187 files changed, 2288 insertions, 1443 deletions
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index 7514dbf0a679..c36892c072da 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -227,7 +227,7 @@ X!Isound/sound_firmware.c
  <chapter id="uart16x50">
     <title>16x50 UART Driver</title>
 !Edrivers/tty/serial/serial_core.c
-!Edrivers/tty/serial/8250/8250.c
+!Edrivers/tty/serial/8250/8250_core.c
  </chapter>
  <chapter id="fbdev">
diff --git a/Documentation/scsi/LICENSE.qla2xxx b/Documentation/scsi/LICENSE.qla2xxx
index 27a91cf43d6d..5020b7b5a244 100644
--- a/Documentation/scsi/LICENSE.qla2xxx
+++ b/Documentation/scsi/LICENSE.qla2xxx
@@ -1,4 +1,4 @@
-Copyright (c) 2003-2012 QLogic Corporation
+Copyright (c) 2003-2013 QLogic Corporation
 QLogic Linux FC-FCoE Driver
 This program includes a device driver for Linux 3.x.
diff --git a/MAINTAINERS b/MAINTAINERS
index c6108c319db9..8bdd7a7ef2f4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4941,6 +4941,12 @@ W:	logfs.org
 S:      Maintained
 F:      fs/logfs/
+LPC32XX MACHINE SUPPORT
+M:      Roland Stigge <stigge@antcom.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-lpc32xx/
 LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI)
 M:      Nagalakshmi Nandigama <Nagalakshmi.Nandigama@lsi.com>
 M:      Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
@@ -6951,7 +6957,6 @@ F:	drivers/scsi/st*
 SCTP PROTOCOL
 M:      Vlad Yasevich <vyasevich@gmail.com>
-M:      Sridhar Samudrala <sri@us.ibm.com>
 M:      Neil Horman <nhorman@tuxdriver.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
diff --git a/Makefile b/Makefile
index 6db672b15bda..9cf6783c2ec3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Unicycling Gorilla
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h
index ccd84806b62f..eac071668201 100644
--- a/arch/arc/include/asm/irqflags.h
+++ b/arch/arc/include/asm/irqflags.h
@@ -39,7 +39,7 @@ static inline long arch_local_irq_save(void)
        "       flag.nz %0              \n"
        : "=r"(temp), "=r"(flags)
        : "n"((STATUS_E1_MASK | STATUS_E2_MASK))
-        : "cc");
+        : "memory", "cc");
        return flags;
 }
@@ -53,7 +53,8 @@ static inline void arch_local_irq_restore(unsigned long flags)
        __asm__ __volatile__(
        "       flag %0                 \n"
        :
-        : "r"(flags));
+        : "r"(flags)
+        : "memory");
 }
 /*
@@ -73,7 +74,8 @@ static inline void arch_local_irq_disable(void)
        "       and %0, %0, %1          \n"
        "       flag %0                 \n"
        : "=&r"(temp)
-        : "n"(~(STATUS_E1_MASK | STATUS_E2_MASK)));
+        : "n"(~(STATUS_E1_MASK | STATUS_E2_MASK))
+        : "memory");
 }
 /*
@@ -85,7 +87,9 @@ static inline long arch_local_save_flags(void)
        __asm__ __volatile__(
        "       lr  %0, [status32]      \n"
-        : "=&r"(temp));
+        : "=&r"(temp)
+        :
+        : "memory");
        return temp;
 }
diff --git a/arch/arm/boot/dts/imx28-m28evk.dts b/arch/arm/boot/dts/imx28-m28evk.dts
index 6ce3d17c3a29..fd36e1cca104 100644
--- a/arch/arm/boot/dts/imx28-m28evk.dts
+++ b/arch/arm/boot/dts/imx28-m28evk.dts
@@ -152,7 +152,6 @@
                        i2c0: i2c@80058000 {
                                pinctrl-names = "default";
                                pinctrl-0 = <&i2c0_pins_a>;
-                                clock-frequency = <400000>;
                                status = "okay";
                                sgtl5000: codec@0a {
diff --git a/arch/arm/boot/dts/imx28-sps1.dts b/arch/arm/boot/dts/imx28-sps1.dts
index e6cde8aa7fff..6c6a5442800a 100644
--- a/arch/arm/boot/dts/imx28-sps1.dts
+++ b/arch/arm/boot/dts/imx28-sps1.dts
@@ -70,7 +70,6 @@
                        i2c0: i2c@80058000 {
                                pinctrl-names = "default";
                                pinctrl-0 = <&i2c0_pins_a>;
-                                clock-frequency = <400000>;
                                status = "okay";
                                rtc: rtc@51 {
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 06ec460b4581..281a223591ff 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -91,6 +91,7 @@
                        compatible = "arm,cortex-a9-twd-timer";
                        reg = <0x00a00600 0x20>;
                        interrupts = <1 13 0xf01>;
+                        clocks = <&clks 15>;
                };
                L2: l2-cache@00a02000 {
diff --git a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
index 93c3afbef9ee..3694e94f6e99 100644
--- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
+++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
@@ -96,11 +96,11 @@
                                marvell,function = "gpio";
                        };
                        pmx_led_rebuild_brt_ctrl_1: pmx-led-rebuild-brt-ctrl-1 {
-                                marvell,pins = "mpp44";
+                                marvell,pins = "mpp46";
                                marvell,function = "gpio";
                        };
                        pmx_led_rebuild_brt_ctrl_2: pmx-led-rebuild-brt-ctrl-2 {
-                                marvell,pins = "mpp45";
+                                marvell,pins = "mpp47";
                                marvell,function = "gpio";
                        };
@@ -157,14 +157,14 @@
                        gpios = <&gpio0 16 0>;
                        linux,default-trigger = "default-on";
                };
-                health_led1 {
+                rebuild_led {
+                        label = "status:white:rebuild_led";
+                        gpios = <&gpio1 4 0>;
+                };
+                health_led {
                        label = "status:red:health_led";
                        gpios = <&gpio1 5 0>;
                };
-                health_led2 {
-                        label = "status:white:health_led";
-                        gpios = <&gpio1 4 0>;
-                };
                backup_led {
                        label = "status:blue:backup_led";
                        gpios = <&gpio0 15 0>;
