizeof(*dev_state), GFP_KERNEL);
+        if (dev_state == NULL)
+                return -ENOMEM;
+        spin_lock_init(&dev_state->lock);
+        init_waitqueue_head(&dev_state->wq);
+        dev_state->pdev = pdev;
+        tmp = pasids;
+        for (dev_state->pasid_levels = 0; (tmp - 1) & ~0x1ff; tmp >>= 9)
+                dev_state->pasid_levels += 1;
+        atomic_set(&dev_state->count, 1);
+        dev_state->max_pasids = pasids;
+        ret = -ENOMEM;
+        dev_state->states = (void *)get_zeroed_page(GFP_KERNEL);
+        if (dev_state->states == NULL)
+                goto out_free_dev_state;
+        dev_state->domain = iommu_domain_alloc(&pci_bus_type);
+        if (dev_state->domain == NULL)
+                goto out_free_states;
+        amd_iommu_domain_direct_map(dev_state->domain);
+        ret = amd_iommu_domain_enable_v2(dev_state->domain, pasids);
+        if (ret)
+                goto out_free_domain;
+        ret = iommu_attach_device(dev_state->domain, &pdev->dev);
+        if (ret != 0)
+                goto out_free_domain;
+        spin_lock_irqsave(&state_lock, flags);
+        if (state_table[devid] != NULL) {
+                spin_unlock_irqrestore(&state_lock, flags);
+                ret = -EBUSY;
+                goto out_free_domain;
+        }
+        state_table[devid] = dev_state;
+        spin_unlock_irqrestore(&state_lock, flags);
+        return 0;
+out_free_domain:
+        iommu_domain_free(dev_state->domain);
+out_free_states:
+        free_page((unsigned long)dev_state->states);
+out_free_dev_state:
+        kfree(dev_state);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_init_device);
+void amd_iommu_free_device(struct pci_dev *pdev)
+{
+        struct device_state *dev_state;
+        unsigned long flags;
+        u16 devid;
+        if (!amd_iommu_v2_supported())
+                return;
+        devid = device_id(pdev);
+        spin_lock_irqsave(&state_lock, flags);
+        dev_state = state_table[devid];
+        if (dev_state == NULL) {
+                spin_unlock_irqrestore(&state_lock, flags);
+                return;
+        }
+        state_table[devid] = NULL;
+        spin_unlock_irqrestore(&state_lock, flags);
+        /* Get rid of any remaining pasid states */
+        free_pasid_states(dev_state);
+        put_device_state_wait(dev_state);
+}
+EXPORT_SYMBOL(amd_iommu_free_device);
+int amd_iommu_set_invalid_ppr_cb(struct pci_dev *pdev,
+                                 amd_iommu_invalid_ppr_cb cb)
+{
+        struct device_state *dev_state;
+        unsigned long flags;
+        u16 devid;
+        int ret;
+        if (!amd_iommu_v2_supported())
+                return -ENODEV;
+        devid = device_id(pdev);
+        spin_lock_irqsave(&state_lock, flags);
+        ret = -EINVAL;
+        dev_state = state_table[devid];
+        if (dev_state == NULL)
+                goto out_unlock;
+        dev_state->inv_ppr_cb = cb;
+        ret = 0;
+out_unlock:
+        spin_unlock_irqrestore(&state_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(amd_iommu_set_invalid_ppr_cb);
+static int __init amd_iommu_v2_init(void)
+{
+        size_t state_table_size;
+        int ret;
+        pr_info("AMD IOMMUv2 driver by Joerg Roedel <joerg.roedel@amd.com>");
+        spin_lock_init(&state_lock);
+        state_table_size = MAX_DEVICES * sizeof(struct device_state *);
+        state_table = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                               get_order(state_table_size));
+        if (state_table == NULL)
+                return -ENOMEM;
+        ret = -ENOMEM;
+        iommu_wq = create_workqueue("amd_iommu_v2");
+        if (iommu_wq == NULL)
+                goto out_free;
+        ret = -ENOMEM;
+        empty_page_table = (u64 *)get_zeroed_page(GFP_KERNEL);
+        if (empty_page_table == NULL)
+                goto out_destroy_wq;
+        amd_iommu_register_ppr_notifier(&ppr_nb);
+        profile_event_register(PROFILE_TASK_EXIT, &profile_nb);
+        return 0;
+out_destroy_wq:
+        destroy_workqueue(iommu_wq);
+out_free:
+        free_pages((unsigned long)state_table, get_order(state_table_size));
+        return ret;
+}
+static void __exit amd_iommu_v2_exit(void)
+{
+        struct device_state *dev_state;
+        size_t state_table_size;
+        int i;
+        profile_event_unregister(PROFILE_TASK_EXIT, &profile_nb);
+        amd_iommu_unregister_ppr_notifier(&ppr_nb);
+        flush_workqueue(iommu_wq);
+        /*
+         * The loop below might call flush_workqueue(), so call
+         * destroy_workqueue() after it
+         */
+        for (i = 0; i < MAX_DEVICES; ++i) {
+                dev_state = get_device_state(i);
+                if (dev_state == NULL)
+                        continue;
+                WARN_ON_ONCE(1);
+                put_device_state(dev_state);
+                amd_iommu_free_device(dev_state->pdev);
+        }
+        destroy_workqueue(iommu_wq);
+        state_table_size = MAX_DEVICES * sizeof(struct device_state *);
+        free_pages((unsigned long)state_table, get_order(state_table_size));
+        free_page((unsigned long)empty_page_table);
+}
+module_init(amd_iommu_v2_init);
+module_exit(amd_iommu_v2_exit);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index c0c7820d4c46..c181883c2f9a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -78,6 +78,24 @@
 #define LEVEL_STRIDE            (9)
 #define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
+/*
+ * This bitmap is used to advertise the page sizes our hardware support
+ * to the IOMMU core, which will then use this information to split
+ * physically contiguous memory regions it is mapping into page sizes
+ * that we support.
+ *
+ * Traditionally the IOMMU core just handed us the mappings directly,
+ * after making sure the size is an order of a 4KiB page and that the
+ * mapping has natural alignment.
+ *
+ * To retain this behavior, we currently advertise that we support
+ * all page sizes that are an order of 4KiB.
+ *
+ * If at some point we'd like to utilize the IOMMU core's new behavior,
+ * we could change this to advertise the real page sizes we support.
+ */
+#define INTEL_IOMMU_PGSIZES     (~0xFFFUL)
 static inline int agaw_to_level(int agaw)
 {
        return agaw + 2;
@@ -3524,7 +3542,7 @@ found:
        return 0;
 }
-int dmar_parse_rmrr_atsr_dev(void)
+int __init dmar_parse_rmrr_atsr_dev(void)
 {
        struct dmar_rmrr_unit *rmrr, *rmrr_n;
        struct dmar_atsr_unit *atsr, *atsr_n;
@@ -3979,12 +3997,11 @@ static void intel_iommu_detach_device(struct iommu_domain *domain,
 static int intel_iommu_map(struct iommu_domain *domain,
                           unsigned long iova, phys_addr_t hpa,
-                           int gfp_order, int iommu_prot)
+                           size_t size, int iommu_prot)
 {
        struct dmar_domain *dmar_domain = domain->priv;
        u64 max_addr;
        int prot = 0;
-        size_t size;
        int ret;
        if (iommu_prot & IOMMU_READ)
@@ -3994,7 +4011,6 @@ static int intel_iommu_map(struct iommu_domain *domain,
        if ((iommu_prot & IOMMU_CACHE) && dmar_domain->iommu_snooping)
                prot |= DMA_PTE_SNP;
-        size     = PAGE_SIZE << gfp_order;
        max_addr = iova + size;
        if (dmar_domain->max_addr < max_addr) {
                u64 end;
@@ -4017,11 +4033,10 @@ static int intel_iommu_map(struct iommu_domain *domain,
        return ret;
 }
-static int intel_iommu_unmap(struct iommu_domain *domain,
+static size_t intel_iommu_unmap(struct iommu_domain *domain,
-                             unsigned long iova, int gfp_order)
+                             unsigned long iova, size_t size)
 {
        struct dmar_domain *dmar_domain = domain->priv;
-        size_t size = PAGE_SIZE << gfp_order;
        int order;
        order = dma_pte_clear_range(dmar_domain, iova >> VTD_PAGE_SHIFT,
@@ -4030,7 +4045,7 @@ static int intel_iommu_unmap(struct iommu_domain *domain,
        if (dmar_domain->max_addr == iova + size)
                dmar_domain->max_addr = iova;
-        return order;
+        return PAGE_SIZE << order;
 }
 static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
@@ -4069,6 +4084,7 @@ static struct iommu_ops intel_iommu_ops = {
        .unmap          = intel_iommu_unmap,
        .iova_to_phys   = intel_iommu_iova_to_phys,
        .domain_has_cap = intel_iommu_domain_has_cap,
+        .pgsize_bitmap  = INTEL_IOMMU_PGSIZES,
 };
 static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
diff --git a/drivers/iommu/intr_remapping.c b/drivers/iommu/intr_remapping.c
index 07c9f189f314..6777ca049471 100644
--- a/drivers/iommu/intr_remapping.c
+++ b/drivers/iommu/intr_remapping.c
@@ -773,7 +773,7 @@ int __init parse_ioapics_under_ir(void)
        return ir_supported;
 }
-int ir_dev_scope_init(void)
+int __init ir_dev_scope_init(void)
 {
        if (!intr_remapping_enabled)
                return 0;
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 2fb2963df553..84cdd8ac81f1 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -16,6 +16,8 @@
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
+#define pr_fmt(fmt)    "%s: " fmt, __func__
 #include <linux/device.h>
 #include <linux/kernel.h>
 #include <linux/bug.h>
@@ -157,32 +159,125 @@ int iommu_domain_has_cap(struct iommu_domain *domain,
 EXPORT_SYMBOL_GPL(iommu_domain_has_cap);
 int iommu_map(struct iommu_domain *domain, unsigned long iova,
-              phys_addr_t paddr, int gfp_order, int prot)
+              phys_addr_t paddr, size_t size, int prot)
 {
-        size_t size;
+        unsigned long orig_iova = iova;
+        unsigned int min_pagesz;
+        size_t orig_size = size;
+        int ret = 0;
        if (unlikely(domain->ops->map == NULL))
                return -ENODEV;
-        size         = PAGE_SIZE << gfp_order;
+        /* find out the minimum page size supported */
+        min_pagesz = 1 << __ffs(domain->ops->pgsize_bitmap);
+        /*
+         * both the virtual address and the physical one, as well as
+         * the size of the mapping, must be aligned (at least) to the
+         * size of the smallest page supported by the hardware
+         */
+        if (!IS_ALIGNED(iova | paddr | size, min_pagesz)) {
+                pr_err("unaligned: iova 0x%lx pa 0x%lx size 0x%lx min_pagesz "
+                        "0x%x\n", iova, (unsigned long)paddr,
+                        (unsigned long)size, min_pagesz);
+                return -EINVAL;
+        }
+        pr_debug("map: iova 0x%lx pa 0x%lx size 0x%lx\n", iova,
+                                (unsigned long)paddr, (unsigned long)size);
+        while (size) {
+                unsigned long pgsize, addr_merge = iova | paddr;
+                unsigned int pgsize_idx;
+                /* Max page size that still fits into 'size' */
+                pgsize_idx = __fls(size);
+                /* need to consider alignment requirements ? */
+                if (likely(addr_merge)) {
+                        /* Max page size allowed by both iova and paddr */
+                        unsigned int align_pgsize_idx = __ffs(addr_merge);
+                        pgsize_idx = min(pgsize_idx, align_pgsize_idx);
+                }
+                /* build a mask of acceptable page sizes */
+                pgsize = (1UL << (pgsize_idx + 1)) - 1;
+                /* throw away page sizes not supported by the hardware */
+                pgsize &= domain->ops->pgsize_bitmap;
-        BUG_ON(!IS_ALIGNED(iova | paddr, size));
+                /* make sure we're still sane */
+                BUG_ON(!pgsize);
-        return domain->ops->map(domain, iova, paddr, gfp_order, prot);
+                /* pick the biggest page */
+                pgsize_idx = __fls(pgsize);
+                pgsize = 1UL << pgsize_idx;
+                pr_debug("mapping: iova 0x%lx pa 0x%lx pgsize %lu\n", iova,
+                                        (unsigned long)paddr, pgsize);
+                ret = domain->ops->map(domain, iova, paddr, pgsize, prot);
+                if (ret)
+                        break;
+                iova += pgsize;
+                paddr += pgsize;
+                size -= pgsize;
+        }
+        /* unroll mapping in case something went wrong */
+        if (ret)
+                iommu_unmap(domain, orig_iova, orig_size - size);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(iommu_map);
-int iommu_unmap(struct iommu_domain *domain, unsigned long iova, int gfp_order)
+size_t iommu_unmap(struct iommu_domain *domain, unsigned long iova, size_t size)
 {
-        size_t size;
+        size_t unmapped_page, unmapped = 0;
+        unsigned int min_pagesz;
        if (unlikely(domain->ops->unmap == NULL))
                return -ENODEV;
-        size         = PAGE_SIZE << gfp_order;
+        /* find out the minimum page size supported */
+        min_pagesz = 1 << __ffs(domain->ops->pgsize_bitmap);
-        BUG_ON(!IS_ALIGNED(iova, size));
+        /*
-        return domain->ops->unmap(domain, iova, gfp_order);
+         * The virtual address, as well as the size of the mapping, must be
+         * aligned (at least) to the size of the smallest page supported
+         * by the hardware
+         */
+        if (!IS_ALIGNED(iova | size, min_pagesz)) {
+                pr_err("unaligned: iova 0x%lx size 0x%lx min_pagesz 0x%x\n",
+                                        iova, (unsigned long)size, min_pagesz);
+                return -EINVAL;
+        }
+        pr_debug("unmap this: iova 0x%lx size 0x%lx\n", iova,
+                                                        (unsigned long)size);
+        /*
+         * Keep iterating until we either unmap 'size' bytes (or more)
+         * or we hit an area that isn't mapped.
+         */
+        while (unmapped < size) {
+                size_t left = size - unmapped;
+                unmapped_page = domain->ops->unmap(domain, iova, left);
+                if (!unmapped_page)
+                        break;
+                pr_debug("unmapped: iova 0x%lx size %lx\n", iova,
+                                        (unsigned long)unmapped_page);
+                iova += unmapped_page;
+                unmapped += unmapped_page;
+        }
+        return unmapped;
 }
 EXPORT_SYMBOL_GPL(iommu_unmap);
diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 5865dd2e28f9..08a90b88e40d 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -42,6 +42,9 @@ __asm__ __volatile__ (							\
 #define RCP15_PRRR(reg)         MRC(reg, p15, 0, c10, c2, 0)
 #define RCP15_NMRR(reg)         MRC(reg, p15, 0, c10, c2, 1)
+/* bitmap of the page sizes currently supported */
+#define MSM_IOMMU_PGSIZES       (SZ_4K | SZ_64K | SZ_1M | SZ_16M)
 static int msm_iommu_tex_class[4];
 DEFINE_SPINLOCK(msm_iommu_lock);
@@ -352,7 +355,7 @@ fail:
 }
 static int msm_iommu_map(struct iommu_domain *domain, unsigned long va,
-                         phys_addr_t pa, int order, int prot)
+                         phys_addr_t pa, size_t len, int prot)
 {
        struct msm_priv *priv;
        unsigned long flags;
@@ -363,7 +366,6 @@ static int msm_iommu_map(struct iommu_domain *domain, unsigned long va,
        unsigned long *sl_pte;
        unsigned long sl_offset;
        unsigned int pgprot;
-        size_t len = 0x1000UL << order;
        int ret = 0, tex, sh;
        spin_lock_irqsave(&msm_iommu_lock, flags);
@@ -463,8 +465,8 @@ fail:
        return ret;
 }
-static int msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
+static size_t msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
-                            int order)
+                            size_t len)
 {
        struct msm_priv *priv;
        unsigned long flags;
@@ -474,7 +476,6 @@ static int msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
        unsigned long *sl_table;
        unsigned long *sl_pte;
        unsigned long sl_offset;
-        size_t len = 0x1000UL << order;
        int i, ret = 0;
        spin_lock_irqsave(&msm_iommu_lock, flags);
@@ -544,15 +545,12 @@ static int msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
        ret = __flush_iotlb(domain);
-        /*
-         * the IOMMU API requires us to return the order of the unmapped
-         * page (on success).
-         */
-        if (!ret)
-                ret = order;
 fail:
        spin_unlock_irqrestore(&msm_iommu_lock, flags);
-        return ret;
+        /* the IOMMU API requires us to return how many bytes were unmapped */
+        len = ret ? 0 : len;
+        return len;
 }
 static phys_addr_t msm_iommu_iova_to_phys(struct iommu_domain *domain,
@@ -684,7 +682,8 @@ static struct iommu_ops msm_iommu_ops = {
        .map = msm_iommu_map,
        .unmap = msm_iommu_unmap,
        .iova_to_phys = msm_iommu_iova_to_phys,
-        .domain_has_cap = msm_iommu_domain_has_cap
+        .domain_has_cap = msm_iommu_domain_has_cap,
+        .pgsize_bitmap = MSM_IOMMU_PGSIZES,
 };
 static int __init get_tex_class(int icp, int ocp, int mt, int nos)
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index 8f32b2bf7587..08cf7ec5b4a5 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -33,6 +33,9 @@
             (__i < (n)) && (cr = __iotlb_read_cr((obj), __i), true);   \
             __i++)
+/* bitmap of the page sizes currently supported */
+#define OMAP_IOMMU_PGSIZES      (SZ_4K | SZ_64K | SZ_1M | SZ_16M)
 /**
 * struct omap_iommu_domain - omap iommu domain
 * @pgtable:    the page table
@@ -1019,12 +1022,11 @@ static void iopte_cachep_ctor(void *iopte)
 }
 static int omap_iommu_map(struct iommu_domain *domain, unsigned long da,
-                         phys_addr_t pa, int order, int prot)
+                         phys_addr_t pa, size_t bytes, int prot)
 {
        struct omap_iommu_domain *omap_domain = domain->priv;
        struct omap_iommu *oiommu = omap_domain->iommu_dev;
        struct device *dev = oiommu->dev;
-        size_t bytes = PAGE_SIZE << order;
        struct iotlb_entry e;
        int omap_pgsz;
        u32 ret, flags;
@@ -1049,19 +1051,16 @@ static int omap_iommu_map(struct iommu_domain *domain, unsigned long da,
        return ret;
 }
-static int omap_iommu_unmap(struct iommu_domain *domain, unsigned long da,
+static size_t omap_iommu_unmap(struct iommu_domain *domain, unsigned long da,
-                            int order)
+                            size_t size)
 {
        struct omap_iommu_domain *omap_domain = domain->priv;
        struct omap_iommu *oiommu = omap_domain->iommu_dev;
        struct device *dev = oiommu->dev;
-        size_t unmap_size;
-        dev_dbg(dev, "unmapping da 0x%lx order %d\n", da, order);
-        unmap_size = iopgtable_clear_entry(oiommu, da);
+        dev_dbg(dev, "unmapping da 0x%lx size %u\n", da, size);
-        return unmap_size ? get_order(unmap_size) : -EINVAL;
+        return iopgtable_clear_entry(oiommu, da);
 }
 static int
@@ -1211,6 +1210,7 @@ static struct iommu_ops omap_iommu_ops = {
        .unmap          = omap_iommu_unmap,
        .iova_to_phys   = omap_iommu_iova_to_phys,
        .domain_has_cap = omap_iommu_domain_has_cap,
+        .pgsize_bitmap  = OMAP_IOMMU_PGSIZES,
 };
 static int __init omap_iommu_init(void)
diff --git a/drivers/iommu/omap-iovmm.c b/drivers/iommu/omap-iovmm.c
index 46be456fcc00..6edc4ceba197 100644
--- a/drivers/iommu/omap-iovmm.c
+++ b/drivers/iommu/omap-iovmm.c
@@ -410,7 +410,6 @@ static int map_iovm_area(struct iommu_domain *domain, struct iovm_struct *new,
        unsigned int i, j;
        struct scatterlist *sg;
        u32 da = new->da_start;
-        int order;
        if (!domain || !sgt)
                return -EINVAL;
@@ -429,12 +428,10 @@ static int map_iovm_area(struct iommu_domain *domain, struct iovm_struct *new,
                if (bytes_to_iopgsz(bytes) < 0)
                        goto err_out;
-                order = get_order(bytes);
                pr_debug("%s: [%d] %08x %08x(%x)\n", __func__,
                         i, da, pa, bytes);
-                err = iommu_map(domain, da, pa, order, flags);
+                err = iommu_map(domain, da, pa, bytes, flags);
                if (err)
                        goto err_out;
@@ -449,10 +446,9 @@ err_out:
                size_t bytes;
                bytes = sg->length + sg->offset;
-                order = get_order(bytes);
                /* ignore failures.. we're already handling one */
-                iommu_unmap(domain, da, order);
+                iommu_unmap(domain, da, bytes);
                da += bytes;
        }
@@ -467,7 +463,8 @@ static void unmap_iovm_area(struct iommu_domain *domain, struct omap_iommu *obj,
        size_t total = area->da_end - area->da_start;
        const struct sg_table *sgt = area->sgt;
        struct scatterlist *sg;
-        int i, err;
+        int i;
+        size_t unmapped;
        BUG_ON(!sgtable_ok(sgt));
        BUG_ON((!total) || !IS_ALIGNED(total, PAGE_SIZE));
@@ -475,13 +472,11 @@ static void unmap_iovm_area(struct iommu_domain *domain, struct omap_iommu *obj,
        start = area->da_start;
        for_each_sg(sgt->sgl, sg, sgt->nents, i) {
                size_t bytes;
-                int order;
                bytes = sg->length + sg->offset;
-                order = get_order(bytes);
-                err = iommu_unmap(domain, start, order);
+                unmapped = iommu_unmap(domain, start, bytes);
-                if (err < 0)
+                if (unmapped < bytes)
                        break;
                dev_dbg(obj->dev, "%s: unmap %08x(%x) %08x\n",
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 7878712721bf..b6907118283a 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1106,10 +1106,12 @@ void bitmap_write_all(struct bitmap *bitmap)
         */
        int i;
+        spin_lock_irq(&bitmap->lock);
        for (i = 0; i < bitmap->file_pages; i++)
                set_page_attr(bitmap, bitmap->filemap[i],
                              BITMAP_PAGE_NEEDWRITE);
        bitmap->allclean = 0;
+        spin_unlock_irq(&bitmap->lock);
 }
 static void bitmap_count_page(struct bitmap *bitmap, sector_t offset, int inc)
@@ -1605,7 +1607,9 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
        for (chunk = s; chunk <= e; chunk++) {
                sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
                bitmap_set_memory_bits(bitmap, sec, 1);
+                spin_lock_irq(&bitmap->lock);
                bitmap_file_set_bit(bitmap, sec);
+                spin_unlock_irq(&bitmap->lock);
                if (sec < bitmap->mddev->recovery_cp)
                        /* We are asserting that the array is dirty,
                         * so move the recovery_cp address back so
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 84acfe7d10e4..ee981737edfc 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -570,7 +570,7 @@ static void mddev_put(struct mddev *mddev)
            mddev->ctime == 0 && !mddev->hold_active) {
                /* Array is not configured at all, and not held active,
                 * so destroy it */
-                list_del(&mddev->all_mddevs);
+                list_del_init(&mddev->all_mddevs);
                bs = mddev->bio_set;
                mddev->bio_set = NULL;
                if (mddev->gendisk) {
@@ -2546,7 +2546,8 @@ state_show(struct md_rdev *rdev, char *page)
                sep = ",";
        }
        if (test_bit(Blocked, &rdev->flags) ||
-            rdev->badblocks.unacked_exist) {
+            (rdev->badblocks.unacked_exist
+             && !test_bit(Faulty, &rdev->flags))) {
                len += sprintf(page+len, "%sblocked", sep);
                sep = ",";
        }
@@ -3788,6 +3789,8 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)
        if (err)
                return err;
        else {
+                if (mddev->hold_active == UNTIL_IOCTL)
+                        mddev->hold_active = 0;
                sysfs_notify_dirent_safe(mddev->sysfs_state);
                return len;
        }
@@ -4487,11 +4490,20 @@ md_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
        if (!entry->show)
                return -EIO;
+        spin_lock(&all_mddevs_lock);
+        if (list_empty(&mddev->all_mddevs)) {
+                spin_unlock(&all_mddevs_lock);
+                return -EBUSY;
+        }
+        mddev_get(mddev);
+        spin_unlock(&all_mddevs_lock);
        rv = mddev_lock(mddev);
        if (!rv) {
                rv = entry->show(mddev, page);
                mddev_unlock(mddev);
        }
+        mddev_put(mddev);
        return rv;
 }
@@ -4507,13 +4519,19 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
                return -EIO;
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
+        spin_lock(&all_mddevs_lock);
+        if (list_empty(&mddev->all_mddevs)) {
+                spin_unlock(&all_mddevs_lock);
+                return -EBUSY;
+        }
+        mddev_get(mddev);
+        spin_unlock(&all_mddevs_lock);
        rv = mddev_lock(mddev);
-        if (mddev->hold_active == UNTIL_IOCTL)
-                mddev->hold_active = 0;
        if (!rv) {
                rv = entry->store(mddev, page, length);
                mddev_unlock(mddev);
        }
+        mddev_put(mddev);
        return rv;
 }
@@ -7840,6 +7858,7 @@ int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
                                  s + rdev->data_offset, sectors, acknowledged);
        if (rv) {
                /* Make sure they get written out promptly */
+                sysfs_notify_dirent_safe(rdev->sysfs_state);
                set_bit(MD_CHANGE_CLEAN, &rdev->mddev->flags);
                md_wakeup_thread(rdev->mddev->thread);
        }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 297e26092178..31670f8d6b65 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3036,6 +3036,8 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                if (dev->written)
                        s->written++;
                rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = NULL;
                if (rdev) {
                        is_bad = is_badblock(rdev, sh->sector, STRIPE_SECTORS,
                                             &first_bad, &bad_sectors);
@@ -3063,12 +3065,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                        }
                } else if (test_bit(In_sync, &rdev->flags))
                        set_bit(R5_Insync, &dev->flags);
-                else if (!test_bit(Faulty, &rdev->flags)) {
+                else {
                        /* in sync if before recovery_offset */
                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
                                set_bit(R5_Insync, &dev->flags);
                }
-                if (test_bit(R5_WriteError, &dev->flags)) {
+                if (rdev && test_bit(R5_WriteError, &dev->flags)) {
                        clear_bit(R5_Insync, &dev->flags);
                        if (!test_bit(Faulty, &rdev->flags)) {
                                s->handle_bad_blocks = 1;
@@ -3076,7 +3078,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                        } else
                                clear_bit(R5_WriteError, &dev->flags);
                }
-                if (test_bit(R5_MadeGood, &dev->flags)) {
+                if (rdev && test_bit(R5_MadeGood, &dev->flags)) {
                        if (!test_bit(Faulty, &rdev->flags)) {
                                s->handle_bad_blocks = 1;
                                atomic_inc(&rdev->nr_pending);
diff --git a/drivers/net/ethernet/pasemi/Makefile b/drivers/net/ethernet/pasemi/Makefile