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index e13a8fa5e62c..2193c834f55c 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -257,6 +257,7 @@ int __init mx35_clocks_init(void)
        clk_register_clkdev(clk[wdog_gate], NULL, "imx2-wdt.0");
        clk_register_clkdev(clk[nfc_div], NULL, "imx25-nand.0");
        clk_register_clkdev(clk[csi_gate], NULL, "mx3-camera.0");
+        clk_register_clkdev(clk[admux_gate], "audmux", NULL);
        clk_prepare_enable(clk[spba_gate]);
        clk_prepare_enable(clk[gpio1_gate]);
@@ -265,6 +266,7 @@ int __init mx35_clocks_init(void)
        clk_prepare_enable(clk[iim_gate]);
        clk_prepare_enable(clk[emi_gate]);
        clk_prepare_enable(clk[max_gate]);
+        clk_prepare_enable(clk[iomuxc_gate]);
        /*
         * SCC is needed to boot via mmc after a watchdog reset. The clock code
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 2f9ff93a4e61..d38e54f5b6d7 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -115,7 +115,7 @@ static const char *gpu2d_core_sels[]	= { "axi", "pll3_usb_otg", "pll2_pfd0_352m"
 static const char *gpu3d_core_sels[]    = { "mmdc_ch0_axi", "pll3_usb_otg", "pll2_pfd1_594m", "pll2_pfd2_396m", };
 static const char *gpu3d_shader_sels[] = { "mmdc_ch0_axi", "pll3_usb_otg", "pll2_pfd1_594m", "pll2_pfd9_720m", };
 static const char *ipu_sels[]           = { "mmdc_ch0_axi", "pll2_pfd2_396m", "pll3_120m", "pll3_pfd1_540m", };
-static const char *ldb_di_sels[]        = { "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "mmdc_ch1_axi", "pll3_pfd1_540m", };
+static const char *ldb_di_sels[]        = { "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "mmdc_ch1_axi", "pll3_usb_otg", };
 static const char *ipu_di_pre_sels[]    = { "mmdc_ch0_axi", "pll3_usb_otg", "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "pll3_pfd1_540m", };
 static const char *ipu1_di0_sels[]      = { "ipu1_di0_pre", "dummy", "dummy", "ldb_di0", "ldb_di1", };
 static const char *ipu1_di1_sels[]      = { "ipu1_di1_pre", "dummy", "dummy", "ldb_di0", "ldb_di1", };
@@ -443,7 +443,6 @@ int __init mx6q_clocks_init(void)
        clk_register_clkdev(clk[gpt_ipg], "ipg", "imx-gpt.0");
        clk_register_clkdev(clk[gpt_ipg_per], "per", "imx-gpt.0");
-        clk_register_clkdev(clk[twd], NULL, "smp_twd");
        clk_register_clkdev(clk[cko1_sel], "cko1_sel", NULL);
        clk_register_clkdev(clk[ahb], "ahb", NULL);
        clk_register_clkdev(clk[cko1], "cko1", NULL);
diff --git a/arch/arm/mach-kirkwood/board-iomega_ix2_200.c b/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
index f655b2637b0e..e5f70415905a 100644
--- a/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
+++ b/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
@@ -20,10 +20,15 @@ static struct mv643xx_eth_platform_data iomega_ix2_200_ge00_data = {
        .duplex         = DUPLEX_FULL,
 };
+static struct mv643xx_eth_platform_data iomega_ix2_200_ge01_data = {
+        .phy_addr       = MV643XX_ETH_PHY_ADDR(11),
+};
 void __init iomega_ix2_200_init(void)
 {
        /*
         * Basic setup. Needs to be called early.
         */
-        kirkwood_ge01_init(&iomega_ix2_200_ge00_data);
+        kirkwood_ge00_init(&iomega_ix2_200_ge00_data);
+        kirkwood_ge01_init(&iomega_ix2_200_ge01_data);
 }
diff --git a/arch/arm/mach-mvebu/irq-armada-370-xp.c b/arch/arm/mach-mvebu/irq-armada-370-xp.c
index 6a9195e10579..d5970f5a1e8d 100644
--- a/arch/arm/mach-mvebu/irq-armada-370-xp.c
+++ b/arch/arm/mach-mvebu/irq-armada-370-xp.c
@@ -61,7 +61,6 @@ static struct irq_domain *armada_370_xp_mpic_domain;
 */
 static void armada_370_xp_irq_mask(struct irq_data *d)
 {
-#ifdef CONFIG_SMP
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
        if (hwirq != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
@@ -70,15 +69,10 @@ static void armada_370_xp_irq_mask(struct irq_data *d)
        else
                writel(hwirq, per_cpu_int_base +
                                ARMADA_370_XP_INT_SET_MASK_OFFS);
-#else
-        writel(irqd_to_hwirq(d),
-               per_cpu_int_base + ARMADA_370_XP_INT_SET_MASK_OFFS);
-#endif
 }
 static void armada_370_xp_irq_unmask(struct irq_data *d)
 {
-#ifdef CONFIG_SMP
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
        if (hwirq != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
@@ -87,10 +81,6 @@ static void armada_370_xp_irq_unmask(struct irq_data *d)
        else
                writel(hwirq, per_cpu_int_base +
                                ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
-#else
-        writel(irqd_to_hwirq(d),
-               per_cpu_int_base + ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
-#endif
 }
 #ifdef CONFIG_SMP
@@ -146,7 +136,11 @@ static int armada_370_xp_mpic_irq_map(struct irq_domain *h,
                                      unsigned int virq, irq_hw_number_t hw)
 {
        armada_370_xp_irq_mask(irq_get_irq_data(virq));
-        writel(hw, main_int_base + ARMADA_370_XP_INT_SET_ENABLE_OFFS);
+        if (hw != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
+                writel(hw, per_cpu_int_base +
+                        ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
+        else
+                writel(hw, main_int_base + ARMADA_370_XP_INT_SET_ENABLE_OFFS);
        irq_set_status_flags(virq, IRQ_LEVEL);
        if (hw == ARMADA_370_XP_TIMER0_PER_CPU_IRQ) {
diff --git a/arch/arm/mach-s3c24xx/include/mach/irqs.h b/arch/arm/mach-s3c24xx/include/mach/irqs.h
index b7a9f4d469e8..1e73f5fa8659 100644
--- a/arch/arm/mach-s3c24xx/include/mach/irqs.h
+++ b/arch/arm/mach-s3c24xx/include/mach/irqs.h
@@ -188,10 +188,8 @@
 #if defined(CONFIG_CPU_S3C2416)
 #define NR_IRQS (IRQ_S3C2416_I2S1 + 1)
-#elif defined(CONFIG_CPU_S3C2443)
-#define NR_IRQS (IRQ_S3C2443_AC97+1)
 #else
-#define NR_IRQS (IRQ_S3C2440_AC97+1)
+#define NR_IRQS (IRQ_S3C2443_AC97 + 1)
 #endif
 /* compatibility define. */
diff --git a/arch/arm/mach-s3c24xx/irq.c b/arch/arm/mach-s3c24xx/irq.c
index cb9f5e011e73..d8ba9bee4c7e 100644
--- a/arch/arm/mach-s3c24xx/irq.c
+++ b/arch/arm/mach-s3c24xx/irq.c
@@ -500,7 +500,7 @@ struct s3c_irq_intc *s3c24xx_init_intc(struct device_node *np,
                base = (void *)0xfd000000;
                intc->reg_mask = base + 0xa4;
-                intc->reg_pending = base + 0x08;
+                intc->reg_pending = base + 0xa8;
                irq_num = 20;
                irq_start = S3C2410_IRQ(32);
                irq_offset = 4;
diff --git a/arch/c6x/include/asm/irqflags.h b/arch/c6x/include/asm/irqflags.h
index cf78e09e18c3..2c71d5634ec2 100644
--- a/arch/c6x/include/asm/irqflags.h
+++ b/arch/c6x/include/asm/irqflags.h
@@ -27,7 +27,7 @@ static inline unsigned long arch_local_save_flags(void)
 /* set interrupt enabled status */
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-        asm volatile (" mvc .s2 %0,CSR\n" : : "b"(flags));
+        asm volatile (" mvc .s2 %0,CSR\n" : : "b"(flags) : "memory");
 }
 /* unconditionally enable interrupts */
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
index 77597e5ea60a..79521d5499f9 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
@@ -849,17 +849,6 @@ static palinfo_entry_t palinfo_entries[]={
 #define NR_PALINFO_ENTRIES      (int) ARRAY_SIZE(palinfo_entries)
-/*
- * this array is used to keep track of the proc entries we create. This is
- * required in the module mode when we need to remove all entries. The procfs code
- * does not do recursion of deletion
- *
- * Notes:
- *      - +1 accounts for the cpuN directory entry in /proc/pal
- */
-#define NR_PALINFO_PROC_ENTRIES (NR_CPUS*(NR_PALINFO_ENTRIES+1))
-static struct proc_dir_entry *palinfo_proc_entries[NR_PALINFO_PROC_ENTRIES];
 static struct proc_dir_entry *palinfo_dir;
 /*
@@ -971,60 +960,32 @@ palinfo_read_entry(char *page, char **start, off_t off, int count, int *eof, voi
 static void __cpuinit
 create_palinfo_proc_entries(unsigned int cpu)
 {
-#       define CPUSTR   "cpu%d"
        pal_func_cpu_u_t f;
-        struct proc_dir_entry **pdir;
        struct proc_dir_entry *cpu_dir;
        int j;
-        char cpustr[sizeof(CPUSTR)];
+        char cpustr[3+4+1];     /* cpu numbers are up to 4095 on itanic */
+        sprintf(cpustr, "cpu%d", cpu);
-        /*
-         * we keep track of created entries in a depth-first order for
-         * cleanup purposes. Each entry is stored into palinfo_proc_entries
-         */
-        sprintf(cpustr,CPUSTR, cpu);
        cpu_dir = proc_mkdir(cpustr, palinfo_dir);
+        if (!cpu_dir)
+                return;
        f.req_cpu = cpu;
-        /*
-         * Compute the location to store per cpu entries
-         * We dont store the top level entry in this list, but
-         * remove it finally after removing all cpu entries.
-         */
-        pdir = &palinfo_proc_entries[cpu*(NR_PALINFO_ENTRIES+1)];
-        *pdir++ = cpu_dir;
        for (j=0; j < NR_PALINFO_ENTRIES; j++) {
                f.func_id = j;
-                *pdir = create_proc_read_entry(
+                create_proc_read_entry(
-                                palinfo_entries[j].name, 0, cpu_dir,
+                        palinfo_entries[j].name, 0, cpu_dir,
-                                palinfo_read_entry, (void *)f.value);
+                        palinfo_read_entry, (void *)f.value);
-                pdir++;
        }
 }
 static void
 remove_palinfo_proc_entries(unsigned int hcpu)
 {
-        int j;
+        char cpustr[3+4+1];     /* cpu numbers are up to 4095 on itanic */
-        struct proc_dir_entry *cpu_dir, **pdir;
+        sprintf(cpustr, "cpu%d", hcpu);
+        remove_proc_subtree(cpustr, palinfo_dir);
-        pdir = &palinfo_proc_entries[hcpu*(NR_PALINFO_ENTRIES+1)];
-        cpu_dir = *pdir;
-        *pdir++=NULL;
-        for (j=0; j < (NR_PALINFO_ENTRIES); j++) {
-                if ((*pdir)) {
-                        remove_proc_entry ((*pdir)->name, cpu_dir);
-                        *pdir ++= NULL;
-                }
-        }
-        if (cpu_dir) {
-                remove_proc_entry(cpu_dir->name, palinfo_dir);
-        }
 }
 static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
@@ -1058,6 +1019,8 @@ palinfo_init(void)
        printk(KERN_INFO "PAL Information Facility v%s\n", PALINFO_VERSION);
        palinfo_dir = proc_mkdir("pal", NULL);
+        if (!palinfo_dir)
+                return -ENOMEM;
        /* Create palinfo dirs in /proc for all online cpus */
        for_each_online_cpu(i) {
@@ -1073,22 +1036,8 @@ palinfo_init(void)
 static void __exit
 palinfo_exit(void)
 {
-        int i = 0;
-        /* remove all nodes: depth first pass. Could optimize this  */
-        for_each_online_cpu(i) {
-                remove_palinfo_proc_entries(i);
-        }
-        /*
-         * Remove the top level entry finally
-         */
-        remove_proc_entry(palinfo_dir->name, NULL);
-        /*
-         * Unregister from cpu notifier callbacks
-         */
        unregister_hotcpu_notifier(&palinfo_cpu_notifier);
+        remove_proc_subtree("pal", NULL);
 }
 module_init(palinfo_init);
diff --git a/arch/m68k/include/asm/gpio.h b/arch/m68k/include/asm/gpio.h
index 4395ffc51fdb..8cc83431805b 100644
--- a/arch/m68k/include/asm/gpio.h
+++ b/arch/m68k/include/asm/gpio.h
@@ -86,4 +86,24 @@ static inline int gpio_cansleep(unsigned gpio)
        return gpio < MCFGPIO_PIN_MAX ? 0 : __gpio_cansleep(gpio);
 }
+static inline int gpio_request_one(unsigned gpio, unsigned long flags, const char *label)
+{
+        int err;
+        err = gpio_request(gpio, label);
+        if (err)
+                return err;
+        if (flags & GPIOF_DIR_IN)
+                err = gpio_direction_input(gpio);
+        else
+                err = gpio_direction_output(gpio,
+                        (flags & GPIOF_INIT_HIGH) ? 1 : 0);
+        if (err)
+                gpio_free(gpio);
+        return err;
+}
 #endif
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 0da39fed355a..299731e9036b 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
                                           (0x1UL << 4), &dummy1, &dummy2);
                if (lpar_rc == H_SUCCESS)
                        return i;
-                BUG_ON(lpar_rc != H_NOT_FOUND);
+                /*
+                 * The test for adjunct partition is performed before the
+                 * ANDCOND test.  H_RESOURCE may be returned, so we need to
+                 * check for that as well.