index 05db5434bafc..90497ffb1ac3 100644
--- a/drivers/net/ethernet/pasemi/Makefile
+++ b/drivers/net/ethernet/pasemi/Makefile
@@ -2,4 +2,5 @@
 # Makefile for the A Semi network device drivers.
 #
-obj-$(CONFIG_PASEMI_MAC) += pasemi_mac.o pasemi_mac_ethtool.o
+obj-$(CONFIG_PASEMI_MAC) += pasemi_mac_driver.o
+pasemi_mac_driver-objs := pasemi_mac.o pasemi_mac_ethtool.o
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 6f06aa10f0d7..67bf07819992 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1183,11 +1183,13 @@ static u8 rtl8168d_efuse_read(void __iomem *ioaddr, int reg_addr)
        return value;
 }
-static void rtl8169_irq_mask_and_ack(void __iomem *ioaddr)
+static void rtl8169_irq_mask_and_ack(struct rtl8169_private *tp)
 {
-        RTL_W16(IntrMask, 0x0000);
+        void __iomem *ioaddr = tp->mmio_addr;
-        RTL_W16(IntrStatus, 0xffff);
+        RTL_W16(IntrMask, 0x0000);
+        RTL_W16(IntrStatus, tp->intr_event);
+        RTL_R8(ChipCmd);
 }
 static unsigned int rtl8169_tbi_reset_pending(struct rtl8169_private *tp)
@@ -3933,8 +3935,6 @@ static void rtl_hw_reset(struct rtl8169_private *tp)
                        break;
                udelay(100);
        }
-        rtl8169_init_ring_indexes(tp);
 }
 static int __devinit
@@ -4339,7 +4339,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
        void __iomem *ioaddr = tp->mmio_addr;
        /* Disable interrupts */
-        rtl8169_irq_mask_and_ack(ioaddr);
+        rtl8169_irq_mask_and_ack(tp);
        rtl_rx_close(tp);
@@ -4885,8 +4885,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
        RTL_W16(IntrMitigate, 0x5151);
        /* Work around for RxFIFO overflow. */
-        if (tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+        if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
-            tp->mac_version == RTL_GIGA_MAC_VER_22) {
                tp->intr_event |= RxFIFOOver | PCSTimeout;
                tp->intr_event &= ~RxOverflow;
        }
@@ -5076,6 +5075,11 @@ static void rtl_hw_start_8101(struct net_device *dev)
        void __iomem *ioaddr = tp->mmio_addr;
        struct pci_dev *pdev = tp->pci_dev;
+        if (tp->mac_version >= RTL_GIGA_MAC_VER_30) {
+                tp->intr_event &= ~RxFIFOOver;
+                tp->napi_event &= ~RxFIFOOver;
+        }
        if (tp->mac_version == RTL_GIGA_MAC_VER_13 ||
            tp->mac_version == RTL_GIGA_MAC_VER_16) {
                int cap = pci_pcie_cap(pdev);
@@ -5342,7 +5346,7 @@ static void rtl8169_wait_for_quiescence(struct net_device *dev)
        /* Wait for any pending NAPI task to complete */
        napi_disable(&tp->napi);
-        rtl8169_irq_mask_and_ack(ioaddr);
+        rtl8169_irq_mask_and_ack(tp);
        tp->intr_mask = 0xffff;
        RTL_W16(IntrMask, tp->intr_event);
@@ -5389,14 +5393,16 @@ static void rtl8169_reset_task(struct work_struct *work)
        if (!netif_running(dev))
                goto out_unlock;
+        rtl8169_hw_reset(tp);
        rtl8169_wait_for_quiescence(dev);
        for (i = 0; i < NUM_RX_DESC; i++)
                rtl8169_mark_to_asic(tp->RxDescArray + i, rx_buf_sz);
        rtl8169_tx_clear(tp);
+        rtl8169_init_ring_indexes(tp);
-        rtl8169_hw_reset(tp);
        rtl_hw_start(dev);
        netif_wake_queue(dev);
        rtl8169_check_link_status(dev, tp, tp->mmio_addr);
@@ -5407,11 +5413,6 @@ out_unlock:
 static void rtl8169_tx_timeout(struct net_device *dev)
 {
-        struct rtl8169_private *tp = netdev_priv(dev);
-        rtl8169_hw_reset(tp);
-        /* Let's wait a bit while any (async) irq lands on */
        rtl8169_schedule_work(dev, rtl8169_reset_task);
 }
@@ -5804,6 +5805,10 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
         */
        status = RTL_R16(IntrStatus);
        while (status && status != 0xffff) {
+                status &= tp->intr_event;
+                if (!status)
+                        break;
                handled = 1;
                /* Handle all of the error cases first. These will reset
@@ -5818,27 +5823,9 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                        switch (tp->mac_version) {
                        /* Work around for rx fifo overflow */
                        case RTL_GIGA_MAC_VER_11:
-                        case RTL_GIGA_MAC_VER_22:
-                        case RTL_GIGA_MAC_VER_26:
                                netif_stop_queue(dev);
                                rtl8169_tx_timeout(dev);
                                goto done;
-                        /* Testers needed. */
-                        case RTL_GIGA_MAC_VER_17:
-                        case RTL_GIGA_MAC_VER_19:
-                        case RTL_GIGA_MAC_VER_20:
-                        case RTL_GIGA_MAC_VER_21:
-                        case RTL_GIGA_MAC_VER_23:
-                        case RTL_GIGA_MAC_VER_24:
-                        case RTL_GIGA_MAC_VER_27:
-                        case RTL_GIGA_MAC_VER_28:
-                        case RTL_GIGA_MAC_VER_31:
-                        /* Experimental science. Pktgen proof. */
-                        case RTL_GIGA_MAC_VER_12:
-                        case RTL_GIGA_MAC_VER_25:
-                                if (status == RxFIFOOver)
-                                        goto done;
-                                break;
                        default:
                                break;
                        }
diff --git a/drivers/net/ethernet/tile/tilepro.c b/drivers/net/ethernet/tile/tilepro.c
index 10826d8a2a2d..1187a1169eb2 100644
--- a/drivers/net/ethernet/tile/tilepro.c
+++ b/drivers/net/ethernet/tile/tilepro.c
@@ -926,7 +926,7 @@ static int tile_net_poll(struct napi_struct *napi, int budget)
                goto done;
        /* Re-enable the ingress interrupt. */
-        enable_percpu_irq(priv->intr_id);
+        enable_percpu_irq(priv->intr_id, 0);
        /* HACK: Avoid the "rotting packet" problem (see above). */
        if (qup->__packet_receive_read !=
@@ -1296,7 +1296,7 @@ static void tile_net_open_enable(void *dev_ptr)
        info->napi_enabled = true;
        /* Enable the ingress interrupt. */
-        enable_percpu_irq(priv->intr_id);
+        enable_percpu_irq(priv->intr_id, 0);
 }
@@ -1697,7 +1697,7 @@ static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
        for (i = 0; i < sh->nr_frags; i++) {
                skb_frag_t *f = &sh->frags[i];
-                unsigned long pfn = page_to_pfn(f->page);
+                unsigned long pfn = page_to_pfn(skb_frag_page(f));
                /* FIXME: Compute "hash_for_home" properly. */
                /* ISSUE: The hypervisor checks CHIP_HAS_REV1_DMA_PACKETS(). */
@@ -1706,7 +1706,7 @@ static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
                /* FIXME: Hmmm. */
                if (!hash_default) {
                        void *va = pfn_to_kaddr(pfn) + f->page_offset;
-                        BUG_ON(PageHighMem(f->page));
+                        BUG_ON(PageHighMem(skb_frag_page(f)));
                        finv_buffer_remote(va, f->size, 0);
                }
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index e12b48c2cff6..dd008b0e6417 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -191,6 +191,7 @@ static struct iwl_base_params iwl1000_base_params = {
        .chain_noise_scale = 1000,
        .wd_timeout = IWL_DEF_WD_TIMEOUT,
        .max_event_log_size = 128,
+        .wd_disable = true,
 };
 static struct iwl_ht_params iwl1000_ht_params = {
        .ht_greenfield_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index c511c98a89a8..f55fb2d1af52 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -364,6 +364,7 @@ static struct iwl_base_params iwl5000_base_params = {
        .wd_timeout = IWL_LONG_WD_TIMEOUT,
        .max_event_log_size = 512,
        .no_idle_support = true,
+        .wd_disable = true,
 };
 static struct iwl_ht_params iwl5000_ht_params = {
        .ht_greenfield_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index 58a381c01c89..a7a6def40d05 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -528,6 +528,24 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
        return 0;
 }
+void iwlagn_config_ht40(struct ieee80211_conf *conf,
+        struct iwl_rxon_context *ctx)
+{
+        if (conf_is_ht40_minus(conf)) {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                ctx->ht.is_40mhz = true;
+        } else if (conf_is_ht40_plus(conf)) {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                ctx->ht.is_40mhz = true;
+        } else {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                ctx->ht.is_40mhz = false;
+        }
+}
 int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
        struct iwl_priv *priv = hw->priv;
@@ -586,19 +604,11 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                                ctx->ht.enabled = conf_is_ht(conf);
                        if (ctx->ht.enabled) {
-                                if (conf_is_ht40_minus(conf)) {
+                                /* if HT40 is used, it should not change
-                                        ctx->ht.extension_chan_offset =
+                                 * after associated except channel switch */
-                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                                if (iwl_is_associated_ctx(ctx) &&
-                                        ctx->ht.is_40mhz = true;
+                                     !ctx->ht.is_40mhz)
-                                } else if (conf_is_ht40_plus(conf)) {
+                                        iwlagn_config_ht40(conf, ctx);
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                        ctx->ht.is_40mhz = true;
-                                } else {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                        ctx->ht.is_40mhz = false;
-                                }
                        } else
                                ctx->ht.is_40mhz = false;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index ed6283623932..4b2aa1da0953 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1268,9 +1268,6 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
        switch (keyconf->cipher) {
        case WLAN_CIPHER_SUITE_TKIP:
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                if (sta)
                        addr = sta->addr;
                else /* station mode case only */
@@ -1283,8 +1280,6 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
                                          seq.tkip.iv32, p1k, CMD_SYNC);
                break;
        case WLAN_CIPHER_SUITE_CCMP:
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                /* fall through */
        case WLAN_CIPHER_SUITE_WEP40:
        case WLAN_CIPHER_SUITE_WEP104:
                ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index ccba69b7f8a7..bacc06c95e7a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2316,6 +2316,17 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                return -EOPNOTSUPP;
        }
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                /* fall through */
+        case WLAN_CIPHER_SUITE_CCMP:
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                break;
+        default:
+                break;
+        }
        /*
         * We could program these keys into the hardware as well, but we
         * don't expect much multicast traffic in IBSS and having keys
@@ -2599,21 +2610,9 @@ static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
        /* Configure HT40 channels */
        ctx->ht.enabled = conf_is_ht(conf);
-        if (ctx->ht.enabled) {
+        if (ctx->ht.enabled)
-                if (conf_is_ht40_minus(conf)) {
+                iwlagn_config_ht40(conf, ctx);
-                        ctx->ht.extension_chan_offset =
+        else
-                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                        ctx->ht.is_40mhz = true;
-                } else if (conf_is_ht40_plus(conf)) {
-                        ctx->ht.extension_chan_offset =
-                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                        ctx->ht.is_40mhz = true;
-                } else {
-                        ctx->ht.extension_chan_offset =
-                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                        ctx->ht.is_40mhz = false;
-                }
-        } else
                ctx->ht.is_40mhz = false;
        if ((le16_to_cpu(ctx->staging.channel) != ch))
@@ -3499,9 +3498,10 @@ MODULE_PARM_DESC(plcp_check, "Check plcp health (default: 1 [enabled])");
 module_param_named(ack_check, iwlagn_mod_params.ack_check, bool, S_IRUGO);
 MODULE_PARM_DESC(ack_check, "Check ack health (default: 0 [disabled])");
-module_param_named(wd_disable, iwlagn_mod_params.wd_disable, bool, S_IRUGO);
+module_param_named(wd_disable, iwlagn_mod_params.wd_disable, int, S_IRUGO);
 MODULE_PARM_DESC(wd_disable,
-                "Disable stuck queue watchdog timer (default: 0 [enabled])");
+                "Disable stuck queue watchdog timer 0=system default, "
+                "1=disable, 2=enable (default: 0)");
 /*
 * set bt_coex_active to true, uCode will do kill/defer
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 5b936ec1a541..3856abaea507 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -86,6 +86,8 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             struct ieee80211_bss_conf *bss_conf,
                             u32 changes);
+void iwlagn_config_ht40(struct ieee80211_conf *conf,
+                        struct iwl_rxon_context *ctx);
 /* uCode */
 int iwlagn_rx_calib_result(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 001fdf140abb..fcf54160e4ed 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1810,11 +1810,23 @@ void iwl_setup_watchdog(struct iwl_priv *priv)
 {
        unsigned int timeout = priv->cfg->base_params->wd_timeout;
-        if (timeout && !iwlagn_mod_params.wd_disable)
+        if (!iwlagn_mod_params.wd_disable) {
-                mod_timer(&priv->watchdog,
+                /* use system default */
-                          jiffies + msecs_to_jiffies(IWL_WD_TICK(timeout)));
+                if (timeout && !priv->cfg->base_params->wd_disable)
-        else
+                        mod_timer(&priv->watchdog,
-                del_timer(&priv->watchdog);
+                                jiffies +
+                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
+                else
+                        del_timer(&priv->watchdog);
+        } else {
+                /* module parameter overwrite default configuration */
+                if (timeout && iwlagn_mod_params.wd_disable == 2)
+                        mod_timer(&priv->watchdog,
+                                jiffies +
+                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
+                else
+                        del_timer(&priv->watchdog);
+        }
 }
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 137da3380704..f2fc288f3dd3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -113,6 +113,7 @@ struct iwl_lib_ops {
 * @shadow_reg_enable: HW shadhow register bit
 * @no_idle_support: do not support idle mode
 * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
+ * wd_disable: disable watchdog timer
 */
 struct iwl_base_params {
        int eeprom_size;
@@ -134,6 +135,7 @@ struct iwl_base_params {
        const bool shadow_reg_enable;
        const bool no_idle_support;
        const bool hd_v2;
+        const bool wd_disable;
 };
 /*
 * @advanced_bt_coexist: support advanced bt coexist
diff --git a/drivers/net/wireless/iwlwifi/iwl-shared.h b/drivers/net/wireless/iwlwifi/iwl-shared.h
index 1f7a93c67c45..14eaf37ce3b1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-shared.h
+++ b/drivers/net/wireless/iwlwifi/iwl-shared.h
@@ -120,7 +120,7 @@ extern struct iwl_mod_params iwlagn_mod_params;
 * @restart_fw: restart firmware, default = 1
 * @plcp_check: enable plcp health check, default = true
 * @ack_check: disable ack health check, default = false
- * @wd_disable: enable stuck queue check, default = false
+ * @wd_disable: enable stuck queue check, default = 0
 * @bt_coex_active: enable bt coex, default = true
 * @led_mode: system default, default = 0
 * @no_sleep_autoadjust: disable autoadjust, default = true
@@ -141,7 +141,7 @@ struct iwl_mod_params {
        int restart_fw;
        bool plcp_check;
        bool ack_check;
-        bool wd_disable;
+        int  wd_disable;
        bool bt_coex_active;
        int led_mode;
        bool no_sleep_autoadjust;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1ae270eed51a..15e332d08c8d 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1668,7 +1668,7 @@ static int __init netback_init(void)
                                             "netback/%u", group);
                if (IS_ERR(netbk->task)) {
-                        printk(KERN_ALERT "kthread_run() fails at netback\n");
+                        printk(KERN_ALERT "kthread_create() fails at netback\n");
                        del_timer(&netbk->net_timer);
                        rc = PTR_ERR(netbk->task);
                        goto failed_init;
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 19c0115092dd..0f0cfa3bca30 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -26,11 +26,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
-/* For archs that don't support NO_IRQ (such as x86), provide a dummy value */
-#ifndef NO_IRQ
-#define NO_IRQ 0
-#endif
 /**
 * irq_of_parse_and_map - Parse and map an interrupt into linux virq space
 * @device: Device node of the device whose interrupt is to be mapped
@@ -44,7 +39,7 @@ unsigned int irq_of_parse_and_map(struct device_node *dev, int index)
        struct of_irq oirq;
        if (of_irq_map_one(dev, index, &oirq))
-                return NO_IRQ;
+                return 0;
        return irq_create_of_mapping(oirq.controller, oirq.specifier,
                                     oirq.size);
@@ -345,7 +340,7 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
        /* Only dereference the resource if both the
         * resource and the irq are valid. */
-        if (r && irq != NO_IRQ) {
+        if (r && irq) {
                r->start = r->end = irq;
                r->flags = IORESOURCE_IRQ;
                r->name = dev->full_name;
@@ -363,7 +358,7 @@ int of_irq_count(struct device_node *dev)
 {
        int nr = 0;
-        while (of_irq_to_resource(dev, nr, NULL) != NO_IRQ)
+        while (of_irq_to_resource(dev, nr, NULL))
                nr++;
        return nr;
@@ -383,7 +378,7 @@ int of_irq_to_resource_table(struct device_node *dev, struct resource *res,
        int i;
        for (i = 0; i < nr_irqs; i++, res++)
-                if (of_irq_to_resource(dev, i, res) == NO_IRQ)
+                if (!of_irq_to_resource(dev, i, res))
                        break;
        return i;
diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
index dccd8636095c..f8c752e408a6 100644
--- a/drivers/oprofile/oprof.c
+++ b/drivers/oprofile/oprof.c
@@ -239,26 +239,45 @@ int oprofile_set_ulong(unsigned long *addr, unsigned long val)
        return err;
 }
+static int timer_mode;
 static int __init oprofile_init(void)
 {
        int err;
+        /* always init architecture to setup backtrace support */
        err = oprofile_arch_init(&oprofile_ops);
-        if (err < 0 || timer) {
-                printk(KERN_INFO "oprofile: using timer interrupt.\n");
+        timer_mode = err || timer;      /* fall back to timer mode on errors */
+        if (timer_mode) {
+                if (!err)
+                        oprofile_arch_exit();
                err = oprofile_timer_init(&oprofile_ops);
                if (err)
                        return err;
        }
-        return oprofilefs_register();
+        err = oprofilefs_register();
+        if (!err)
+                return 0;
+        /* failed */
+        if (timer_mode)
+                oprofile_timer_exit();
+        else
+                oprofile_arch_exit();
+        return err;
 }
 static void __exit oprofile_exit(void)
 {
-        oprofile_timer_exit();
        oprofilefs_unregister();
-        oprofile_arch_exit();
+        if (timer_mode)
+                oprofile_timer_exit();
+        else
+                oprofile_arch_exit();
 }
diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
index 3ef44624f510..878fba126582 100644
--- a/drivers/oprofile/timer_int.c
+++ b/drivers/oprofile/timer_int.c
@@ -110,6 +110,7 @@ int oprofile_timer_init(struct oprofile_operations *ops)
        ops->start = oprofile_hrtimer_start;
        ops->stop = oprofile_hrtimer_stop;
        ops->cpu_type = "timer";
+        printk(KERN_INFO "oprofile: using timer interrupt.\n");
        return 0;
 }
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 13ef8c37471d..dcdc1f4a4624 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -121,6 +121,7 @@ struct toshiba_acpi_dev {
        int illumination_supported:1;
        int video_supported:1;
        int fan_supported:1;
+        int system_event_supported:1;
        struct mutex mutex;
 };
@@ -724,7 +725,7 @@ static int keys_proc_show(struct seq_file *m, void *v)
        u32 hci_result;
        u32 value;
-        if (!dev->key_event_valid) {
+        if (!dev->key_event_valid && dev->system_event_supported) {
                hci_read1(dev, HCI_SYSTEM_EVENT, &value, &hci_result);
                if (hci_result == HCI_SUCCESS) {
                        dev->key_event_valid = 1;
@@ -964,6 +965,8 @@ static int __devinit toshiba_acpi_add(struct acpi_device *acpi_dev)
        /* enable event fifo */
        hci_write1(dev, HCI_SYSTEM_EVENT, 1, &hci_result);
+        if (hci_result == HCI_SUCCESS)
+                dev->system_event_supported = 1;
        props.type = BACKLIGHT_PLATFORM;
        props.max_brightness = HCI_LCD_BRIGHTNESS_LEVELS - 1;
@@ -1032,12 +1035,15 @@ static void toshiba_acpi_notify(struct acpi_device *acpi_dev, u32 event)
 {
        struct toshiba_acpi_dev *dev = acpi_driver_data(acpi_dev);
        u32 hci_result, value;
+        int retries = 3;
-        if (event != 0x80)
+        if (!dev->system_event_supported || event != 0x80)
                return;
        do {
                hci_read1(dev, HCI_SYSTEM_EVENT, &value, &hci_result);
-                if (hci_result == HCI_SUCCESS) {
+                switch (hci_result) {
+                case HCI_SUCCESS:
                        if (value == 0x100)
                                continue;
                        /* act on key press; ignore key release */
@@ -1049,14 +1055,19 @@ static void toshiba_acpi_notify(struct acpi_device *acpi_dev, u32 event)
                                pr_info("Unknown key %x\n",
                                       value);
                        }
-                } else if (hci_result == HCI_NOT_SUPPORTED) {
+                        break;
+                case HCI_NOT_SUPPORTED:
                        /* This is a workaround for an unresolved issue on
                         * some machines where system events sporadically
                         * become disabled. */
                        hci_write1(dev, HCI_SYSTEM_EVENT, 1, &hci_result);
                        pr_notice("Re-enabled hotkeys\n");
+                        /* fall through */
+                default:
+                        retries--;
+                        break;
                }
-        } while (hci_result != HCI_EMPTY);
+        } while (retries && hci_result != HCI_EMPTY);
 }
diff --git a/drivers/power/intel_mid_battery.c b/drivers/power/intel_mid_battery.c
index cffcb7c00b00..01fa671ec97f 100644
--- a/drivers/power/intel_mid_battery.c
+++ b/drivers/power/intel_mid_battery.c
@@ -61,7 +61,8 @@ MODULE_PARM_DESC(debug, "Flag to enable PMIC Battery debug messages.");
 #define PMIC_BATT_CHR_SBATDET_MASK      (1 << 5)
 #define PMIC_BATT_CHR_SDCLMT_MASK       (1 << 6)
 #define PMIC_BATT_CHR_SUSBOVP_MASK      (1 << 7)
-#define PMIC_BATT_CHR_EXCPT_MASK        0xC6
+#define PMIC_BATT_CHR_EXCPT_MASK        0x86
 #define PMIC_BATT_ADC_ACCCHRG_MASK      (1 << 31)
 #define PMIC_BATT_ADC_ACCCHRGVAL_MASK   0x7FFFFFFF
@@ -304,11 +305,6 @@ static void pmic_battery_read_status(struct pmic_power_module_info *pbi)
                        pbi->batt_status = POWER_SUPPLY_STATUS_NOT_CHARGING;
                        pmic_battery_log_event(BATT_EVENT_BATOVP_EXCPT);
                        batt_exception = 1;
-                } else if (r8 & PMIC_BATT_CHR_SDCLMT_MASK) {
-                        pbi->batt_health = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
-                        pbi->batt_status = POWER_SUPPLY_STATUS_NOT_CHARGING;
-                        pmic_battery_log_event(BATT_EVENT_DCLMT_EXCPT);
-                        batt_exception = 1;
                } else if (r8 & PMIC_BATT_CHR_STEMP_MASK) {
                        pbi->batt_health = POWER_SUPPLY_HEALTH_OVERHEAT;
                        pbi->batt_status = POWER_SUPPLY_STATUS_NOT_CHARGING;
@@ -316,6 +312,10 @@ static void pmic_battery_read_status(struct pmic_power_module_info *pbi)
                        batt_exception = 1;
                } else {
                        pbi->batt_health = POWER_SUPPLY_HEALTH_GOOD;
+                        if (r8 & PMIC_BATT_CHR_SDCLMT_MASK) {
+                                /* PMIC will change charging current automatically */
+                                pmic_battery_log_event(BATT_EVENT_DCLMT_EXCPT);
+                        }
                }
        }
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index cf3f9997546d..10451a15e828 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -101,7 +101,9 @@ static s32 scaled_ppm_to_ppb(long ppm)
 static int ptp_clock_getres(struct posix_clock *pc, struct timespec *tp)
 {
-        return 1; /* always round timer functions to one nanosecond */
+        tp->tv_sec = 0;
+        tp->tv_nsec = 1;
+        return 0;
 }
 static int ptp_clock_settime(struct posix_clock *pc, const struct timespec *tp)
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 5225930a10cd..691b1ab1a3d0 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -851,14 +851,12 @@ static int tsi721_doorbell_init(struct tsi721_device *priv)
        INIT_WORK(&priv->idb_work, tsi721_db_dpc);
        /* Allocate buffer for inbound doorbells queue */
-        priv->idb_base = dma_alloc_coherent(&priv->pdev->dev,
+        priv->idb_base = dma_zalloc_coherent(&priv->pdev->dev,
                                IDB_QSIZE * TSI721_IDB_ENTRY_SIZE,
                                &priv->idb_dma, GFP_KERNEL);
        if (!priv->idb_base)
                return -ENOMEM;
-        memset(priv->idb_base, 0, IDB_QSIZE * TSI721_IDB_ENTRY_SIZE);
        dev_dbg(&priv->pdev->dev, "Allocated IDB buffer @ %p (phys = %llx)\n",
                priv->idb_base, (unsigned long long)priv->idb_dma);
@@ -904,7 +902,7 @@ static int tsi721_bdma_ch_init(struct tsi721_device *priv, int chnum)
         */
        /* Allocate space for DMA descriptors */
-        bd_ptr = dma_alloc_coherent(&priv->pdev->dev,
+        bd_ptr = dma_zalloc_coherent(&priv->pdev->dev,
                                        bd_num * sizeof(struct tsi721_dma_desc),
                                        &bd_phys, GFP_KERNEL);
        if (!bd_ptr)
@@ -913,8 +911,6 @@ static int tsi721_bdma_ch_init(struct tsi721_device *priv, int chnum)
        priv->bdma[chnum].bd_phys = bd_phys;
        priv->bdma[chnum].bd_base = bd_ptr;
-        memset(bd_ptr, 0, bd_num * sizeof(struct tsi721_dma_desc));
        dev_dbg(&priv->pdev->dev, "DMA descriptors @ %p (phys = %llx)\n",
                bd_ptr, (unsigned long long)bd_phys);
@@ -922,7 +918,7 @@ static int tsi721_bdma_ch_init(struct tsi721_device *priv, int chnum)
        sts_size = (bd_num >= TSI721_DMA_MINSTSSZ) ?
                                        bd_num : TSI721_DMA_MINSTSSZ;
        sts_size = roundup_pow_of_two(sts_size);
-        sts_ptr = dma_alloc_coherent(&priv->pdev->dev,
+        sts_ptr = dma_zalloc_coherent(&priv->pdev->dev,
                                     sts_size * sizeof(struct tsi721_dma_sts),
                                     &sts_phys, GFP_KERNEL);
        if (!sts_ptr) {
@@ -938,8 +934,6 @@ static int tsi721_bdma_ch_init(struct tsi721_device *priv, int chnum)
        priv->bdma[chnum].sts_base = sts_ptr;
        priv->bdma[chnum].sts_size = sts_size;
-        memset(sts_ptr, 0, sts_size);
        dev_dbg(&priv->pdev->dev,
                "desc status FIFO @ %p (phys = %llx) size=0x%x\n",
                sts_ptr, (unsigned long long)sts_phys, sts_size);
@@ -1400,7 +1394,7 @@ static int tsi721_open_outb_mbox(struct rio_mport *mport, void *dev_id,
        /* Outbound message descriptor status FIFO allocation */
        priv->omsg_ring[mbox].sts_size = roundup_pow_of_two(entries + 1);
-        priv->omsg_ring[mbox].sts_base = dma_alloc_coherent(&priv->pdev->dev,
+        priv->omsg_ring[mbox].sts_base = dma_zalloc_coherent(&priv->pdev->dev,
                        priv->omsg_ring[mbox].sts_size *
                                                sizeof(struct tsi721_dma_sts),
                        &priv->omsg_ring[mbox].sts_phys, GFP_KERNEL);
@@ -1412,9 +1406,6 @@ static int tsi721_open_outb_mbox(struct rio_mport *mport, void *dev_id,
                goto out_desc;
        }
-        memset(priv->omsg_ring[mbox].sts_base, 0,
-                entries * sizeof(struct tsi721_dma_sts));
        /*
         * Configure Outbound Messaging Engine
         */
@@ -2116,8 +2107,8 @@ static int __devinit tsi721_setup_mport(struct tsi721_device *priv)
        INIT_LIST_HEAD(&mport->dbells);
        rio_init_dbell_res(&mport->riores[RIO_DOORBELL_RESOURCE], 0, 0xffff);
-        rio_init_mbox_res(&mport->riores[RIO_INB_MBOX_RESOURCE], 0, 0);
+        rio_init_mbox_res(&mport->riores[RIO_INB_MBOX_RESOURCE], 0, 3);
-        rio_init_mbox_res(&mport->riores[RIO_OUTB_MBOX_RESOURCE], 0, 0);
+        rio_init_mbox_res(&mport->riores[RIO_OUTB_MBOX_RESOURCE], 0, 3);
        strcpy(mport->name, "Tsi721 mport");
        /* Hook up interrupt handler */
@@ -2163,7 +2154,7 @@ static int __devinit tsi721_probe(struct pci_dev *pdev,
                                  const struct pci_device_id *id)
 {
        struct tsi721_device *priv;
-        int i;
+        int i, cap;
        int err;
        u32 regval;
@@ -2271,10 +2262,20 @@ static int __devinit tsi721_probe(struct pci_dev *pdev,
                        dev_info(&pdev->dev, "Unable to set consistent DMA mask\n");
        }
-        /* Clear "no snoop" and "relaxed ordering" bits. */
+        cap = pci_pcie_cap(pdev);
-        pci_read_config_dword(pdev, 0x40 + PCI_EXP_DEVCTL, &regval);
+        BUG_ON(cap == 0);
-        regval &= ~(PCI_EXP_DEVCTL_RELAX_EN | PCI_EXP_DEVCTL_NOSNOOP_EN);
-        pci_write_config_dword(pdev, 0x40 + PCI_EXP_DEVCTL, regval);
+        /* Clear "no snoop" and "relaxed ordering" bits, use default MRRS. */
+        pci_read_config_dword(pdev, cap + PCI_EXP_DEVCTL, &regval);
+        regval &= ~(PCI_EXP_DEVCTL_READRQ | PCI_EXP_DEVCTL_RELAX_EN |
+                    PCI_EXP_DEVCTL_NOSNOOP_EN);
+        regval |= 0x2 << MAX_READ_REQUEST_SZ_SHIFT;
+        pci_write_config_dword(pdev, cap + PCI_EXP_DEVCTL, regval);
+        /* Adjust PCIe completion timeout. */
+        pci_read_config_dword(pdev, cap + PCI_EXP_DEVCTL2, &regval);
+        regval &= ~(0x0f);
+        pci_write_config_dword(pdev, cap + PCI_EXP_DEVCTL2, regval | 0x2);
        /*
         * FIXUP: correct offsets of MSI-X tables in the MSI-X Capability Block
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 58be4deb1402..822e54c394d5 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -72,6 +72,8 @@
 #define TSI721_MSIXPBA_OFFSET   0x2a000
 #define TSI721_PCIECFG_EPCTL    0x400
+#define MAX_READ_REQUEST_SZ_SHIFT       12
 /*
 * Event Management Registers
 */
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index e8326f26fa2f..dc4c2748bbc3 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -63,7 +63,7 @@ static int rtc_suspend(struct device *dev, pm_message_t mesg)
         */
        delta = timespec_sub(old_system, old_rtc);
        delta_delta = timespec_sub(delta, old_delta);
-        if (abs(delta_delta.tv_sec)  >= 2) {
+        if (delta_delta.tv_sec < -2 || delta_delta.tv_sec >= 2) {
                /*
                 * if delta_delta is too large, assume time correction
                 * has occured and set old_delta to the current delta.
@@ -97,9 +97,8 @@ static int rtc_resume(struct device *dev)
        rtc_tm_to_time(&tm, &new_rtc.tv_sec);
        new_rtc.tv_nsec = 0;
-        if (new_rtc.tv_sec <= old_rtc.tv_sec) {
+        if (new_rtc.tv_sec < old_rtc.tv_sec) {
-                if (new_rtc.tv_sec < old_rtc.tv_sec)
+                pr_debug("%s:  time travel!\n", dev_name(&rtc->dev));
-                        pr_debug("%s:  time travel!\n", dev_name(&rtc->dev));
                return 0;
        }
@@ -116,7 +115,8 @@ static int rtc_resume(struct device *dev)
        sleep_time = timespec_sub(sleep_time,
                        timespec_sub(new_system, old_system));
-        timekeeping_inject_sleeptime(&sleep_time);
+        if (sleep_time.tv_sec >= 0)
+                timekeeping_inject_sleeptime(&sleep_time);
        return 0;
 }
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 8e286259a007..fa4d9f324189 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -319,6 +319,20 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 }
 EXPORT_SYMBOL_GPL(rtc_read_alarm);
+static int ___rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+{
+        int err;
+        if (!rtc->ops)
+                err = -ENODEV;
+        else if (!rtc->ops->set_alarm)
+                err = -EINVAL;
+        else
+                err = rtc->ops->set_alarm(rtc->dev.parent, alarm);
+        return err;
+}
 static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 {
        struct rtc_time tm;
@@ -342,14 +356,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
         * over right here, before we set the alarm.
         */
-        if (!rtc->ops)
+        return ___rtc_set_alarm(rtc, alarm);
-                err = -ENODEV;
-        else if (!rtc->ops->set_alarm)
-                err = -EINVAL;
-        else
-                err = rtc->ops->set_alarm(rtc->dev.parent, alarm);
-        return err;
 }
 int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
@@ -763,6 +770,20 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
        return 0;
 }
+static void rtc_alarm_disable(struct rtc_device *rtc)
+{
+        struct rtc_wkalrm alarm;
+        struct rtc_time tm;
+        __rtc_read_time(rtc, &tm);
+        alarm.time = rtc_ktime_to_tm(ktime_add(rtc_tm_to_ktime(tm),
+                                     ktime_set(300, 0)));
+        alarm.enabled = 0;
+        ___rtc_set_alarm(rtc, &alarm);
+}
 /**
 * rtc_timer_remove - Removes a rtc_timer from the rtc_device timerqueue
 * @rtc rtc device
@@ -784,8 +805,10 @@ static void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer)
                struct rtc_wkalrm alarm;
                int err;
                next = timerqueue_getnext(&rtc->timerqueue);
-                if (!next)
+                if (!next) {
+                        rtc_alarm_disable(rtc);
                        return;
+                }
                alarm.time = rtc_ktime_to_tm(next->expires);
                alarm.enabled = 1;
                err = __rtc_set_alarm(rtc, &alarm);
@@ -847,7 +870,8 @@ again:
                err = __rtc_set_alarm(rtc, &alarm);
                if (err == -ETIME)
                        goto again;
-        }
+        } else
+                rtc_alarm_disable(rtc);
        mutex_unlock(&rtc->ops_lock);
 }
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 7639ab906f02..5b979d9cc332 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -202,7 +202,6 @@ static int s3c_rtc_settime(struct device *dev, struct rtc_time *tm)
        void __iomem *base = s3c_rtc_base;
        int year = tm->tm_year - 100;
-        clk_enable(rtc_clk);
        pr_debug("set time %04d.%02d.%02d %02d:%02d:%02d\n",
                 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
                 tm->tm_hour, tm->tm_min, tm->tm_sec);
@@ -214,6 +213,7 @@ static int s3c_rtc_settime(struct device *dev, struct rtc_time *tm)
                return -EINVAL;
        }
+        clk_enable(rtc_clk);
        writeb(bin2bcd(tm->tm_sec),  base + S3C2410_RTCSEC);
        writeb(bin2bcd(tm->tm_min),  base + S3C2410_RTCMIN);
        writeb(bin2bcd(tm->tm_hour), base + S3C2410_RTCHOUR);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 75c3f1f8fd43..a84631a7391d 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -529,10 +529,7 @@ __s390_vary_chpid_on(struct subchannel_id schid, void *data)
 int chsc_chp_vary(struct chp_id chpid, int on)
 {
        struct channel_path *chp = chpid_to_chp(chpid);
-        struct chp_link link;
-        memset(&link, 0, sizeof(struct chp_link));
-        link.chpid = chpid;
        /* Wait until previous actions have settled. */
        css_wait_for_slow_path();
        /*
@@ -542,10 +539,10 @@ int chsc_chp_vary(struct chp_id chpid, int on)
                /* Try to update the channel path descritor. */
                chsc_determine_base_channel_path_desc(chpid, &chp->desc);
                for_each_subchannel_staged(s390_subchannel_vary_chpid_on,
-                                           __s390_vary_chpid_on, &link);
+                                           __s390_vary_chpid_on, &chpid);
        } else
                for_each_subchannel_staged(s390_subchannel_vary_chpid_off,
-                                           NULL, &link);
+                                           NULL, &chpid);
        return 0;
 }
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 155a82bcb9e5..4a1ff5c2eb88 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -68,8 +68,13 @@ struct schib {
        __u8 mda[4];             /* model dependent area */
 } __attribute__ ((packed,aligned(4)));
+/*
+ * When rescheduled, todo's with higher values will overwrite those
+ * with lower values.
+ */
 enum sch_todo {
        SCH_TODO_NOTHING,
+        SCH_TODO_EVAL,
        SCH_TODO_UNREG,
 };
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 92d7324acb1c..21908e67bf67 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -195,51 +195,6 @@ void css_sch_device_unregister(struct subchannel *sch)
 }
 EXPORT_SYMBOL_GPL(css_sch_device_unregister);
-static void css_sch_todo(struct work_struct *work)
-{
-        struct subchannel *sch;
-        enum sch_todo todo;
-        sch = container_of(work, struct subchannel, todo_work);
-        /* Find out todo. */
-        spin_lock_irq(sch->lock);
-        todo = sch->todo;
-        CIO_MSG_EVENT(4, "sch_todo: sch=0.%x.%04x, todo=%d\n", sch->schid.ssid,
-                      sch->schid.sch_no, todo);
-        sch->todo = SCH_TODO_NOTHING;
-        spin_unlock_irq(sch->lock);
-        /* Perform todo. */
-        if (todo == SCH_TODO_UNREG)
-                css_sch_device_unregister(sch);
-        /* Release workqueue ref. */
-        put_device(&sch->dev);
-}
-/**
- * css_sched_sch_todo - schedule a subchannel operation
- * @sch: subchannel
- * @todo: todo
- *
- * Schedule the operation identified by @todo to be performed on the slow path
- * workqueue. Do nothing if another operation with higher priority is already
- * scheduled. Needs to be called with subchannel lock held.
- */
-void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo)
-{
-        CIO_MSG_EVENT(4, "sch_todo: sched sch=0.%x.%04x todo=%d\n",
-                      sch->schid.ssid, sch->schid.sch_no, todo);
-        if (sch->todo >= todo)
-                return;
-        /* Get workqueue ref. */
-        if (!get_device(&sch->dev))
-                return;
-        sch->todo = todo;
-        if (!queue_work(cio_work_q, &sch->todo_work)) {
-                /* Already queued, release workqueue ref. */
-                put_device(&sch->dev);
-        }
-}
 static void ssd_from_pmcw(struct chsc_ssd_info *ssd, struct pmcw *pmcw)
 {
        int i;
@@ -466,6 +421,65 @@ static void css_evaluate_subchannel(struct subchannel_id schid, int slow)
                css_schedule_eval(schid);
 }
+/**
+ * css_sched_sch_todo - schedule a subchannel operation
+ * @sch: subchannel
+ * @todo: todo
+ *
+ * Schedule the operation identified by @todo to be performed on the slow path
+ * workqueue. Do nothing if another operation with higher priority is already
+ * scheduled. Needs to be called with subchannel lock held.
+ */
+void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo)
+{
+        CIO_MSG_EVENT(4, "sch_todo: sched sch=0.%x.%04x todo=%d\n",
+                      sch->schid.ssid, sch->schid.sch_no, todo);
+        if (sch->todo >= todo)
+                return;
+        /* Get workqueue ref. */
+        if (!get_device(&sch->dev))
+                return;
+        sch->todo = todo;
+        if (!queue_work(cio_work_q, &sch->todo_work)) {
+                /* Already queued, release workqueue ref. */
+                put_device(&sch->dev);
+        }
+}
+static void css_sch_todo(struct work_struct *work)
+{
+        struct subchannel *sch;
+        enum sch_todo todo;
+        int ret;
+        sch = container_of(work, struct subchannel, todo_work);
+        /* Find out todo. */
+        spin_lock_irq(sch->lock);
+        todo = sch->todo;
+        CIO_MSG_EVENT(4, "sch_todo: sch=0.%x.%04x, todo=%d\n", sch->schid.ssid,
+                      sch->schid.sch_no, todo);
+        sch->todo = SCH_TODO_NOTHING;
+        spin_unlock_irq(sch->lock);
+        /* Perform todo. */
+        switch (todo) {
+        case SCH_TODO_NOTHING:
+                break;
+        case SCH_TODO_EVAL:
+                ret = css_evaluate_known_subchannel(sch, 1);
+                if (ret == -EAGAIN) {
+                        spin_lock_irq(sch->lock);
+                        css_sched_sch_todo(sch, todo);
+                        spin_unlock_irq(sch->lock);
+                }
+                break;
+        case SCH_TODO_UNREG:
+                css_sch_device_unregister(sch);
+                break;
+        }
+        /* Release workqueue ref. */
+        put_device(&sch->dev);
+}
 static struct idset *slow_subchannel_set;
 static spinlock_t slow_subchannel_lock;
 static wait_queue_head_t css_eval_wq;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index d734f4a0ecac..47269858ecb6 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1868,9 +1868,9 @@ static void __ccw_device_pm_restore(struct ccw_device *cdev)
         */
        cdev->private->flags.resuming = 1;
        cdev->private->path_new_mask = LPM_ANYPATH;
-        css_schedule_eval(sch->schid);
+        css_sched_sch_todo(sch, SCH_TODO_EVAL);
        spin_unlock_irq(sch->lock);
-        css_complete_work();
+        css_wait_for_slow_path();
        /* cdev may have been moved to a different subchannel. */
        sch = to_subchannel(cdev->dev.parent);
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 52c233fa2b12..1b853513c891 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -496,8 +496,26 @@ static void ccw_device_reset_path_events(struct ccw_device *cdev)
        cdev->private->pgid_reset_mask = 0;
 }
-void
+static void create_fake_irb(struct irb *irb, int type)
-ccw_device_verify_done(struct ccw_device *cdev, int err)
+{
+        memset(irb, 0, sizeof(*irb));
+        if (type == FAKE_CMD_IRB) {
+                struct cmd_scsw *scsw = &irb->scsw.cmd;
+                scsw->cc = 1;
+                scsw->fctl = SCSW_FCTL_START_FUNC;
+                scsw->actl = SCSW_ACTL_START_PEND;
+                scsw->stctl = SCSW_STCTL_STATUS_PEND;
+        } else if (type == FAKE_TM_IRB) {
+                struct tm_scsw *scsw = &irb->scsw.tm;
+                scsw->x = 1;
+                scsw->cc = 1;
+                scsw->fctl = SCSW_FCTL_START_FUNC;
+                scsw->actl = SCSW_ACTL_START_PEND;
+                scsw->stctl = SCSW_STCTL_STATUS_PEND;
+        }
+}
+void ccw_device_verify_done(struct ccw_device *cdev, int err)
 {
        struct subchannel *sch;
@@ -520,12 +538,8 @@ callback:
                ccw_device_done(cdev, DEV_STATE_ONLINE);
                /* Deliver fake irb to device driver, if needed. */
                if (cdev->private->flags.fake_irb) {
-                        memset(&cdev->private->irb, 0, sizeof(struct irb));
+                        create_fake_irb(&cdev->private->irb,
-                        cdev->private->irb.scsw.cmd.cc = 1;
+                                        cdev->private->flags.fake_irb);
-                        cdev->private->irb.scsw.cmd.fctl = SCSW_FCTL_START_FUNC;
-                        cdev->private->irb.scsw.cmd.actl = SCSW_ACTL_START_PEND;
-                        cdev->private->irb.scsw.cmd.stctl =
-                                SCSW_STCTL_STATUS_PEND;
                        cdev->private->flags.fake_irb = 0;
                        if (cdev->handler)
                                cdev->handler(cdev, cdev->private->intparm,
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index f98698d5735e..ec7fb6d3b479 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -198,7 +198,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
        if (cdev->private->state == DEV_STATE_VERIFY) {
                /* Remember to fake irb when finished. */
                if (!cdev->private->flags.fake_irb) {
-                        cdev->private->flags.fake_irb = 1;
+                        cdev->private->flags.fake_irb = FAKE_CMD_IRB;
                        cdev->private->intparm = intparm;
                        return 0;
                } else
@@ -213,9 +213,9 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
        ret = cio_set_options (sch, flags);
        if (ret)
                return ret;
-        /* Adjust requested path mask to excluded varied off paths. */
+        /* Adjust requested path mask to exclude unusable paths. */
        if (lpm) {
-                lpm &= sch->opm;
+                lpm &= sch->lpm;
                if (lpm == 0)
                        return -EACCES;
        }
@@ -605,11 +605,21 @@ int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
        sch = to_subchannel(cdev->dev.parent);
        if (!sch->schib.pmcw.ena)
                return -EINVAL;
+        if (cdev->private->state == DEV_STATE_VERIFY) {
+                /* Remember to fake irb when finished. */
+                if (!cdev->private->flags.fake_irb) {
+                        cdev->private->flags.fake_irb = FAKE_TM_IRB;
+                        cdev->private->intparm = intparm;
+                        return 0;
+                } else
+                        /* There's already a fake I/O around. */
+                        return -EBUSY;
+        }
        if (cdev->private->state != DEV_STATE_ONLINE)
                return -EIO;
-        /* Adjust requested path mask to excluded varied off paths. */
+        /* Adjust requested path mask to exclude unusable paths. */
        if (lpm) {
-                lpm &= sch->opm;
+                lpm &= sch->lpm;
                if (lpm == 0)
                        return -EACCES;
        }
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 2ebb492a5c17..76253dfcc1be 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -111,6 +111,9 @@ enum cdev_todo {
        CDEV_TODO_UNREG_EVAL,
 };
+#define FAKE_CMD_IRB    1
+#define FAKE_TM_IRB     2
 struct ccw_device_private {
        struct ccw_device *cdev;
        struct subchannel *sch;
@@ -138,7 +141,7 @@ struct ccw_device_private {
                unsigned int doverify:1;    /* delayed path verification */
                unsigned int donotify:1;    /* call notify function */
                unsigned int recog_done:1;  /* dev. recog. complete */
-                unsigned int fake_irb:1;    /* deliver faked irb */
+                unsigned int fake_irb:2;    /* deliver faked irb */
                unsigned int resuming:1;    /* recognition while resume */
                unsigned int pgroup:1;      /* pathgroup is set up */
                unsigned int mpath:1;       /* multipathing is set up */
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ec94f049e995..96bbe9d12a79 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1552,6 +1552,8 @@ static void ap_reset(struct ap_device *ap_dev)
        rc = ap_init_queue(ap_dev->qid);
        if (rc == -ENODEV)
                ap_dev->unregistered = 1;
+        else
+                __ap_schedule_poll_timer();
 }
 static int __ap_poll_device(struct ap_device *ap_dev, unsigned long *flags)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index a1fd73df5416..8ba4510a9519 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -199,7 +199,7 @@ config SPI_FSL_LIB
        depends on FSL_SOC
 config SPI_FSL_SPI
-        tristate "Freescale SPI controller"
+        bool "Freescale SPI controller"
        depends on FSL_SOC
        select SPI_FSL_LIB
        help
@@ -208,7 +208,7 @@ config SPI_FSL_SPI
          MPC8569 uses the controller in QE mode, MPC8610 in cpu mode.
 config SPI_FSL_ESPI
-        tristate "Freescale eSPI controller"
+        bool "Freescale eSPI controller"
        depends on FSL_SOC
        select SPI_FSL_LIB
        help
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 024b48aed5ca..acc88b4d2869 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -13,6 +13,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index e093d3ec41ba..0094c645ff0d 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -256,7 +256,7 @@ static void spi_gpio_cleanup(struct spi_device *spi)
        spi_bitbang_cleanup(spi);
 }
-static int __init spi_gpio_alloc(unsigned pin, const char *label, bool is_in)
+static int __devinit spi_gpio_alloc(unsigned pin, const char *label, bool is_in)
 {
        int value;
@@ -270,7 +270,7 @@ static int __init spi_gpio_alloc(unsigned pin, const char *label, bool is_in)
        return value;
 }
-static int __init
+static int __devinit
 spi_gpio_request(struct spi_gpio_platform_data *pdata, const char *label,
        u16 *res_flags)
 {
diff --git a/drivers/spi/spi-nuc900.c b/drivers/spi/spi-nuc900.c
index 21c70b2b8311..182e9c873822 100644
--- a/drivers/spi/spi-nuc900.c
+++ b/drivers/spi/spi-nuc900.c
@@ -8,6 +8,7 @@
 *
 */
+#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 0fd96c10271d..8599545cdf9e 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -614,13 +614,12 @@ int iscsit_add_reject(
        hdr     = (struct iscsi_reject *) cmd->pdu;
        hdr->reason = reason;
-        cmd->buf_ptr = kzalloc(ISCSI_HDR_LEN, GFP_KERNEL);
+        cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
        if (!cmd->buf_ptr) {
                pr_err("Unable to allocate memory for cmd->buf_ptr\n");
                iscsit_release_cmd(cmd);
                return -1;
        }
-        memcpy(cmd->buf_ptr, buf, ISCSI_HDR_LEN);
        spin_lock_bh(&conn->cmd_lock);
        list_add_tail(&cmd->i_list, &conn->conn_cmd_list);
@@ -661,13 +660,12 @@ int iscsit_add_reject_from_cmd(
        hdr     = (struct iscsi_reject *) cmd->pdu;
        hdr->reason = reason;
-        cmd->buf_ptr = kzalloc(ISCSI_HDR_LEN, GFP_KERNEL);
+        cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
        if (!cmd->buf_ptr) {
                pr_err("Unable to allocate memory for cmd->buf_ptr\n");
                iscsit_release_cmd(cmd);
                return -1;
        }
-        memcpy(cmd->buf_ptr, buf, ISCSI_HDR_LEN);
        if (add_to_conn) {
                spin_lock_bh(&conn->cmd_lock);
@@ -1017,11 +1015,6 @@ done:
                                " non-existent or non-exported iSCSI LUN:"
                                " 0x%016Lx\n", get_unaligned_le64(&hdr->lun));
                }
-                if (ret == PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES)
-                        return iscsit_add_reject_from_cmd(
-                                        ISCSI_REASON_BOOKMARK_NO_RESOURCES,
-                                        1, 1, buf, cmd);
                send_check_condition = 1;
                goto attach_cmd;
        }
@@ -1044,6 +1037,8 @@ done:
                 */
                send_check_condition = 1;
        } else {
+                cmd->data_length = cmd->se_cmd.data_length;
                if (iscsit_decide_list_to_build(cmd, payload_length) < 0)
                        return iscsit_add_reject_from_cmd(
                                ISCSI_REASON_BOOKMARK_NO_RESOURCES,
@@ -1123,7 +1118,7 @@ attach_cmd:
         * the backend memory allocation.
         */
        ret = transport_generic_new_cmd(&cmd->se_cmd);
-        if ((ret < 0) || (cmd->se_cmd.se_cmd_flags & SCF_SE_CMD_FAILED)) {
+        if (ret < 0) {
                immed_ret = IMMEDIATE_DATA_NORMAL_OPERATION;
                dump_immediate_data = 1;
                goto after_immediate_data;
@@ -1341,7 +1336,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
                spin_lock_irqsave(&se_cmd->t_state_lock, flags);
                if (!(se_cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) ||
-                     (se_cmd->se_cmd_flags & SCF_SE_CMD_FAILED))
+                     (se_cmd->se_cmd_flags & SCF_SCSI_CDB_EXCEPTION))
                        dump_unsolicited_data = 1;
                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -2513,10 +2508,10 @@ static int iscsit_send_data_in(
        if (hdr->flags & ISCSI_FLAG_DATA_STATUS) {
                if (cmd->se_cmd.se_cmd_flags & SCF_OVERFLOW_BIT) {
                        hdr->flags |= ISCSI_FLAG_DATA_OVERFLOW;
-                        hdr->residual_count = cpu_to_be32(cmd->residual_count);
+                        hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
                } else if (cmd->se_cmd.se_cmd_flags & SCF_UNDERFLOW_BIT) {
                        hdr->flags |= ISCSI_FLAG_DATA_UNDERFLOW;
-                        hdr->residual_count = cpu_to_be32(cmd->residual_count);
+                        hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
                }
        }
        hton24(hdr->dlength, datain.length);
@@ -3018,10 +3013,10 @@ static int iscsit_send_status(
        hdr->flags              |= ISCSI_FLAG_CMD_FINAL;
        if (cmd->se_cmd.se_cmd_flags & SCF_OVERFLOW_BIT) {
                hdr->flags |= ISCSI_FLAG_CMD_OVERFLOW;
-                hdr->residual_count = cpu_to_be32(cmd->residual_count);
+                hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
        } else if (cmd->se_cmd.se_cmd_flags & SCF_UNDERFLOW_BIT) {
                hdr->flags |= ISCSI_FLAG_CMD_UNDERFLOW;
-                hdr->residual_count = cpu_to_be32(cmd->residual_count);
+                hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
        }
        hdr->response           = cmd->iscsi_response;
        hdr->cmd_status         = cmd->se_cmd.scsi_status;
@@ -3133,6 +3128,7 @@ static int iscsit_send_task_mgt_rsp(
        hdr                     = (struct iscsi_tm_rsp *) cmd->pdu;
        memset(hdr, 0, ISCSI_HDR_LEN);
        hdr->opcode             = ISCSI_OP_SCSI_TMFUNC_RSP;
+        hdr->flags              = ISCSI_FLAG_CMD_FINAL;
        hdr->response           = iscsit_convert_tcm_tmr_rsp(se_tmr);
        hdr->itt                = cpu_to_be32(cmd->init_task_tag);
        cmd->stat_sn            = conn->stat_sn++;
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index beb39469e7f1..1cd6ce373b83 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -30,9 +30,11 @@
 static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
 {
-        int j = DIV_ROUND_UP(len, 2);
+        int j = DIV_ROUND_UP(len, 2), rc;
-        hex2bin(dst, src, j);
+        rc = hex2bin(dst, src, j);
+        if (rc < 0)
+                pr_debug("CHAP string contains non hex digit symbols\n");
        dst[j] = '\0';
        return j;
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 3723d90d5ae5..f1a02dad05a0 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -398,7 +398,6 @@ struct iscsi_cmd {
        u32                     pdu_send_order;
        /* Current struct iscsi_pdu in struct iscsi_cmd->pdu_list */
        u32                     pdu_start;
-        u32                     residual_count;
        /* Next struct iscsi_seq to send in struct iscsi_cmd->seq_list */
        u32                     seq_send_order;
        /* Number of struct iscsi_seq in struct iscsi_cmd->seq_list */
@@ -535,7 +534,6 @@ struct iscsi_conn {
        atomic_t                connection_exit;
        atomic_t                connection_recovery;
        atomic_t                connection_reinstatement;
-        atomic_t                connection_wait;
        atomic_t                connection_wait_rcfr;
        atomic_t                sleep_on_conn_wait_comp;
        atomic_t                transport_failed;
@@ -643,7 +641,6 @@ struct iscsi_session {
        atomic_t                session_reinstatement;
        atomic_t                session_stop_active;
        atomic_t                sleep_on_sess_wait_comp;
-        atomic_t                transport_wait_cmds;
        /* connection list */
        struct list_head        sess_conn_list;
        struct list_head        cr_active_list;
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index c4c68da3e500..101b1beb3bca 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -938,8 +938,7 @@ int iscsit_execute_cmd(struct iscsi_cmd *cmd, int ooo)
                 * handle the SCF_SCSI_RESERVATION_CONFLICT case here as well.
                 */
                if (se_cmd->se_cmd_flags & SCF_SCSI_CDB_EXCEPTION) {
-                        if (se_cmd->se_cmd_flags &
+                        if (se_cmd->scsi_sense_reason == TCM_RESERVATION_CONFLICT) {
-                                        SCF_SCSI_RESERVATION_CONFLICT) {
                                cmd->i_state = ISTATE_SEND_STATUS;
                                spin_unlock_bh(&cmd->istate_lock);
                                iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index daad362a93ce..d734bdec24f9 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -224,7 +224,7 @@ static int iscsi_login_zero_tsih_s1(
                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
                pr_err("Could not allocate memory for session\n");
-                return -1;
+                return -ENOMEM;
        }
        iscsi_login_set_conn_values(sess, conn, pdu->cid);
@@ -250,7 +250,8 @@ static int iscsi_login_zero_tsih_s1(
                pr_err("idr_pre_get() for sess_idr failed\n");
                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
-                return -1;
+                kfree(sess);
+                return -ENOMEM;
        }
        spin_lock(&sess_idr_lock);
        idr_get_new(&sess_idr, NULL, &sess->session_index);
@@ -270,14 +271,16 @@ static int iscsi_login_zero_tsih_s1(
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
                pr_err("Unable to allocate memory for"
                                " struct iscsi_sess_ops.\n");
-                return -1;
+                kfree(sess);
+                return -ENOMEM;
        }
        sess->se_sess = transport_init_session();
-        if (!sess->se_sess) {
+        if (IS_ERR(sess->se_sess)) {
                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
-                return -1;
+                kfree(sess);
+                return -ENOMEM;
        }
        return 0;
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 426cd4bf6a9a..98936cb7c294 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -981,14 +981,13 @@ struct iscsi_login *iscsi_target_init_negotiation(
                return NULL;
        }
-        login->req = kzalloc(ISCSI_HDR_LEN, GFP_KERNEL);
+        login->req = kmemdup(login_pdu, ISCSI_HDR_LEN, GFP_KERNEL);
        if (!login->req) {
                pr_err("Unable to allocate memory for Login Request.\n");
                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
                goto out;
        }
-        memcpy(login->req, login_pdu, ISCSI_HDR_LEN);
        login->req_buf = kzalloc(MAX_KEY_VALUE_PAIRS, GFP_KERNEL);
        if (!login->req_buf) {
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 3df1c9b8ae6b..81d5832fbbd5 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -113,11 +113,9 @@ static struct se_cmd *tcm_loop_allocate_core_cmd(
                        scsi_bufflen(sc), sc->sc_data_direction, sam_task_attr,
                        &tl_cmd->tl_sense_buf[0]);
-        /*
-         * Signal BIDI usage with T_TASK(cmd)->t_tasks_bidi
-         */
        if (scsi_bidi_cmnd(sc))
-                se_cmd->t_tasks_bidi = 1;
+                se_cmd->se_cmd_flags |= SCF_BIDI;
        /*
         * Locate the struct se_lun pointer and attach it to struct se_cmd
         */
@@ -148,27 +146,13 @@ static int tcm_loop_new_cmd_map(struct se_cmd *se_cmd)
         * Allocate the necessary tasks to complete the received CDB+data
         */
        ret = transport_generic_allocate_tasks(se_cmd, sc->cmnd);
-        if (ret == -ENOMEM) {
+        if (ret != 0)
-                /* Out of Resources */
+                return ret;
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
-        } else if (ret == -EINVAL) {
-                /*
-                 * Handle case for SAM_STAT_RESERVATION_CONFLICT
-                 */
-                if (se_cmd->se_cmd_flags & SCF_SCSI_RESERVATION_CONFLICT)
-                        return PYX_TRANSPORT_RESERVATION_CONFLICT;
-                /*
-                 * Otherwise, return SAM_STAT_CHECK_CONDITION and return
-                 * sense data.
-                 */
-                return PYX_TRANSPORT_USE_SENSE_REASON;
-        }
        /*
         * For BIDI commands, pass in the extra READ buffer
         * to transport_generic_map_mem_to_cmd() below..
         */
-        if (se_cmd->t_tasks_bidi) {
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
                struct scsi_data_buffer *sdb = scsi_in(sc);
                sgl_bidi = sdb->table.sgl;
@@ -194,12 +178,8 @@ static int tcm_loop_new_cmd_map(struct se_cmd *se_cmd)
        }
        /* Tell the core about our preallocated memory */
-        ret = transport_generic_map_mem_to_cmd(se_cmd, scsi_sglist(sc),
+        return transport_generic_map_mem_to_cmd(se_cmd, scsi_sglist(sc),
                        scsi_sg_count(sc), sgl_bidi, sgl_bidi_count);
-        if (ret < 0)
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
-        return 0;
 }
 /*
@@ -1360,17 +1340,16 @@ void tcm_loop_drop_scsi_hba(
 {
        struct tcm_loop_hba *tl_hba = container_of(wwn,
                                struct tcm_loop_hba, tl_hba_wwn);
-        int host_no = tl_hba->sh->host_no;
+        pr_debug("TCM_Loop_ConfigFS: Deallocating emulated Target"
+                " SAS Address: %s at Linux/SCSI Host ID: %d\n",
+                tl_hba->tl_wwn_address, tl_hba->sh->host_no);
        /*
         * Call device_unregister() on the original tl_hba->dev.
         * tcm_loop_fabric_scsi.c:tcm_loop_release_adapter() will
         * release *tl_hba;
         */
        device_unregister(&tl_hba->dev);
-        pr_debug("TCM_Loop_ConfigFS: Deallocated emulated Target"
-                " SAS Address: %s at Linux/SCSI Host ID: %d\n",
-                config_item_name(&wwn->wwn_group.cg_item), host_no);
 }
 /* Start items for tcm_loop_cit */
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 88f2ad43ec8b..1dcbef499d6a 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -191,9 +191,10 @@ int target_emulate_set_target_port_groups(struct se_task *task)
        int alua_access_state, primary = 0, rc;
        u16 tg_pt_id, rtpi;
-        if (!l_port)
+        if (!l_port) {
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
+        }
        buf = transport_kmap_first_data_page(cmd);
        /*
@@ -203,7 +204,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
        l_tg_pt_gp_mem = l_port->sep_alua_tg_pt_gp_mem;
        if (!l_tg_pt_gp_mem) {
                pr_err("Unable to access l_port->sep_alua_tg_pt_gp_mem\n");
-                rc = PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                rc = -EINVAL;
                goto out;
        }
        spin_lock(&l_tg_pt_gp_mem->tg_pt_gp_mem_lock);
@@ -211,7 +213,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
        if (!l_tg_pt_gp) {
                spin_unlock(&l_tg_pt_gp_mem->tg_pt_gp_mem_lock);
                pr_err("Unable to access *l_tg_pt_gp_mem->tg_pt_gp\n");
-                rc = PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                rc = -EINVAL;
                goto out;
        }
        rc = (l_tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICT_ALUA);
@@ -220,7 +223,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
        if (!rc) {
                pr_debug("Unable to process SET_TARGET_PORT_GROUPS"
                                " while TPGS_EXPLICT_ALUA is disabled\n");
-                rc = PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                rc = -EINVAL;
                goto out;
        }
@@ -245,7 +249,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
                         * REQUEST, and the additional sense code set to INVALID
                         * FIELD IN PARAMETER LIST.
                         */
-                        rc = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        rc = -EINVAL;
                        goto out;
                }
                rc = -1;
@@ -298,7 +303,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
                         * throw an exception with ASCQ: INVALID_PARAMETER_LIST
                         */
                        if (rc != 0) {
-                                rc = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                                rc = -EINVAL;
                                goto out;
                        }
                } else {
@@ -335,7 +341,8 @@ int target_emulate_set_target_port_groups(struct se_task *task)
                         * INVALID_PARAMETER_LIST
                         */
                        if (rc != 0) {
-                                rc = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                                rc = -EINVAL;
                                goto out;
                        }
                }
@@ -1184,7 +1191,6 @@ void core_alua_free_lu_gp(struct t10_alua_lu_gp *lu_gp)
         * struct t10_alua_lu_gp.
         */
        spin_lock(&lu_gps_lock);
-        atomic_set(&lu_gp->lu_gp_shutdown, 1);
        list_del(&lu_gp->lu_gp_node);
        alua_lu_gps_count--;
        spin_unlock(&lu_gps_lock);
@@ -1438,7 +1444,6 @@ struct t10_alua_tg_pt_gp_member *core_alua_allocate_tg_pt_gp_mem(
        tg_pt_gp_mem->tg_pt = port;
        port->sep_alua_tg_pt_gp_mem = tg_pt_gp_mem;
-        atomic_set(&port->sep_tg_pt_gp_active, 1);
        return tg_pt_gp_mem;
 }
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 683ba02b8247..831468b3163d 100644
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -478,7 +478,7 @@ target_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
        if (cmd->data_length < 60)
                return 0;
-        buf[2] = 0x3c;
+        buf[3] = 0x3c;
        /* Set HEADSUP, ORDSUP, SIMPSUP */
        buf[5] = 0x07;
@@ -703,6 +703,7 @@ int target_emulate_inquiry(struct se_task *task)
        if (cmd->data_length < 4) {
                pr_err("SCSI Inquiry payload length: %u"
                        " too small for EVPD=1\n", cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
                return -EINVAL;
        }
@@ -719,6 +720,7 @@ int target_emulate_inquiry(struct se_task *task)
        }
        pr_err("Unknown VPD Code: 0x%02x\n", cdb[2]);
+        cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
        ret = -EINVAL;
 out_unmap:
@@ -969,7 +971,8 @@ int target_emulate_modesense(struct se_task *task)
        default:
                pr_err("MODE SENSE: unimplemented page/subpage: 0x%02x/0x%02x\n",
                       cdb[2] & 0x3f, cdb[3]);
-                return PYX_TRANSPORT_UNKNOWN_MODE_PAGE;
+                cmd->scsi_sense_reason = TCM_UNKNOWN_MODE_PAGE;
+                return -EINVAL;
        }
        offset += length;
@@ -1027,7 +1030,8 @@ int target_emulate_request_sense(struct se_task *task)
        if (cdb[1] & 0x01) {
                pr_err("REQUEST_SENSE description emulation not"
                        " supported\n");
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -ENOSYS;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -1100,7 +1104,8 @@ int target_emulate_unmap(struct se_task *task)
        if (!dev->transport->do_discard) {
                pr_err("UNMAP emulation not supported for: %s\n",
                                dev->transport->name);
-                return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                return -ENOSYS;
        }
        /* First UNMAP block descriptor starts at 8 byte offset */
@@ -1157,7 +1162,8 @@ int target_emulate_write_same(struct se_task *task)
        if (!dev->transport->do_discard) {
                pr_err("WRITE_SAME emulation not supported"
                                " for: %s\n", dev->transport->name);
-                return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                return -ENOSYS;
        }
        if (cmd->t_task_cdb[0] == WRITE_SAME)
@@ -1193,11 +1199,13 @@ int target_emulate_write_same(struct se_task *task)
 int target_emulate_synchronize_cache(struct se_task *task)
 {
        struct se_device *dev = task->task_se_cmd->se_dev;
+        struct se_cmd *cmd = task->task_se_cmd;
        if (!dev->transport->do_sync_cache) {
                pr_err("SYNCHRONIZE_CACHE emulation not supported"
                        " for: %s\n", dev->transport->name);
-                return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                return -ENOSYS;
        }
        dev->transport->do_sync_cache(task);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index e0c1e8a8dd4e..93d4f6a1b798 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -67,9 +67,6 @@ static struct config_group target_core_hbagroup;
 static struct config_group alua_group;
 static struct config_group alua_lu_gps_group;
-static DEFINE_SPINLOCK(se_device_lock);
-static LIST_HEAD(se_dev_list);
 static inline struct se_hba *
 item_to_hba(struct config_item *item)
 {
@@ -2741,7 +2738,6 @@ static struct config_group *target_core_make_subdev(
                                " struct se_subsystem_dev\n");
                goto unlock;
        }
-        INIT_LIST_HEAD(&se_dev->se_dev_node);
        INIT_LIST_HEAD(&se_dev->t10_wwn.t10_vpd_list);
        spin_lock_init(&se_dev->t10_wwn.t10_vpd_lock);
        INIT_LIST_HEAD(&se_dev->t10_pr.registration_list);
@@ -2777,9 +2773,6 @@ static struct config_group *target_core_make_subdev(
                        " from allocate_virtdevice()\n");
                goto out;
        }
-        spin_lock(&se_device_lock);
-        list_add_tail(&se_dev->se_dev_node, &se_dev_list);
-        spin_unlock(&se_device_lock);
        config_group_init_type_name(&se_dev->se_dev_group, name,
                        &target_core_dev_cit);
@@ -2874,10 +2867,6 @@ static void target_core_drop_subdev(
        mutex_lock(&hba->hba_access_mutex);
        t = hba->transport;
-        spin_lock(&se_device_lock);
-        list_del(&se_dev->se_dev_node);
-        spin_unlock(&se_device_lock);
        dev_stat_grp = &se_dev->dev_stat_grps.stat_group;
        for (i = 0; dev_stat_grp->default_groups[i]; i++) {
                df_item = &dev_stat_grp->default_groups[i]->cg_item;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index ba5edec2c5f8..9b8639425472 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -104,7 +104,6 @@ int transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                se_cmd->se_lun = deve->se_lun;
                se_cmd->pr_res_key = deve->pr_res_key;
                se_cmd->orig_fe_lun = unpacked_lun;
-                se_cmd->se_orig_obj_ptr = se_cmd->se_lun->lun_se_dev;
                se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
        }
        spin_unlock_irqrestore(&se_sess->se_node_acl->device_list_lock, flags);
@@ -137,7 +136,6 @@ int transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                se_lun = &se_sess->se_tpg->tpg_virt_lun0;
                se_cmd->se_lun = &se_sess->se_tpg->tpg_virt_lun0;
                se_cmd->orig_fe_lun = 0;
-                se_cmd->se_orig_obj_ptr = se_cmd->se_lun->lun_se_dev;
                se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
        }
        /*
@@ -200,7 +198,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                se_lun = deve->se_lun;
                se_cmd->pr_res_key = deve->pr_res_key;
                se_cmd->orig_fe_lun = unpacked_lun;
-                se_cmd->se_orig_obj_ptr = se_cmd->se_dev;
        }
        spin_unlock_irqrestore(&se_sess->se_node_acl->device_list_lock, flags);
@@ -708,7 +705,7 @@ done:
        se_task->task_scsi_status = GOOD;
        transport_complete_task(se_task, 1);
-        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+        return 0;
 }
 /*      se_release_device_for_hba():
@@ -957,8 +954,12 @@ int se_dev_set_emulate_dpo(struct se_device *dev, int flag)
                return -EINVAL;
        }
-        pr_err("dpo_emulated not supported\n");
+        if (flag) {
-        return -EINVAL;
+                pr_err("dpo_emulated not supported\n");
+                return -EINVAL;
+        }
+        return 0;
 }
 int se_dev_set_emulate_fua_write(struct se_device *dev, int flag)
@@ -968,7 +969,7 @@ int se_dev_set_emulate_fua_write(struct se_device *dev, int flag)
                return -EINVAL;
        }
-        if (dev->transport->fua_write_emulated == 0) {
+        if (flag && dev->transport->fua_write_emulated == 0) {
                pr_err("fua_write_emulated not supported\n");
                return -EINVAL;
        }
@@ -985,8 +986,12 @@ int se_dev_set_emulate_fua_read(struct se_device *dev, int flag)
                return -EINVAL;
        }
-        pr_err("ua read emulated not supported\n");
+        if (flag) {
-        return -EINVAL;
+                pr_err("ua read emulated not supported\n");
+                return -EINVAL;
+        }
+        return 0;
 }
 int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
@@ -995,7 +1000,7 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                pr_err("Illegal value %d\n", flag);
                return -EINVAL;
        }
-        if (dev->transport->write_cache_emulated == 0) {
+        if (flag && dev->transport->write_cache_emulated == 0) {
                pr_err("write_cache_emulated not supported\n");
                return -EINVAL;
        }
@@ -1056,7 +1061,7 @@ int se_dev_set_emulate_tpu(struct se_device *dev, int flag)
         * We expect this value to be non-zero when generic Block Layer
         * Discard supported is detected iblock_create_virtdevice().
         */
-        if (!dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+        if (flag && !dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
                pr_err("Generic Block Discard not supported\n");
                return -ENOSYS;
        }
@@ -1077,7 +1082,7 @@ int se_dev_set_emulate_tpws(struct se_device *dev, int flag)
         * We expect this value to be non-zero when generic Block Layer
         * Discard supported is detected iblock_create_virtdevice().
         */
-        if (!dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+        if (flag && !dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
                pr_err("Generic Block Discard not supported\n");
                return -ENOSYS;
        }
@@ -1587,7 +1592,6 @@ int core_dev_setup_virtual_lun0(void)
                ret = -ENOMEM;
                goto out;
        }
-        INIT_LIST_HEAD(&se_dev->se_dev_node);
        INIT_LIST_HEAD(&se_dev->t10_wwn.t10_vpd_list);
        spin_lock_init(&se_dev->t10_wwn.t10_vpd_lock);
        INIT_LIST_HEAD(&se_dev->t10_pr.registration_list);
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 67cd6fe05bfa..b4864fba4ef0 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -289,9 +289,9 @@ static int fd_do_readv(struct se_task *task)
                return -ENOMEM;
        }
-        for (i = 0; i < task->task_sg_nents; i++) {
+        for_each_sg(task->task_sg, sg, task->task_sg_nents, i) {
-                iov[i].iov_len = sg[i].length;
+                iov[i].iov_len = sg->length;
-                iov[i].iov_base = sg_virt(&sg[i]);
+                iov[i].iov_base = sg_virt(sg);
        }
        old_fs = get_fs();
@@ -342,9 +342,9 @@ static int fd_do_writev(struct se_task *task)
                return -ENOMEM;
        }
-        for (i = 0; i < task->task_sg_nents; i++) {
+        for_each_sg(task->task_sg, sg, task->task_sg_nents, i) {
-                iov[i].iov_len = sg[i].length;
+                iov[i].iov_len = sg->length;
-                iov[i].iov_base = sg_virt(&sg[i]);
+                iov[i].iov_base = sg_virt(sg);
        }
        old_fs = get_fs();
@@ -438,7 +438,7 @@ static int fd_do_task(struct se_task *task)
                if (ret > 0 &&
                    dev->se_sub_dev->se_dev_attrib.emulate_write_cache > 0 &&
                    dev->se_sub_dev->se_dev_attrib.emulate_fua_write > 0 &&
-                    cmd->t_tasks_fua) {
+                    (cmd->se_cmd_flags & SCF_FUA)) {
                        /*
                         * We might need to be a bit smarter here
                         * and return some sense data to let the initiator
@@ -449,13 +449,15 @@ static int fd_do_task(struct se_task *task)
        }
-        if (ret < 0)
+        if (ret < 0) {
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                return ret;
+        }
        if (ret) {
                task->task_scsi_status = GOOD;
                transport_complete_task(task, 1);
        }
-        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+        return 0;
 }
 /*      fd_free_task(): (Part of se_subsystem_api_t template)
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 7698efe29262..4aa992204438 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -531,7 +531,7 @@ static int iblock_do_task(struct se_task *task)
                 */
                if (dev->se_sub_dev->se_dev_attrib.emulate_write_cache == 0 ||
                    (dev->se_sub_dev->se_dev_attrib.emulate_fua_write > 0 &&
-                     task->task_se_cmd->t_tasks_fua))
+                     (cmd->se_cmd_flags & SCF_FUA)))
                        rw = WRITE_FUA;
                else
                        rw = WRITE;
@@ -554,12 +554,15 @@ static int iblock_do_task(struct se_task *task)
        else {
                pr_err("Unsupported SCSI -> BLOCK LBA conversion:"
                                " %u\n", dev->se_sub_dev->se_dev_attrib.block_size);
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -ENOSYS;
        }
        bio = iblock_get_bio(task, block_lba, sg_num);
-        if (!bio)
+        if (!bio) {
-                return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -ENOMEM;
+        }
        bio_list_init(&list);
        bio_list_add(&list, bio);
@@ -588,12 +591,13 @@ static int iblock_do_task(struct se_task *task)
                submit_bio(rw, bio);
        blk_finish_plug(&plug);
-        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+        return 0;
 fail:
        while ((bio = bio_list_pop(&list)))
                bio_put(bio);
-        return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
+        cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return -ENOMEM;
 }
 static u32 iblock_get_device_rev(struct se_device *dev)
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 5a4ebfc3a54f..95dee7074aeb 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -191,7 +191,7 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
                pr_err("Received legacy SPC-2 RESERVE/RELEASE"
                        " while active SPC-3 registrations exist,"
                        " returning RESERVATION_CONFLICT\n");
-                *ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
                return true;
        }
@@ -252,7 +252,8 @@ int target_scsi2_reservation_reserve(struct se_task *task)
            (cmd->t_task_cdb[1] & 0x02)) {
                pr_err("LongIO and Obselete Bits set, returning"
                                " ILLEGAL_REQUEST\n");
-                ret = PYX_TRANSPORT_ILLEGAL_REQUEST;
+                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -277,7 +278,8 @@ int target_scsi2_reservation_reserve(struct se_task *task)
                        " from %s \n", cmd->se_lun->unpacked_lun,
                        cmd->se_deve->mapped_lun,
                        sess->se_node_acl->initiatorname);
-                ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = -EINVAL;
                goto out_unlock;
        }
@@ -1510,7 +1512,8 @@ static int core_scsi3_decode_spec_i_port(
        tidh_new = kzalloc(sizeof(struct pr_transport_id_holder), GFP_KERNEL);
        if (!tidh_new) {
                pr_err("Unable to allocate tidh_new\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        INIT_LIST_HEAD(&tidh_new->dest_list);
        tidh_new->dest_tpg = tpg;
@@ -1522,7 +1525,8 @@ static int core_scsi3_decode_spec_i_port(
                                sa_res_key, all_tg_pt, aptpl);
        if (!local_pr_reg) {
                kfree(tidh_new);
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -ENOMEM;
        }
        tidh_new->dest_pr_reg = local_pr_reg;
        /*
@@ -1548,7 +1552,8 @@ static int core_scsi3_decode_spec_i_port(
                pr_err("SPC-3 PR: Illegal tpdl: %u + 28 byte header"
                        " does not equal CDB data_length: %u\n", tpdl,
                        cmd->data_length);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -1598,7 +1603,9 @@ static int core_scsi3_decode_spec_i_port(
                                        " for tmp_tpg\n");
                                atomic_dec(&tmp_tpg->tpg_pr_ref_count);
                                smp_mb__after_atomic_dec();
-                                ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                                cmd->scsi_sense_reason =
+                                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                                ret = -EINVAL;
                                goto out;
                        }
                        /*
@@ -1628,7 +1635,9 @@ static int core_scsi3_decode_spec_i_port(
                                atomic_dec(&dest_node_acl->acl_pr_ref_count);
                                smp_mb__after_atomic_dec();
                                core_scsi3_tpg_undepend_item(tmp_tpg);
-                                ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                                cmd->scsi_sense_reason =
+                                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                                ret = -EINVAL;
                                goto out;
                        }
@@ -1646,7 +1655,8 @@ static int core_scsi3_decode_spec_i_port(
                if (!dest_tpg) {
                        pr_err("SPC-3 PR SPEC_I_PT: Unable to locate"
                                        " dest_tpg\n");
-                        ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        ret = -EINVAL;
                        goto out;
                }
 #if 0
@@ -1660,7 +1670,8 @@ static int core_scsi3_decode_spec_i_port(
                                " %u for Transport ID: %s\n", tid_len, ptr);
                        core_scsi3_nodeacl_undepend_item(dest_node_acl);
                        core_scsi3_tpg_undepend_item(dest_tpg);
-                        ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        ret = -EINVAL;
                        goto out;
                }
                /*
@@ -1678,7 +1689,8 @@ static int core_scsi3_decode_spec_i_port(
                        core_scsi3_nodeacl_undepend_item(dest_node_acl);
                        core_scsi3_tpg_undepend_item(dest_tpg);
-                        ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        ret = -EINVAL;
                        goto out;
                }
@@ -1690,7 +1702,9 @@ static int core_scsi3_decode_spec_i_port(
                        smp_mb__after_atomic_dec();
                        core_scsi3_nodeacl_undepend_item(dest_node_acl);
                        core_scsi3_tpg_undepend_item(dest_tpg);
-                        ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                        cmd->scsi_sense_reason =
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                        ret = -EINVAL;
                        goto out;
                }
 #if 0
@@ -1727,7 +1741,9 @@ static int core_scsi3_decode_spec_i_port(
                        core_scsi3_lunacl_undepend_item(dest_se_deve);
                        core_scsi3_nodeacl_undepend_item(dest_node_acl);
                        core_scsi3_tpg_undepend_item(dest_tpg);
-                        ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                        cmd->scsi_sense_reason =
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                        ret = -ENOMEM;
                        goto out;
                }
                INIT_LIST_HEAD(&tidh_new->dest_list);
@@ -1759,7 +1775,8 @@ static int core_scsi3_decode_spec_i_port(
                        core_scsi3_nodeacl_undepend_item(dest_node_acl);
                        core_scsi3_tpg_undepend_item(dest_tpg);
                        kfree(tidh_new);
-                        ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        ret = -EINVAL;
                        goto out;
                }
                tidh_new->dest_pr_reg = dest_pr_reg;
@@ -2098,7 +2115,8 @@ static int core_scsi3_emulate_pro_register(
        if (!se_sess || !se_lun) {
                pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        se_tpg = se_sess->se_tpg;
        se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
@@ -2117,13 +2135,14 @@ static int core_scsi3_emulate_pro_register(
                if (res_key) {
                        pr_warn("SPC-3 PR: Reservation Key non-zero"
                                " for SA REGISTER, returning CONFLICT\n");
-                        return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                        return -EINVAL;
                }
                /*
                 * Do nothing but return GOOD status.