+                 */
+                BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
                slot_offset++;
                slot_offset &= 0x7;
diff --git a/arch/tile/include/asm/irqflags.h b/arch/tile/include/asm/irqflags.h
index 241c0bb60b12..c96f9bbb760d 100644
--- a/arch/tile/include/asm/irqflags.h
+++ b/arch/tile/include/asm/irqflags.h
@@ -40,7 +40,15 @@
 #include <asm/percpu.h>
 #include <arch/spr_def.h>
-/* Set and clear kernel interrupt masks. */
+/*
+ * Set and clear kernel interrupt masks.
+ *
+ * NOTE: __insn_mtspr() is a compiler builtin marked as a memory
+ * clobber.  We rely on it being equivalent to a compiler barrier in
+ * this code since arch_local_irq_save() and friends must act as
+ * compiler barriers.  This compiler semantic is baked into enough
+ * places that the compiler will maintain it going forward.
+ */
 #if CHIP_HAS_SPLIT_INTR_MASK()
 #if INT_PERF_COUNT < 32 || INT_AUX_PERF_COUNT < 32 || INT_MEM_ERROR >= 32
 # error Fix assumptions about which word various interrupts are in
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 5edd1742cfd0..7361e47db79f 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -703,7 +703,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
        PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
 }
-void arch_flush_lazy_mmu_mode(void);
+static inline void arch_flush_lazy_mmu_mode(void)
+{
+        PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
+}
 static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
                                phys_addr_t phys, pgprot_t flags)
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 142236ed83af..b3b0ec1dac86 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -91,6 +91,7 @@ struct pv_lazy_ops {
        /* Set deferred update mode, used for batching operations. */
        void (*enter)(void);
        void (*leave)(void);
+        void (*flush)(void);
 };
 struct pv_time_ops {
@@ -679,6 +680,7 @@ void paravirt_end_context_switch(struct task_struct *next);
 void paravirt_enter_lazy_mmu(void);
 void paravirt_leave_lazy_mmu(void);
+void paravirt_flush_lazy_mmu(void);
 void _paravirt_nop(void);
 u32 _paravirt_ident_32(u32);
diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
index 4fef20773b8f..c7797307fc2b 100644
--- a/arch/x86/include/asm/tlb.h
+++ b/arch/x86/include/asm/tlb.h
@@ -7,7 +7,7 @@
 #define tlb_flush(tlb)                                                  \
 {                                                                       \
-        if (tlb->fullmm == 0)                                           \
+        if (!tlb->fullmm && !tlb->need_flush_all)                       \
                flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end, 0UL); \
        else                                                            \
                flush_tlb_mm_range(tlb->mm, 0UL, TLB_FLUSH_ALL, 0UL);   \
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index b05a575d56f4..26830f3af0df 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
        if (top <= at)
                return 0;
+        memset(&regs, 0, sizeof(regs));
        ds->bts_index = ds->bts_buffer_base;
        perf_sample_data_init(&data, 0, event->hw.last_period);
-        regs.ip     = 0;
        /*
         * Prepare a generic sample, i.e. fill in the invariant fields.
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 17fff18a1031..8bfb335f74bb 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -263,6 +263,18 @@ void paravirt_leave_lazy_mmu(void)
        leave_lazy(PARAVIRT_LAZY_MMU);
 }
+void paravirt_flush_lazy_mmu(void)
+{
+        preempt_disable();
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
+                arch_leave_lazy_mmu_mode();
+                arch_enter_lazy_mmu_mode();
+        }
+        preempt_enable();
+}
 void paravirt_start_context_switch(struct task_struct *prev)
 {
        BUG_ON(preemptible());
@@ -292,18 +304,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
        return this_cpu_read(paravirt_lazy_mode);
 }
-void arch_flush_lazy_mmu_mode(void)
-{
-        preempt_disable();
-        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
-                arch_leave_lazy_mmu_mode();
-                arch_enter_lazy_mmu_mode();
-        }
-        preempt_enable();
-}
 struct pv_info pv_info = {
        .name = "bare hardware",
        .paravirt_enabled = 0,
@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
        .lazy_mode = {
                .enter = paravirt_nop,
                .leave = paravirt_nop,
+                .flush = paravirt_nop,
        },
        .set_fixmap = native_set_fixmap,
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 1cbd89ca5569..7114c63f047d 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -1334,6 +1334,7 @@ __init void lguest_init(void)
        pv_mmu_ops.read_cr3 = lguest_read_cr3;
        pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
        pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
+        pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
        pv_mmu_ops.pte_update = lguest_pte_update;
        pv_mmu_ops.pte_update_defer = lguest_pte_update;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2b97525246d4..0e883364abb5 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -378,10 +378,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
        if (pgd_none(*pgd_ref))
                return -1;
-        if (pgd_none(*pgd))
+        if (pgd_none(*pgd)) {
                set_pgd(pgd, *pgd_ref);
-        else
+                arch_flush_lazy_mmu_mode();
+        } else {
                BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
+        }
        /*
         * Below here mismatches are bugs because these lower tables
diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
index b0086567271c..0e38951e65eb 100644
--- a/arch/x86/mm/pageattr-test.c
+++ b/arch/x86/mm/pageattr-test.c
@@ -68,7 +68,7 @@ static int print_split(struct split_state *s)
                        s->gpg++;
                        i += GPS/PAGE_SIZE;
                } else if (level == PG_LEVEL_2M) {
-                        if (!(pte_val(*pte) & _PAGE_PSE)) {
+                        if ((pte_val(*pte) & _PAGE_PRESENT) && !(pte_val(*pte) & _PAGE_PSE)) {
                                printk(KERN_ERR
                                        "%lx level %d but not PSE %Lx\n",
                                        addr, level, (u64)pte_val(*pte));
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 091934e1d0d9..fb4e73ec24d8 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -467,7 +467,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
         * We are safe now. Check whether the new pgprot is the same:
         */
        old_pte = *kpte;
-        old_prot = new_prot = req_prot = pte_pgprot(old_pte);
+        old_prot = req_prot = pte_pgprot(old_pte);
        pgprot_val(req_prot) &= ~pgprot_val(cpa->mask_clr);
        pgprot_val(req_prot) |= pgprot_val(cpa->mask_set);
@@ -478,12 +478,12 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
         * a non present pmd. The canon_pgprot will clear _PAGE_GLOBAL
         * for the ancient hardware that doesn't support it.