                 */
                if (!sa_res_key)
-                        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+                        return 0;
                if (!spec_i_pt) {
                        /*
@@ -2138,7 +2157,8 @@ static int core_scsi3_emulate_pro_register(
                        if (ret != 0) {
                                pr_err("Unable to allocate"
                                        " struct t10_pr_registration\n");
-                                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                                return -EINVAL;
                        }
                } else {
                        /*
@@ -2197,14 +2217,16 @@ static int core_scsi3_emulate_pro_register(
                                        " 0x%016Lx\n", res_key,
                                        pr_reg->pr_res_key);
                                core_scsi3_put_pr_reg(pr_reg);
-                                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                                return -EINVAL;
                        }
                }
                if (spec_i_pt) {
                        pr_err("SPC-3 PR UNREGISTER: SPEC_I_PT"
                                " set while sa_res_key=0\n");
                        core_scsi3_put_pr_reg(pr_reg);
-                        return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        return -EINVAL;
                }
                /*
                 * An existing ALL_TG_PT=1 registration being released
@@ -2215,7 +2237,8 @@ static int core_scsi3_emulate_pro_register(
                                " registration exists, but ALL_TG_PT=1 bit not"
                                " present in received PROUT\n");
                        core_scsi3_put_pr_reg(pr_reg);
-                        return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                        cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                        return -EINVAL;
                }
                /*
                 * Allocate APTPL metadata buffer used for UNREGISTER ops
@@ -2227,7 +2250,9 @@ static int core_scsi3_emulate_pro_register(
                                pr_err("Unable to allocate"
                                        " pr_aptpl_buf\n");
                                core_scsi3_put_pr_reg(pr_reg);
-                                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                                cmd->scsi_sense_reason =
+                                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                                return -EINVAL;
                        }
                }
                /*
@@ -2241,7 +2266,8 @@ static int core_scsi3_emulate_pro_register(
                        if (pr_holder < 0) {
                                kfree(pr_aptpl_buf);
                                core_scsi3_put_pr_reg(pr_reg);
-                                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                                return -EINVAL;
                        }
                        spin_lock(&pr_tmpl->registration_lock);
@@ -2405,7 +2431,8 @@ static int core_scsi3_pro_reserve(
        if (!se_sess || !se_lun) {
                pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        se_tpg = se_sess->se_tpg;
        se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
@@ -2417,7 +2444,8 @@ static int core_scsi3_pro_reserve(
        if (!pr_reg) {
                pr_err("SPC-3 PR: Unable to locate"
                        " PR_REGISTERED *pr_reg for RESERVE\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        /*
         * From spc4r17 Section 5.7.9: Reserving:
@@ -2433,7 +2461,8 @@ static int core_scsi3_pro_reserve(
                        " does not match existing SA REGISTER res_key:"
                        " 0x%016Lx\n", res_key, pr_reg->pr_res_key);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        /*
         * From spc4r17 Section 5.7.9: Reserving:
@@ -2448,7 +2477,8 @@ static int core_scsi3_pro_reserve(
        if (scope != PR_SCOPE_LU_SCOPE) {
                pr_err("SPC-3 PR: Illegal SCOPE: 0x%02x\n", scope);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        /*
         * See if we have an existing PR reservation holder pointer at
@@ -2480,7 +2510,8 @@ static int core_scsi3_pro_reserve(
                        spin_unlock(&dev->dev_reservation_lock);
                        core_scsi3_put_pr_reg(pr_reg);
-                        return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                        return -EINVAL;
                }
                /*
                 * From spc4r17 Section 5.7.9: Reserving:
@@ -2503,7 +2534,8 @@ static int core_scsi3_pro_reserve(
                        spin_unlock(&dev->dev_reservation_lock);
                        core_scsi3_put_pr_reg(pr_reg);
-                        return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                        return -EINVAL;
                }
                /*
                 * From spc4r17 Section 5.7.9: Reserving:
@@ -2517,7 +2549,7 @@ static int core_scsi3_pro_reserve(
                 */
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+                return 0;
        }
        /*
         * Otherwise, our *pr_reg becomes the PR reservation holder for said
@@ -2574,7 +2606,8 @@ static int core_scsi3_emulate_pro_reserve(
        default:
                pr_err("SPC-3 PR: Unknown Service Action RESERVE Type:"
                        " 0x%02x\n", type);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        return ret;
@@ -2630,7 +2663,8 @@ static int core_scsi3_emulate_pro_release(
        if (!se_sess || !se_lun) {
                pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        /*
         * Locate the existing *pr_reg via struct se_node_acl pointers
@@ -2639,7 +2673,8 @@ static int core_scsi3_emulate_pro_release(
        if (!pr_reg) {
                pr_err("SPC-3 PR: Unable to locate"
                        " PR_REGISTERED *pr_reg for RELEASE\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        /*
         * From spc4r17 Section 5.7.11.2 Releasing:
@@ -2661,7 +2696,7 @@ static int core_scsi3_emulate_pro_release(
                 */
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+                return 0;
        }
        if ((pr_res_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
            (pr_res_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))
@@ -2675,7 +2710,7 @@ static int core_scsi3_emulate_pro_release(
                 */
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+                return 0;
        }
        /*
         * From spc4r17 Section 5.7.11.2 Releasing:
@@ -2697,7 +2732,8 @@ static int core_scsi3_emulate_pro_release(
                        " 0x%016Lx\n", res_key, pr_reg->pr_res_key);
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        /*
         * From spc4r17 Section 5.7.11.2 Releasing and above:
@@ -2719,7 +2755,8 @@ static int core_scsi3_emulate_pro_release(
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        /*
         * In response to a persistent reservation release request from the
@@ -2802,7 +2839,8 @@ static int core_scsi3_emulate_pro_clear(
        if (!pr_reg_n) {
                pr_err("SPC-3 PR: Unable to locate"
                        " PR_REGISTERED *pr_reg for CLEAR\n");
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        /*
         * From spc4r17 section 5.7.11.6, Clearing:
@@ -2821,7 +2859,8 @@ static int core_scsi3_emulate_pro_clear(
                        " existing SA REGISTER res_key:"
                        " 0x%016Lx\n", res_key, pr_reg_n->pr_res_key);
                core_scsi3_put_pr_reg(pr_reg_n);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        /*
         * a) Release the persistent reservation, if any;
@@ -2979,8 +3018,10 @@ static int core_scsi3_pro_preempt(
        int all_reg = 0, calling_it_nexus = 0, released_regs = 0;
        int prh_type = 0, prh_scope = 0, ret;
-        if (!se_sess)
+        if (!se_sess) {
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
+        }
        se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
        pr_reg_n = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
@@ -2989,16 +3030,19 @@ static int core_scsi3_pro_preempt(
                pr_err("SPC-3 PR: Unable to locate"
                        " PR_REGISTERED *pr_reg for PREEMPT%s\n",
                        (abort) ? "_AND_ABORT" : "");
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        if (pr_reg_n->pr_res_key != res_key) {
                core_scsi3_put_pr_reg(pr_reg_n);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        if (scope != PR_SCOPE_LU_SCOPE) {
                pr_err("SPC-3 PR: Illegal SCOPE: 0x%02x\n", scope);
                core_scsi3_put_pr_reg(pr_reg_n);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        INIT_LIST_HEAD(&preempt_and_abort_list);
@@ -3012,7 +3056,8 @@ static int core_scsi3_pro_preempt(
        if (!all_reg && !sa_res_key) {
                spin_unlock(&dev->dev_reservation_lock);
                core_scsi3_put_pr_reg(pr_reg_n);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        /*
         * From spc4r17, section 5.7.11.4.4 Removing Registrations:
@@ -3106,7 +3151,8 @@ static int core_scsi3_pro_preempt(
                if (!released_regs) {
                        spin_unlock(&dev->dev_reservation_lock);
                        core_scsi3_put_pr_reg(pr_reg_n);
-                        return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                        return -EINVAL;
                }
                /*
                 * For an existing all registrants type reservation
@@ -3297,7 +3343,8 @@ static int core_scsi3_emulate_pro_preempt(
        default:
                pr_err("SPC-3 PR: Unknown Service Action PREEMPT%s"
                        " Type: 0x%02x\n", (abort) ? "_AND_ABORT" : "", type);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        return ret;
@@ -3331,7 +3378,8 @@ static int core_scsi3_emulate_pro_register_and_move(
        if (!se_sess || !se_lun) {
                pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        memset(dest_iport, 0, 64);
        memset(i_buf, 0, PR_REG_ISID_ID_LEN);
@@ -3349,7 +3397,8 @@ static int core_scsi3_emulate_pro_register_and_move(
        if (!pr_reg) {
                pr_err("SPC-3 PR: Unable to locate PR_REGISTERED"
                        " *pr_reg for REGISTER_AND_MOVE\n");
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
        }
        /*
         * The provided reservation key much match the existing reservation key
@@ -3360,7 +3409,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                        " res_key: 0x%016Lx does not match existing SA REGISTER"
                        " res_key: 0x%016Lx\n", res_key, pr_reg->pr_res_key);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        /*
         * The service active reservation key needs to be non zero
@@ -3369,7 +3419,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                pr_warn("SPC-3 PR REGISTER_AND_MOVE: Received zero"
                        " sa_res_key\n");
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        /*
@@ -3392,7 +3443,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                        " does not equal CDB data_length: %u\n", tid_len,
                        cmd->data_length);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        spin_lock(&dev->se_port_lock);
@@ -3417,7 +3469,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                        atomic_dec(&dest_se_tpg->tpg_pr_ref_count);
                        smp_mb__after_atomic_dec();
                        core_scsi3_put_pr_reg(pr_reg);
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                        cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                        return -EINVAL;
                }
                spin_lock(&dev->se_port_lock);
@@ -3430,7 +3483,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                        " fabric ops from Relative Target Port Identifier:"
                        " %hu\n", rtpi);
                core_scsi3_put_pr_reg(pr_reg);
-                return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -3445,14 +3499,16 @@ static int core_scsi3_emulate_pro_register_and_move(
                        " from fabric: %s\n", proto_ident,
                        dest_tf_ops->get_fabric_proto_ident(dest_se_tpg),
                        dest_tf_ops->get_fabric_name());
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        if (dest_tf_ops->tpg_parse_pr_out_transport_id == NULL) {
                pr_err("SPC-3 PR REGISTER_AND_MOVE: Fabric does not"
                        " containg a valid tpg_parse_pr_out_transport_id"
                        " function pointer\n");
-                ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                ret = -EINVAL;
                goto out;
        }
        initiator_str = dest_tf_ops->tpg_parse_pr_out_transport_id(dest_se_tpg,
@@ -3460,7 +3516,8 @@ static int core_scsi3_emulate_pro_register_and_move(
        if (!initiator_str) {
                pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate"
                        " initiator_str from Transport ID\n");
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
@@ -3489,7 +3546,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                pr_err("SPC-3 PR REGISTER_AND_MOVE: TransportID: %s"
                        " matches: %s on received I_T Nexus\n", initiator_str,
                        pr_reg_nacl->initiatorname);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        if (!strcmp(iport_ptr, pr_reg->pr_reg_isid)) {
@@ -3497,7 +3555,8 @@ static int core_scsi3_emulate_pro_register_and_move(
                        " matches: %s %s on received I_T Nexus\n",
                        initiator_str, iport_ptr, pr_reg_nacl->initiatorname,
                        pr_reg->pr_reg_isid);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
 after_iport_check:
@@ -3517,7 +3576,8 @@ after_iport_check:
                pr_err("Unable to locate %s dest_node_acl for"
                        " TransportID%s\n", dest_tf_ops->get_fabric_name(),
                        initiator_str);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        ret = core_scsi3_nodeacl_depend_item(dest_node_acl);
@@ -3527,7 +3587,8 @@ after_iport_check:
                atomic_dec(&dest_node_acl->acl_pr_ref_count);
                smp_mb__after_atomic_dec();
                dest_node_acl = NULL;
-                ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
 #if 0
@@ -3543,7 +3604,8 @@ after_iport_check:
        if (!dest_se_deve) {
                pr_err("Unable to locate %s dest_se_deve from RTPI:"
                        " %hu\n",  dest_tf_ops->get_fabric_name(), rtpi);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
@@ -3553,7 +3615,8 @@ after_iport_check:
                atomic_dec(&dest_se_deve->pr_ref_count);
                smp_mb__after_atomic_dec();
                dest_se_deve = NULL;
-                ret = PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                ret = -EINVAL;
                goto out;
        }
 #if 0
@@ -3572,7 +3635,8 @@ after_iport_check:
                pr_warn("SPC-3 PR REGISTER_AND_MOVE: No reservation"
                        " currently held\n");
                spin_unlock(&dev->dev_reservation_lock);
-                ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -3585,7 +3649,8 @@ after_iport_check:
                pr_warn("SPC-3 PR REGISTER_AND_MOVE: Calling I_T"
                        " Nexus is not reservation holder\n");
                spin_unlock(&dev->dev_reservation_lock);
-                ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -3603,7 +3668,8 @@ after_iport_check:
                        " reservation for type: %s\n",
                        core_scsi3_pr_dump_type(pr_res_holder->pr_res_type));
                spin_unlock(&dev->dev_reservation_lock);
-                ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = -EINVAL;
                goto out;
        }
        pr_res_nacl = pr_res_holder->pr_reg_nacl;
@@ -3640,7 +3706,8 @@ after_iport_check:
                                sa_res_key, 0, aptpl, 2, 1);
                if (ret != 0) {
                        spin_unlock(&dev->dev_reservation_lock);
-                        ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                        cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                        ret = -EINVAL;
                        goto out;
                }
                dest_pr_reg = __core_scsi3_locate_pr_reg(dev, dest_node_acl,
@@ -3771,7 +3838,8 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
                pr_err("Received PERSISTENT_RESERVE CDB while legacy"
                        " SPC-2 reservation is held, returning"
                        " RESERVATION_CONFLICT\n");
-                ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = EINVAL;
                goto out;
        }
@@ -3779,13 +3847,16 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
         * FIXME: A NULL struct se_session pointer means an this is not coming from
         * a $FABRIC_MOD's nexus, but from internal passthrough ops.
         */
-        if (!cmd->se_sess)
+        if (!cmd->se_sess) {
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                return -EINVAL;
+        }
        if (cmd->data_length < 24) {
                pr_warn("SPC-PR: Received PR OUT parameter list"
                        " length too small: %u\n", cmd->data_length);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -3820,7 +3891,8 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
         * SPEC_I_PT=1 is only valid for Service action: REGISTER
         */
        if (spec_i_pt && ((cdb[1] & 0x1f) != PRO_REGISTER)) {
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
@@ -3837,7 +3909,8 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
            (cmd->data_length != 24)) {
                pr_warn("SPC-PR: Received PR OUT illegal parameter"
                        " list length: %u\n", cmd->data_length);
-                ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
                goto out;
        }
        /*
@@ -3878,7 +3951,8 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
        default:
                pr_err("Unknown PERSISTENT_RESERVE_OUT service"
                        " action: 0x%02x\n", cdb[1] & 0x1f);
-                ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                ret = -EINVAL;
                break;
        }
@@ -3906,7 +3980,8 @@ static int core_scsi3_pri_read_keys(struct se_cmd *cmd)
        if (cmd->data_length < 8) {
                pr_err("PRIN SA READ_KEYS SCSI Data Length: %u"
                        " too small\n", cmd->data_length);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -3965,7 +4040,8 @@ static int core_scsi3_pri_read_reservation(struct se_cmd *cmd)
        if (cmd->data_length < 8) {
                pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
                        " too small\n", cmd->data_length);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -4047,7 +4123,8 @@ static int core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
        if (cmd->data_length < 6) {
                pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
                        " %u too small\n", cmd->data_length);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -4108,7 +4185,8 @@ static int core_scsi3_pri_read_full_status(struct se_cmd *cmd)
        if (cmd->data_length < 8) {
                pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u"
                        " too small\n", cmd->data_length);
-                return PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
        }
        buf = transport_kmap_first_data_page(cmd);
@@ -4255,7 +4333,8 @@ int target_scsi3_emulate_pr_in(struct se_task *task)
                pr_err("Received PERSISTENT_RESERVE CDB while legacy"
                        " SPC-2 reservation is held, returning"
                        " RESERVATION_CONFLICT\n");
-                return PYX_TRANSPORT_RESERVATION_CONFLICT;
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                return -EINVAL;
        }
        switch (cmd->t_task_cdb[1] & 0x1f) {
@@ -4274,7 +4353,8 @@ int target_scsi3_emulate_pr_in(struct se_task *task)
        default:
                pr_err("Unknown PERSISTENT_RESERVE_IN service"
                        " action: 0x%02x\n", cmd->t_task_cdb[1] & 0x1f);
-                ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                ret = -EINVAL;
                break;
        }
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index ed32e1efe429..8b15e56b0384 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -963,6 +963,7 @@ static inline struct bio *pscsi_get_bio(int sg_num)
 static int pscsi_map_sg(struct se_task *task, struct scatterlist *task_sg,
                struct bio **hbio)
 {
+        struct se_cmd *cmd = task->task_se_cmd;
        struct pscsi_dev_virt *pdv = task->task_se_cmd->se_dev->dev_ptr;
        u32 task_sg_num = task->task_sg_nents;
        struct bio *bio = NULL, *tbio = NULL;
@@ -971,7 +972,7 @@ static int pscsi_map_sg(struct se_task *task, struct scatterlist *task_sg,
        u32 data_len = task->task_size, i, len, bytes, off;
        int nr_pages = (task->task_size + task_sg[0].offset +
                        PAGE_SIZE - 1) >> PAGE_SHIFT;
-        int nr_vecs = 0, rc, ret = PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
+        int nr_vecs = 0, rc;
        int rw = (task->task_data_direction == DMA_TO_DEVICE);
        *hbio = NULL;
@@ -1058,11 +1059,13 @@ fail:
                bio->bi_next = NULL;
                bio_endio(bio, 0);      /* XXX: should be error */
        }
-        return ret;
+        cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return -ENOMEM;
 }
 static int pscsi_do_task(struct se_task *task)
 {
+        struct se_cmd *cmd = task->task_se_cmd;
        struct pscsi_dev_virt *pdv = task->task_se_cmd->se_dev->dev_ptr;
        struct pscsi_plugin_task *pt = PSCSI_TASK(task);
        struct request *req;
@@ -1078,7 +1081,9 @@ static int pscsi_do_task(struct se_task *task)
                if (!req || IS_ERR(req)) {
                        pr_err("PSCSI: blk_get_request() failed: %ld\n",
                                        req ? IS_ERR(req) : -ENOMEM);
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                        cmd->scsi_sense_reason =
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                        return -ENODEV;
                }
        } else {
                BUG_ON(!task->task_size);
@@ -1087,8 +1092,11 @@ static int pscsi_do_task(struct se_task *task)
                 * Setup the main struct request for the task->task_sg[] payload
                 */
                ret = pscsi_map_sg(task, task->task_sg, &hbio);
-                if (ret < 0)
+                if (ret < 0) {
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                        cmd->scsi_sense_reason =
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                        return ret;
+                }
                req = blk_make_request(pdv->pdv_sd->request_queue, hbio,
                                       GFP_KERNEL);
@@ -1115,7 +1123,7 @@ static int pscsi_do_task(struct se_task *task)
                        (task->task_se_cmd->sam_task_attr == MSG_HEAD_TAG),
                        pscsi_req_done);
-        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
+        return 0;
 fail:
        while (hbio) {
@@ -1124,7 +1132,8 @@ fail:
                bio->bi_next = NULL;
                bio_endio(bio, 0);      /* XXX: should be error */
        }
-        return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
+        cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return -ENOMEM;
 }
 /*      pscsi_get_sense_buffer():
@@ -1198,9 +1207,8 @@ static inline void pscsi_process_SAM_status(
                        " 0x%02x Result: 0x%08x\n", task, pt->pscsi_cdb[0],
                        pt->pscsi_result);
                task->task_scsi_status = SAM_STAT_CHECK_CONDITION;
-                task->task_error_status = PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                task->task_se_cmd->scsi_sense_reason =
-                task->task_se_cmd->transport_error_status =
+                                        TCM_UNSUPPORTED_SCSI_OPCODE;
-                                        PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
                transport_complete_task(task, 0);
                break;
        }
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 5158d3846f19..02e51faa2f4e 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -343,235 +343,74 @@ static struct rd_dev_sg_table *rd_get_sg_table(struct rd_dev *rd_dev, u32 page)
        return NULL;
 }
-/*      rd_MEMCPY_read():
+static int rd_MEMCPY(struct rd_request *req, u32 read_rd)
- *
- *
- */
-static int rd_MEMCPY_read(struct rd_request *req)
 {
        struct se_task *task = &req->rd_task;
        struct rd_dev *dev = req->rd_task.task_se_cmd->se_dev->dev_ptr;
        struct rd_dev_sg_table *table;
-        struct scatterlist *sg_d, *sg_s;
+        struct scatterlist *rd_sg;
-        void *dst, *src;
+        struct sg_mapping_iter m;
-        u32 i = 0, j = 0, dst_offset = 0, src_offset = 0;
-        u32 length, page_end = 0, table_sg_end;
        u32 rd_offset = req->rd_offset;
+        u32 src_len;
        table = rd_get_sg_table(dev, req->rd_page);
        if (!table)
                return -EINVAL;
-        table_sg_end = (table->page_end_offset - req->rd_page);
+        rd_sg = &table->sg_table[req->rd_page - table->page_start_offset];
-        sg_d = task->task_sg;
-        sg_s = &table->sg_table[req->rd_page - table->page_start_offset];
-        pr_debug("RD[%u]: Read LBA: %llu, Size: %u Page: %u, Offset:"
+        pr_debug("RD[%u]: %s LBA: %llu, Size: %u Page: %u, Offset: %u\n",
-                " %u\n", dev->rd_dev_id, task->task_lba, req->rd_size,
+                        dev->rd_dev_id, read_rd ? "Read" : "Write",
-                req->rd_page, req->rd_offset);
+                        task->task_lba, req->rd_size, req->rd_page,
+                        rd_offset);
-        src_offset = rd_offset;
+        src_len = PAGE_SIZE - rd_offset;
+        sg_miter_start(&m, task->task_sg, task->task_sg_nents,
+                        read_rd ? SG_MITER_TO_SG : SG_MITER_FROM_SG);
        while (req->rd_size) {
-                if ((sg_d[i].length - dst_offset) <
+                u32 len;
-                    (sg_s[j].length - src_offset)) {
+                void *rd_addr;
-                        length = (sg_d[i].length - dst_offset);
-                        pr_debug("Step 1 - sg_d[%d]: %p length: %d"
-                                " offset: %u sg_s[%d].length: %u\n", i,
-                                &sg_d[i], sg_d[i].length, sg_d[i].offset, j,
-                                sg_s[j].length);
-                        pr_debug("Step 1 - length: %u dst_offset: %u"
-                                " src_offset: %u\n", length, dst_offset,
-                                src_offset);
-                        if (length > req->rd_size)
-                                length = req->rd_size;
-                        dst = sg_virt(&sg_d[i++]) + dst_offset;
-                        BUG_ON(!dst);
-                        src = sg_virt(&sg_s[j]) + src_offset;
-                        BUG_ON(!src);
-                        dst_offset = 0;
-                        src_offset = length;
-                        page_end = 0;
-                } else {
-                        length = (sg_s[j].length - src_offset);
-                        pr_debug("Step 2 - sg_d[%d]: %p length: %d"
-                                " offset: %u sg_s[%d].length: %u\n", i,
-                                &sg_d[i], sg_d[i].length, sg_d[i].offset,
-                                j, sg_s[j].length);
-                        pr_debug("Step 2 - length: %u dst_offset: %u"
-                                " src_offset: %u\n", length, dst_offset,
-                                src_offset);
-                        if (length > req->rd_size)
-                                length = req->rd_size;
-                        dst = sg_virt(&sg_d[i]) + dst_offset;
-                        BUG_ON(!dst);
-                        if (sg_d[i].length == length) {
-                                i++;
-                                dst_offset = 0;
-                        } else
-                                dst_offset = length;
-                        src = sg_virt(&sg_s[j++]) + src_offset;
-                        BUG_ON(!src);
-                        src_offset = 0;
-                        page_end = 1;
-                }
-                memcpy(dst, src, length);
+                sg_miter_next(&m);
+                len = min((u32)m.length, src_len);
+                m.consumed = len;
-                pr_debug("page: %u, remaining size: %u, length: %u,"
+                rd_addr = sg_virt(rd_sg) + rd_offset;
-                        " i: %u, j: %u\n", req->rd_page,
-                        (req->rd_size - length), length, i, j);
-                req->rd_size -= length;
+                if (read_rd)
-                if (!req->rd_size)
+                        memcpy(m.addr, rd_addr, len);
-                        return 0;
+                else
+                        memcpy(rd_addr, m.addr, len);
-                if (!page_end)
+                req->rd_size -= len;
+                if (!req->rd_size)
                        continue;
-                if (++req->rd_page <= table->page_end_offset) {
+                src_len -= len;
-                        pr_debug("page: %u in same page table\n",
+                if (src_len) {
-                                req->rd_page);
+                        rd_offset += len;
                        continue;
                }
-                pr_debug("getting new page table for page: %u\n",
+                /* rd page completed, next one please */
-                                req->rd_page);
+                req->rd_page++;
+                rd_offset = 0;
-                table = rd_get_sg_table(dev, req->rd_page);
+                src_len = PAGE_SIZE;
-                if (!table)
+                if (req->rd_page <= table->page_end_offset) {
-                        return -EINVAL;
+                        rd_sg++;
-                sg_s = &table->sg_table[j = 0];
-        }
-        return 0;
-}
-/*      rd_MEMCPY_write():
- *
- *
- */
-static int rd_MEMCPY_write(struct rd_request *req)
-{
-        struct se_task *task = &req->rd_task;
-        struct rd_dev *dev = req->rd_task.task_se_cmd->se_dev->dev_ptr;
-        struct rd_dev_sg_table *table;
-        struct scatterlist *sg_d, *sg_s;
-        void *dst, *src;
-        u32 i = 0, j = 0, dst_offset = 0, src_offset = 0;
-        u32 length, page_end = 0, table_sg_end;
-        u32 rd_offset = req->rd_offset;
-        table = rd_get_sg_table(dev, req->rd_page);
-        if (!table)
-                return -EINVAL;
-        table_sg_end = (table->page_end_offset - req->rd_page);
-        sg_d = &table->sg_table[req->rd_page - table->page_start_offset];
-        sg_s = task->task_sg;
-        pr_debug("RD[%d] Write LBA: %llu, Size: %u, Page: %u,"
-                " Offset: %u\n", dev->rd_dev_id, task->task_lba, req->rd_size,
-                req->rd_page, req->rd_offset);
-        dst_offset = rd_offset;
-        while (req->rd_size) {
-                if ((sg_s[i].length - src_offset) <
-                    (sg_d[j].length - dst_offset)) {
-                        length = (sg_s[i].length - src_offset);
-                        pr_debug("Step 1 - sg_s[%d]: %p length: %d"
-                                " offset: %d sg_d[%d].length: %u\n", i,
-                                &sg_s[i], sg_s[i].length, sg_s[i].offset,
-                                j, sg_d[j].length);
-                        pr_debug("Step 1 - length: %u src_offset: %u"
-                                " dst_offset: %u\n", length, src_offset,
-                                dst_offset);
-                        if (length > req->rd_size)
-                                length = req->rd_size;
-                        src = sg_virt(&sg_s[i++]) + src_offset;
-                        BUG_ON(!src);
-                        dst = sg_virt(&sg_d[j]) + dst_offset;
-                        BUG_ON(!dst);
-                        src_offset = 0;
-                        dst_offset = length;
-                        page_end = 0;
-                } else {
-                        length = (sg_d[j].length - dst_offset);
-                        pr_debug("Step 2 - sg_s[%d]: %p length: %d"
-                                " offset: %d sg_d[%d].length: %u\n", i,
-                                &sg_s[i], sg_s[i].length, sg_s[i].offset,
-                                j, sg_d[j].length);
-                        pr_debug("Step 2 - length: %u src_offset: %u"
-                                " dst_offset: %u\n", length, src_offset,
-                                dst_offset);
-                        if (length > req->rd_size)
-                                length = req->rd_size;
-                        src = sg_virt(&sg_s[i]) + src_offset;
-                        BUG_ON(!src);
-                        if (sg_s[i].length == length) {
-                                i++;
-                                src_offset = 0;
-                        } else
-                                src_offset = length;
-                        dst = sg_virt(&sg_d[j++]) + dst_offset;
-                        BUG_ON(!dst);
-                        dst_offset = 0;
-                        page_end = 1;
-                }
-                memcpy(dst, src, length);
-                pr_debug("page: %u, remaining size: %u, length: %u,"
-                        " i: %u, j: %u\n", req->rd_page,
-                        (req->rd_size - length), length, i, j);
-                req->rd_size -= length;
-                if (!req->rd_size)
-                        return 0;
-                if (!page_end)
-                        continue;
-                if (++req->rd_page <= table->page_end_offset) {
-                        pr_debug("page: %u in same page table\n",
-                                req->rd_page);
                        continue;
                }
-                pr_debug("getting new page table for page: %u\n",
-                                req->rd_page);
                table = rd_get_sg_table(dev, req->rd_page);
-                if (!table)
+                if (!table) {
+                        sg_miter_stop(&m);
                        return -EINVAL;
+                }
-                sg_d = &table->sg_table[j = 0];
+                /* since we increment, the first sg entry is correct */
+                rd_sg = table->sg_table;
        }
+        sg_miter_stop(&m);
        return 0;
 }
@@ -583,28 +422,21 @@ static int rd_MEMCPY_do_task(struct se_task *task)
 {
        struct se_device *dev = task->task_se_cmd->se_dev;
        struct rd_request *req = RD_REQ(task);
-        unsigned long long lba;
+        u64 tmp;
        int ret;
-        req->rd_page = (task->task_lba * dev->se_sub_dev->se_dev_attrib.block_size) / PAGE_SIZE;
+        tmp = task->task_lba * dev->se_sub_dev->se_dev_attrib.block_size;
-        lba = task->task_lba;
+        req->rd_offset = do_div(tmp, PAGE_SIZE);
-        req->rd_offset = (do_div(lba,
+        req->rd_page = tmp;
-                          (PAGE_SIZE / dev->se_sub_dev->se_dev_attrib.block_size))) *
-                           dev->se_sub_dev->se_dev_attrib.block_size;
        req->rd_size = task->task_size;
-        if (task->task_data_direction == DMA_FROM_DEVICE)
+        ret = rd_MEMCPY(req, task->task_data_direction == DMA_FROM_DEVICE);
-                ret = rd_MEMCPY_read(req);
-        else
-                ret = rd_MEMCPY_write(req);
        if (ret != 0)
                return ret;
        task->task_scsi_status = GOOD;
        transport_complete_task(task, 1);
+        return 0;
-        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
 }
 /*      rd_free_task(): (Part of se_subsystem_api_t template)
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 217e29df6297..684522805a1f 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -345,10 +345,6 @@ static void core_tmr_drain_cmd_list(
                        " %d t_fe_count: %d\n", (preempt_and_abort_list) ?
                        "Preempt" : "", cmd, cmd->t_state,
                        atomic_read(&cmd->t_fe_count));
-                /*
-                 * Signal that the command has failed via cmd->se_cmd_flags,
-                 */
-                transport_new_cmd_failure(cmd);
                core_tmr_handle_tas_abort(tmr_nacl, cmd, tas,
                                atomic_read(&cmd->t_fe_count));
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 3400ae6e93f8..0257658e2e3e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -61,7 +61,6 @@
 static int sub_api_initialized;
 static struct workqueue_struct *target_completion_wq;
-static struct kmem_cache *se_cmd_cache;
 static struct kmem_cache *se_sess_cache;
 struct kmem_cache *se_tmr_req_cache;
 struct kmem_cache *se_ua_cache;
@@ -82,24 +81,18 @@ static int transport_generic_get_mem(struct se_cmd *cmd);
 static void transport_put_cmd(struct se_cmd *cmd);
 static void transport_remove_cmd_from_queue(struct se_cmd *cmd);
 static int transport_set_sense_codes(struct se_cmd *cmd, u8 asc, u8 ascq);
-static void transport_generic_request_failure(struct se_cmd *, int, int);
+static void transport_generic_request_failure(struct se_cmd *);
 static void target_complete_ok_work(struct work_struct *work);
 int init_se_kmem_caches(void)
 {
-        se_cmd_cache = kmem_cache_create("se_cmd_cache",
-                        sizeof(struct se_cmd), __alignof__(struct se_cmd), 0, NULL);
-        if (!se_cmd_cache) {
-                pr_err("kmem_cache_create for struct se_cmd failed\n");
-                goto out;
-        }
        se_tmr_req_cache = kmem_cache_create("se_tmr_cache",
                        sizeof(struct se_tmr_req), __alignof__(struct se_tmr_req),
                        0, NULL);
        if (!se_tmr_req_cache) {
                pr_err("kmem_cache_create() for struct se_tmr_req"
                                " failed\n");
-                goto out_free_cmd_cache;
+                goto out;
        }
        se_sess_cache = kmem_cache_create("se_sess_cache",
                        sizeof(struct se_session), __alignof__(struct se_session),
@@ -182,8 +175,6 @@ out_free_sess_cache:
        kmem_cache_destroy(se_sess_cache);
 out_free_tmr_req_cache:
        kmem_cache_destroy(se_tmr_req_cache);
-out_free_cmd_cache:
-        kmem_cache_destroy(se_cmd_cache);
 out:
        return -ENOMEM;
 }
@@ -191,7 +182,6 @@ out:
 void release_se_kmem_caches(void)
 {
        destroy_workqueue(target_completion_wq);
-        kmem_cache_destroy(se_cmd_cache);
        kmem_cache_destroy(se_tmr_req_cache);
        kmem_cache_destroy(se_sess_cache);
        kmem_cache_destroy(se_ua_cache);
@@ -680,9 +670,9 @@ void transport_complete_sync_cache(struct se_cmd *cmd, int good)
                task->task_scsi_status = GOOD;
        } else {
                task->task_scsi_status = SAM_STAT_CHECK_CONDITION;
-                task->task_error_status = PYX_TRANSPORT_ILLEGAL_REQUEST;
+                task->task_se_cmd->scsi_sense_reason =
-                task->task_se_cmd->transport_error_status =
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                                        PYX_TRANSPORT_ILLEGAL_REQUEST;
        }
        transport_complete_task(task, good);
@@ -693,7 +683,7 @@ static void target_complete_failure_work(struct work_struct *work)
 {
        struct se_cmd *cmd = container_of(work, struct se_cmd, work);
-        transport_generic_request_failure(cmd, 1, 1);
+        transport_generic_request_failure(cmd);
 }
 /*      transport_complete_task():
@@ -755,10 +745,11 @@ void transport_complete_task(struct se_task *task, int success)
        if (cmd->t_tasks_failed) {
                if (!task->task_error_status) {
                        task->task_error_status =
-                                PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                        cmd->transport_error_status =
+                        cmd->scsi_sense_reason =
-                                PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                }
                INIT_WORK(&cmd->work, target_complete_failure_work);
        } else {
                atomic_set(&cmd->t_transport_complete, 1);
@@ -1335,23 +1326,17 @@ struct se_device *transport_add_device_to_core_hba(
        dev->se_hba             = hba;
        dev->se_sub_dev         = se_dev;
        dev->transport          = transport;
-        atomic_set(&dev->active_cmds, 0);
        INIT_LIST_HEAD(&dev->dev_list);
        INIT_LIST_HEAD(&dev->dev_sep_list);
        INIT_LIST_HEAD(&dev->dev_tmr_list);
        INIT_LIST_HEAD(&dev->execute_task_list);
        INIT_LIST_HEAD(&dev->delayed_cmd_list);
-        INIT_LIST_HEAD(&dev->ordered_cmd_list);
        INIT_LIST_HEAD(&dev->state_task_list);
        INIT_LIST_HEAD(&dev->qf_cmd_list);
        spin_lock_init(&dev->execute_task_lock);
        spin_lock_init(&dev->delayed_cmd_lock);
-        spin_lock_init(&dev->ordered_cmd_lock);
-        spin_lock_init(&dev->state_task_lock);
-        spin_lock_init(&dev->dev_alua_lock);
        spin_lock_init(&dev->dev_reservation_lock);
        spin_lock_init(&dev->dev_status_lock);
-        spin_lock_init(&dev->dev_status_thr_lock);
        spin_lock_init(&dev->se_port_lock);
        spin_lock_init(&dev->se_tmr_lock);
        spin_lock_init(&dev->qf_cmd_lock);
@@ -1507,7 +1492,6 @@ void transport_init_se_cmd(
 {
        INIT_LIST_HEAD(&cmd->se_lun_node);
        INIT_LIST_HEAD(&cmd->se_delayed_node);
-        INIT_LIST_HEAD(&cmd->se_ordered_node);
        INIT_LIST_HEAD(&cmd->se_qf_node);
        INIT_LIST_HEAD(&cmd->se_queue_node);
        INIT_LIST_HEAD(&cmd->se_cmd_list);
@@ -1573,6 +1557,8 @@ int transport_generic_allocate_tasks(
                pr_err("Received SCSI CDB with command_size: %d that"
                        " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
                        scsi_command_size(cdb), SCSI_MAX_VARLEN_CDB_SIZE);
+                cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
                return -EINVAL;
        }
        /*
@@ -1588,6 +1574,9 @@ int transport_generic_allocate_tasks(
                                " %u > sizeof(cmd->__t_task_cdb): %lu ops\n",
                                scsi_command_size(cdb),
                                (unsigned long)sizeof(cmd->__t_task_cdb));
+                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+                        cmd->scsi_sense_reason =
+                                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                        return -ENOMEM;
                }
        } else
@@ -1658,11 +1647,9 @@ int transport_handle_cdb_direct(
         * and call transport_generic_request_failure() if necessary..
         */
        ret = transport_generic_new_cmd(cmd);
-        if (ret < 0) {
+        if (ret < 0)
-                cmd->transport_error_status = ret;
+                transport_generic_request_failure(cmd);
-                transport_generic_request_failure(cmd, 0,
-                                (cmd->data_direction != DMA_TO_DEVICE));
-        }
        return 0;
 }
 EXPORT_SYMBOL(transport_handle_cdb_direct);
@@ -1798,20 +1785,16 @@ static int transport_stop_tasks_for_cmd(struct se_cmd *cmd)
 /*
 * Handle SAM-esque emulation for generic transport request failures.
 */
-static void transport_generic_request_failure(
+static void transport_generic_request_failure(struct se_cmd *cmd)
-        struct se_cmd *cmd,
-        int complete,
-        int sc)
 {
        int ret = 0;
        pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x"
                " CDB: 0x%02x\n", cmd, cmd->se_tfo->get_task_tag(cmd),
                cmd->t_task_cdb[0]);
-        pr_debug("-----[ i_state: %d t_state: %d transport_error_status: %d\n",
+        pr_debug("-----[ i_state: %d t_state: %d scsi_sense_reason: %d\n",
                cmd->se_tfo->get_cmd_state(cmd),
-                cmd->t_state,
+                cmd->t_state, cmd->scsi_sense_reason);
-                cmd->transport_error_status);
        pr_debug("-----[ t_tasks: %d t_task_cdbs_left: %d"
                " t_task_cdbs_sent: %d t_task_cdbs_ex_left: %d --"
                " t_transport_active: %d t_transport_stop: %d"
@@ -1829,46 +1812,19 @@ static void transport_generic_request_failure(
        if (cmd->se_dev->dev_task_attr_type == SAM_TASK_ATTR_EMULATED)
                transport_complete_task_attr(cmd);
-        if (complete) {
+        switch (cmd->scsi_sense_reason) {
-                cmd->transport_error_status = PYX_TRANSPORT_LU_COMM_FAILURE;
+        case TCM_NON_EXISTENT_LUN:
-        }
+        case TCM_UNSUPPORTED_SCSI_OPCODE:
+        case TCM_INVALID_CDB_FIELD:
-        switch (cmd->transport_error_status) {
+        case TCM_INVALID_PARAMETER_LIST:
-        case PYX_TRANSPORT_UNKNOWN_SAM_OPCODE:
+        case TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE:
-                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
+        case TCM_UNKNOWN_MODE_PAGE:
-                break;
+        case TCM_WRITE_PROTECTED:
-        case PYX_TRANSPORT_REQ_TOO_MANY_SECTORS:
+        case TCM_CHECK_CONDITION_ABORT_CMD:
-                cmd->scsi_sense_reason = TCM_SECTOR_COUNT_TOO_MANY;
+        case TCM_CHECK_CONDITION_UNIT_ATTENTION:
-                break;
+        case TCM_CHECK_CONDITION_NOT_READY:
-        case PYX_TRANSPORT_INVALID_CDB_FIELD:
-                cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
-                break;
-        case PYX_TRANSPORT_INVALID_PARAMETER_LIST:
-                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
-                break;
-        case PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES:
-                if (!sc)
-                        transport_new_cmd_failure(cmd);
-                /*
-                 * Currently for PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES,
-                 * we force this session to fall back to session
-                 * recovery.
-                 */
-                cmd->se_tfo->fall_back_to_erl0(cmd->se_sess);
-                cmd->se_tfo->stop_session(cmd->se_sess, 0, 0);
-                goto check_stop;
-        case PYX_TRANSPORT_LU_COMM_FAILURE:
-        case PYX_TRANSPORT_ILLEGAL_REQUEST:
-                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                break;
-        case PYX_TRANSPORT_UNKNOWN_MODE_PAGE:
-                cmd->scsi_sense_reason = TCM_UNKNOWN_MODE_PAGE;
-                break;
-        case PYX_TRANSPORT_WRITE_PROTECTED:
-                cmd->scsi_sense_reason = TCM_WRITE_PROTECTED;
                break;
-        case PYX_TRANSPORT_RESERVATION_CONFLICT:
+        case TCM_RESERVATION_CONFLICT:
                /*
                 * No SENSE Data payload for this case, set SCSI Status
                 * and queue the response to $FABRIC_MOD.
@@ -1893,15 +1849,9 @@ static void transport_generic_request_failure(
                if (ret == -EAGAIN || ret == -ENOMEM)
                        goto queue_full;
                goto check_stop;
-        case PYX_TRANSPORT_USE_SENSE_REASON:
-                /*
-                 * struct se_cmd->scsi_sense_reason already set
-                 */
-                break;
        default:
                pr_err("Unknown transport error for CDB 0x%02x: %d\n",
-                        cmd->t_task_cdb[0],
+                        cmd->t_task_cdb[0], cmd->scsi_sense_reason);
-                        cmd->transport_error_status);
                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
                break;
        }
@@ -1912,14 +1862,10 @@ static void transport_generic_request_failure(
         * transport_send_check_condition_and_sense() after handling
         * possible unsoliticied write data payloads.
         */
-        if (!sc && !cmd->se_tfo->new_cmd_map)
+        ret = transport_send_check_condition_and_sense(cmd,
-                transport_new_cmd_failure(cmd);
+                        cmd->scsi_sense_reason, 0);
-        else {
+        if (ret == -EAGAIN || ret == -ENOMEM)
-                ret = transport_send_check_condition_and_sense(cmd,
+                goto queue_full;
-                                cmd->scsi_sense_reason, 0);
-                if (ret == -EAGAIN || ret == -ENOMEM)
-                        goto queue_full;
-        }
 check_stop:
        transport_lun_remove_cmd(cmd);
@@ -2002,19 +1948,12 @@ static inline int transport_execute_task_attr(struct se_cmd *cmd)
         * to allow the passed struct se_cmd list of tasks to the front of the list.
         */
         if (cmd->sam_task_attr == MSG_HEAD_TAG) {
-                atomic_inc(&cmd->se_dev->dev_hoq_count);
-                smp_mb__after_atomic_inc();
                pr_debug("Added HEAD_OF_QUEUE for CDB:"
                        " 0x%02x, se_ordered_id: %u\n",
                        cmd->t_task_cdb[0],
                        cmd->se_ordered_id);
                return 1;
        } else if (cmd->sam_task_attr == MSG_ORDERED_TAG) {
-                spin_lock(&cmd->se_dev->ordered_cmd_lock);
-                list_add_tail(&cmd->se_ordered_node,
-                                &cmd->se_dev->ordered_cmd_list);
-                spin_unlock(&cmd->se_dev->ordered_cmd_lock);
                atomic_inc(&cmd->se_dev->dev_ordered_sync);
                smp_mb__after_atomic_inc();
@@ -2076,9 +2015,9 @@ static int transport_execute_tasks(struct se_cmd *cmd)
 {
        int add_tasks;
-        if (se_dev_check_online(cmd->se_orig_obj_ptr) != 0) {
+        if (se_dev_check_online(cmd->se_dev) != 0) {
-                cmd->transport_error_status = PYX_TRANSPORT_LU_COMM_FAILURE;
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                transport_generic_request_failure(cmd, 0, 1);
+                transport_generic_request_failure(cmd);
                return 0;
        }
@@ -2163,14 +2102,13 @@ check_depth:
        else
                error = dev->transport->do_task(task);
        if (error != 0) {
-                cmd->transport_error_status = error;
                spin_lock_irqsave(&cmd->t_state_lock, flags);
                task->task_flags &= ~TF_ACTIVE;
                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                atomic_set(&cmd->t_transport_sent, 0);
                transport_stop_tasks_for_cmd(cmd);
                atomic_inc(&dev->depth_left);
-                transport_generic_request_failure(cmd, 0, 1);
+                transport_generic_request_failure(cmd);
        }
        goto check_depth;
@@ -2178,19 +2116,6 @@ check_depth:
        return 0;
 }
-void transport_new_cmd_failure(struct se_cmd *se_cmd)
-{
-        unsigned long flags;
-        /*
-         * Any unsolicited data will get dumped for failed command inside of
-         * the fabric plugin
-         */
-        spin_lock_irqsave(&se_cmd->t_state_lock, flags);
-        se_cmd->se_cmd_flags |= SCF_SE_CMD_FAILED;
-        se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
-        spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
-}
 static inline u32 transport_get_sectors_6(
        unsigned char *cdb,
        struct se_cmd *cmd,
@@ -2213,10 +2138,15 @@ static inline u32 transport_get_sectors_6(
        /*
         * Everything else assume TYPE_DISK Sector CDB location.
-         * Use 8-bit sector value.
+         * Use 8-bit sector value.  SBC-3 says:
+         *
+         *   A TRANSFER LENGTH field set to zero specifies that 256
+         *   logical blocks shall be written.  Any other value
+         *   specifies the number of logical blocks that shall be
+         *   written.
         */
 type_disk:
-        return (u32)cdb[4];
+        return cdb[4] ? : 256;
 }
 static inline u32 transport_get_sectors_10(
@@ -2460,27 +2390,6 @@ static int transport_get_sense_data(struct se_cmd *cmd)
        return -1;
 }
-static int
-transport_handle_reservation_conflict(struct se_cmd *cmd)
-{
-        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
-        cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
-        cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
-        /*
-         * For UA Interlock Code 11b, a RESERVATION CONFLICT will
-         * establish a UNIT ATTENTION with PREVIOUS RESERVATION
-         * CONFLICT STATUS.
-         *
-         * See spc4r17, section 7.4.6 Control Mode Page, Table 349
-         */
-        if (cmd->se_sess &&
-            cmd->se_dev->se_sub_dev->se_dev_attrib.emulate_ua_intlck_ctrl == 2)
-                core_scsi3_ua_allocate(cmd->se_sess->se_node_acl,
-                        cmd->orig_fe_lun, 0x2C,
-                        ASCQ_2CH_PREVIOUS_RESERVATION_CONFLICT_STATUS);
-        return -EINVAL;
-}
 static inline long long transport_dev_end_lba(struct se_device *dev)
 {
        return dev->transport->get_blocks(dev) + 1;
@@ -2595,8 +2504,12 @@ static int transport_generic_cmd_sequencer(
         */
        if (su_dev->t10_pr.pr_ops.t10_reservation_check(cmd, &pr_reg_type) != 0) {
                if (su_dev->t10_pr.pr_ops.t10_seq_non_holder(
-                                        cmd, cdb, pr_reg_type) != 0)
+                                        cmd, cdb, pr_reg_type) != 0) {
-                        return transport_handle_reservation_conflict(cmd);
+                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+                        cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
+                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                        return -EBUSY;
+                }
                /*
                 * This means the CDB is allowed for the SCSI Initiator port
                 * when said port is *NOT* holding the legacy SPC-2 or
@@ -2658,7 +2571,8 @@ static int transport_generic_cmd_sequencer(
                        goto out_unsupported_cdb;
                size = transport_get_size(sectors, cdb, cmd);
                cmd->t_task_lba = transport_lba_32(cdb);
-                cmd->t_tasks_fua = (cdb[1] & 0x8);
+                if (cdb[1] & 0x8)
+                        cmd->se_cmd_flags |= SCF_FUA;
                cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
                break;
        case WRITE_12:
@@ -2667,7 +2581,8 @@ static int transport_generic_cmd_sequencer(
                        goto out_unsupported_cdb;
                size = transport_get_size(sectors, cdb, cmd);
                cmd->t_task_lba = transport_lba_32(cdb);
-                cmd->t_tasks_fua = (cdb[1] & 0x8);
+                if (cdb[1] & 0x8)
+                        cmd->se_cmd_flags |= SCF_FUA;
                cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
                break;
        case WRITE_16:
@@ -2676,12 +2591,13 @@ static int transport_generic_cmd_sequencer(
                        goto out_unsupported_cdb;
                size = transport_get_size(sectors, cdb, cmd);
                cmd->t_task_lba = transport_lba_64(cdb);
-                cmd->t_tasks_fua = (cdb[1] & 0x8);
+                if (cdb[1] & 0x8)
+                        cmd->se_cmd_flags |= SCF_FUA;
                cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
                break;
        case XDWRITEREAD_10:
                if ((cmd->data_direction != DMA_TO_DEVICE) ||
-                    !(cmd->t_tasks_bidi))
+                    !(cmd->se_cmd_flags & SCF_BIDI))
                        goto out_invalid_cdb_field;
                sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
                if (sector_ret)
@@ -2700,7 +2616,8 @@ static int transport_generic_cmd_sequencer(
                 * Setup BIDI XOR callback to be run after I/O completion.
                 */
                cmd->transport_complete_callback = &transport_xor_callback;
-                cmd->t_tasks_fua = (cdb[1] & 0x8);
+                if (cdb[1] & 0x8)
+                        cmd->se_cmd_flags |= SCF_FUA;
                break;
        case VARIABLE_LENGTH_CMD:
                service_action = get_unaligned_be16(&cdb[8]);
@@ -2728,7 +2645,8 @@ static int transport_generic_cmd_sequencer(
                         * completion.
                         */
                        cmd->transport_complete_callback = &transport_xor_callback;
-                        cmd->t_tasks_fua = (cdb[10] & 0x8);
+                        if (cdb[1] & 0x8)
+                                cmd->se_cmd_flags |= SCF_FUA;
                        break;
                case WRITE_SAME_32:
                        sectors = transport_get_sectors_32(cdb, cmd, &sector_ret);
@@ -3171,18 +3089,13 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
                        " SIMPLE: %u\n", dev->dev_cur_ordered_id,
                        cmd->se_ordered_id);
        } else if (cmd->sam_task_attr == MSG_HEAD_TAG) {
-                atomic_dec(&dev->dev_hoq_count);
-                smp_mb__after_atomic_dec();
                dev->dev_cur_ordered_id++;
                pr_debug("Incremented dev_cur_ordered_id: %u for"
                        " HEAD_OF_QUEUE: %u\n", dev->dev_cur_ordered_id,
                        cmd->se_ordered_id);
        } else if (cmd->sam_task_attr == MSG_ORDERED_TAG) {
-                spin_lock(&dev->ordered_cmd_lock);
-                list_del(&cmd->se_ordered_node);
                atomic_dec(&dev->dev_ordered_sync);
                smp_mb__after_atomic_dec();
-                spin_unlock(&dev->ordered_cmd_lock);
                dev->dev_cur_ordered_id++;
                pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED:"
@@ -3495,6 +3408,18 @@ int transport_generic_map_mem_to_cmd(
        if ((cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) ||
            (cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB)) {
+                /*
+                 * Reject SCSI data overflow with map_mem_to_cmd() as incoming
+                 * scatterlists already have been set to follow what the fabric
+                 * passes for the original expected data transfer length.
+                 */
+                if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
+                        pr_warn("Rejecting SCSI DATA overflow for fabric using"
+                                " SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC\n");
+                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+                        cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                        return -EINVAL;
+                }
                cmd->t_data_sg = sgl;
                cmd->t_data_nents = sgl_count;
@@ -3813,7 +3738,7 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
            cmd->data_length) {
                ret = transport_generic_get_mem(cmd);
                if (ret < 0)
-                        return ret;
+                        goto out_fail;
        }
        /*
@@ -3842,8 +3767,15 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
                task_cdbs = transport_allocate_control_task(cmd);
        }
-        if (task_cdbs <= 0)
+        if (task_cdbs < 0)
                goto out_fail;
+        else if (!task_cdbs && (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)) {
+                cmd->t_state = TRANSPORT_COMPLETE;
+                atomic_set(&cmd->t_transport_active, 1);
+                INIT_WORK(&cmd->work, target_complete_ok_work);
+                queue_work(target_completion_wq, &cmd->work);
+                return 0;
+        }
        if (set_counts) {
                atomic_inc(&cmd->t_fe_count);
@@ -3929,7 +3861,7 @@ static int transport_generic_write_pending(struct se_cmd *cmd)
        else if (ret < 0)
                return ret;
-        return PYX_TRANSPORT_WRITE_PENDING;
+        return 1;
 queue_full:
        pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n", cmd);
@@ -4602,9 +4534,6 @@ void transport_send_task_abort(struct se_cmd *cmd)
                if (cmd->se_tfo->write_pending_status(cmd) != 0) {
                        atomic_inc(&cmd->t_transport_aborted);
                        smp_mb__after_atomic_inc();
-                        cmd->scsi_status = SAM_STAT_TASK_ABORTED;
-                        transport_new_cmd_failure(cmd);
-                        return;
                }
        }
        cmd->scsi_status = SAM_STAT_TASK_ABORTED;
@@ -4670,8 +4599,6 @@ static int transport_processing_thread(void *param)
        struct se_cmd *cmd;
        struct se_device *dev = (struct se_device *) param;
-        set_user_nice(current, -20);
        while (!kthread_should_stop()) {
                ret = wait_event_interruptible(dev->dev_queue_obj.thread_wq,
                                atomic_read(&dev->dev_queue_obj.queue_cnt) ||
@@ -4698,18 +4625,13 @@ get_cmd:
                        }
                        ret = cmd->se_tfo->new_cmd_map(cmd);
                        if (ret < 0) {
-                                cmd->transport_error_status = ret;
+                                transport_generic_request_failure(cmd);
-                                transport_generic_request_failure(cmd,
-                                                0, (cmd->data_direction !=
-                                                    DMA_TO_DEVICE));
                                break;
                        }
                        ret = transport_generic_new_cmd(cmd);
                        if (ret < 0) {
-                                cmd->transport_error_status = ret;
+                                transport_generic_request_failure(cmd);
-                                transport_generic_request_failure(cmd,
+                                break;
-                                        0, (cmd->data_direction !=
-                                         DMA_TO_DEVICE));
                        }
                        break;
                case TRANSPORT_PROCESS_WRITE:
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 4fac37c4c615..71fc9cea5dc9 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -200,7 +200,7 @@ int ft_write_pending(struct se_cmd *se_cmd)
        lport = ep->lp;
        fp = fc_frame_alloc(lport, sizeof(*txrdy));
        if (!fp)
-                return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
+                return -ENOMEM; /* Signal QUEUE_FULL */
        txrdy = fc_frame_payload_get(fp, sizeof(*txrdy));
        memset(txrdy, 0, sizeof(*txrdy));
diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index 5f770412ca40..9402b7387cac 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -436,8 +436,7 @@ static void ft_del_lport(struct se_wwn *wwn)
        struct ft_lport_acl *lacl = container_of(wwn,
                                struct ft_lport_acl, fc_lport_wwn);
-        pr_debug("del lport %s\n",
+        pr_debug("del lport %s\n", lacl->name);
-                        config_item_name(&wwn->wwn_group.cg_item));
        mutex_lock(&ft_lport_lock);
        list_del(&lacl->list);
        mutex_unlock(&ft_lport_lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index f0d5718d2587..2ad813674d77 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5107,11 +5107,11 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
        struct btrfs_root *root = orig_root->fs_info->extent_root;
        struct btrfs_free_cluster *last_ptr = NULL;
        struct btrfs_block_group_cache *block_group = NULL;
+        struct btrfs_block_group_cache *used_block_group;
        int empty_cluster = 2 * 1024 * 1024;
        int allowed_chunk_alloc = 0;
        int done_chunk_alloc = 0;
        struct btrfs_space_info *space_info;
-        int last_ptr_loop = 0;
        int loop = 0;
        int index = 0;
        int alloc_type = (data & BTRFS_BLOCK_GROUP_DATA) ?
@@ -5173,6 +5173,7 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
 ideal_cache:
                block_group = btrfs_lookup_block_group(root->fs_info,
                                                       search_start);
+                used_block_group = block_group;
                /*
                 * we don't want to use the block group if it doesn't match our
                 * allocation bits, or if its not cached.
@@ -5210,6 +5211,7 @@ search:
                u64 offset;
                int cached;
+                used_block_group = block_group;
                btrfs_get_block_group(block_group);
                search_start = block_group->key.objectid;
@@ -5286,71 +5288,62 @@ alloc:
                spin_unlock(&block_group->free_space_ctl->tree_lock);
                /*
-                 * Ok we want to try and use the cluster allocator, so lets look
+                 * Ok we want to try and use the cluster allocator, so
-                 * there, unless we are on LOOP_NO_EMPTY_SIZE, since we will
+                 * lets look there
-                 * have tried the cluster allocator plenty of times at this
-                 * point and not have found anything, so we are likely way too
-                 * fragmented for the clustering stuff to find anything, so lets
-                 * just skip it and let the allocator find whatever block it can
-                 * find
                 */
-                if (last_ptr && loop < LOOP_NO_EMPTY_SIZE) {
+                if (last_ptr) {
                        /*
                         * the refill lock keeps out other
                         * people trying to start a new cluster
                         */
                        spin_lock(&last_ptr->refill_lock);
-                        if (!last_ptr->block_group ||
+                        used_block_group = last_ptr->block_group;
-                            last_ptr->block_group->ro ||
+                        if (used_block_group != block_group &&
-                            !block_group_bits(last_ptr->block_group, data))
+                            (!used_block_group ||
+                             used_block_group->ro ||
+                             !block_group_bits(used_block_group, data))) {
+                                used_block_group = block_group;
                                goto refill_cluster;
+                        }
+                        if (used_block_group != block_group)
+                                btrfs_get_block_group(used_block_group);
-                        offset = btrfs_alloc_from_cluster(block_group, last_ptr,
+                        offset = btrfs_alloc_from_cluster(used_block_group,
-                                                 num_bytes, search_start);
+                          last_ptr, num_bytes, used_block_group->key.objectid);
                        if (offset) {
                                /* we have a block, we're done */
                                spin_unlock(&last_ptr->refill_lock);
                                goto checks;
                        }
-                        spin_lock(&last_ptr->lock);
+                        WARN_ON(last_ptr->block_group != used_block_group);
-                        /*
+                        if (used_block_group != block_group) {
-                         * whoops, this cluster doesn't actually point to
+                                btrfs_put_block_group(used_block_group);
-                         * this block group.  Get a ref on the block
+                                used_block_group = block_group;
-                         * group is does point to and try again
-                         */
-                        if (!last_ptr_loop && last_ptr->block_group &&
-                            last_ptr->block_group != block_group &&
-                            index <=
-                                 get_block_group_index(last_ptr->block_group)) {
-                                btrfs_put_block_group(block_group);
-                                block_group = last_ptr->block_group;
-                                btrfs_get_block_group(block_group);
-                                spin_unlock(&last_ptr->lock);
-                                spin_unlock(&last_ptr->refill_lock);
-                                last_ptr_loop = 1;
-                                search_start = block_group->key.objectid;
-                                /*
-                                 * we know this block group is properly
-                                 * in the list because
-                                 * btrfs_remove_block_group, drops the
-                                 * cluster before it removes the block
-                                 * group from the list
-                                 */
-                                goto have_block_group;
                        }
-                        spin_unlock(&last_ptr->lock);
 refill_cluster:
+                        BUG_ON(used_block_group != block_group);
+                        /* If we are on LOOP_NO_EMPTY_SIZE, we can't
+                         * set up a new clusters, so lets just skip it
+                         * and let the allocator find whatever block
+                         * it can find.  If we reach this point, we
+                         * will have tried the cluster allocator
+                         * plenty of times and not have found
+                         * anything, so we are likely way too
+                         * fragmented for the clustering stuff to find
+                         * anything.  */
+                        if (loop >= LOOP_NO_EMPTY_SIZE) {
+                                spin_unlock(&last_ptr->refill_lock);
+                                goto unclustered_alloc;
+                        }
                        /*
                         * this cluster didn't work out, free it and
                         * start over
                         */
                        btrfs_return_cluster_to_free_space(NULL, last_ptr);
-                        last_ptr_loop = 0;
                        /* allocate a cluster in this block group */
                        ret = btrfs_find_space_cluster(trans, root,
                                               block_group, last_ptr,
@@ -5390,6 +5383,7 @@ refill_cluster:
                        goto loop;
                }
+unclustered_alloc:
                offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                    num_bytes, empty_size);
                /*
@@ -5416,14 +5410,14 @@ checks:
                search_start = stripe_align(root, offset);
                /* move on to the next group */
                if (search_start + num_bytes >= search_end) {
-                        btrfs_add_free_space(block_group, offset, num_bytes);
+                        btrfs_add_free_space(used_block_group, offset, num_bytes);
                        goto loop;
                }
                /* move on to the next group */
                if (search_start + num_bytes >
-                    block_group->key.objectid + block_group->key.offset) {
+                    used_block_group->key.objectid + used_block_group->key.offset) {
-                        btrfs_add_free_space(block_group, offset, num_bytes);
+                        btrfs_add_free_space(used_block_group, offset, num_bytes);
                        goto loop;
                }
@@ -5431,14 +5425,14 @@ checks:
                ins->offset = num_bytes;
                if (offset < search_start)
-                        btrfs_add_free_space(block_group, offset,
+                        btrfs_add_free_space(used_block_group, offset,
                                             search_start - offset);
                BUG_ON(offset > search_start);
-                ret = btrfs_update_reserved_bytes(block_group, num_bytes,
+                ret = btrfs_update_reserved_bytes(used_block_group, num_bytes,
                                                  alloc_type);
                if (ret == -EAGAIN) {
-                        btrfs_add_free_space(block_group, offset, num_bytes);
+                        btrfs_add_free_space(used_block_group, offset, num_bytes);
                        goto loop;
                }
@@ -5447,15 +5441,19 @@ checks:
                ins->offset = num_bytes;
                if (offset < search_start)
-                        btrfs_add_free_space(block_group, offset,
+                        btrfs_add_free_space(used_block_group, offset,
                                             search_start - offset);
                BUG_ON(offset > search_start);
+                if (used_block_group != block_group)
+                        btrfs_put_block_group(used_block_group);
                btrfs_put_block_group(block_group);
                break;
 loop:
                failed_cluster_refill = false;
                failed_alloc = false;
                BUG_ON(index != get_block_group_index(block_group));
+                if (used_block_group != block_group)
+                        btrfs_put_block_group(used_block_group);
                btrfs_put_block_group(block_group);
        }
        up_read(&space_info->groups_sem);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index be1bf627a14b..49f3c9dc09f4 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -935,8 +935,10 @@ again:
        node = tree_search(tree, start);
        if (!node) {
                prealloc = alloc_extent_state_atomic(prealloc);
-                if (!prealloc)
+                if (!prealloc) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto out;
+                }
                err = insert_state(tree, prealloc, start, end, &bits);
                prealloc = NULL;
                BUG_ON(err == -EEXIST);
@@ -992,8 +994,10 @@ hit_next:
         */
        if (state->start < start) {
                prealloc = alloc_extent_state_atomic(prealloc);
-                if (!prealloc)
+                if (!prealloc) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto out;
+                }
                err = split_state(tree, state, prealloc, start);
                BUG_ON(err == -EEXIST);
                prealloc = NULL;
@@ -1024,8 +1028,10 @@ hit_next:
                        this_end = last_start - 1;
                prealloc = alloc_extent_state_atomic(prealloc);
-                if (!prealloc)
+                if (!prealloc) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto out;
+                }
                /*
                 * Avoid to free 'prealloc' if it can be merged with
@@ -1051,8 +1057,10 @@ hit_next:
         */
        if (state->start <= end && state->end > end) {
                prealloc = alloc_extent_state_atomic(prealloc);
-                if (!prealloc)
+                if (!prealloc) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto out;
+                }
                err = split_state(tree, state, prealloc, end + 1);
                BUG_ON(err == -EEXIST);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index c37433d3cd82..0a8c8f8304b1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1611,7 +1611,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        if ((sb->s_flags & MS_RDONLY) && !root->fs_info->fs_devices->seeding)
                return -EINVAL;
-        bdev = blkdev_get_by_path(device_path, FMODE_EXCL,
+        bdev = blkdev_get_by_path(device_path, FMODE_WRITE | FMODE_EXCL,
                                  root->fs_info->bdev_holder);
        if (IS_ERR(bdev))
                return PTR_ERR(bdev);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d6a972df0338..8cd4b52d4217 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -441,6 +441,8 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct kvec *iov_orig,
        smb_msg.msg_controllen = 0;
        for (total_read = 0; to_read; total_read += length, to_read -= length) {
+                try_to_freeze();
                if (server_unresponsive(server)) {
                        total_read = -EAGAIN;
                        break;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index cf0b1539b321..4dd9283885e7 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -702,6 +702,13 @@ cifs_find_lock_conflict(struct cifsInodeInfo *cinode, struct cifsLockInfo *lock,
                                         lock->type, lock->netfid, conf_lock);
 }
+/*
+ * Check if there is another lock that prevents us to set the lock (mandatory
+ * style). If such a lock exists, update the flock structure with its
+ * properties. Otherwise, set the flock type to F_UNLCK if we can cache brlocks
+ * or leave it the same if we can't. Returns 0 if we don't need to request to
+ * the server or 1 otherwise.
+ */
 static int
 cifs_lock_test(struct cifsInodeInfo *cinode, __u64 offset, __u64 length,
               __u8 type, __u16 netfid, struct file_lock *flock)
@@ -739,6 +746,12 @@ cifs_lock_add(struct cifsInodeInfo *cinode, struct cifsLockInfo *lock)
        mutex_unlock(&cinode->lock_mutex);
 }
+/*
+ * Set the byte-range lock (mandatory style). Returns:
+ * 1) 0, if we set the lock and don't need to request to the server;
+ * 2) 1, if no locks prevent us but we need to request to the server;
+ * 3) -EACCESS, if there is a lock that prevents us and wait is false.
+ */
 static int
 cifs_lock_add_if(struct cifsInodeInfo *cinode, struct cifsLockInfo *lock,
                 bool wait)
@@ -778,6 +791,13 @@ try_again:
        return rc;
 }
+/*
+ * Check if there is another lock that prevents us to set the lock (posix
+ * style). If such a lock exists, update the flock structure with its
+ * properties. Otherwise, set the flock type to F_UNLCK if we can cache brlocks
+ * or leave it the same if we can't. Returns 0 if we don't need to request to
+ * the server or 1 otherwise.
+ */
 static int
 cifs_posix_lock_test(struct file *file, struct file_lock *flock)
 {
@@ -800,6 +820,12 @@ cifs_posix_lock_test(struct file *file, struct file_lock *flock)
        return rc;
 }
+/*
+ * Set the byte-range lock (posix style). Returns:
+ * 1) 0, if we set the lock and don't need to request to the server;
+ * 2) 1, if we need to request to the server;
+ * 3) <0, if the error occurs while setting the lock.
+ */
 static int
 cifs_posix_lock_set(struct file *file, struct file_lock *flock)
 {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 5de03ec20144..a090bbe6ee29 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -554,7 +554,10 @@ static int find_cifs_entry(const int xid, struct cifs_tcon *pTcon,
                                 rc);
                        return rc;
                }
-                cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
+                /* FindFirst/Next set last_entry to NULL on malformed reply */
+                if (cifsFile->srch_inf.last_entry)
+                        cifs_save_resume_key(cifsFile->srch_inf.last_entry,
+                                                cifsFile);
        }
        while ((index_to_find >= cifsFile->srch_inf.index_of_last_entry) &&
@@ -562,7 +565,10 @@ static int find_cifs_entry(const int xid, struct cifs_tcon *pTcon,
                cFYI(1, "calling findnext2");
                rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
                                  &cifsFile->srch_inf);
-                cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
+                /* FindFirst/Next set last_entry to NULL on malformed reply */
+                if (cifsFile->srch_inf.last_entry)
+                        cifs_save_resume_key(cifsFile->srch_inf.last_entry,
+                                                cifsFile);
                if (rc)
                        return -ENOENT;
        }
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 7cacba12b8f1..80d850881938 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -209,7 +209,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16,
 {
        int rc;
        int len;
-        __u16 wpwd[129];
+        __le16 wpwd[129];
        /* Password cannot be longer than 128 characters */
        if (passwd) /* Password must be converted to NT unicode */
@@ -219,8 +219,8 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16,
                *wpwd = 0; /* Ensure string is null terminated */
        }
-        rc = mdfour(p16, (unsigned char *) wpwd, len * sizeof(__u16));
+        rc = mdfour(p16, (unsigned char *) wpwd, len * sizeof(__le16));
-        memset(wpwd, 0, 129 * sizeof(__u16));
+        memset(wpwd, 0, 129 * sizeof(__le16));
        return rc;
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 10ba92def3f6..89509b5a090e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2439,16 +2439,14 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
 /**
 * prepend_path - Prepend path string to a buffer
 * @path: the dentry/vfsmount to report
- * @root: root vfsmnt/dentry (may be modified by this function)
+ * @root: root vfsmnt/dentry
 * @buffer: pointer to the end of the buffer
 * @buflen: pointer to buffer length
 *
 * Caller holds the rename_lock.
- *
- * If path is not reachable from the supplied root, then the value of
- * root is changed (without modifying refcounts).
 */
-static int prepend_path(const struct path *path, struct path *root,
+static int prepend_path(const struct path *path,
+                        const struct path *root,
                        char **buffer, int *buflen)
 {
        struct dentry *dentry = path->dentry;
@@ -2483,10 +2481,10 @@ static int prepend_path(const struct path *path, struct path *root,
                dentry = parent;
        }
-out:
        if (!error && !slash)
                error = prepend(buffer, buflen, "/", 1);
+out:
        br_read_unlock(vfsmount_lock);
        return error;
@@ -2500,15 +2498,17 @@ global_root:
                WARN(1, "Root dentry has weird name <%.*s>\n",
                     (int) dentry->d_name.len, dentry->d_name.name);
        }
-        root->mnt = vfsmnt;
+        if (!slash)
-        root->dentry = dentry;
+                error = prepend(buffer, buflen, "/", 1);
+        if (!error)
+                error = vfsmnt->mnt_ns ? 1 : 2;
        goto out;
 }
 /**
 * __d_path - return the path of a dentry
 * @path: the dentry/vfsmount to report
- * @root: root vfsmnt/dentry (may be modified by this function)
+ * @root: root vfsmnt/dentry
 * @buf: buffer to return value in
 * @buflen: buffer length
 *
@@ -2519,10 +2519,10 @@ global_root:
 *
 * "buflen" should be positive.
 *
- * If path is not reachable from the supplied root, then the value of
+ * If the path is not reachable from the supplied root, return %NULL.
- * root is changed (without modifying refcounts).
 */
-char *__d_path(const struct path *path, struct path *root,
+char *__d_path(const struct path *path,
+               const struct path *root,
               char *buf, int buflen)
 {
        char *res = buf + buflen;
@@ -2533,7 +2533,28 @@ char *__d_path(const struct path *path, struct path *root,
        error = prepend_path(path, root, &res, &buflen);
        write_sequnlock(&rename_lock);
-        if (error)
+        if (error < 0)
+                return ERR_PTR(error);
+        if (error > 0)
+                return NULL;
+        return res;
+}
+char *d_absolute_path(const struct path *path,
+               char *buf, int buflen)
+{
+        struct path root = {};
+        char *res = buf + buflen;
+        int error;
+        prepend(&res, &buflen, "\0", 1);
+        write_seqlock(&rename_lock);
+        error = prepend_path(path, &root, &res, &buflen);
+        write_sequnlock(&rename_lock);
+        if (error > 1)
+                error = -EINVAL;
+        if (error < 0)
                return ERR_PTR(error);
        return res;
 }
@@ -2541,8 +2562,9 @@ char *__d_path(const struct path *path, struct path *root,
 /*
 * same as __d_path but appends "(deleted)" for unlinked files.
 */
-static int path_with_deleted(const struct path *path, struct path *root,
+static int path_with_deleted(const struct path *path,
-                                 char **buf, int *buflen)
+                             const struct path *root,
+                             char **buf, int *buflen)
 {
        prepend(buf, buflen, "\0", 1);
        if (d_unlinked(path->dentry)) {
@@ -2579,7 +2601,6 @@ char *d_path(const struct path *path, char *buf, int buflen)
 {
        char *res = buf + buflen;
        struct path root;
-        struct path tmp;
        int error;
        /*
@@ -2594,9 +2615,8 @@ char *d_path(const struct path *path, char *buf, int buflen)
        get_fs_root(current->fs, &root);
        write_seqlock(&rename_lock);
-        tmp = root;
+        error = path_with_deleted(path, &root, &res, &buflen);
-        error = path_with_deleted(path, &tmp, &res, &buflen);
+        if (error < 0)
-        if (error)
                res = ERR_PTR(error);
        write_sequnlock(&rename_lock);
        path_put(&root);
@@ -2617,7 +2637,6 @@ char *d_path_with_unreachable(const struct path *path, char *buf, int buflen)
 {
        char *res = buf + buflen;
        struct path root;
-        struct path tmp;
        int error;
        if (path->dentry->d_op && path->dentry->d_op->d_dname)
@@ -2625,9 +2644,8 @@ char *d_path_with_unreachable(const struct path *path, char *buf, int buflen)
        get_fs_root(current->fs, &root);
        write_seqlock(&rename_lock);
-        tmp = root;
+        error = path_with_deleted(path, &root, &res, &buflen);
-        error = path_with_deleted(path, &tmp, &res, &buflen);
+        if (error > 0)
-        if (!error && !path_equal(&tmp, &root))
                error = prepend_unreachable(&res, &buflen);
        write_sequnlock(&rename_lock);
        path_put(&root);
@@ -2758,19 +2776,18 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
        write_seqlock(&rename_lock);
        if (!d_unlinked(pwd.dentry)) {
                unsigned long len;
-                struct path tmp = root;
                char *cwd = page + PAGE_SIZE;
                int buflen = PAGE_SIZE;
                prepend(&cwd, &buflen, "\0", 1);
-                error = prepend_path(&pwd, &tmp, &cwd, &buflen);
+                error = prepend_path(&pwd, &root, &cwd, &buflen);
                write_sequnlock(&rename_lock);
-                if (error)
+                if (error < 0)
                        goto out;
                /* Unreachable from current root */
-                if (!path_equal(&tmp, &root)) {
+                if (error > 0) {
                        error = prepend_unreachable(&cwd, &buflen);
                        if (error)
                                goto out;
diff --git a/fs/namespace.c b/fs/namespace.c
index 6d3a1963879b..cfc6d4448aa5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1048,15 +1048,12 @@ static int show_mountinfo(struct seq_file *m, void *v)
        if (err)
                goto out;
        seq_putc(m, ' ');
-        seq_path_root(m, &mnt_path, &root, " \t\n\\");
-        if (root.mnt != p->root.mnt || root.dentry != p->root.dentry) {
+        /* mountpoints outside of chroot jail will give SEQ_SKIP on this */
-                /*
+        err = seq_path_root(m, &mnt_path, &root, " \t\n\\");
-                 * Mountpoint is outside root, discard that one.  Ugly,
+        if (err)
-                 * but less so than trying to do that in iterator in a
+                goto out;
-                 * race-free way (due to renames).
-                 */
-                return SEQ_SKIP;
-        }
        seq_puts(m, mnt->mnt_flags & MNT_READONLY ? " ro" : " rw");
        show_mnt_opts(m, mnt);
@@ -2776,3 +2773,8 @@ void kern_unmount(struct vfsmount *mnt)
        }
 }
 EXPORT_SYMBOL(kern_unmount);
+bool our_mnt(struct vfsmount *mnt)
+{
+        return check_mnt(mnt);
+}
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 586174168e2a..80e4645f7990 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -131,12 +131,13 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                K(i.freeswap),
                K(global_page_state(NR_FILE_DIRTY)),
                K(global_page_state(NR_WRITEBACK)),
-                K(global_page_state(NR_ANON_PAGES)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+                K(global_page_state(NR_ANON_PAGES)
                  + global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
-                  HPAGE_PMD_NR
+                  HPAGE_PMD_NR),
+#else
+                K(global_page_state(NR_ANON_PAGES)),
 #endif
-                  ),
                K(global_page_state(NR_FILE_MAPPED)),
                K(global_page_state(NR_SHMEM)),
                K(global_page_state(NR_SLAB_RECLAIMABLE) +
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 42b274da92c3..2a30d67dd6b8 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -32,7 +32,7 @@ static cputime64_t get_idle_time(int cpu)
                idle = kstat_cpu(cpu).cpustat.idle;
                idle = cputime64_add(idle, arch_idle_time(cpu));
        } else
-                idle = usecs_to_cputime(idle_time);
+                idle = nsecs_to_jiffies64(1000 * idle_time);
        return idle;
 }
@@ -46,7 +46,7 @@ static cputime64_t get_iowait_time(int cpu)
                /* !NO_HZ so we can rely on cpustat.iowait */
                iowait = kstat_cpu(cpu).cpustat.iowait;
        else
-                iowait = usecs_to_cputime(iowait_time);
+                iowait = nsecs_to_jiffies64(1000 * iowait_time);
        return iowait;
 }
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 05d6b0e78c95..dba43c3ea3af 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -449,8 +449,6 @@ EXPORT_SYMBOL(seq_path);
 /*
 * Same as seq_path, but relative to supplied root.
- *
- * root may be changed, see __d_path().
 */
 int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
                  char *esc)
@@ -463,6 +461,8 @@ int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
                char *p;
                p = __d_path(path, root, buf, size);
+                if (!p)
+                        return SEQ_SKIP;
                res = PTR_ERR(p);
                if (!IS_ERR(p)) {
                        char *end = mangle_path(buf, p, esc);
@@ -474,7 +474,7 @@ int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
        }
        seq_commit(m, res);
-        return res < 0 ? res : 0;
+        return res < 0 && res != -ENAMETOOLONG ? res : 0;
 }
 /*
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index c68baeb0974a..d0ab78837057 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -2383,6 +2383,8 @@ xfs_bmap_btalloc(
        int             tryagain;
        int             error;
+        ASSERT(ap->length);
        mp = ap->ip->i_mount;
        align = ap->userdata ? xfs_get_extsz_hint(ap->ip) : 0;
        if (unlikely(align)) {
@@ -4629,6 +4631,8 @@ xfs_bmapi_allocate(
        int                     error;
        int                     rt;
+        ASSERT(bma->length > 0);
        rt = (whichfork == XFS_DATA_FORK) && XFS_IS_REALTIME_INODE(bma->ip);
        /*
@@ -4849,6 +4853,7 @@ xfs_bmapi_write(
        ASSERT(*nmap <= XFS_BMAP_MAX_NMAP);
        ASSERT(!(flags & XFS_BMAPI_IGSTATE));
        ASSERT(tp != NULL);
+        ASSERT(len > 0);
        whichfork = (flags & XFS_BMAPI_ATTRFORK) ?
                XFS_ATTR_FORK : XFS_DATA_FORK;
@@ -4918,9 +4923,22 @@ xfs_bmapi_write(
                        bma.eof = eof;
                        bma.conv = !!(flags & XFS_BMAPI_CONVERT);
                        bma.wasdel = wasdelay;
-                        bma.length = len;
                        bma.offset = bno;
+                        /*
+                         * There's a 32/64 bit type mismatch between the
+                         * allocation length request (which can be 64 bits in
+                         * length) and the bma length request, which is
+                         * xfs_extlen_t and therefore 32 bits. Hence we have to
+                         * check for 32-bit overflows and handle them here.