         */
-        if (pgprot_val(new_prot) & _PAGE_PRESENT)
+        if (pgprot_val(req_prot) & _PAGE_PRESENT)
-                pgprot_val(new_prot) |= _PAGE_PSE | _PAGE_GLOBAL;
+                pgprot_val(req_prot) |= _PAGE_PSE | _PAGE_GLOBAL;
        else
-                pgprot_val(new_prot) &= ~(_PAGE_PSE | _PAGE_GLOBAL);
+                pgprot_val(req_prot) &= ~(_PAGE_PSE | _PAGE_GLOBAL);
-        new_prot = canon_pgprot(new_prot);
+        req_prot = canon_pgprot(req_prot);
        /*
         * old_pte points to the large page base address. So we need
@@ -1413,6 +1413,8 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
         * but that can deadlock->flush only current cpu:
         */
        __flush_tlb_all();
+        arch_flush_lazy_mmu_mode();
 }
 #ifdef CONFIG_HIBERNATION
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 193350b51f90..17fda6a8b3c2 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -58,6 +58,13 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
        paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
+        /*
+         * NOTE! For PAE, any changes to the top page-directory-pointer-table
+         * entries need a full cr3 reload to flush.
+         */
+#ifdef CONFIG_X86_PAE
+        tlb->need_flush_all = 1;
+#endif
        tlb_remove_page(tlb, virt_to_page(pmd));
 }
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 6afbb2ca9a0a..e006c18d288a 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1748,14 +1748,18 @@ static void *m2v(phys_addr_t maddr)
 }
 /* Set the page permissions on an identity-mapped pages */
-static void set_page_prot(void *addr, pgprot_t prot)
+static void set_page_prot_flags(void *addr, pgprot_t prot, unsigned long flags)
 {
        unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
        pte_t pte = pfn_pte(pfn, prot);
-        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
+        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, flags))
                BUG();
 }
+static void set_page_prot(void *addr, pgprot_t prot)
+{
+        return set_page_prot_flags(addr, prot, UVMF_NONE);
+}
 #ifdef CONFIG_X86_32
 static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
 {
@@ -1839,12 +1843,12 @@ static void __init check_pt_base(unsigned long *pt_base, unsigned long *pt_end,
                                 unsigned long addr)
 {
        if (*pt_base == PFN_DOWN(__pa(addr))) {
-                set_page_prot((void *)addr, PAGE_KERNEL);
+                set_page_prot_flags((void *)addr, PAGE_KERNEL, UVMF_INVLPG);
                clear_page((void *)addr);
                (*pt_base)++;
        }
        if (*pt_end == PFN_DOWN(__pa(addr))) {
-                set_page_prot((void *)addr, PAGE_KERNEL);
+                set_page_prot_flags((void *)addr, PAGE_KERNEL, UVMF_INVLPG);
                clear_page((void *)addr);
                (*pt_end)--;
        }
@@ -2196,6 +2200,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
        .lazy_mode = {
                .enter = paravirt_enter_lazy_mmu,
                .leave = xen_leave_lazy_mmu,
+                .flush = paravirt_flush_lazy_mmu,
        },
        .set_fixmap = xen_set_fixmap,
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 6206a934eb8c..5efc5a647183 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -229,6 +229,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
        unsigned long val;                                              \
        ssize_t ret;                                                    \
        ret = queue_var_store(&val, page, count);                       \
+        if (ret < 0)                                                    \
+                 return ret;                                            \
        if (neg)                                                        \
                val = !val;                                             \
                                                                        \
diff --git a/block/partition-generic.c b/block/partition-generic.c
index ae95ee6a58aa..789cdea05893 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -257,7 +257,6 @@ void delete_partition(struct gendisk *disk, int partno)
        hd_struct_put(part);
 }
-EXPORT_SYMBOL(delete_partition);
 static ssize_t whole_disk_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
diff --git a/crypto/gcm.c b/crypto/gcm.c
index 137ad1ec5438..13ccbda34ff9 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
 struct crypto_rfc4543_req_ctx {
        u8 auth_tag[16];
+        u8 assocbuf[32];
        struct scatterlist cipher[1];
        struct scatterlist payload[2];
        struct scatterlist assoc[2];
@@ -1133,9 +1134,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
        scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
        assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
-        sg_init_table(assoc, 2);
+        if (req->assoc->length == req->assoclen) {
-        sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+                sg_init_table(assoc, 2);
-                    req->assoc->offset);
+                sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+                            req->assoc->offset);
+        } else {
+                BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
+                scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
+                                         req->assoclen, 0);
+                sg_init_table(assoc, 2);
+                sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
+        }
        scatterwalk_crypto_chain(assoc, payload, 0, 2);
        aead_request_set_tfm(subreq, ctx->child);
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index ffdd32d22602..2f48123d74c4 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -150,6 +150,7 @@ enum piix_controller_ids {
        tolapai_sata,
        piix_pata_vmw,                  /* PIIX4 for VMware, spurious DMA_ERR */
        ich8_sata_snb,
+        ich8_2port_sata_snb,
 };
 struct piix_map_db {
@@ -304,7 +305,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
        /* SATA Controller IDE (Lynx Point) */
        { 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
        /* SATA Controller IDE (Lynx Point) */
-        { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
        /* SATA Controller IDE (Lynx Point) */
        { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (Lynx Point-LP) */
@@ -439,6 +440,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
        [ich8m_apple_sata]      = &ich8m_apple_map_db,
        [tolapai_sata]          = &tolapai_map_db,
        [ich8_sata_snb]         = &ich8_map_db,
+        [ich8_2port_sata_snb]   = &ich8_2port_map_db,
 };
 static struct pci_bits piix_enable_bits[] = {
@@ -1242,6 +1244,16 @@ static struct ata_port_info piix_port_info[] = {
                .udma_mask      = ATA_UDMA6,
                .port_ops       = &piix_sata_ops,
        },
+        [ich8_2port_sata_snb] =
+        {
+                .flags          = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
+                                        | PIIX_FLAG_PIO16,
+                .pio_mask       = ATA_PIO4,
+                .mwdma_mask     = ATA_MWDMA2,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &piix_sata_ops,
+        },
 };
 #define AHCI_PCI_BAR 5
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 497adea1f0d6..63c743baf920 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2329,7 +2329,7 @@ int ata_dev_configure(struct ata_device *dev)
                 * from SATA Settings page of Identify Device Data Log.