+                         */
+                        if (len > (xfs_filblks_t)MAXEXTLEN)
+                                bma.length = MAXEXTLEN;
+                        else
+                                bma.length = len;
+                        ASSERT(len > 0);
+                        ASSERT(bma.length > 0);
                        error = xfs_bmapi_allocate(&bma, flags);
                        if (error)
                                goto error0;
diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c
index da108977b21f..558910f5e3c0 100644
--- a/fs/xfs/xfs_export.c
+++ b/fs/xfs/xfs_export.c
@@ -98,22 +98,22 @@ xfs_fs_encode_fh(
        switch (fileid_type) {
        case FILEID_INO32_GEN_PARENT:
                spin_lock(&dentry->d_lock);
-                fid->i32.parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid->i32.parent_ino = XFS_I(dentry->d_parent->d_inode)->i_ino;
                fid->i32.parent_gen = dentry->d_parent->d_inode->i_generation;
                spin_unlock(&dentry->d_lock);
                /*FALLTHRU*/
        case FILEID_INO32_GEN:
-                fid->i32.ino = inode->i_ino;
+                fid->i32.ino = XFS_I(inode)->i_ino;
                fid->i32.gen = inode->i_generation;
                break;
        case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
                spin_lock(&dentry->d_lock);
-                fid64->parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid64->parent_ino = XFS_I(dentry->d_parent->d_inode)->i_ino;
                fid64->parent_gen = dentry->d_parent->d_inode->i_generation;
                spin_unlock(&dentry->d_lock);
                /*FALLTHRU*/
        case FILEID_INO32_GEN | XFS_FILEID_TYPE_64FLAG:
-                fid64->ino = inode->i_ino;
+                fid64->ino = XFS_I(inode)->i_ino;
                fid64->gen = inode->i_generation;
                break;
        }
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index a14cd89fe465..34817adf4b9e 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -150,6 +150,117 @@ xlog_grant_add_space(
        } while (head_val != old);
 }
+STATIC bool
+xlog_reserveq_wake(
+        struct log              *log,
+        int                     *free_bytes)
+{
+        struct xlog_ticket      *tic;
+        int                     need_bytes;
+        list_for_each_entry(tic, &log->l_reserveq, t_queue) {
+                if (tic->t_flags & XLOG_TIC_PERM_RESERV)
+                        need_bytes = tic->t_unit_res * tic->t_cnt;
+                else
+                        need_bytes = tic->t_unit_res;
+                if (*free_bytes < need_bytes)
+                        return false;
+                *free_bytes -= need_bytes;
+                trace_xfs_log_grant_wake_up(log, tic);
+                wake_up(&tic->t_wait);
+        }
+        return true;
+}
+STATIC bool
+xlog_writeq_wake(
+        struct log              *log,
+        int                     *free_bytes)
+{
+        struct xlog_ticket      *tic;
+        int                     need_bytes;
+        list_for_each_entry(tic, &log->l_writeq, t_queue) {
+                ASSERT(tic->t_flags & XLOG_TIC_PERM_RESERV);
+                need_bytes = tic->t_unit_res;
+                if (*free_bytes < need_bytes)
+                        return false;
+                *free_bytes -= need_bytes;
+                trace_xfs_log_regrant_write_wake_up(log, tic);
+                wake_up(&tic->t_wait);
+        }
+        return true;
+}
+STATIC int
+xlog_reserveq_wait(
+        struct log              *log,
+        struct xlog_ticket      *tic,
+        int                     need_bytes)
+{
+        list_add_tail(&tic->t_queue, &log->l_reserveq);
+        do {
+                if (XLOG_FORCED_SHUTDOWN(log))
+                        goto shutdown;
+                xlog_grant_push_ail(log, need_bytes);
+                XFS_STATS_INC(xs_sleep_logspace);
+                trace_xfs_log_grant_sleep(log, tic);
+                xlog_wait(&tic->t_wait, &log->l_grant_reserve_lock);
+                trace_xfs_log_grant_wake(log, tic);
+                spin_lock(&log->l_grant_reserve_lock);
+                if (XLOG_FORCED_SHUTDOWN(log))
+                        goto shutdown;
+        } while (xlog_space_left(log, &log->l_grant_reserve_head) < need_bytes);
+        list_del_init(&tic->t_queue);
+        return 0;
+shutdown:
+        list_del_init(&tic->t_queue);
+        return XFS_ERROR(EIO);
+}
+STATIC int
+xlog_writeq_wait(
+        struct log              *log,
+        struct xlog_ticket      *tic,
+        int                     need_bytes)
+{
+        list_add_tail(&tic->t_queue, &log->l_writeq);
+        do {
+                if (XLOG_FORCED_SHUTDOWN(log))
+                        goto shutdown;
+                xlog_grant_push_ail(log, need_bytes);
+                XFS_STATS_INC(xs_sleep_logspace);
+                trace_xfs_log_regrant_write_sleep(log, tic);
+                xlog_wait(&tic->t_wait, &log->l_grant_write_lock);
+                trace_xfs_log_regrant_write_wake(log, tic);
+                spin_lock(&log->l_grant_write_lock);
+                if (XLOG_FORCED_SHUTDOWN(log))
+                        goto shutdown;
+        } while (xlog_space_left(log, &log->l_grant_write_head) < need_bytes);
+        list_del_init(&tic->t_queue);
+        return 0;
+shutdown:
+        list_del_init(&tic->t_queue);
+        return XFS_ERROR(EIO);
+}
 static void
 xlog_tic_reset_res(xlog_ticket_t *tic)
 {
@@ -350,8 +461,19 @@ xfs_log_reserve(
                retval = xlog_grant_log_space(log, internal_ticket);
        }
+        if (unlikely(retval)) {
+                /*
+                 * If we are failing, make sure the ticket doesn't have any
+                 * current reservations.  We don't want to add this back
+                 * when the ticket/ transaction gets cancelled.
+                 */
+                internal_ticket->t_curr_res = 0;
+                /* ungrant will give back unit_res * t_cnt. */
+                internal_ticket->t_cnt = 0;
+        }
        return retval;
-}       /* xfs_log_reserve */
+}
 /*
@@ -2481,8 +2603,8 @@ restart:
 /*
 * Atomically get the log space required for a log ticket.
 *
- * Once a ticket gets put onto the reserveq, it will only return after
+ * Once a ticket gets put onto the reserveq, it will only return after the
- * the needed reservation is satisfied.
+ * needed reservation is satisfied.
 *
 * This function is structured so that it has a lock free fast path. This is
 * necessary because every new transaction reservation will come through this
@@ -2490,113 +2612,53 @@ restart:
 * every pass.
 *
 * As tickets are only ever moved on and off the reserveq under the
- * l_grant_reserve_lock, we only need to take that lock if we are going
+ * l_grant_reserve_lock, we only need to take that lock if we are going to add
- * to add the ticket to the queue and sleep. We can avoid taking the lock if the
+ * the ticket to the queue and sleep. We can avoid taking the lock if the ticket
- * ticket was never added to the reserveq because the t_queue list head will be
+ * was never added to the reserveq because the t_queue list head will be empty
- * empty and we hold the only reference to it so it can safely be checked
+ * and we hold the only reference to it so it can safely be checked unlocked.
- * unlocked.
 */
 STATIC int
-xlog_grant_log_space(xlog_t        *log,
+xlog_grant_log_space(
-                     xlog_ticket_t *tic)
+        struct log              *log,
+        struct xlog_ticket      *tic)
 {
-        int              free_bytes;
+        int                     free_bytes, need_bytes;
-        int              need_bytes;
+        int                     error = 0;
-#ifdef DEBUG
+        ASSERT(!(log->l_flags & XLOG_ACTIVE_RECOVERY));
-        if (log->l_flags & XLOG_ACTIVE_RECOVERY)
-                panic("grant Recovery problem");
-#endif
        trace_xfs_log_grant_enter(log, tic);
+        /*
+         * If there are other waiters on the queue then give them a chance at
+         * logspace before us.  Wake up the first waiters, if we do not wake
+         * up all the waiters then go to sleep waiting for more free space,
+         * otherwise try to get some space for this transaction.
+         */
        need_bytes = tic->t_unit_res;
        if (tic->t_flags & XFS_LOG_PERM_RESERV)
                need_bytes *= tic->t_ocnt;
-        /* something is already sleeping; insert new transaction at end */
-        if (!list_empty_careful(&log->l_reserveq)) {
-                spin_lock(&log->l_grant_reserve_lock);
-                /* recheck the queue now we are locked */
-                if (list_empty(&log->l_reserveq)) {
-                        spin_unlock(&log->l_grant_reserve_lock);
-                        goto redo;
-                }
-                list_add_tail(&tic->t_queue, &log->l_reserveq);
-                trace_xfs_log_grant_sleep1(log, tic);
-                /*
-                 * Gotta check this before going to sleep, while we're
-                 * holding the grant lock.
-                 */
-                if (XLOG_FORCED_SHUTDOWN(log))
-                        goto error_return;
-                XFS_STATS_INC(xs_sleep_logspace);
-                xlog_wait(&tic->t_wait, &log->l_grant_reserve_lock);
-                /*
-                 * If we got an error, and the filesystem is shutting down,
-                 * we'll catch it down below. So just continue...
-                 */
-                trace_xfs_log_grant_wake1(log, tic);
-        }
-redo:
-        if (XLOG_FORCED_SHUTDOWN(log))
-                goto error_return_unlocked;
        free_bytes = xlog_space_left(log, &log->l_grant_reserve_head);
-        if (free_bytes < need_bytes) {
+        if (!list_empty_careful(&log->l_reserveq)) {
                spin_lock(&log->l_grant_reserve_lock);
-                if (list_empty(&tic->t_queue))
+                if (!xlog_reserveq_wake(log, &free_bytes) ||
-                        list_add_tail(&tic->t_queue, &log->l_reserveq);
+                    free_bytes < need_bytes)
+                        error = xlog_reserveq_wait(log, tic, need_bytes);
-                trace_xfs_log_grant_sleep2(log, tic);
+                spin_unlock(&log->l_grant_reserve_lock);
+        } else if (free_bytes < need_bytes) {
-                if (XLOG_FORCED_SHUTDOWN(log))
-                        goto error_return;
-                xlog_grant_push_ail(log, need_bytes);
-                XFS_STATS_INC(xs_sleep_logspace);
-                xlog_wait(&tic->t_wait, &log->l_grant_reserve_lock);
-                trace_xfs_log_grant_wake2(log, tic);
-                goto redo;
-        }
-        if (!list_empty(&tic->t_queue)) {
                spin_lock(&log->l_grant_reserve_lock);
-                list_del_init(&tic->t_queue);
+                error = xlog_reserveq_wait(log, tic, need_bytes);
                spin_unlock(&log->l_grant_reserve_lock);
        }
+        if (error)
+                return error;
-        /* we've got enough space */
        xlog_grant_add_space(log, &log->l_grant_reserve_head, need_bytes);
        xlog_grant_add_space(log, &log->l_grant_write_head, need_bytes);
        trace_xfs_log_grant_exit(log, tic);
        xlog_verify_grant_tail(log);
        return 0;
+}
-error_return_unlocked:
-        spin_lock(&log->l_grant_reserve_lock);
-error_return:
-        list_del_init(&tic->t_queue);
-        spin_unlock(&log->l_grant_reserve_lock);
-        trace_xfs_log_grant_error(log, tic);
-        /*
-         * If we are failing, make sure the ticket doesn't have any
-         * current reservations. We don't want to add this back when
-         * the ticket/transaction gets cancelled.
-         */
-        tic->t_curr_res = 0;
-        tic->t_cnt = 0; /* ungrant will give back unit_res * t_cnt. */
-        return XFS_ERROR(EIO);
-}       /* xlog_grant_log_space */
 /*
 * Replenish the byte reservation required by moving the grant write head.
@@ -2605,10 +2667,12 @@ error_return:
 * free fast path.
 */
 STATIC int
-xlog_regrant_write_log_space(xlog_t        *log,
+xlog_regrant_write_log_space(
-                             xlog_ticket_t *tic)
+        struct log              *log,
+        struct xlog_ticket      *tic)
 {
-        int             free_bytes, need_bytes;
+        int                     free_bytes, need_bytes;
+        int                     error = 0;
        tic->t_curr_res = tic->t_unit_res;
        xlog_tic_reset_res(tic);
@@ -2616,104 +2680,38 @@ xlog_regrant_write_log_space(xlog_t	   *log,
        if (tic->t_cnt > 0)
                return 0;
-#ifdef DEBUG
+        ASSERT(!(log->l_flags & XLOG_ACTIVE_RECOVERY));
-        if (log->l_flags & XLOG_ACTIVE_RECOVERY)
-                panic("regrant Recovery problem");
-#endif
        trace_xfs_log_regrant_write_enter(log, tic);
-        if (XLOG_FORCED_SHUTDOWN(log))
-                goto error_return_unlocked;
-        /* If there are other waiters on the queue then give them a
+        /*
-         * chance at logspace before us. Wake up the first waiters,
+         * If there are other waiters on the queue then give them a chance at
-         * if we do not wake up all the waiters then go to sleep waiting
+         * logspace before us.  Wake up the first waiters, if we do not wake
-         * for more free space, otherwise try to get some space for
+         * up all the waiters then go to sleep waiting for more free space,
-         * this transaction.
+         * otherwise try to get some space for this transaction.
         */
        need_bytes = tic->t_unit_res;
-        if (!list_empty_careful(&log->l_writeq)) {
-                struct xlog_ticket *ntic;
-                spin_lock(&log->l_grant_write_lock);
-                free_bytes = xlog_space_left(log, &log->l_grant_write_head);
-                list_for_each_entry(ntic, &log->l_writeq, t_queue) {
-                        ASSERT(ntic->t_flags & XLOG_TIC_PERM_RESERV);
-                        if (free_bytes < ntic->t_unit_res)
-                                break;
-                        free_bytes -= ntic->t_unit_res;
-                        wake_up(&ntic->t_wait);
-                }
-                if (ntic != list_first_entry(&log->l_writeq,
-                                                struct xlog_ticket, t_queue)) {
-                        if (list_empty(&tic->t_queue))
-                                list_add_tail(&tic->t_queue, &log->l_writeq);
-                        trace_xfs_log_regrant_write_sleep1(log, tic);
-                        xlog_grant_push_ail(log, need_bytes);
-                        XFS_STATS_INC(xs_sleep_logspace);
-                        xlog_wait(&tic->t_wait, &log->l_grant_write_lock);
-                        trace_xfs_log_regrant_write_wake1(log, tic);
-                } else
-                        spin_unlock(&log->l_grant_write_lock);
-        }
-redo:
-        if (XLOG_FORCED_SHUTDOWN(log))
-                goto error_return_unlocked;
        free_bytes = xlog_space_left(log, &log->l_grant_write_head);
-        if (free_bytes < need_bytes) {
+        if (!list_empty_careful(&log->l_writeq)) {
                spin_lock(&log->l_grant_write_lock);
-                if (list_empty(&tic->t_queue))
+                if (!xlog_writeq_wake(log, &free_bytes) ||
-                        list_add_tail(&tic->t_queue, &log->l_writeq);
+                    free_bytes < need_bytes)
+                        error = xlog_writeq_wait(log, tic, need_bytes);
-                if (XLOG_FORCED_SHUTDOWN(log))
+                spin_unlock(&log->l_grant_write_lock);
-                        goto error_return;
+        } else if (free_bytes < need_bytes) {
-                xlog_grant_push_ail(log, need_bytes);
-                XFS_STATS_INC(xs_sleep_logspace);
-                trace_xfs_log_regrant_write_sleep2(log, tic);
-                xlog_wait(&tic->t_wait, &log->l_grant_write_lock);
-                trace_xfs_log_regrant_write_wake2(log, tic);
-                goto redo;
-        }
-        if (!list_empty(&tic->t_queue)) {
                spin_lock(&log->l_grant_write_lock);
-                list_del_init(&tic->t_queue);
+                error = xlog_writeq_wait(log, tic, need_bytes);
                spin_unlock(&log->l_grant_write_lock);
        }
-        /* we've got enough space */
+        if (error)
+                return error;
        xlog_grant_add_space(log, &log->l_grant_write_head, need_bytes);
        trace_xfs_log_regrant_write_exit(log, tic);
        xlog_verify_grant_tail(log);
        return 0;
+}
- error_return_unlocked:
-        spin_lock(&log->l_grant_write_lock);
- error_return:
-        list_del_init(&tic->t_queue);
-        spin_unlock(&log->l_grant_write_lock);
-        trace_xfs_log_regrant_write_error(log, tic);
-        /*
-         * If we are failing, make sure the ticket doesn't have any
-         * current reservations. We don't want to add this back when
-         * the ticket/transaction gets cancelled.
-         */
-        tic->t_curr_res = 0;
-        tic->t_cnt = 0; /* ungrant will give back unit_res * t_cnt. */
-        return XFS_ERROR(EIO);
-}       /* xlog_regrant_write_log_space */
 /* The first cnt-1 times through here we don't need to
 * move the grant write head because the permanent
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index f1d2802b2f07..494035798873 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -834,18 +834,14 @@ DEFINE_LOGGRANT_EVENT(xfs_log_umount_write);
 DEFINE_LOGGRANT_EVENT(xfs_log_grant_enter);
 DEFINE_LOGGRANT_EVENT(xfs_log_grant_exit);
 DEFINE_LOGGRANT_EVENT(xfs_log_grant_error);
-DEFINE_LOGGRANT_EVENT(xfs_log_grant_sleep1);
+DEFINE_LOGGRANT_EVENT(xfs_log_grant_sleep);
-DEFINE_LOGGRANT_EVENT(xfs_log_grant_wake1);
+DEFINE_LOGGRANT_EVENT(xfs_log_grant_wake);
-DEFINE_LOGGRANT_EVENT(xfs_log_grant_sleep2);
-DEFINE_LOGGRANT_EVENT(xfs_log_grant_wake2);
 DEFINE_LOGGRANT_EVENT(xfs_log_grant_wake_up);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_enter);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_exit);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_error);
-DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_sleep1);
+DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_sleep);
-DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_wake1);
+DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_wake);
-DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_sleep2);
-DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_wake2);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_write_wake_up);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_reserve_enter);
 DEFINE_LOGGRANT_EVENT(xfs_log_regrant_reserve_exit);
diff --git a/include/asm-generic/unistd.h b/include/asm-generic/unistd.h
index f4c38d8c6674..2292d1af9d70 100644
--- a/include/asm-generic/unistd.h
+++ b/include/asm-generic/unistd.h
@@ -685,9 +685,15 @@ __SYSCALL(__NR_syncfs, sys_syncfs)
 __SYSCALL(__NR_setns, sys_setns)
 #define __NR_sendmmsg 269
 __SC_COMP(__NR_sendmmsg, sys_sendmmsg, compat_sys_sendmmsg)
+#define __NR_process_vm_readv 270
+__SC_COMP(__NR_process_vm_readv, sys_process_vm_readv, \
+          compat_sys_process_vm_readv)
+#define __NR_process_vm_writev 271
+__SC_COMP(__NR_process_vm_writev, sys_process_vm_writev, \
+          compat_sys_process_vm_writev)
 #undef __NR_syscalls
-#define __NR_syscalls 270
+#define __NR_syscalls 272
 /*
 * All syscalls below here should go away really,
diff --git a/include/linux/amd-iommu.h b/include/linux/amd-iommu.h
index a6863a2dec1f..06688c42167d 100644
--- a/include/linux/amd-iommu.h
+++ b/include/linux/amd-iommu.h
@@ -20,12 +20,105 @@
 #ifndef _ASM_X86_AMD_IOMMU_H
 #define _ASM_X86_AMD_IOMMU_H
-#include <linux/irqreturn.h>
+#include <linux/types.h>
 #ifdef CONFIG_AMD_IOMMU
+struct task_struct;
+struct pci_dev;
 extern int amd_iommu_detect(void);
+/**
+ * amd_iommu_enable_device_erratum() - Enable erratum workaround for device
+ *                                     in the IOMMUv2 driver
+ * @pdev: The PCI device the workaround is necessary for
+ * @erratum: The erratum workaround to enable
+ *
+ * The function needs to be called before amd_iommu_init_device().
+ * Possible values for the erratum number are for now:
+ * - AMD_PRI_DEV_ERRATUM_ENABLE_RESET - Reset PRI capability when PRI
+ *                                      is enabled
+ * - AMD_PRI_DEV_ERRATUM_LIMIT_REQ_ONE - Limit number of outstanding PRI
+ *                                       requests to one
+ */
+#define AMD_PRI_DEV_ERRATUM_ENABLE_RESET                0
+#define AMD_PRI_DEV_ERRATUM_LIMIT_REQ_ONE               1
+extern void amd_iommu_enable_device_erratum(struct pci_dev *pdev, u32 erratum);
+/**
+ * amd_iommu_init_device() - Init device for use with IOMMUv2 driver
+ * @pdev: The PCI device to initialize
+ * @pasids: Number of PASIDs to support for this device
+ *
+ * This function does all setup for the device pdev so that it can be
+ * used with IOMMUv2.
+ * Returns 0 on success or negative value on error.
+ */
+extern int amd_iommu_init_device(struct pci_dev *pdev, int pasids);
+/**
+ * amd_iommu_free_device() - Free all IOMMUv2 related device resources
+ *                           and disable IOMMUv2 usage for this device
+ * @pdev: The PCI device to disable IOMMUv2 usage for'
+ */
+extern void amd_iommu_free_device(struct pci_dev *pdev);
+/**
+ * amd_iommu_bind_pasid() - Bind a given task to a PASID on a device
+ * @pdev: The PCI device to bind the task to
+ * @pasid: The PASID on the device the task should be bound to
+ * @task: the task to bind
+ *
+ * The function returns 0 on success or a negative value on error.
+ */
+extern int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid,
+                                struct task_struct *task);
+/**
+ * amd_iommu_unbind_pasid() - Unbind a PASID from its task on
+ *                            a device
+ * @pdev: The device of the PASID
+ * @pasid: The PASID to unbind
+ *
+ * When this function returns the device is no longer using the PASID
+ * and the PASID is no longer bound to its task.
+ */
+extern void amd_iommu_unbind_pasid(struct pci_dev *pdev, int pasid);
+/**
+ * amd_iommu_set_invalid_ppr_cb() - Register a call-back for failed
+ *                                  PRI requests
+ * @pdev: The PCI device the call-back should be registered for
+ * @cb: The call-back function
+ *
+ * The IOMMUv2 driver invokes this call-back when it is unable to
+ * successfully handle a PRI request. The device driver can then decide
+ * which PRI response the device should see. Possible return values for
+ * the call-back are:
+ *
+ * - AMD_IOMMU_INV_PRI_RSP_SUCCESS - Send SUCCESS back to the device
+ * - AMD_IOMMU_INV_PRI_RSP_INVALID - Send INVALID back to the device
+ * - AMD_IOMMU_INV_PRI_RSP_FAIL    - Send Failure back to the device,
+ *                                   the device is required to disable
+ *                                   PRI when it receives this response
+ *
+ * The function returns 0 on success or negative value on error.
+ */
+#define AMD_IOMMU_INV_PRI_RSP_SUCCESS   0
+#define AMD_IOMMU_INV_PRI_RSP_INVALID   1
+#define AMD_IOMMU_INV_PRI_RSP_FAIL      2
+typedef int (*amd_iommu_invalid_ppr_cb)(struct pci_dev *pdev,
+                                        int pasid,
+                                        unsigned long address,
+                                        u16);
+extern int amd_iommu_set_invalid_ppr_cb(struct pci_dev *pdev,
+                                        amd_iommu_invalid_ppr_cb cb);
 #else
 static inline int amd_iommu_detect(void) { return -ENODEV; }
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 154bf5683015..66ed067fb729 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -552,5 +552,14 @@ extern ssize_t compat_rw_copy_check_uvector(int type,
 extern void __user *compat_alloc_user_space(unsigned long len);
+asmlinkage ssize_t compat_sys_process_vm_readv(compat_pid_t pid,
+                const struct compat_iovec __user *lvec,
+                unsigned long liovcnt, const struct compat_iovec __user *rvec,
+                unsigned long riovcnt, unsigned long flags);
+asmlinkage ssize_t compat_sys_process_vm_writev(compat_pid_t pid,
+                const struct compat_iovec __user *lvec,
+                unsigned long liovcnt, const struct compat_iovec __user *rvec,
+                unsigned long riovcnt, unsigned long flags);
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 4df926199369..ed9f74f6c519 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -339,7 +339,8 @@ extern int d_validate(struct dentry *, struct dentry *);
 */
 extern char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
-extern char *__d_path(const struct path *path, struct path *root, char *, int);
+extern char *__d_path(const struct path *, const struct path *, char *, int);
+extern char *d_absolute_path(const struct path *, char *, int);
 extern char *d_path(const struct path *, char *, int);
 extern char *d_path_with_unreachable(const struct path *, char *, int);
 extern char *dentry_path_raw(struct dentry *, char *, int);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e3130220ce3e..e0bc4ffb8e7f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -393,8 +393,8 @@ struct inodes_stat_t {
 #include <linux/semaphore.h>
 #include <linux/fiemap.h>
 #include <linux/rculist_bl.h>
-#include <linux/shrinker.h>
 #include <linux/atomic.h>
+#include <linux/shrinker.h>
 #include <asm/byteorder.h>
@@ -1942,6 +1942,7 @@ extern int fd_statfs(int, struct kstatfs *);
 extern int statfs_by_dentry(struct dentry *, struct kstatfs *);
 extern int freeze_super(struct super_block *super);
 extern int thaw_super(struct super_block *super);
+extern bool our_mnt(struct vfsmount *mnt);
 extern int current_umask(void);
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 96efa6794ea5..c3da42dd22ba 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -172,6 +172,7 @@ enum {
        TRACE_EVENT_FL_FILTERED_BIT,
        TRACE_EVENT_FL_RECORDED_CMD_BIT,
        TRACE_EVENT_FL_CAP_ANY_BIT,
+        TRACE_EVENT_FL_NO_SET_FILTER_BIT,
 };
 enum {
@@ -179,6 +180,7 @@ enum {
        TRACE_EVENT_FL_FILTERED         = (1 << TRACE_EVENT_FL_FILTERED_BIT),
        TRACE_EVENT_FL_RECORDED_CMD     = (1 << TRACE_EVENT_FL_RECORDED_CMD_BIT),
        TRACE_EVENT_FL_CAP_ANY          = (1 << TRACE_EVENT_FL_CAP_ANY_BIT),
+        TRACE_EVENT_FL_NO_SET_FILTER    = (1 << TRACE_EVENT_FL_NO_SET_FILTER_BIT),
 };
 struct ftrace_event_call {
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index 94b1e356c02a..32574eef9394 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -126,6 +126,8 @@ extern struct cred init_cred;
 # define INIT_PERF_EVENTS(tsk)
 #endif
+#define INIT_TASK_COMM "swapper"
 /*
 *  INIT_TASK is used to set up the first task table, touch at
 * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -162,7 +164,7 @@ extern struct cred init_cred;
        .group_leader   = &tsk,                                         \
        RCU_INIT_POINTER(.real_cred, &init_cred),                       \
        RCU_INIT_POINTER(.cred, &init_cred),                            \
-        .comm           = "swapper",                                    \
+        .comm           = INIT_TASK_COMM,                               \
        .thread         = INIT_THREAD,                                  \
        .fs             = &init_fs,                                     \
        .files          = &init_files,                                  \
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 432acc4c054d..cc26f89c4ee6 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -48,19 +48,33 @@ struct iommu_domain {
 #ifdef CONFIG_IOMMU_API
+/**
+ * struct iommu_ops - iommu ops and capabilities
+ * @domain_init: init iommu domain
+ * @domain_destroy: destroy iommu domain
+ * @attach_dev: attach device to an iommu domain
+ * @detach_dev: detach device from an iommu domain
+ * @map: map a physically contiguous memory region to an iommu domain
+ * @unmap: unmap a physically contiguous memory region from an iommu domain
+ * @iova_to_phys: translate iova to physical address
+ * @domain_has_cap: domain capabilities query
+ * @commit: commit iommu domain
+ * @pgsize_bitmap: bitmap of supported page sizes
+ */
 struct iommu_ops {
        int (*domain_init)(struct iommu_domain *domain);
        void (*domain_destroy)(struct iommu_domain *domain);
        int (*attach_dev)(struct iommu_domain *domain, struct device *dev);
        void (*detach_dev)(struct iommu_domain *domain, struct device *dev);
        int (*map)(struct iommu_domain *domain, unsigned long iova,
-                   phys_addr_t paddr, int gfp_order, int prot);
+                   phys_addr_t paddr, size_t size, int prot);
-        int (*unmap)(struct iommu_domain *domain, unsigned long iova,
+        size_t (*unmap)(struct iommu_domain *domain, unsigned long iova,
-                     int gfp_order);
+                     size_t size);
        phys_addr_t (*iova_to_phys)(struct iommu_domain *domain,
                                    unsigned long iova);
        int (*domain_has_cap)(struct iommu_domain *domain,
                              unsigned long cap);
+        unsigned long pgsize_bitmap;
 };
 extern int bus_set_iommu(struct bus_type *bus, struct iommu_ops *ops);
@@ -72,9 +86,9 @@ extern int iommu_attach_device(struct iommu_domain *domain,
 extern void iommu_detach_device(struct iommu_domain *domain,
                                struct device *dev);
 extern int iommu_map(struct iommu_domain *domain, unsigned long iova,
-                     phys_addr_t paddr, int gfp_order, int prot);
+                     phys_addr_t paddr, size_t size, int prot);
-extern int iommu_unmap(struct iommu_domain *domain, unsigned long iova,
+extern size_t iommu_unmap(struct iommu_domain *domain, unsigned long iova,
-                       int gfp_order);
+                       size_t size);
 extern phys_addr_t iommu_iova_to_phys(struct iommu_domain *domain,
                                      unsigned long iova);
 extern int iommu_domain_has_cap(struct iommu_domain *domain,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3dc3a8c2c485..4baadd18f4ad 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -10,6 +10,7 @@
 #include <linux/mmzone.h>
 #include <linux/rbtree.h>
 #include <linux/prio_tree.h>
+#include <linux/atomic.h>
 #include <linux/debug_locks.h>
 #include <linux/mm_types.h>
 #include <linux/range.h>
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 172ba70306d1..2aaee0ca9da8 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -517,8 +517,12 @@
 #define PCI_DEVICE_ID_AMD_11H_NB_DRAM   0x1302
 #define PCI_DEVICE_ID_AMD_11H_NB_MISC   0x1303
 #define PCI_DEVICE_ID_AMD_11H_NB_LINK   0x1304
+#define PCI_DEVICE_ID_AMD_15H_NB_F0     0x1600
+#define PCI_DEVICE_ID_AMD_15H_NB_F1     0x1601
+#define PCI_DEVICE_ID_AMD_15H_NB_F2     0x1602
 #define PCI_DEVICE_ID_AMD_15H_NB_F3     0x1603
 #define PCI_DEVICE_ID_AMD_15H_NB_F4     0x1604
+#define PCI_DEVICE_ID_AMD_15H_NB_F5     0x1605
 #define PCI_DEVICE_ID_AMD_CNB17H_F3     0x1703
 #define PCI_DEVICE_ID_AMD_LANCE         0x2000
 #define PCI_DEVICE_ID_AMD_LANCE_HOME    0x2001
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 1e9ebe5e0091..b1f89122bf6a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -822,6 +822,7 @@ struct perf_event {
        int                             mmap_locked;
        struct user_struct              *mmap_user;
        struct ring_buffer              *rb;
+        struct list_head                rb_entry;
        /* poll related */
        wait_queue_head_t               waitq;
diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h
index a83833a1f7a2..07ceb97d53fa 100644
--- a/include/linux/shrinker.h
+++ b/include/linux/shrinker.h
@@ -35,7 +35,7 @@ struct shrinker {
        /* These are for internal use */
        struct list_head list;
-        long nr;        /* objs pending delete */
+        atomic_long_t nr_in_batch; /* objs pending delete */
 };
 #define DEFAULT_SEEKS 2 /* A good number if you don't know better. */
 extern void register_shrinker(struct shrinker *);
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 7f5fed3c89e1..6873c7dd9145 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -103,9 +103,10 @@ enum se_cmd_flags_table {
        SCF_SCSI_NON_DATA_CDB           = 0x00000040,
        SCF_SCSI_CDB_EXCEPTION          = 0x00000080,
        SCF_SCSI_RESERVATION_CONFLICT   = 0x00000100,
-        SCF_SE_CMD_FAILED               = 0x00000400,
+        SCF_FUA                         = 0x00000200,
        SCF_SE_LUN_CMD                  = 0x00000800,
        SCF_SE_ALLOW_EOO                = 0x00001000,
+        SCF_BIDI                        = 0x00002000,
        SCF_SENT_CHECK_CONDITION        = 0x00004000,
        SCF_OVERFLOW_BIT                = 0x00008000,
        SCF_UNDERFLOW_BIT               = 0x00010000,
@@ -154,6 +155,7 @@ enum tcm_sense_reason_table {
        TCM_CHECK_CONDITION_ABORT_CMD           = 0x0d,
        TCM_CHECK_CONDITION_UNIT_ATTENTION      = 0x0e,
        TCM_CHECK_CONDITION_NOT_READY           = 0x0f,
+        TCM_RESERVATION_CONFLICT                = 0x10,
 };
 struct se_obj {
@@ -211,7 +213,6 @@ struct t10_alua_lu_gp {
        u16     lu_gp_id;
        int     lu_gp_valid_id;
        u32     lu_gp_members;
-        atomic_t lu_gp_shutdown;
        atomic_t lu_gp_ref_cnt;
        spinlock_t lu_gp_lock;
        struct config_group lu_gp_group;
@@ -422,11 +423,9 @@ struct se_cmd {
        int                     sam_task_attr;
        /* Transport protocol dependent state, see transport_state_table */
        enum transport_state_table t_state;
-        /* Transport specific error status */
-        int                     transport_error_status;
        /* Used to signal cmd->se_tfo->check_release_cmd() usage per cmd */
-        int                     check_release:1;
+        unsigned                check_release:1;
-        int                     cmd_wait_set:1;
+        unsigned                cmd_wait_set:1;
        /* See se_cmd_flags_table */
        u32                     se_cmd_flags;
        u32                     se_ordered_id;
@@ -441,13 +440,10 @@ struct se_cmd {
        /* Used for sense data */
        void                    *sense_buffer;
        struct list_head        se_delayed_node;
-        struct list_head        se_ordered_node;
        struct list_head        se_lun_node;
        struct list_head        se_qf_node;
        struct se_device      *se_dev;
        struct se_dev_entry   *se_deve;
-        struct se_device        *se_obj_ptr;
-        struct se_device        *se_orig_obj_ptr;
        struct se_lun           *se_lun;
        /* Only used for internal passthrough and legacy TCM fabric modules */
        struct se_session       *se_sess;
@@ -463,8 +459,6 @@ struct se_cmd {
        unsigned char           __t_task_cdb[TCM_MAX_COMMAND_SIZE];
        unsigned long long      t_task_lba;
        int                     t_tasks_failed;
-        int                     t_tasks_fua;
-        bool                    t_tasks_bidi;
        u32                     t_tasks_sg_chained_no;
        atomic_t                t_fe_count;
        atomic_t                t_se_count;
@@ -489,14 +483,6 @@ struct se_cmd {
        struct work_struct      work;
-        /*
-         * Used for pre-registered fabric SGL passthrough WRITE and READ
-         * with the special SCF_PASSTHROUGH_CONTIG_TO_SG case for TCM_Loop
-         * and other HW target mode fabric modules.
-         */
-        struct scatterlist      *t_task_pt_sgl;
-        u32                     t_task_pt_sgl_num;
        struct scatterlist      *t_data_sg;
        unsigned int            t_data_nents;
        struct scatterlist      *t_bidi_data_sg;
@@ -562,7 +548,7 @@ struct se_node_acl {
 } ____cacheline_aligned;
 struct se_session {
-        int                     sess_tearing_down:1;
+        unsigned                sess_tearing_down:1;
        u64                     sess_bin_isid;
        struct se_node_acl      *se_node_acl;
        struct se_portal_group *se_tpg;
@@ -683,7 +669,6 @@ struct se_subsystem_dev {
        struct t10_reservation t10_pr;
        spinlock_t      se_dev_lock;
        void            *se_dev_su_ptr;
-        struct list_head se_dev_node;
        struct config_group se_dev_group;
        /* For T10 Reservations */
        struct config_group se_dev_pr_group;
@@ -692,9 +677,6 @@ struct se_subsystem_dev {
 } ____cacheline_aligned;
 struct se_device {
-        /* Set to 1 if thread is NOT sleeping on thread_sem */
-        u8                      thread_active;
-        u8                      dev_status_timer_flags;
        /* RELATIVE TARGET PORT IDENTIFER Counter */
        u16                     dev_rpti_counter;
        /* Used for SAM Task Attribute ordering */
@@ -719,14 +701,10 @@ struct se_device {
        u64                     write_bytes;
        spinlock_t              stats_lock;
        /* Active commands on this virtual SE device */
-        atomic_t                active_cmds;
        atomic_t                simple_cmds;
        atomic_t                depth_left;
        atomic_t                dev_ordered_id;
-        atomic_t                dev_tur_active;
        atomic_t                execute_tasks;
-        atomic_t                dev_status_thr_count;
-        atomic_t                dev_hoq_count;
        atomic_t                dev_ordered_sync;
        atomic_t                dev_qf_count;
        struct se_obj           dev_obj;
@@ -734,14 +712,9 @@ struct se_device {
        struct se_obj           dev_export_obj;
        struct se_queue_obj     dev_queue_obj;
        spinlock_t              delayed_cmd_lock;
-        spinlock_t              ordered_cmd_lock;
        spinlock_t              execute_task_lock;
-        spinlock_t              state_task_lock;
-        spinlock_t              dev_alua_lock;
        spinlock_t              dev_reservation_lock;
-        spinlock_t              dev_state_lock;
        spinlock_t              dev_status_lock;
-        spinlock_t              dev_status_thr_lock;
        spinlock_t              se_port_lock;
        spinlock_t              se_tmr_lock;
        spinlock_t              qf_cmd_lock;
@@ -753,14 +726,10 @@ struct se_device {
        struct t10_pr_registration *dev_pr_res_holder;
        struct list_head        dev_sep_list;
        struct list_head        dev_tmr_list;
-        struct timer_list       dev_status_timer;
        /* Pointer to descriptor for processing thread */
        struct task_struct      *process_thread;
-        pid_t                   process_thread_pid;
-        struct task_struct              *dev_mgmt_thread;
        struct work_struct      qf_work_queue;
        struct list_head        delayed_cmd_list;
-        struct list_head        ordered_cmd_list;
        struct list_head        execute_task_list;
        struct list_head        state_task_list;
        struct list_head        qf_cmd_list;
@@ -771,8 +740,6 @@ struct se_device {
        struct se_subsystem_api *transport;
        /* Linked list for struct se_hba struct se_device list */
        struct list_head        dev_list;
-        /* Linked list for struct se_global->g_se_dev_list */
-        struct list_head        g_se_dev_list;
 }  ____cacheline_aligned;
 struct se_hba {
@@ -834,7 +801,6 @@ struct se_port {
        u32             sep_index;
        struct scsi_port_stats sep_stats;
        /* Used for ALUA Target Port Groups membership */
-        atomic_t        sep_tg_pt_gp_active;
        atomic_t        sep_tg_pt_secondary_offline;
        /* Used for PR ALL_TG_PT=1 */
        atomic_t        sep_tg_pt_ref_cnt;
diff --git a/include/target/target_core_transport.h b/include/target/target_core_transport.h
index c16e9431dd01..dac4f2d859fd 100644
--- a/include/target/target_core_transport.h
+++ b/include/target/target_core_transport.h
@@ -10,29 +10,6 @@
 #define PYX_TRANSPORT_STATUS_INTERVAL           5 /* In seconds */
-#define PYX_TRANSPORT_SENT_TO_TRANSPORT         0
-#define PYX_TRANSPORT_WRITE_PENDING             1
-#define PYX_TRANSPORT_UNKNOWN_SAM_OPCODE        -1
-#define PYX_TRANSPORT_HBA_QUEUE_FULL            -2
-#define PYX_TRANSPORT_REQ_TOO_MANY_SECTORS      -3
-#define PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES   -4
-#define PYX_TRANSPORT_INVALID_CDB_FIELD         -5
-#define PYX_TRANSPORT_INVALID_PARAMETER_LIST    -6
-#define PYX_TRANSPORT_LU_COMM_FAILURE           -7
-#define PYX_TRANSPORT_UNKNOWN_MODE_PAGE         -8
-#define PYX_TRANSPORT_WRITE_PROTECTED           -9
-#define PYX_TRANSPORT_RESERVATION_CONFLICT      -10
-#define PYX_TRANSPORT_ILLEGAL_REQUEST           -11
-#define PYX_TRANSPORT_USE_SENSE_REASON          -12
-#ifndef SAM_STAT_RESERVATION_CONFLICT
-#define SAM_STAT_RESERVATION_CONFLICT           0x18
-#endif
-#define TRANSPORT_PLUGIN_FREE                   0
-#define TRANSPORT_PLUGIN_REGISTERED             1
 #define TRANSPORT_PLUGIN_PHBA_PDEV              1
 #define TRANSPORT_PLUGIN_VHBA_PDEV              2
 #define TRANSPORT_PLUGIN_VHBA_VDEV              3
@@ -158,7 +135,6 @@ extern int transport_generic_allocate_tasks(struct se_cmd *, unsigned char *);
 extern int transport_handle_cdb_direct(struct se_cmd *);
 extern int transport_generic_handle_cdb_map(struct se_cmd *);
 extern int transport_generic_handle_data(struct se_cmd *);
-extern void transport_new_cmd_failure(struct se_cmd *);
 extern int transport_generic_handle_tmr(struct se_cmd *);
 extern bool target_stop_task(struct se_task *task, unsigned long *flags);
 extern int transport_generic_map_mem_to_cmd(struct se_cmd *cmd, struct scatterlist *, u32,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 0e8457da6f95..d3b9df5962c2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -185,6 +185,9 @@ static void cpu_ctx_sched_in(struct perf_cpu_context *cpuctx,
 static void update_context_time(struct perf_event_context *ctx);
 static u64 perf_event_time(struct perf_event *event);
+static void ring_buffer_attach(struct perf_event *event,
+                               struct ring_buffer *rb);
 void __weak perf_event_print_debug(void)        { }
 extern __weak const char *perf_pmu_name(void)
@@ -2171,9 +2174,10 @@ static void perf_event_context_sched_in(struct perf_event_context *ctx,
         */
        cpu_ctx_sched_out(cpuctx, EVENT_FLEXIBLE);
-        perf_event_sched_in(cpuctx, ctx, task);
+        if (ctx->nr_events)
+                cpuctx->task_ctx = ctx;
-        cpuctx->task_ctx = ctx;
+        perf_event_sched_in(cpuctx, cpuctx->task_ctx, task);
        perf_pmu_enable(ctx->pmu);
        perf_ctx_unlock(cpuctx, ctx);
@@ -3190,12 +3194,33 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
        struct ring_buffer *rb;
        unsigned int events = POLL_HUP;
+        /*
+         * Race between perf_event_set_output() and perf_poll(): perf_poll()
+         * grabs the rb reference but perf_event_set_output() overrides it.