                 */
                if (ata_id_has_devslp(dev->id)) {
-                        u8 sata_setting[ATA_SECT_SIZE];
+                        u8 *sata_setting = ap->sector_buf;
                        int i, j;
                        dev->flags |= ATA_DFLAG_DEVSLP;
@@ -2439,6 +2439,9 @@ int ata_dev_configure(struct ata_device *dev)
                dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
                                         dev->max_sectors);
+        if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
+                dev->max_sectors = ATA_MAX_SECTORS_LBA48;
        if (ap->ops->dev_config)
                ap->ops->dev_config(dev);
@@ -4100,6 +4103,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* Weird ATAPI devices */
        { "TORiSAN DVD-ROM DRD-N216", NULL,     ATA_HORKAGE_MAX_SEC_128 },
        { "QUANTUM DAT    DAT72-000", NULL,     ATA_HORKAGE_ATAPI_MOD16_DMA },
+        { "Slimtype DVD A  DS8A8SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
        /* Devices we expect to fail diagnostics */
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 318b41358187..ff44787e5a45 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -532,8 +532,8 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
                        struct scsi_sense_hdr sshdr;
                        scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
                                             &sshdr);
-                        if (sshdr.sense_key == 0 &&
+                        if (sshdr.sense_key == RECOVERED_ERROR &&
-                            sshdr.asc == 0 && sshdr.ascq == 0)
+                            sshdr.asc == 0 && sshdr.ascq == 0x1d)
                                cmd_result &= ~SAM_STAT_CHECK_CONDITION;
                }
@@ -618,8 +618,8 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
                        struct scsi_sense_hdr sshdr;
                        scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
                                                &sshdr);
-                        if (sshdr.sense_key == 0 &&
+                        if (sshdr.sense_key == RECOVERED_ERROR &&
-                                sshdr.asc == 0 && sshdr.ascq == 0)
+                            sshdr.asc == 0 && sshdr.ascq == 0x1d)
                                cmd_result &= ~SAM_STAT_CHECK_CONDITION;
                }
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index d34adef1e63e..58cfb3232428 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -943,7 +943,8 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
                unsigned int ival;
                int val_bytes = map->format.val_bytes;
                for (i = 0; i < val_len / val_bytes; i++) {
-                        ival = map->format.parse_val(val + (i * val_bytes));
+                        memcpy(map->work_buf, val + (i * val_bytes), val_bytes);
+                        ival = map->format.parse_val(map->work_buf);
                        ret = regcache_write(map, reg + (i * map->reg_stride),
                                             ival);
                        if (ret) {
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 2c127f9c3f3b..dfe758382eaf 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1051,29 +1051,12 @@ static int loop_clr_fd(struct loop_device *lo)
        lo->lo_state = Lo_unbound;
        /* This is safe: open() is still holding a reference. */
        module_put(THIS_MODULE);
+        if (lo->lo_flags & LO_FLAGS_PARTSCAN && bdev)
+                ioctl_by_bdev(bdev, BLKRRPART, 0);
        lo->lo_flags = 0;
        if (!part_shift)
                lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
        mutex_unlock(&lo->lo_ctl_mutex);
-        /*
-         * Remove all partitions, since BLKRRPART won't remove user
-         * added partitions when max_part=0
-         */
-        if (bdev) {
-                struct disk_part_iter piter;
-                struct hd_struct *part;
-                mutex_lock_nested(&bdev->bd_mutex, 1);
-                invalidate_partition(bdev->bd_disk, 0);
-                disk_part_iter_init(&piter, bdev->bd_disk,
-                                        DISK_PITER_INCL_EMPTY);
-                while ((part = disk_part_iter_next(&piter)))
-                        delete_partition(bdev->bd_disk, part->partno);
-                disk_part_iter_exit(&piter);
-                mutex_unlock(&bdev->bd_mutex);
-        }
        /*
         * Need not hold lo_ctl_mutex to fput backing file.
         * Calling fput holding lo_ctl_mutex triggers a circular
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 92250af84e7d..32c678028e53 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -81,12 +81,17 @@
 /* Device instance number, incremented each time a device is probed. */
 static int instance;
+struct list_head online_list;
+struct list_head removing_list;
+spinlock_t dev_lock;
 /*
 * Global variable used to hold the major block device number
 * allocated in mtip_init().
 */
 static int mtip_major;
 static struct dentry *dfs_parent;
+static struct dentry *dfs_device_status;
 static u32 cpu_use[NR_CPUS];
@@ -243,40 +248,31 @@ static inline void release_slot(struct mtip_port *port, int tag)
 /*
 * Reset the HBA (without sleeping)
 *
- * Just like hba_reset, except does not call sleep, so can be
- * run from interrupt/tasklet context.
- *
 * @dd Pointer to the driver data structure.
 *
 * return value
 *      0       The reset was successful.
 *      -1      The HBA Reset bit did not clear.
 */
-static int hba_reset_nosleep(struct driver_data *dd)
+static int mtip_hba_reset(struct driver_data *dd)
 {
        unsigned long timeout;
-        /* Chip quirk: quiesce any chip function */
-        mdelay(10);
        /* Set the reset bit */
        writel(HOST_RESET, dd->mmio + HOST_CTL);
        /* Flush */
        readl(dd->mmio + HOST_CTL);
-        /*
+        /* Spin for up to 2 seconds, waiting for reset acknowledgement */
-         * Wait 10ms then spin for up to 1 second
+        timeout = jiffies + msecs_to_jiffies(2000);
-         * waiting for reset acknowledgement
+        do {
-         */
+                mdelay(10);
-        timeout = jiffies + msecs_to_jiffies(1000);
+                if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))
-        mdelay(10);
+                        return -1;
-        while ((readl(dd->mmio + HOST_CTL) & HOST_RESET)
-                 && time_before(jiffies, timeout))
-                mdelay(1);
-        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))
+        } while ((readl(dd->mmio + HOST_CTL) & HOST_RESET)
-                return -1;
+                 && time_before(jiffies, timeout));
        if (readl(dd->mmio + HOST_CTL) & HOST_RESET)
                return -1;
@@ -481,7 +477,7 @@ static void mtip_restart_port(struct mtip_port *port)
                dev_warn(&port->dd->pdev->dev,
                        "PxCMD.CR not clear, escalating reset\n");
-                if (hba_reset_nosleep(port->dd))
+                if (mtip_hba_reset(port->dd))
                        dev_err(&port->dd->pdev->dev,
                                "HBA reset escalation failed.\n");
@@ -527,6 +523,26 @@ static void mtip_restart_port(struct mtip_port *port)
 }
+static int mtip_device_reset(struct driver_data *dd)
+{
+        int rv = 0;
+        if (mtip_check_surprise_removal(dd->pdev))
+                return 0;
+        if (mtip_hba_reset(dd) < 0)
+                rv = -EFAULT;
+        mdelay(1);
+        mtip_init_port(dd->port);
+        mtip_start_port(dd->port);
+        /* Enable interrupts on the HBA. */
+        writel(readl(dd->mmio + HOST_CTL) | HOST_IRQ_EN,
+                                        dd->mmio + HOST_CTL);
+        return rv;
+}
 /*
 * Helper function for tag logging
 */
@@ -632,7 +648,7 @@ static void mtip_timeout_function(unsigned long int data)
        if (cmdto_cnt) {
                print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
                if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
-                        mtip_restart_port(port);
+                        mtip_device_reset(port->dd);
                        wake_up_interruptible(&port->svc_wait);
                }
                clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
@@ -1283,11 +1299,11 @@ static int mtip_exec_internal_command(struct mtip_port *port,
        int rv = 0, ready2go = 1;
        struct mtip_cmd *int_cmd = &port->commands[MTIP_TAG_INTERNAL];
        unsigned long to;
+        struct driver_data *dd = port->dd;
        /* Make sure the buffer is 8 byte aligned. This is asic specific. */
        if (buffer & 0x00000007) {
-                dev_err(&port->dd->pdev->dev,
+                dev_err(&dd->pdev->dev, "SG buffer is not 8 byte aligned\n");
-                        "SG buffer is not 8 byte aligned\n");
                return -EFAULT;
        }
@@ -1300,23 +1316,21 @@ static int mtip_exec_internal_command(struct mtip_port *port,
                mdelay(100);
        } while (time_before(jiffies, to));
        if (!ready2go) {
-                dev_warn(&port->dd->pdev->dev,
+                dev_warn(&dd->pdev->dev,
                        "Internal cmd active. new cmd [%02X]\n", fis->command);
                return -EBUSY;
        }
        set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
        port->ic_pause_timer = 0;
-        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+        clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
-                clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+        clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
-        else if (fis->command == ATA_CMD_DOWNLOAD_MICRO)
-                clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
        if (atomic == GFP_KERNEL) {
                if (fis->command != ATA_CMD_STANDBYNOW1) {
                        /* wait for io to complete if non atomic */
                        if (mtip_quiesce_io(port, 5000) < 0) {
-                                dev_warn(&port->dd->pdev->dev,
+                                dev_warn(&dd->pdev->dev,
                                        "Failed to quiesce IO\n");
                                release_slot(port, MTIP_TAG_INTERNAL);
                                clear_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
@@ -1361,58 +1375,84 @@ static int mtip_exec_internal_command(struct mtip_port *port,
        /* Issue the command to the hardware */
        mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL);
-        /* Poll if atomic, wait_for_completion otherwise */
        if (atomic == GFP_KERNEL) {
                /* Wait for the command to complete or timeout. */
-                if (wait_for_completion_timeout(
+                if (wait_for_completion_interruptible_timeout(
                                &wait,
-                                msecs_to_jiffies(timeout)) == 0) {
+                                msecs_to_jiffies(timeout)) <= 0) {
-                        dev_err(&port->dd->pdev->dev,
+                        if (rv == -ERESTARTSYS) { /* interrupted */
-                                "Internal command did not complete [%d] "
+                                dev_err(&dd->pdev->dev,
-                                "within timeout of  %lu ms\n",
+                                        "Internal command [%02X] was interrupted after %lu ms\n",
-                                atomic, timeout);
+                                        fis->command, timeout);
-                        if (mtip_check_surprise_removal(port->dd->pdev) ||
+                                rv = -EINTR;
+                                goto exec_ic_exit;
+                        } else if (rv == 0) /* timeout */
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command did not complete [%02X] within timeout of  %lu ms\n",
+                                        fis->command, timeout);
+                        else
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] wait returned code [%d] after %lu ms - unhandled\n",
+                                        fis->command, rv, timeout);
+                        if (mtip_check_surprise_removal(dd->pdev) ||
                                test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
-                                                &port->dd->dd_flag)) {
+                                                &dd->dd_flag)) {
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] wait returned due to SR\n",
+                                        fis->command);
                                rv = -ENXIO;
                                goto exec_ic_exit;
                        }
+                        mtip_device_reset(dd); /* recover from timeout issue */
                        rv = -EAGAIN;
+                        goto exec_ic_exit;
                }
        } else {
+                u32 hba_stat, port_stat;
                /* Spin for <timeout> checking if command still outstanding */
                timeout = jiffies + msecs_to_jiffies(timeout);
                while ((readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                                & (1 << MTIP_TAG_INTERNAL))
                                && time_before(jiffies, timeout)) {
-                        if (mtip_check_surprise_removal(port->dd->pdev)) {
+                        if (mtip_check_surprise_removal(dd->pdev)) {
                                rv = -ENXIO;
                                goto exec_ic_exit;
                        }
                        if ((fis->command != ATA_CMD_STANDBYNOW1) &&
                                test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
-                                                &port->dd->dd_flag)) {
+                                                &dd->dd_flag)) {
                                rv = -ENXIO;
                                goto exec_ic_exit;
                        }
-                        if (readl(port->mmio + PORT_IRQ_STAT) & PORT_IRQ_ERR) {
+                        port_stat = readl(port->mmio + PORT_IRQ_STAT);
-                                atomic_inc(&int_cmd->active); /* error */
+                        if (!port_stat)
-                                break;
+                                continue;
+                        if (port_stat & PORT_IRQ_ERR) {
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] failed\n",
+                                        fis->command);
+                                mtip_device_reset(dd);
+                                rv = -EIO;
+                                goto exec_ic_exit;
+                        } else {
+                                writel(port_stat, port->mmio + PORT_IRQ_STAT);
+                                hba_stat = readl(dd->mmio + HOST_IRQ_STAT);
+                                if (hba_stat)
+                                        writel(hba_stat,
+                                                dd->mmio + HOST_IRQ_STAT);
                        }
+                        break;
                }
        }
-        if (atomic_read(&int_cmd->active) > 1) {
-                dev_err(&port->dd->pdev->dev,
-                        "Internal command [%02X] failed\n", fis->command);
-                rv = -EIO;
-        }
        if (readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                        & (1 << MTIP_TAG_INTERNAL)) {
                rv = -ENXIO;
-                if (!test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                if (!test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag)) {
-                                        &port->dd->dd_flag)) {
+                        mtip_device_reset(dd);
-                        mtip_restart_port(port);
                        rv = -EAGAIN;
                }
        }
@@ -1724,7 +1764,8 @@ static int mtip_get_smart_attr(struct mtip_port *port, unsigned int id,
 *      -EINVAL         Invalid parameters passed in, trim not supported
 *      -EIO            Error submitting trim request to hw
 */
-static int mtip_send_trim(struct driver_data *dd, unsigned int lba, unsigned int len)
+static int mtip_send_trim(struct driver_data *dd, unsigned int lba,
+                                unsigned int len)
 {
        int i, rv = 0;
        u64 tlba, tlen, sect_left;
@@ -1811,45 +1852,6 @@ static bool mtip_hw_get_capacity(struct driver_data *dd, sector_t *sectors)
 }
 /*
- * Reset the HBA.