+         * Here is the timeline for two threads T1, T2:
+         * t0: T1, rb = rcu_dereference(event->rb)
+         * t1: T2, old_rb = event->rb
+         * t2: T2, event->rb = new rb
+         * t3: T2, ring_buffer_detach(old_rb)
+         * t4: T1, ring_buffer_attach(rb1)
+         * t5: T1, poll_wait(event->waitq)
+         *
+         * To avoid this problem, we grab mmap_mutex in perf_poll()
+         * thereby ensuring that the assignment of the new ring buffer
+         * and the detachment of the old buffer appear atomic to perf_poll()
+         */
+        mutex_lock(&event->mmap_mutex);
        rcu_read_lock();
        rb = rcu_dereference(event->rb);
-        if (rb)
+        if (rb) {
+                ring_buffer_attach(event, rb);
                events = atomic_xchg(&rb->poll, 0);
+        }
        rcu_read_unlock();
+        mutex_unlock(&event->mmap_mutex);
        poll_wait(file, &event->waitq, wait);
        return events;
@@ -3496,6 +3521,49 @@ unlock:
        return ret;
 }
+static void ring_buffer_attach(struct perf_event *event,
+                               struct ring_buffer *rb)
+{
+        unsigned long flags;
+        if (!list_empty(&event->rb_entry))
+                return;
+        spin_lock_irqsave(&rb->event_lock, flags);
+        if (!list_empty(&event->rb_entry))
+                goto unlock;
+        list_add(&event->rb_entry, &rb->event_list);
+unlock:
+        spin_unlock_irqrestore(&rb->event_lock, flags);
+}
+static void ring_buffer_detach(struct perf_event *event,
+                               struct ring_buffer *rb)
+{
+        unsigned long flags;
+        if (list_empty(&event->rb_entry))
+                return;
+        spin_lock_irqsave(&rb->event_lock, flags);
+        list_del_init(&event->rb_entry);
+        wake_up_all(&event->waitq);
+        spin_unlock_irqrestore(&rb->event_lock, flags);
+}
+static void ring_buffer_wakeup(struct perf_event *event)
+{
+        struct ring_buffer *rb;
+        rcu_read_lock();
+        rb = rcu_dereference(event->rb);
+        list_for_each_entry_rcu(event, &rb->event_list, rb_entry) {
+                wake_up_all(&event->waitq);
+        }
+        rcu_read_unlock();
+}
 static void rb_free_rcu(struct rcu_head *rcu_head)
 {
        struct ring_buffer *rb;
@@ -3521,9 +3589,19 @@ static struct ring_buffer *ring_buffer_get(struct perf_event *event)
 static void ring_buffer_put(struct ring_buffer *rb)
 {
+        struct perf_event *event, *n;
+        unsigned long flags;
        if (!atomic_dec_and_test(&rb->refcount))
                return;
+        spin_lock_irqsave(&rb->event_lock, flags);
+        list_for_each_entry_safe(event, n, &rb->event_list, rb_entry) {
+                list_del_init(&event->rb_entry);
+                wake_up_all(&event->waitq);
+        }
+        spin_unlock_irqrestore(&rb->event_lock, flags);
        call_rcu(&rb->rcu_head, rb_free_rcu);
 }
@@ -3546,6 +3624,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
                atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm);
                vma->vm_mm->pinned_vm -= event->mmap_locked;
                rcu_assign_pointer(event->rb, NULL);
+                ring_buffer_detach(event, rb);
                mutex_unlock(&event->mmap_mutex);
                ring_buffer_put(rb);
@@ -3700,7 +3779,7 @@ static const struct file_operations perf_fops = {
 void perf_event_wakeup(struct perf_event *event)
 {
-        wake_up_all(&event->waitq);
+        ring_buffer_wakeup(event);
        if (event->pending_kill) {
                kill_fasync(&event->fasync, SIGIO, event->pending_kill);
@@ -5822,6 +5901,8 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
        INIT_LIST_HEAD(&event->group_entry);
        INIT_LIST_HEAD(&event->event_entry);
        INIT_LIST_HEAD(&event->sibling_list);
+        INIT_LIST_HEAD(&event->rb_entry);
        init_waitqueue_head(&event->waitq);
        init_irq_work(&event->pending, perf_pending_event);
@@ -6028,6 +6109,8 @@ set:
        old_rb = event->rb;
        rcu_assign_pointer(event->rb, rb);
+        if (old_rb)
+                ring_buffer_detach(event, old_rb);
        ret = 0;
 unlock:
        mutex_unlock(&event->mmap_mutex);
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index 09097dd8116c..64568a699375 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -22,6 +22,9 @@ struct ring_buffer {
        local_t                         lost;           /* nr records lost   */
        long                            watermark;      /* wakeup watermark  */
+        /* poll crap */
+        spinlock_t                      event_lock;
+        struct list_head                event_list;
        struct perf_event_mmap_page     *user_page;
        void                            *data_pages[0];
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index a2a29205cc0f..7f3011c6b57f 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -209,6 +209,9 @@ ring_buffer_init(struct ring_buffer *rb, long watermark, int flags)
                rb->writable = 1;
        atomic_set(&rb->refcount, 1);
+        INIT_LIST_HEAD(&rb->event_list);
+        spin_lock_init(&rb->event_lock);
 }
 #ifndef CONFIG_PERF_USE_VMALLOC
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 0e2b179bc7b3..1da999f5e746 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -623,8 +623,9 @@ static irqreturn_t irq_nested_primary_handler(int irq, void *dev_id)
 static int irq_wait_for_interrupt(struct irqaction *action)
 {
+        set_current_state(TASK_INTERRUPTIBLE);
        while (!kthread_should_stop()) {
-                set_current_state(TASK_INTERRUPTIBLE);
                if (test_and_clear_bit(IRQTF_RUNTHREAD,
                                       &action->thread_flags)) {
@@ -632,7 +633,9 @@ static int irq_wait_for_interrupt(struct irqaction *action)
                        return 0;
                }
                schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
        }
+        __set_current_state(TASK_RUNNING);
        return -1;
 }
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index bbdfe2a462a0..66ff7109f697 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -66,8 +66,9 @@ void jump_label_inc(struct jump_label_key *key)
                return;
        jump_label_lock();
-        if (atomic_add_return(1, &key->enabled) == 1)
+        if (atomic_read(&key->enabled) == 0)
                jump_label_update(key, JUMP_LABEL_ENABLE);
+        atomic_inc(&key->enabled);
        jump_label_unlock();
 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index e69434b070da..b2e08c932d91 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -44,6 +44,7 @@
 #include <linux/stringify.h>
 #include <linux/bitops.h>
 #include <linux/gfp.h>
+#include <linux/kmemcheck.h>
 #include <asm/sections.h>
@@ -2948,7 +2949,12 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
                      struct lock_class_key *key, int subclass)
 {
-        memset(lock, 0, sizeof(*lock));
+        int i;
+        kmemcheck_mark_initialized(lock, sizeof(*lock));
+        for (i = 0; i < NR_LOCKDEP_CACHING_CLASSES; i++)
+                lock->class_cache[i] = NULL;
 #ifdef CONFIG_LOCK_STAT
        lock->cpu = raw_smp_processor_id();
diff --git a/kernel/printk.c b/kernel/printk.c
index 1455a0d4eedd..7982a0a841ea 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1293,10 +1293,11 @@ again:
        raw_spin_lock(&logbuf_lock);
        if (con_start != log_end)
                retry = 1;
+        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
        if (retry && console_trylock())
                goto again;
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
        if (wake_klogd)
                wake_up_klogd();
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index 0e9344a71be3..d6b149ccf925 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -71,6 +71,7 @@
 #include <linux/ctype.h>
 #include <linux/ftrace.h>
 #include <linux/slab.h>
+#include <linux/init_task.h>
 #include <asm/tlb.h>
 #include <asm/irq_regs.h>
@@ -4810,6 +4811,9 @@ EXPORT_SYMBOL(wait_for_completion);
 * This waits for either a completion of a specific task to be signaled or for a
 * specified timeout to expire. The timeout is in jiffies. It is not
 * interruptible.
+ *
+ * The return value is 0 if timed out, and positive (at least 1, or number of
+ * jiffies left till timeout) if completed.
 */
 unsigned long __sched
 wait_for_completion_timeout(struct completion *x, unsigned long timeout)
@@ -4824,6 +4828,8 @@ EXPORT_SYMBOL(wait_for_completion_timeout);
 *
 * This waits for completion of a specific task to be signaled. It is
 * interruptible.
+ *
+ * The return value is -ERESTARTSYS if interrupted, 0 if completed.
 */
 int __sched wait_for_completion_interruptible(struct completion *x)
 {
@@ -4841,6 +4847,9 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
 *
 * This waits for either a completion of a specific task to be signaled or for a
 * specified timeout to expire. It is interruptible. The timeout is in jiffies.
+ *
+ * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
+ * positive (at least 1, or number of jiffies left till timeout) if completed.
 */
 long __sched
 wait_for_completion_interruptible_timeout(struct completion *x,
@@ -4856,6 +4865,8 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
 *
 * This waits to be signaled for completion of a specific task. It can be
 * interrupted by a kill signal.
+ *
+ * The return value is -ERESTARTSYS if interrupted, 0 if completed.
 */
 int __sched wait_for_completion_killable(struct completion *x)
 {
@@ -4874,6 +4885,9 @@ EXPORT_SYMBOL(wait_for_completion_killable);
 * This waits for either a completion of a specific task to be
 * signaled or for a specified timeout to expire. It can be
 * interrupted by a kill signal. The timeout is in jiffies.
+ *
+ * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
+ * positive (at least 1, or number of jiffies left till timeout) if completed.
 */
 long __sched
 wait_for_completion_killable_timeout(struct completion *x,
@@ -6099,6 +6113,9 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
         */
        idle->sched_class = &idle_sched_class;
        ftrace_graph_init_idle_task(idle, cpu);
+#if defined(CONFIG_SMP)
+        sprintf(idle->comm, "%s/%d", INIT_TASK_COMM, cpu);
+#endif
 }
 /*
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 5c9e67923b7c..a78ed2736ba7 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -772,19 +772,32 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
                list_del_leaf_cfs_rq(cfs_rq);
 }
+static inline long calc_tg_weight(struct task_group *tg, struct cfs_rq *cfs_rq)
+{
+        long tg_weight;
+        /*
+         * Use this CPU's actual weight instead of the last load_contribution
+         * to gain a more accurate current total weight. See
+         * update_cfs_rq_load_contribution().
+         */
+        tg_weight = atomic_read(&tg->load_weight);
+        tg_weight -= cfs_rq->load_contribution;
+        tg_weight += cfs_rq->load.weight;
+        return tg_weight;
+}
 static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
 {
-        long load_weight, load, shares;
+        long tg_weight, load, shares;
+        tg_weight = calc_tg_weight(tg, cfs_rq);
        load = cfs_rq->load.weight;
-        load_weight = atomic_read(&tg->load_weight);
-        load_weight += load;
-        load_weight -= cfs_rq->load_contribution;
        shares = (tg->shares * load);
-        if (load_weight)
+        if (tg_weight)
-                shares /= load_weight;
+                shares /= tg_weight;
        if (shares < MIN_SHARES)
                shares = MIN_SHARES;
@@ -1743,7 +1756,7 @@ static void __return_cfs_rq_runtime(struct cfs_rq *cfs_rq)
 static __always_inline void return_cfs_rq_runtime(struct cfs_rq *cfs_rq)
 {
-        if (!cfs_rq->runtime_enabled || !cfs_rq->nr_running)
+        if (!cfs_rq->runtime_enabled || cfs_rq->nr_running)
                return;
        __return_cfs_rq_runtime(cfs_rq);
@@ -2036,36 +2049,100 @@ static void task_waking_fair(struct task_struct *p)
 * Adding load to a group doesn't make a group heavier, but can cause movement
 * of group shares between cpus. Assuming the shares were perfectly aligned one
 * can calculate the shift in shares.
+ *
+ * Calculate the effective load difference if @wl is added (subtracted) to @tg
+ * on this @cpu and results in a total addition (subtraction) of @wg to the
+ * total group weight.
+ *
+ * Given a runqueue weight distribution (rw_i) we can compute a shares
+ * distribution (s_i) using:
+ *
+ *   s_i = rw_i / \Sum rw_j                                             (1)
+ *
+ * Suppose we have 4 CPUs and our @tg is a direct child of the root group and
+ * has 7 equal weight tasks, distributed as below (rw_i), with the resulting
+ * shares distribution (s_i):
+ *
+ *   rw_i = {   2,   4,   1,   0 }
+ *   s_i  = { 2/7, 4/7, 1/7,   0 }
+ *
+ * As per wake_affine() we're interested in the load of two CPUs (the CPU the
+ * task used to run on and the CPU the waker is running on), we need to
+ * compute the effect of waking a task on either CPU and, in case of a sync
+ * wakeup, compute the effect of the current task going to sleep.
+ *
+ * So for a change of @wl to the local @cpu with an overall group weight change
+ * of @wl we can compute the new shares distribution (s'_i) using:
+ *
+ *   s'_i = (rw_i + @wl) / (@wg + \Sum rw_j)                            (2)
+ *
+ * Suppose we're interested in CPUs 0 and 1, and want to compute the load
+ * differences in waking a task to CPU 0. The additional task changes the
+ * weight and shares distributions like:
+ *
+ *   rw'_i = {   3,   4,   1,   0 }
+ *   s'_i  = { 3/8, 4/8, 1/8,   0 }
+ *
+ * We can then compute the difference in effective weight by using:
+ *
+ *   dw_i = S * (s'_i - s_i)                                            (3)
+ *
+ * Where 'S' is the group weight as seen by its parent.
+ *
+ * Therefore the effective change in loads on CPU 0 would be 5/56 (3/8 - 2/7)
+ * times the weight of the group. The effect on CPU 1 would be -4/56 (4/8 -
+ * 4/7) times the weight of the group.
 */
 static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
 {
        struct sched_entity *se = tg->se[cpu];
-        if (!tg->parent)
+        if (!tg->parent)        /* the trivial, non-cgroup case */
                return wl;
        for_each_sched_entity(se) {
-                long lw, w;
+                long w, W;
                tg = se->my_q->tg;
-                w = se->my_q->load.weight;
-                /* use this cpu's instantaneous contribution */
+                /*
-                lw = atomic_read(&tg->load_weight);
+                 * W = @wg + \Sum rw_j
-                lw -= se->my_q->load_contribution;
+                 */
-                lw += w + wg;
+                W = wg + calc_tg_weight(tg, se->my_q);
-                wl += w;
+                /*
+                 * w = rw_i + @wl
+                 */
+                w = se->my_q->load.weight + wl;
-                if (lw > 0 && wl < lw)
+                /*
-                        wl = (wl * tg->shares) / lw;
+                 * wl = S * s'_i; see (2)
+                 */
+                if (W > 0 && w < W)
+                        wl = (w * tg->shares) / W;
                else
                        wl = tg->shares;
-                /* zero point is MIN_SHARES */
+                /*
+                 * Per the above, wl is the new se->load.weight value; since
+                 * those are clipped to [MIN_SHARES, ...) do so now. See
+                 * calc_cfs_shares().
+                 */
                if (wl < MIN_SHARES)
                        wl = MIN_SHARES;
+                /*
+                 * wl = dw_i = S * (s'_i - s_i); see (3)
+                 */
                wl -= se->load.weight;
+                /*
+                 * Recursively apply this logic to all parent groups to compute
+                 * the final effective load change on the root group. Since
+                 * only the @tg group gets extra weight, all parent groups can
+                 * only redistribute existing shares. @wl is the shift in shares
+                 * resulting from this level per the above.
+                 */
                wg = 0;
        }
@@ -2249,7 +2326,8 @@ static int select_idle_sibling(struct task_struct *p, int target)
        int cpu = smp_processor_id();
        int prev_cpu = task_cpu(p);
        struct sched_domain *sd;
-        int i;
+        struct sched_group *sg;
+        int i, smt = 0;
        /*
         * If the task is going to be woken-up on this cpu and if it is
@@ -2269,25 +2347,38 @@ static int select_idle_sibling(struct task_struct *p, int target)
         * Otherwise, iterate the domains and find an elegible idle cpu.
         */
        rcu_read_lock();
+again:
        for_each_domain(target, sd) {
-                if (!(sd->flags & SD_SHARE_PKG_RESOURCES))
+                if (!smt && (sd->flags & SD_SHARE_CPUPOWER))
-                        break;
+                        continue;
-                for_each_cpu_and(i, sched_domain_span(sd), tsk_cpus_allowed(p)) {
+                if (!(sd->flags & SD_SHARE_PKG_RESOURCES)) {
-                        if (idle_cpu(i)) {
+                        if (!smt) {
-                                target = i;
+                                smt = 1;
-                                break;
+                                goto again;
                        }
+                        break;
                }
-                /*
+                sg = sd->groups;
-                 * Lets stop looking for an idle sibling when we reached
+                do {
-                 * the domain that spans the current cpu and prev_cpu.
+                        if (!cpumask_intersects(sched_group_cpus(sg),
-                 */
+                                                tsk_cpus_allowed(p)))
-                if (cpumask_test_cpu(cpu, sched_domain_span(sd)) &&
+                                goto next;
-                    cpumask_test_cpu(prev_cpu, sched_domain_span(sd)))
-                        break;
+                        for_each_cpu(i, sched_group_cpus(sg)) {
+                                if (!idle_cpu(i))
+                                        goto next;
+                        }
+                        target = cpumask_first_and(sched_group_cpus(sg),
+                                        tsk_cpus_allowed(p));
+                        goto done;
+next:
+                        sg = sg->next;
+                } while (sg != sd->groups);
        }
+done:
        rcu_read_unlock();
        return target;
@@ -3511,7 +3602,7 @@ static bool update_sd_pick_busiest(struct sched_domain *sd,
 }
 /**
- * update_sd_lb_stats - Update sched_group's statistics for load balancing.
+ * update_sd_lb_stats - Update sched_domain's statistics for load balancing.
 * @sd: sched_domain whose statistics are to be updated.
 * @this_cpu: Cpu for which load balance is currently performed.
 * @idle: Idle status of this_cpu
diff --git a/kernel/sched_features.h b/kernel/sched_features.h
index efa0a7b75dde..84802245abd2 100644
--- a/kernel/sched_features.h
+++ b/kernel/sched_features.h
@@ -67,3 +67,4 @@ SCHED_FEAT(NONTASK_POWER, 1)
 SCHED_FEAT(TTWU_QUEUE, 1)
 SCHED_FEAT(FORCE_SD_OVERLAP, 0)
+SCHED_FEAT(RT_RUNTIME_SHARE, 1)
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 056cbd2e2a27..583a1368afe6 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -560,6 +560,9 @@ static int balance_runtime(struct rt_rq *rt_rq)
 {
        int more = 0;
+        if (!sched_feat(RT_RUNTIME_SHARE))
+                return more;
        if (rt_rq->rt_time > rt_rq->rt_runtime) {
                raw_spin_unlock(&rt_rq->rt_runtime_lock);
                more = do_balance_runtime(rt_rq);
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index c436e790b21b..8a46f5d64504 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -195,7 +195,7 @@ static enum hrtimer_restart alarmtimer_fired(struct hrtimer *timer)
                struct alarm *alarm;
                ktime_t expired = next->expires;
-                if (expired.tv64 >= now.tv64)
+                if (expired.tv64 > now.tv64)
                        break;
                alarm = container_of(next, struct alarm, node);
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 1ecd6ba36d6c..c4eb71c8b2ea 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -387,6 +387,7 @@ void clockevents_exchange_device(struct clock_event_device *old,
         * released list and do a notify add later.
         */
        if (old) {
+                old->event_handler = clockevents_handle_noop;
                clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
                list_del(&old->list);
                list_add(&old->list, &clockevents_released);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index cfc65e1eb9fb..da2f760e780c 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -548,7 +548,7 @@ static u64 clocksource_max_deferment(struct clocksource *cs)
         * note a margin of 12.5% is used because this can be computed with
         * a shift, versus say 10% which would require division.
         */
-        return max_nsecs - (max_nsecs >> 5);
+        return max_nsecs - (max_nsecs >> 3);
 }
 #ifndef CONFIG_ARCH_USES_GETTIMEOFFSET
@@ -669,7 +669,7 @@ void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
         * ~ 0.06ppm granularity for NTP. We apply the same 12.5%
         * margin as we do in clocksource_max_deferment()
         */
-        sec = (cs->mask - (cs->mask >> 5));
+        sec = (cs->mask - (cs->mask >> 3));
        do_div(sec, freq);
        do_div(sec, scale);
        if (!sec)
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index f954282d9a82..fd4a7b1625a2 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -71,7 +71,7 @@ int tick_check_broadcast_device(struct clock_event_device *dev)
             (dev->features & CLOCK_EVT_FEAT_C3STOP))
                return 0;
-        clockevents_exchange_device(NULL, dev);
+        clockevents_exchange_device(tick_broadcast_device.evtdev, dev);
        tick_broadcast_device.evtdev = dev;
        if (!cpumask_empty(tick_get_broadcast_mask()))
                tick_broadcast_start_periodic(dev);
diff --git a/kernel/timer.c b/kernel/timer.c
index dbaa62422b13..9c3c62b0c4bc 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1368,7 +1368,7 @@ SYSCALL_DEFINE0(getppid)
        int pid;
        rcu_read_lock();
-        pid = task_tgid_vnr(current->real_parent);
+        pid = task_tgid_vnr(rcu_dereference(current->real_parent));
        rcu_read_unlock();
        return pid;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 900b409543db..b1e8943fed1d 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -152,7 +152,6 @@ void clear_ftrace_function(void)
        ftrace_pid_function = ftrace_stub;
 }
-#undef CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST
 #ifndef CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST
 /*
 * For those archs that do not test ftrace_trace_stop in their
@@ -1212,7 +1211,9 @@ ftrace_hash_move(struct ftrace_ops *ops, int enable,
        if (!src->count) {
                free_ftrace_hash_rcu(*dst);
                rcu_assign_pointer(*dst, EMPTY_HASH);
-                return 0;
+                /* still need to update the function records */
+                ret = 0;
+                goto out;
        }
        /*
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 581876f9f387..c212a7f934ec 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1078,7 +1078,6 @@ event_subsystem_dir(const char *name, struct dentry *d_events)
        /* First see if we did not already create this dir */
        list_for_each_entry(system, &event_subsystems, list) {
                if (strcmp(system->name, name) == 0) {
-                        __get_system(system);
                        system->nr_events++;
                        return system->entry;
                }
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 816d3d074979..95dc31efd6dd 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1649,7 +1649,9 @@ static int replace_system_preds(struct event_subsystem *system,
                 */
                err = replace_preds(call, NULL, ps, filter_string, true);
                if (err)
-                        goto fail;
+                        call->flags |= TRACE_EVENT_FL_NO_SET_FILTER;
+                else
+                        call->flags &= ~TRACE_EVENT_FL_NO_SET_FILTER;
        }
        list_for_each_entry(call, &ftrace_events, list) {
@@ -1658,6 +1660,9 @@ static int replace_system_preds(struct event_subsystem *system,
                if (strcmp(call->class->system, system->name) != 0)
                        continue;
+                if (call->flags & TRACE_EVENT_FL_NO_SET_FILTER)
+                        continue;
                filter_item = kzalloc(sizeof(*filter_item), GFP_KERNEL);
                if (!filter_item)
                        goto fail_mem;
@@ -1686,7 +1691,7 @@ static int replace_system_preds(struct event_subsystem *system,
                 * replace the filter for the call.
                 */
                filter = call->filter;
-                call->filter = filter_item->filter;
+                rcu_assign_pointer(call->filter, filter_item->filter);
                filter_item->filter = filter;
                fail = false;
@@ -1741,7 +1746,7 @@ int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
                filter = call->filter;
                if (!filter)
                        goto out_unlock;
-                call->filter = NULL;
+                RCU_INIT_POINTER(call->filter, NULL);
                /* Make sure the filter is not being used */
                synchronize_sched();
                __free_filter(filter);
@@ -1782,7 +1787,7 @@ out:
         * string
         */
        tmp = call->filter;
-        call->filter = filter;
+        rcu_assign_pointer(call->filter, filter);
        if (tmp) {
                /* Make sure the call is done with the filter */
                synchronize_sched();
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 74c6c7fce749..fea790a2b176 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -245,7 +245,7 @@ static void put_hash_bucket(struct hash_bucket *bucket,
 static bool exact_match(struct dma_debug_entry *a, struct dma_debug_entry *b)
 {
-        return ((a->dev_addr == a->dev_addr) &&
+        return ((a->dev_addr == b->dev_addr) &&
                (a->dev == b->dev)) ? true : false;
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 4298abaae153..36b3d988b4ef 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2259,12 +2259,8 @@ static void khugepaged_do_scan(struct page **hpage)
 static void khugepaged_alloc_sleep(void)
 {
-        DEFINE_WAIT(wait);
+        wait_event_freezable_timeout(khugepaged_wait, false,
-        add_wait_queue(&khugepaged_wait, &wait);
+                        msecs_to_jiffies(khugepaged_alloc_sleep_millisecs));
-        schedule_timeout_interruptible(
-                msecs_to_jiffies(
-                        khugepaged_alloc_sleep_millisecs));
-        remove_wait_queue(&khugepaged_wait, &wait);
 }
 #ifndef CONFIG_NUMA
@@ -2313,14 +2309,10 @@ static void khugepaged_loop(void)
                if (unlikely(kthread_should_stop()))
                        break;
                if (khugepaged_has_work()) {
-                        DEFINE_WAIT(wait);
                        if (!khugepaged_scan_sleep_millisecs)
                                continue;
-                        add_wait_queue(&khugepaged_wait, &wait);
+                        wait_event_freezable_timeout(khugepaged_wait, false,
-                        schedule_timeout_interruptible(
+                            msecs_to_jiffies(khugepaged_scan_sleep_millisecs));
-                                msecs_to_jiffies(
-                                        khugepaged_scan_sleep_millisecs));
-                        remove_wait_queue(&khugepaged_wait, &wait);
                } else if (khugepaged_enabled())
                        wait_event_freezable(khugepaged_wait,
                                             khugepaged_wait_event());
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index bb28a5f9db8d..73f17c0293c0 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -576,6 +576,7 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
        __SetPageHead(page);
        for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
                __SetPageTail(p);
+                set_page_count(p, 0);
                p->first_page = page;
        }
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 578e29174fa6..177aca424a06 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -871,9 +871,9 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
        if (anon_vma)
                put_anon_vma(anon_vma);
-out:
        unlock_page(hpage);
+out:
        if (rc != -EAGAIN) {
                list_del(&hpage->lru);
                put_page(hpage);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 9dd443d89d8b..2b8ba3aebf6e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -356,8 +356,8 @@ void prep_compound_page(struct page *page, unsigned long order)
        __SetPageHead(page);
        for (i = 1; i < nr_pages; i++) {
                struct page *p = page + i;
                __SetPageTail(p);
+                set_page_count(p, 0);
                p->first_page = page;
        }
 }
@@ -3377,9 +3377,15 @@ static void setup_zone_migrate_reserve(struct zone *zone)
        unsigned long block_migratetype;
        int reserve;
-        /* Get the start pfn, end pfn and the number of blocks to reserve */
+        /*
+         * Get the start pfn, end pfn and the number of blocks to reserve
+         * We have to be careful to be aligned to pageblock_nr_pages to
+         * make sure that we always check pfn_valid for the first page in
+         * the block.
+         */
        start_pfn = zone->zone_start_pfn;
        end_pfn = start_pfn + zone->spanned_pages;
+        start_pfn = roundup(start_pfn, pageblock_nr_pages);
        reserve = roundup(min_wmark_pages(zone), pageblock_nr_pages) >>
                                                        pageblock_order;
diff --git a/mm/slab.c b/mm/slab.c
index 708efe886154..83311c9aaf9d 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -595,6 +595,7 @@ static enum {
        PARTIAL_AC,
        PARTIAL_L3,
        EARLY,
+        LATE,
        FULL
 } g_cpucache_up;
@@ -671,7 +672,7 @@ static void init_node_lock_keys(int q)
 {
        struct cache_sizes *s = malloc_sizes;
-        if (g_cpucache_up != FULL)
+        if (g_cpucache_up < LATE)
                return;
        for (s = malloc_sizes; s->cs_size != ULONG_MAX; s++) {
@@ -1666,6 +1667,8 @@ void __init kmem_cache_init_late(void)
 {
        struct kmem_cache *cachep;
+        g_cpucache_up = LATE;
        /* Annotate slab for lockdep -- annotate the malloc caches */
        init_lock_keys();
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 3231bf332878..1d8b32f07139 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1633,6 +1633,8 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
                goto fail;
        addr = __vmalloc_area_node(area, gfp_mask, prot, node, caller);
+        if (!addr)
+                return NULL;
        /*
         * In this function, newly allocated vm_struct is not added
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a1893c050795..f54a05b7a61d 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -183,7 +183,7 @@ static unsigned long zone_nr_lru_pages(struct zone *zone,
 */
 void register_shrinker(struct shrinker *shrinker)
 {
-        shrinker->nr = 0;
+        atomic_long_set(&shrinker->nr_in_batch, 0);
        down_write(&shrinker_rwsem);
        list_add_tail(&shrinker->list, &shrinker_list);
        up_write(&shrinker_rwsem);
@@ -247,25 +247,26 @@ unsigned long shrink_slab(struct shrink_control *shrink,
        list_for_each_entry(shrinker, &shrinker_list, list) {
                unsigned long long delta;
-                unsigned long total_scan;
+                long total_scan;
-                unsigned long max_pass;
+                long max_pass;
                int shrink_ret = 0;
                long nr;
                long new_nr;
                long batch_size = shrinker->batch ? shrinker->batch
                                                  : SHRINK_BATCH;
+                max_pass = do_shrinker_shrink(shrinker, shrink, 0);
+                if (max_pass <= 0)
+                        continue;
                /*
                 * copy the current shrinker scan count into a local variable
                 * and zero it so that other concurrent shrinker invocations
                 * don't also do this scanning work.
                 */
-                do {
+                nr = atomic_long_xchg(&shrinker->nr_in_batch, 0);
-                        nr = shrinker->nr;
-                } while (cmpxchg(&shrinker->nr, nr, 0) != nr);
                total_scan = nr;
-                max_pass = do_shrinker_shrink(shrinker, shrink, 0);
                delta = (4 * nr_pages_scanned) / shrinker->seeks;
                delta *= max_pass;
                do_div(delta, lru_pages + 1);
@@ -325,12 +326,11 @@ unsigned long shrink_slab(struct shrink_control *shrink,
                 * manner that handles concurrent updates. If we exhausted the
                 * scan, there is no need to do an update.
                 */
-                do {
+                if (total_scan > 0)
-                        nr = shrinker->nr;
+                        new_nr = atomic_long_add_return(total_scan,
-                        new_nr = total_scan + nr;
+                                        &shrinker->nr_in_batch);
-                        if (total_scan <= 0)
+                else
-                                break;
+                        new_nr = atomic_long_read(&shrinker->nr_in_batch);
-                } while (cmpxchg(&shrinker->nr, nr, new_nr) != nr);
                trace_mm_shrink_slab_end(shrinker, shrink_ret, nr, new_nr);
        }
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 182236b2510a..9b570a6a33c5 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -26,10 +26,11 @@
 * but then some measure against one socket starving all other sockets
 * would be needed.
 *
- * It was 128 by default. Experiments with real servers show, that
+ * The minimum value of it is 128. Experiments with real servers show that
 * it is absolutely not enough even at 100conn/sec. 256 cures most
- * of problems. This value is adjusted to 128 for very small machines
+ * of problems.
- * (<=32Mb of memory) and to 1024 on normal or better ones (>=256Mb).
+ * This value is adjusted to 128 for low memory machines,
+ * and it will increase in proportion to the memory of machine.
 * Note : Dont forget somaxconn that may limit backlog too.
 */
 int sysctl_max_syn_backlog = 256;
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 025233de25f9..925991ae6f52 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -19,6 +19,7 @@ static int __init net_secret_init(void)
 }
 late_initcall(net_secret_init);
+#ifdef CONFIG_INET
 static u32 seq_scale(u32 seq)
 {
        /*
@@ -33,6 +34,7 @@ static u32 seq_scale(u32 seq)
         */
        return seq + (ktime_to_ns(ktime_get_real()) >> 6);
 }
+#endif
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ca5e237df029..46af62363b8c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -112,7 +112,7 @@
 #include <net/secure_seq.h>
 #define RT_FL_TOS(oldflp4) \
-    ((u32)(oldflp4->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
+        ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
 #define IP_MAX_MTU      0xFFF0
@@ -1310,7 +1310,7 @@ static void rt_del(unsigned hash, struct rtable *rt)
        spin_unlock_bh(rt_hash_lock_addr(hash));
 }
-static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
+static void check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
 {
        struct rtable *rt = (struct rtable *) dst;
        __be32 orig_gw = rt->rt_gateway;
@@ -1321,21 +1321,19 @@ static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
        rt->rt_gateway = peer->redirect_learned.a4;
        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
-        if (IS_ERR(n))
+        if (IS_ERR(n)) {
-                return PTR_ERR(n);
+                rt->rt_gateway = orig_gw;
+                return;
+        }
        old_n = xchg(&rt->dst._neighbour, n);
        if (old_n)
                neigh_release(old_n);
-        if (!n || !(n->nud_state & NUD_VALID)) {
+        if (!(n->nud_state & NUD_VALID)) {
-                if (n)
+                neigh_event_send(n, NULL);
-                        neigh_event_send(n, NULL);
-                rt->rt_gateway = orig_gw;
-                return -EAGAIN;
        } else {
                rt->rt_flags |= RTCF_REDIRECTED;
                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
        }
-        return 0;
 }
 /* called in rcu_read_lock() section */
@@ -1693,7 +1691,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 }
-static struct rtable *ipv4_validate_peer(struct rtable *rt)
+static void ipv4_validate_peer(struct rtable *rt)
 {
        if (rt->rt_peer_genid != rt_peer_genid()) {
                struct inet_peer *peer;
@@ -1708,15 +1706,12 @@ static struct rtable *ipv4_validate_peer(struct rtable *rt)
                        if (peer->redirect_genid != redirect_genid)
                                peer->redirect_learned.a4 = 0;
                        if (peer->redirect_learned.a4 &&
-                            peer->redirect_learned.a4 != rt->rt_gateway) {
+                            peer->redirect_learned.a4 != rt->rt_gateway)
-                                if (check_peer_redir(&rt->dst, peer))
+                                check_peer_redir(&rt->dst, peer);
-                                        return NULL;
-                        }
                }
                rt->rt_peer_genid = rt_peer_genid();
        }
-        return rt;
 }
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
@@ -1725,7 +1720,7 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
        if (rt_is_expired(rt))
                return NULL;
-        dst = (struct dst_entry *) ipv4_validate_peer(rt);
+        ipv4_validate_peer(rt);
        return dst;
 }
@@ -2380,9 +2375,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                    rth->rt_mark == skb->mark &&
                    net_eq(dev_net(rth->dst.dev), net) &&
                    !rt_is_expired(rth)) {
-                        rth = ipv4_validate_peer(rth);
+                        ipv4_validate_peer(rth);
-                        if (!rth)
-                                continue;
                        if (noref) {
                                dst_use_noref(&rth->dst, jiffies);
                                skb_dst_set_noref(skb, &rth->dst);
@@ -2441,11 +2434,11 @@ EXPORT_SYMBOL(ip_route_input_common);
 static struct rtable *__mkroute_output(const struct fib_result *res,
                                       const struct flowi4 *fl4,
                                       __be32 orig_daddr, __be32 orig_saddr,
-                                       int orig_oif, struct net_device *dev_out,
+                                       int orig_oif, __u8 orig_rtos,
+                                       struct net_device *dev_out,
                                       unsigned int flags)
 {
        struct fib_info *fi = res->fi;
-        u32 tos = RT_FL_TOS(fl4);
        struct in_device *in_dev;
        u16 type = res->type;
        struct rtable *rth;
@@ -2496,7 +2489,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
        rth->rt_genid = rt_genid(dev_net(dev_out));
        rth->rt_flags   = flags;
        rth->rt_type    = type;
-        rth->rt_key_tos = tos;
+        rth->rt_key_tos = orig_rtos;
        rth->rt_dst     = fl4->daddr;
        rth->rt_src     = fl4->saddr;
        rth->rt_route_iif = 0;
@@ -2546,7 +2539,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
 static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
 {
        struct net_device *dev_out = NULL;
-        u32 tos = RT_FL_TOS(fl4);
+        __u8 tos = RT_FL_TOS(fl4);
        unsigned int flags = 0;
        struct fib_result res;
        struct rtable *rth;
@@ -2722,7 +2715,7 @@ static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
 make_route:
        rth = __mkroute_output(&res, fl4, orig_daddr, orig_saddr, orig_oif,
-                               dev_out, flags);
+                               tos, dev_out, flags);
        if (!IS_ERR(rth)) {
                unsigned int hash;
@@ -2758,9 +2751,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *flp4)
                            (IPTOS_RT_MASK | RTO_ONLINK)) &&
                    net_eq(dev_net(rth->dst.dev), net) &&
                    !rt_is_expired(rth)) {
-                        rth = ipv4_validate_peer(rth);
+                        ipv4_validate_peer(rth);
-                        if (!rth)
-                                continue;
                        dst_use(&rth->dst, jiffies);
                        RT_CACHE_STAT_INC(out_hit);
                        rcu_read_unlock_bh();
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d999bf3b84e1..cae443563ec9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -757,6 +757,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        if (!local->int_scan_req)
                return -ENOMEM;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!local->hw.wiphy->bands[band])
+                        continue;
+                local->int_scan_req->rates[band] = (u32) -1;
+        }
        /* if low-level driver supports AP, we also support VLAN */
        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP)) {
                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index eca0fad09709..d5230ecc784d 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1039,7 +1039,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                             struct ieee80211_sub_if_data,
                                             u.ap);
-                        memset(&sta->sta.drv_priv, 0, hw->sta_data_size);
                        WARN_ON(drv_sta_add(local, sdata, &sta->sta));
                }
        }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 77e926738014..3302c56f60d1 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -57,8 +57,17 @@
 #define REG_DBG_PRINT(args...)
 #endif
+static struct regulatory_request core_request_world = {
+        .initiator = NL80211_REGDOM_SET_BY_CORE,
+        .alpha2[0] = '0',
+        .alpha2[1] = '0',
+        .intersect = false,
+        .processed = true,
+        .country_ie_env = ENVIRON_ANY,
+};
 /* Receipt of information from last regulatory request */
-static struct regulatory_request *last_request;
+static struct regulatory_request *last_request = &core_request_world;
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -150,7 +159,7 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
-static void reset_regdomains(void)
+static void reset_regdomains(bool full_reset)
 {
        /* avoid freeing static information or freeing something twice */
        if (cfg80211_regdomain == cfg80211_world_regdom)
@@ -165,6 +174,13 @@ static void reset_regdomains(void)
        cfg80211_world_regdom = &world_regdom;
        cfg80211_regdomain = NULL;
+        if (!full_reset)
+                return;
+        if (last_request != &core_request_world)
+                kfree(last_request);
+        last_request = &core_request_world;
 }
 /*
@@ -175,7 +191,7 @@ static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
        BUG_ON(!last_request);
-        reset_regdomains();
+        reset_regdomains(false);
        cfg80211_world_regdom = rd;
        cfg80211_regdomain = rd;
@@ -1407,7 +1423,8 @@ static int __regulatory_hint(struct wiphy *wiphy,
        }
 new_request:
-        kfree(last_request);
+        if (last_request != &core_request_world)
+                kfree(last_request);
        last_request = pending_request;
        last_request->intersect = intersect;
@@ -1577,9 +1594,6 @@ static int regulatory_hint_core(const char *alpha2)
 {
        struct regulatory_request *request;
-        kfree(last_request);
-        last_request = NULL;
        request = kzalloc(sizeof(struct regulatory_request),
                          GFP_KERNEL);
        if (!request)
@@ -1777,7 +1791,7 @@ static void restore_regulatory_settings(bool reset_user)
        mutex_lock(&cfg80211_mutex);
        mutex_lock(&reg_mutex);
-        reset_regdomains();
+        reset_regdomains(true);
        restore_alpha2(alpha2, reset_user);
        /*
@@ -2037,8 +2051,10 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
        }
        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
-        if (!request_wiphy) {
+        if (!request_wiphy &&
-                reg_set_request_processed();
+            (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+             last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+                schedule_delayed_work(&reg_timeout, 0);
                return -ENODEV;
        }
@@ -2046,7 +2062,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                int r;
                if (last_request->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
-                        reset_regdomains();
+                        reset_regdomains(false);
                        cfg80211_regdomain = rd;
                        return 0;
                }
@@ -2067,7 +2083,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                if (r)
                        return r;
-                reset_regdomains();
+                reset_regdomains(false);
                cfg80211_regdomain = rd;
                return 0;
        }
@@ -2092,7 +2108,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                rd = NULL;
-                reset_regdomains();
+                reset_regdomains(false);
                cfg80211_regdomain = intersected_rd;
                return 0;
@@ -2112,7 +2128,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
        kfree(rd);
        rd = NULL;
-        reset_regdomains();
+        reset_regdomains(false);
        cfg80211_regdomain = intersected_rd;
        return 0;
@@ -2265,11 +2281,8 @@ void /* __init_or_exit */ regulatory_exit(void)
        mutex_lock(&cfg80211_mutex);
        mutex_lock(&reg_mutex);
-        reset_regdomains();
+        reset_regdomains(true);
-        kfree(last_request);
-        last_request = NULL;
        dev_set_uevent_suppress(&reg_pdev->dev, true);
        platform_device_unregister(reg_pdev);
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index 36cc0cc39e78..b566eba4a65c 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -57,23 +57,44 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
 static int d_namespace_path(struct path *path, char *buf, int buflen,
                            char **name, int flags)
 {
-        struct path root, tmp;
        char *res;
-        int connected, error = 0;
+        int error = 0;
+        int connected = 1;
+        if (path->mnt->mnt_flags & MNT_INTERNAL) {
+                /* it's not mounted anywhere */
+                res = dentry_path(path->dentry, buf, buflen);
+                *name = res;
+                if (IS_ERR(res)) {
+                        *name = buf;
+                        return PTR_ERR(res);
+                }
+                if (path->dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
+                    strncmp(*name, "/sys/", 5) == 0) {
+                        /* TODO: convert over to using a per namespace
+                         * control instead of hard coded /proc
+                         */
+                        return prepend(name, *name - buf, "/proc", 5);
+                }
+                return 0;
+        }
-        /* Get the root we want to resolve too, released below */
+        /* resolve paths relative to chroot?*/
        if (flags & PATH_CHROOT_REL) {
-                /* resolve paths relative to chroot */
+                struct path root;
                get_fs_root(current->fs, &root);
-        } else {
+                res = __d_path(path, &root, buf, buflen);
-                /* resolve paths relative to namespace */
+                if (res && !IS_ERR(res)) {
-                root.mnt = current->nsproxy->mnt_ns->root;
+                        /* everything's fine */
-                root.dentry = root.mnt->mnt_root;
+                        *name = res;
-                path_get(&root);
+                        path_put(&root);
+                        goto ok;
+                }
+                path_put(&root);
+                connected = 0;
        }
-        tmp = root;
+        res = d_absolute_path(path, buf, buflen);
-        res = __d_path(path, &tmp, buf, buflen);
        *name = res;
        /* handle error conditions - and still allow a partial path to
@@ -84,7 +105,10 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                *name = buf;
                goto out;
        }
+        if (!our_mnt(path->mnt))
+                connected = 0;
+ok:
        /* Handle two cases:
         * 1. A deleted dentry && profile is not allowing mediation of deleted
         * 2. On some filesystems, newly allocated dentries appear to the
@@ -97,10 +121,7 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                        goto out;
        }
-        /* Determine if the path is connected to the expected root */
+        /* If the path is not connected to the expected root,
-        connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt;
-        /* If the path is not connected,
         * check if it is a sysctl and handle specially else remove any
         * leading / that __d_path may have returned.
         * Unless
@@ -112,17 +133,9 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
         *     namespace root.
         */
        if (!connected) {
-                /* is the disconnect path a sysctl? */
+                if (!(flags & PATH_CONNECT_PATH) &&
-                if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
-                    strncmp(*name, "/sys/", 5) == 0) {
-                        /* TODO: convert over to using a per namespace
-                         * control instead of hard coded /proc
-                         */
-                        error = prepend(name, *name - buf, "/proc", 5);
-                } else if (!(flags & PATH_CONNECT_PATH) &&
                           !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) &&
-                             (tmp.mnt == current->nsproxy->mnt_ns->root &&
+                             our_mnt(path->mnt))) {
-                              tmp.dentry == tmp.mnt->mnt_root))) {
                        /* disconnected path, don't return pathname starting
                         * with '/'
                         */
@@ -133,8 +146,6 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
        }
 out:
-        path_put(&root);
        return error;
 }
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index 738bbdf8d4c7..d9f3ced8756e 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -101,9 +101,8 @@ static char *tomoyo_get_absolute_path(struct path *path, char * const buffer,
 {
        char *pos = ERR_PTR(-ENOMEM);
        if (buflen >= 256) {
-                struct path ns_root = { };
                /* go to whatever namespace root we are under */
-                pos = __d_path(path, &ns_root, buffer, buflen - 1);
+                pos = d_absolute_path(path, buffer, buflen - 1);
                if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
                        struct inode *inode = path->dentry->d_inode;
                        if (inode && S_ISDIR(inode->i_mode)) {
@@ -294,8 +293,16 @@ char *tomoyo_realpath_from_path(struct path *path)
                        pos = tomoyo_get_local_path(path->dentry, buf,
                                                    buf_len - 1);
                /* Get absolute name for the rest. */
-                else
+                else {
                        pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
+                        /*
+                         * Fall back to local name if absolute name is not
+                         * available.
+                         */
+                        if (pos == ERR_PTR(-EINVAL))
+                                pos = tomoyo_get_local_path(path->dentry, buf,
+                                                            buf_len - 1);
+                }
 encode:
                if (IS_ERR(pos))
                        continue;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index cbde019d3d52..1d07e8fa2433 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -297,6 +297,8 @@ static int alc_mux_select(struct hda_codec *codec, unsigned int adc_idx,
        imux = &spec->input_mux[mux_idx];
        if (!imux->num_items && mux_idx > 0)
                imux = &spec->input_mux[0];
+        if (!imux->num_items)
+                return 0;
        if (idx >= imux->num_items)
                idx = imux->num_items - 1;
@@ -2629,6 +2631,8 @@ static const char *alc_get_line_out_pfx(struct alc_spec *spec, int ch,
        case AUTO_PIN_SPEAKER_OUT:
                if (cfg->line_outs == 1)
                        return "Speaker";
+                if (cfg->line_outs == 2)
+                        return ch ? "Bass Speaker" : "Speaker";
                break;
        case AUTO_PIN_HP_OUT:
                /* for multi-io case, only the primary out */
@@ -2902,7 +2906,7 @@ static hda_nid_t alc_auto_look_for_dac(struct hda_codec *codec, hda_nid_t pin)
                if (!nid)
                        continue;
                if (found_in_nid_list(nid, spec->multiout.dac_nids,
-                                      spec->multiout.num_dacs))
+                                      ARRAY_SIZE(spec->private_dac_nids)))
                        continue;
                if (found_in_nid_list(nid, spec->multiout.hp_out_nid,
                                      ARRAY_SIZE(spec->multiout.hp_out_nid)))
@@ -2923,6 +2927,7 @@ static hda_nid_t get_dac_if_single(struct hda_codec *codec, hda_nid_t pin)
        return 0;
 }
+/* return 0 if no possible DAC is found, 1 if one or more found */
 static int alc_auto_fill_extra_dacs(struct hda_codec *codec, int num_outs,
                                    const hda_nid_t *pins, hda_nid_t *dacs)
 {
@@ -2940,7 +2945,7 @@ static int alc_auto_fill_extra_dacs(struct hda_codec *codec, int num_outs,
                if (!dacs[i])
                        dacs[i] = alc_auto_look_for_dac(codec, pins[i]);
        }
-        return 0;
+        return 1;
 }
 static int alc_auto_fill_multi_ios(struct hda_codec *codec,
@@ -2950,7 +2955,7 @@ static int alc_auto_fill_multi_ios(struct hda_codec *codec,
 static int alc_auto_fill_dac_nids(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        const struct auto_pin_cfg *cfg = &spec->autocfg;
+        struct auto_pin_cfg *cfg = &spec->autocfg;
        bool redone = false;
        int i;
@@ -2961,6 +2966,7 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
        spec->multiout.extra_out_nid[0] = 0;
        memset(spec->private_dac_nids, 0, sizeof(spec->private_dac_nids));
        spec->multiout.dac_nids = spec->private_dac_nids;
+        spec->multi_ios = 0;
        /* fill hard-wired DACs first */
        if (!redone) {
@@ -2994,10 +3000,12 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
        for (i = 0; i < cfg->line_outs; i++) {
                if (spec->private_dac_nids[i])
                        spec->multiout.num_dacs++;
-                else
+                else {
                        memmove(spec->private_dac_nids + i,
                                spec->private_dac_nids + i + 1,
                                sizeof(hda_nid_t) * (cfg->line_outs - i - 1));
+                        spec->private_dac_nids[cfg->line_outs - 1] = 0;
+                }
        }
        if (cfg->line_outs == 1 && cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
@@ -3019,9 +3027,28 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
        if (cfg->line_out_type != AUTO_PIN_HP_OUT)
                alc_auto_fill_extra_dacs(codec, cfg->hp_outs, cfg->hp_pins,
                                 spec->multiout.hp_out_nid);
-        if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT)
+        if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
-                alc_auto_fill_extra_dacs(codec, cfg->speaker_outs, cfg->speaker_pins,
+                int err = alc_auto_fill_extra_dacs(codec, cfg->speaker_outs,
-                                 spec->multiout.extra_out_nid);
+                                        cfg->speaker_pins,
+                                        spec->multiout.extra_out_nid);
+                /* if no speaker volume is assigned, try again as the primary
+                 * output
+                 */
+                if (!err && cfg->speaker_outs > 0 &&
+                    cfg->line_out_type == AUTO_PIN_HP_OUT) {
+                        cfg->hp_outs = cfg->line_outs;
+                        memcpy(cfg->hp_pins, cfg->line_out_pins,
+                               sizeof(cfg->hp_pins));
+                        cfg->line_outs = cfg->speaker_outs;
+                        memcpy(cfg->line_out_pins, cfg->speaker_pins,
+                               sizeof(cfg->speaker_pins));
+                        cfg->speaker_outs = 0;
+                        memset(cfg->speaker_pins, 0, sizeof(cfg->speaker_pins));
+                        cfg->line_out_type = AUTO_PIN_SPEAKER_OUT;
+                        redone = false;
+                        goto again;
+                }
+        }
        return 0;
 }
@@ -3171,7 +3198,8 @@ static int alc_auto_create_multi_out_ctls(struct hda_codec *codec,
 }
 static int alc_auto_create_extra_out(struct hda_codec *codec, hda_nid_t pin,
-                                     hda_nid_t dac, const char *pfx)
+                                     hda_nid_t dac, const char *pfx,
+                                     int cidx)
 {
        struct alc_spec *spec = codec->spec;
        hda_nid_t sw, vol;
@@ -3187,15 +3215,15 @@ static int alc_auto_create_extra_out(struct hda_codec *codec, hda_nid_t pin,
                if (is_ctl_used(spec->sw_ctls, val))
                        return 0; /* already created */
                mark_ctl_usage(spec->sw_ctls, val);
-                return add_pb_sw_ctrl(spec, ALC_CTL_WIDGET_MUTE, pfx, val);
+                return __add_pb_sw_ctrl(spec, ALC_CTL_WIDGET_MUTE, pfx, cidx, val);
        }
        sw = alc_look_for_out_mute_nid(codec, pin, dac);
        vol = alc_look_for_out_vol_nid(codec, pin, dac);
-        err = alc_auto_add_stereo_vol(codec, pfx, 0, vol);
+        err = alc_auto_add_stereo_vol(codec, pfx, cidx, vol);
        if (err < 0)
                return err;
-        err = alc_auto_add_stereo_sw(codec, pfx, 0, sw);
+        err = alc_auto_add_stereo_sw(codec, pfx, cidx, sw);
        if (err < 0)
                return err;
        return 0;
@@ -3236,16 +3264,21 @@ static int alc_auto_create_extra_outs(struct hda_codec *codec, int num_pins,
                hda_nid_t dac = *dacs;
                if (!dac)
                        dac = spec->multiout.dac_nids[0];
-                return alc_auto_create_extra_out(codec, *pins, dac, pfx);
+                return alc_auto_create_extra_out(codec, *pins, dac, pfx, 0);
        }
        if (dacs[num_pins - 1]) {
                /* OK, we have a multi-output system with individual volumes */
                for (i = 0; i < num_pins; i++) {
-                        snprintf(name, sizeof(name), "%s %s",
+                        if (num_pins >= 3) {
-                                 pfx, channel_name[i]);
+                                snprintf(name, sizeof(name), "%s %s",
-                        err = alc_auto_create_extra_out(codec, pins[i], dacs[i],
+                                         pfx, channel_name[i]);
-                                                        name);
+                                err = alc_auto_create_extra_out(codec, pins[i], dacs[i],
+                                                                name, 0);
+                        } else {
+                                err = alc_auto_create_extra_out(codec, pins[i], dacs[i],
+                                                                pfx, i);
+                        }
                        if (err < 0)
                                return err;
                }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d8d2f9dccd9b..eeb25d529e30 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -215,6 +215,7 @@ struct sigmatel_spec {
        unsigned int gpio_mute;
        unsigned int gpio_led;
        unsigned int gpio_led_polarity;
+        unsigned int vref_mute_led_nid; /* pin NID for mute-LED vref control */
        unsigned int vref_led;
        /* stream */
@@ -4318,12 +4319,10 @@ static void stac_store_hints(struct hda_codec *codec)
                spec->eapd_switch = val;
        get_int_hint(codec, "gpio_led_polarity", &spec->gpio_led_polarity);
        if (get_int_hint(codec, "gpio_led", &spec->gpio_led)) {
-                if (spec->gpio_led <= 8) {
+                spec->gpio_mask |= spec->gpio_led;
-                        spec->gpio_mask |= spec->gpio_led;
+                spec->gpio_dir |= spec->gpio_led;
-                        spec->gpio_dir |= spec->gpio_led;
+                if (spec->gpio_led_polarity)
-                        if (spec->gpio_led_polarity)
+                        spec->gpio_data |= spec->gpio_led;
-                                spec->gpio_data |= spec->gpio_led;
-                }
        }
 }
@@ -4443,7 +4442,7 @@ static int stac92xx_init(struct hda_codec *codec)
                /* power on when no jack detection is available */
                /* or when the VREF is used for controlling LED */
                if (!spec->hp_detect ||
-                    (spec->gpio_led > 8 && spec->gpio_led == nid)) {
+                    spec->vref_mute_led_nid == nid) {
                        stac_toggle_power_map(codec, nid, 1);
                        continue;
                }
@@ -4915,8 +4914,14 @@ static int find_mute_led_gpio(struct hda_codec *codec, int default_polarity)
                        if (sscanf(dev->name, "HP_Mute_LED_%d_%x",
                                  &spec->gpio_led_polarity,
                                  &spec->gpio_led) == 2) {
-                                if (spec->gpio_led < 4)
+                                unsigned int max_gpio;
+                                max_gpio = snd_hda_param_read(codec, codec->afg,
+                                                              AC_PAR_GPIO_CAP);
+                                max_gpio &= AC_GPIO_IO_COUNT;
+                                if (spec->gpio_led < max_gpio)
                                        spec->gpio_led = 1 << spec->gpio_led;
+                                else
+                                        spec->vref_mute_led_nid = spec->gpio_led;
                                return 1;
                        }
                        if (sscanf(dev->name, "HP_Mute_LED_%d",
@@ -5045,15 +5050,12 @@ static int stac92xx_pre_resume(struct hda_codec *codec)
        struct sigmatel_spec *spec = codec->spec;
        /* sync mute LED */
-        if (spec->gpio_led) {
+        if (spec->vref_mute_led_nid)
-                if (spec->gpio_led <= 8) {
+                stac_vrefout_set(codec, spec->vref_mute_led_nid,
-                        stac_gpio_set(codec, spec->gpio_mask,
+                                 spec->vref_led);
-                                        spec->gpio_dir, spec->gpio_data);
+        else if (spec->gpio_led)
-                } else {
+                stac_gpio_set(codec, spec->gpio_mask,
-                        stac_vrefout_set(codec,
+                              spec->gpio_dir, spec->gpio_data);
-                                        spec->gpio_led, spec->vref_led);
-                }
-        }
        return 0;
 }
@@ -5064,7 +5066,7 @@ static void stac92xx_set_power_state(struct hda_codec *codec, hda_nid_t fg,
        struct sigmatel_spec *spec = codec->spec;
        if (power_state == AC_PWRST_D3) {
-                if (spec->gpio_led > 8) {
+                if (spec->vref_mute_led_nid) {
                        /* with vref-out pin used for mute led control
                         * codec AFG is prevented from D3 state
                         */
@@ -5117,7 +5119,7 @@ static int stac92xx_update_led_status(struct hda_codec *codec)
                }
        }
        /*polarity defines *not* muted state level*/
-        if (spec->gpio_led <= 8) {
+        if (!spec->vref_mute_led_nid) {
                if (muted)
                        spec->gpio_data &= ~spec->gpio_led; /* orange */
                else
@@ -5135,7 +5137,8 @@ static int stac92xx_update_led_status(struct hda_codec *codec)
                muted_lvl = spec->gpio_led_polarity ?
                                AC_PINCTL_VREF_GRD : AC_PINCTL_VREF_HIZ;
                spec->vref_led = muted ? muted_lvl : notmtd_lvl;
-                stac_vrefout_set(codec, spec->gpio_led, spec->vref_led);
+                stac_vrefout_set(codec, spec->vref_mute_led_nid,
+                                 spec->vref_led);
        }
        return 0;
 }
@@ -5649,7 +5652,7 @@ again:
 #ifdef CONFIG_SND_HDA_POWER_SAVE
        if (spec->gpio_led) {
-                if (spec->gpio_led <= 8) {
+                if (!spec->vref_mute_led_nid) {
                        spec->gpio_mask |= spec->gpio_led;
                        spec->gpio_dir |= spec->gpio_led;
                        spec->gpio_data |= spec->gpio_led;
@@ -5962,7 +5965,7 @@ again:
 #ifdef CONFIG_SND_HDA_POWER_SAVE
        if (spec->gpio_led) {
-                if (spec->gpio_led <= 8) {
+                if (!spec->vref_mute_led_nid) {
                        spec->gpio_mask |= spec->gpio_led;
                        spec->gpio_dir |= spec->gpio_led;
                        spec->gpio_data |= spec->gpio_led;
diff --git a/sound/pci/sis7019.c b/sound/pci/sis7019.c
index a391e622a192..28dfafb56dd1 100644
--- a/sound/pci/sis7019.c
+++ b/sound/pci/sis7019.c
@@ -41,6 +41,7 @@ MODULE_SUPPORTED_DEVICE("{{SiS,SiS7019 Audio Accelerator}}");
 static int index = SNDRV_DEFAULT_IDX1;  /* Index 0-MAX */
 static char *id = SNDRV_DEFAULT_STR1;   /* ID for this card */
 static int enable = 1;
+static int codecs = 1;
 module_param(index, int, 0444);
 MODULE_PARM_DESC(index, "Index value for SiS7019 Audio Accelerator.");
@@ -48,6 +49,8 @@ module_param(id, charp, 0444);
 MODULE_PARM_DESC(id, "ID string for SiS7019 Audio Accelerator.");
 module_param(enable, bool, 0444);
 MODULE_PARM_DESC(enable, "Enable SiS7019 Audio Accelerator.");
+module_param(codecs, int, 0444);
+MODULE_PARM_DESC(codecs, "Set bit to indicate that codec number is expected to be present (default 1)");
 static DEFINE_PCI_DEVICE_TABLE(snd_sis7019_ids) = {
        { PCI_DEVICE(PCI_VENDOR_ID_SI, 0x7019) },
@@ -140,6 +143,9 @@ struct sis7019 {
        dma_addr_t silence_dma_addr;
 };
+/* These values are also used by the module param 'codecs' to indicate
+ * which codecs should be present.
+ */
 #define SIS_PRIMARY_CODEC_PRESENT       0x0001
 #define SIS_SECONDARY_CODEC_PRESENT     0x0002
 #define SIS_TERTIARY_CODEC_PRESENT      0x0004
@@ -1078,6 +1084,7 @@ static int sis_chip_init(struct sis7019 *sis)
 {
        unsigned long io = sis->ioport;
        void __iomem *ioaddr = sis->ioaddr;
+        unsigned long timeout;
        u16 status;
        int count;
        int i;
@@ -1104,21 +1111,45 @@ static int sis_chip_init(struct sis7019 *sis)
        while ((inw(io + SIS_AC97_STATUS) & SIS_AC97_STATUS_BUSY) && --count)
                udelay(1);
+        /* Command complete, we can let go of the semaphore now.
+         */
+        outl(SIS_AC97_SEMA_RELEASE, io + SIS_AC97_SEMA);
+        if (!count)
+                return -EIO;
        /* Now that we've finished the reset, find out what's attached.
+         * There are some codec/board combinations that take an extremely
+         * long time to come up. 350+ ms has been observed in the field,
+         * so we'll give them up to 500ms.
         */
-        status = inl(io + SIS_AC97_STATUS);
+        sis->codecs_present = 0;
-        if (status & SIS_AC97_STATUS_CODEC_READY)
+        timeout = msecs_to_jiffies(500) + jiffies;
-                sis->codecs_present |= SIS_PRIMARY_CODEC_PRESENT;
+        while (time_before_eq(jiffies, timeout)) {
-        if (status & SIS_AC97_STATUS_CODEC2_READY)
+                status = inl(io + SIS_AC97_STATUS);
-                sis->codecs_present |= SIS_SECONDARY_CODEC_PRESENT;
+                if (status & SIS_AC97_STATUS_CODEC_READY)
-        if (status & SIS_AC97_STATUS_CODEC3_READY)
+                        sis->codecs_present |= SIS_PRIMARY_CODEC_PRESENT;
-                sis->codecs_present |= SIS_TERTIARY_CODEC_PRESENT;
+                if (status & SIS_AC97_STATUS_CODEC2_READY)
+                        sis->codecs_present |= SIS_SECONDARY_CODEC_PRESENT;
-        /* All done, let go of the semaphore, and check for errors
+                if (status & SIS_AC97_STATUS_CODEC3_READY)
+                        sis->codecs_present |= SIS_TERTIARY_CODEC_PRESENT;
+                if (sis->codecs_present == codecs)
+                        break;
+                msleep(1);
+        }
+        /* All done, check for errors.
         */
-        outl(SIS_AC97_SEMA_RELEASE, io + SIS_AC97_SEMA);
+        if (!sis->codecs_present) {
-        if (!sis->codecs_present || !count)
+                printk(KERN_ERR "sis7019: could not find any codecs\n");
                return -EIO;
+        }
+        if (sis->codecs_present != codecs) {
+                printk(KERN_WARNING "sis7019: missing codecs, found %0x, expected %0x\n",
+                       sis->codecs_present, codecs);
+        }
        /* Let the hardware know that the audio driver is alive,
         * and enable PCM slots on the AC-link for L/R playback (3 & 4) and
@@ -1390,6 +1421,17 @@ static int __devinit snd_sis7019_probe(struct pci_dev *pci,
        if (!enable)
                goto error_out;
+        /* The user can specify which codecs should be present so that we
+         * can wait for them to show up if they are slow to recover from
+         * the AC97 cold reset. We default to a single codec, the primary.
+         *
+         * We assume that SIS_PRIMARY_*_PRESENT matches bits 0-2.
+         */
+        codecs &= SIS_PRIMARY_CODEC_PRESENT | SIS_SECONDARY_CODEC_PRESENT |
+                  SIS_TERTIARY_CODEC_PRESENT;
+        if (!codecs)
+                codecs = SIS_PRIMARY_CODEC_PRESENT;
        rc = snd_card_create(index, id, THIS_MODULE, sizeof(*sis), &card);
        if (rc < 0)
                goto error_out;
diff --git a/sound/soc/codecs/uda1380.c b/sound/soc/codecs/uda1380.c
index c5ca8cfea60f..0441893e270e 100644
--- a/sound/soc/codecs/uda1380.c
+++ b/sound/soc/codecs/uda1380.c
@@ -863,13 +863,13 @@ static struct i2c_driver uda1380_i2c_driver = {
 static int __init uda1380_modinit(void)
 {
-        int ret;
+        int ret = 0;
 #if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
        ret = i2c_add_driver(&uda1380_i2c_driver);
        if (ret != 0)
                pr_err("Failed to register UDA1380 I2C driver: %d\n", ret);
 #endif
-        return 0;
+        return ret;
 }
 module_init(uda1380_modinit);
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 6c2988549003..d0c545b73d78 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1325,15 +1325,15 @@ SND_SOC_DAPM_DAC("DAC1R", NULL, WM8994_POWER_MANAGEMENT_5, 0, 0),
 };
 static const struct snd_soc_dapm_widget wm8994_adc_revd_widgets[] = {
-SND_SOC_DAPM_MUX_E("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux,
+SND_SOC_DAPM_VIRT_MUX_E("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux,
-                   adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
+                        adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
-SND_SOC_DAPM_MUX_E("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux,
+SND_SOC_DAPM_VIRT_MUX_E("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux,
-                   adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
+                        adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
 };
 static const struct snd_soc_dapm_widget wm8994_adc_widgets[] = {
-SND_SOC_DAPM_MUX("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux),
+SND_SOC_DAPM_VIRT_MUX("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux),
-SND_SOC_DAPM_MUX("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux),
+SND_SOC_DAPM_VIRT_MUX("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux),
 };
 static const struct snd_soc_dapm_widget wm8994_dapm_widgets[] = {
diff --git a/sound/soc/imx/Kconfig b/sound/soc/imx/Kconfig
index b133bfcc5848..738391757f2c 100644
--- a/sound/soc/imx/Kconfig
+++ b/sound/soc/imx/Kconfig
@@ -28,7 +28,7 @@ config SND_MXC_SOC_WM1133_EV1
 config SND_SOC_MX27VIS_AIC32X4
        tristate "SoC audio support for Visstrim M10 boards"
-        depends on MACH_IMX27_VISSTRIM_M10
+        depends on MACH_IMX27_VISSTRIM_M10 && I2C
        select SND_SOC_TLV320AIC32X4
        select SND_MXC_SOC_MX2
        help
diff --git a/sound/soc/kirkwood/Kconfig b/sound/soc/kirkwood/Kconfig
index 8f49e165f4d1..c62d715235e2 100644
--- a/sound/soc/kirkwood/Kconfig
+++ b/sound/soc/kirkwood/Kconfig
@@ -12,6 +12,7 @@ config SND_KIRKWOOD_SOC_I2S
 config SND_KIRKWOOD_SOC_OPENRD
        tristate "SoC Audio support for Kirkwood Openrd Client"
        depends on SND_KIRKWOOD_SOC && (MACH_OPENRD_CLIENT || MACH_OPENRD_ULTIMATE)
+        depends on I2C
        select SND_KIRKWOOD_SOC_I2S
        select SND_SOC_CS42L51
        help
@@ -20,7 +21,7 @@ config SND_KIRKWOOD_SOC_OPENRD
 config SND_KIRKWOOD_SOC_T5325
        tristate "SoC Audio support for HP t5325"
-        depends on SND_KIRKWOOD_SOC && MACH_T5325
+        depends on SND_KIRKWOOD_SOC && MACH_T5325 && I2C
        select SND_KIRKWOOD_SOC_I2S
        select SND_SOC_ALC5623
        help
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index ffd2242e305f..a0f7d3cfa470 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -151,6 +151,7 @@ config SND_SOC_ZYLONITE
 config SND_SOC_RAUMFELD
        tristate "SoC Audio support Raumfeld audio adapter"
        depends on SND_PXA2XX_SOC && (MACH_RAUMFELD_SPEAKER || MACH_RAUMFELD_CONNECTOR)
+        depends on I2C && SPI_MASTER
        select SND_PXA_SOC_SSP
        select SND_SOC_CS4270
        select SND_SOC_AK4104
@@ -159,7 +160,7 @@ config SND_SOC_RAUMFELD
 config SND_PXA2XX_SOC_HX4700
        tristate "SoC Audio support for HP iPAQ hx4700"
-        depends on SND_PXA2XX_SOC && MACH_H4700
+        depends on SND_PXA2XX_SOC && MACH_H4700 && I2C
        select SND_PXA2XX_SOC_I2S
        select SND_SOC_AK4641
        help
diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
index 0c12b98484bd..4220bb0f2730 100644
--- a/sound/soc/soc-utils.c
+++ b/sound/soc/soc-utils.c
@@ -58,7 +58,36 @@ int snd_soc_params_to_bclk(struct snd_pcm_hw_params *params)
 }
 EXPORT_SYMBOL_GPL(snd_soc_params_to_bclk);
-static struct snd_soc_platform_driver dummy_platform;
+static const struct snd_pcm_hardware dummy_dma_hardware = {
+        .formats                = 0xffffffff,
+        .channels_min           = 1,
+        .channels_max           = UINT_MAX,
+        /* Random values to keep userspace happy when checking constraints */
+        .info                   = SNDRV_PCM_INFO_INTERLEAVED |
+                                  SNDRV_PCM_INFO_BLOCK_TRANSFER,
+        .buffer_bytes_max       = 128*1024,
+        .period_bytes_min       = PAGE_SIZE,
+        .period_bytes_max       = PAGE_SIZE*2,
+        .periods_min            = 2,
+        .periods_max            = 128,
+};
+static int dummy_dma_open(struct snd_pcm_substream *substream)
+{
+        snd_soc_set_runtime_hwparams(substream, &dummy_dma_hardware);
+        return 0;
+}
+static struct snd_pcm_ops dummy_dma_ops = {
+        .open           = dummy_dma_open,
+        .ioctl          = snd_pcm_lib_ioctl,
+};
+static struct snd_soc_platform_driver dummy_platform = {
+        .ops = &dummy_dma_ops,
+};
 static __devinit int snd_soc_dummy_probe(struct platform_device *pdev)
 {
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 7d98676808d8..955930e0a5c3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -463,7 +463,8 @@ static int run_perf_stat(int argc __used, const char **argv)
        list_for_each_entry(counter, &evsel_list->entries, node) {
                if (create_perf_stat_counter(counter, first) < 0) {
-                        if (errno == EINVAL || errno == ENOSYS || errno == ENOENT) {
+                        if (errno == EINVAL || errno == ENOSYS ||
+                            errno == ENOENT || errno == EOPNOTSUPP) {
                                if (verbose)
                                        ui__warning("%s event is not supported by the kernel.\n",
                                                    event_name(counter));
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index e42626422587..d7915d4e77cb 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -34,6 +34,16 @@ int __perf_evsel__sample_size(u64 sample_type)
        return size;
 }
+static void hists__init(struct hists *hists)
+{
+        memset(hists, 0, sizeof(*hists));
+        hists->entries_in_array[0] = hists->entries_in_array[1] = RB_ROOT;
+        hists->entries_in = &hists->entries_in_array[0];
+        hists->entries_collapsed = RB_ROOT;
+        hists->entries = RB_ROOT;
+        pthread_mutex_init(&hists->lock, NULL);
+}
 void perf_evsel__init(struct perf_evsel *evsel,
                      struct perf_event_attr *attr, int idx)
 {
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index bcd05d05b4f0..33c17a2b2a81 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -388,7 +388,7 @@ static int write_event_desc(int fd, struct perf_header *h __used,
                /*
                 * write event string as passed on cmdline
                 */
-                ret = do_write_string(fd, attr->name);
+                ret = do_write_string(fd, event_name(attr));
                if (ret < 0)
                        return ret;
                /*
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index a36a3fa81ffb..abef2703cd24 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1211,13 +1211,3 @@ size_t hists__fprintf_nr_events(struct hists *hists, FILE *fp)
        return ret;
 }
-void hists__init(struct hists *hists)
-{
-        memset(hists, 0, sizeof(*hists));
-        hists->entries_in_array[0] = hists->entries_in_array[1] = RB_ROOT;
-        hists->entries_in = &hists->entries_in_array[0];
-        hists->entries_collapsed = RB_ROOT;
-        hists->entries = RB_ROOT;
-        pthread_mutex_init(&hists->lock, NULL);
-}
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index c86c1d27bd1e..89289c8e935e 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -63,8 +63,6 @@ struct hists {
        struct callchain_cursor callchain_cursor;
 };
-void hists__init(struct hists *hists);
 struct hist_entry *__hists__add_entry(struct hists *self,
                                      struct addr_location *al,
                                      struct symbol *parent, u64 period);
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 85c1e6b76f0a..0f4555ce9063 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1333,6 +1333,10 @@ int perf_session__cpu_bitmap(struct perf_session *session,
        }
        map = cpu_map__new(cpu_list);
+        if (map == NULL) {
+                pr_err("Invalid cpu_list\n");
+                return -1;
+        }
        for (i = 0; i < map->nr; i++) {
                int cpu = map->map[i];
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 0a7ed5b5e281..6c164dc9ee95 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -1537,6 +1537,8 @@ process_flags(struct event *event, struct print_arg *arg, char **tok)
        field = malloc_or_die(sizeof(*field));
        type = process_arg(event, field, &token);
+        while (type == EVENT_OP)
+                type = process_op(event, field, &token);
        if (test_type_token(type, token, EVENT_DELIM, ","))
                goto out_free;
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index a195c07fa829..304d7e5717e9 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -113,7 +113,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
                /* Map into IO address space */
                r = iommu_map(domain, gfn_to_gpa(gfn), pfn_to_hpa(pfn),
-                              get_order(page_size), flags);
+                              page_size, flags);
                if (r) {
                        printk(KERN_ERR "kvm_iommu_map_address:"
                               "iommu failed to map pfn=%llx\n", pfn);
@@ -292,15 +292,15 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
        while (gfn < end_gfn) {
                unsigned long unmap_pages;
-                int order;
+                size_t size;
                /* Get physical address */
                phys = iommu_iova_to_phys(domain, gfn_to_gpa(gfn));
                pfn  = phys >> PAGE_SHIFT;
                /* Unmap address from IO address space */
-                order       = iommu_unmap(domain, gfn_to_gpa(gfn), 0);
+                size       = iommu_unmap(domain, gfn_to_gpa(gfn), PAGE_SIZE);
-                unmap_pages = 1ULL << order;
+                unmap_pages = 1ULL << get_order(size);
                /* Unpin all pages we just unmapped to not leak any memory */
                kvm_unpin_pages(kvm, pfn, unmap_pages);