- *
- * Resets the HBA by setting the HBA Reset bit in the Global
- * HBA Control register. After setting the HBA Reset bit the
- * function waits for 1 second before reading the HBA Reset
- * bit to make sure it has cleared. If HBA Reset is not clear
- * an error is returned. Cannot be used in non-blockable
- * context.
- *
- * @dd Pointer to the driver data structure.
- *
- * return value
- *      0  The reset was successful.
- *      -1 The HBA Reset bit did not clear.
- */
-static int mtip_hba_reset(struct driver_data *dd)
-{
-        mtip_deinit_port(dd->port);
-        /* Set the reset bit */
-        writel(HOST_RESET, dd->mmio + HOST_CTL);
-        /* Flush */
-        readl(dd->mmio + HOST_CTL);
-        /* Wait for reset to clear */
-        ssleep(1);
-        /* Check the bit has cleared */
-        if (readl(dd->mmio + HOST_CTL) & HOST_RESET) {
-                dev_err(&dd->pdev->dev,
-                        "Reset bit did not clear.\n");
-                return -1;
-        }
-        return 0;
-}
-/*
 * Display the identify command data.
 *
 * @port Pointer to the port data structure.
@@ -2710,6 +2712,100 @@ static ssize_t mtip_hw_show_status(struct device *dev,
 static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
+/* debugsfs entries */
+static ssize_t show_device_status(struct device_driver *drv, char *buf)
+{
+        int size = 0;
+        struct driver_data *dd, *tmp;
+        unsigned long flags;
+        char id_buf[42];
+        u16 status = 0;
+        spin_lock_irqsave(&dev_lock, flags);
+        size += sprintf(&buf[size], "Devices Present:\n");
+        list_for_each_entry_safe(dd, tmp, &online_list, online_list) {
+                if (dd->pdev) {
+                        if (dd->port &&
+                            dd->port->identify &&
+                            dd->port->identify_valid) {
+                                strlcpy(id_buf,
+                                        (char *) (dd->port->identify + 10), 21);
+                                status = *(dd->port->identify + 141);
+                        } else {
+                                memset(id_buf, 0, 42);
+                                status = 0;
+                        }
+                        if (dd->port &&
+                            test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags)) {
+                                size += sprintf(&buf[size],
+                                        " device %s %s (ftl rebuild %d %%)\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf,
+                                        status);
+                        } else {
+                                size += sprintf(&buf[size],
+                                        " device %s %s\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf);
+                        }
+                }
+        }
+        size += sprintf(&buf[size], "Devices Being Removed:\n");
+        list_for_each_entry_safe(dd, tmp, &removing_list, remove_list) {
+                if (dd->pdev) {
+                        if (dd->port &&
+                            dd->port->identify &&
+                            dd->port->identify_valid) {
+                                strlcpy(id_buf,
+                                        (char *) (dd->port->identify+10), 21);
+                                status = *(dd->port->identify + 141);
+                        } else {
+                                memset(id_buf, 0, 42);
+                                status = 0;
+                        }
+                        if (dd->port &&
+                            test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags)) {
+                                size += sprintf(&buf[size],
+                                        " device %s %s (ftl rebuild %d %%)\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf,
+                                        status);
+                        } else {
+                                size += sprintf(&buf[size],
+                                        " device %s %s\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf);
+                        }
+                }
+        }
+        spin_unlock_irqrestore(&dev_lock, flags);
+        return size;
+}
+static ssize_t mtip_hw_read_device_status(struct file *f, char __user *ubuf,
+                                                size_t len, loff_t *offset)
+{
+        int size = *offset;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        if (!len || *offset)
+                return 0;
+        size += show_device_status(NULL, buf);
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+        return *offset;
+}
 static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
                                  size_t len, loff_t *offset)
 {
@@ -2804,6 +2900,13 @@ static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
        return *offset;
 }
+static const struct file_operations mtip_device_status_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_device_status,
+        .llseek = no_llseek,
+};
 static const struct file_operations mtip_regs_fops = {
        .owner  = THIS_MODULE,
        .open   = simple_open,
@@ -4161,6 +4264,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
        const struct cpumask *node_mask;
        int cpu, i = 0, j = 0;
        int my_node = NUMA_NO_NODE;
+        unsigned long flags;
        /* Allocate memory for this devices private data. */
        my_node = pcibus_to_node(pdev->bus);
@@ -4218,6 +4322,9 @@ static int mtip_pci_probe(struct pci_dev *pdev,
        dd->pdev        = pdev;
        dd->numa_node   = my_node;
+        INIT_LIST_HEAD(&dd->online_list);
+        INIT_LIST_HEAD(&dd->remove_list);
        memset(dd->workq_name, 0, 32);
        snprintf(dd->workq_name, 31, "mtipq%d", dd->instance);
@@ -4305,6 +4412,14 @@ static int mtip_pci_probe(struct pci_dev *pdev,
        instance++;
        if (rv != MTIP_FTL_REBUILD_MAGIC)
                set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
+        else
+                rv = 0; /* device in rebuild state, return 0 from probe */
+        /* Add to online list even if in ftl rebuild */
+        spin_lock_irqsave(&dev_lock, flags);
+        list_add(&dd->online_list, &online_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
        goto done;
 block_initialize_err:
@@ -4338,9 +4453,15 @@ static void mtip_pci_remove(struct pci_dev *pdev)
 {
        struct driver_data *dd = pci_get_drvdata(pdev);
        int counter = 0;
+        unsigned long flags;
        set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
+        spin_lock_irqsave(&dev_lock, flags);
+        list_del_init(&dd->online_list);
+        list_add(&dd->remove_list, &removing_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
        if (mtip_check_surprise_removal(pdev)) {
                while (!test_bit(MTIP_DDF_CLEANUP_BIT, &dd->dd_flag)) {
                        counter++;
@@ -4366,6 +4487,10 @@ static void mtip_pci_remove(struct pci_dev *pdev)
        pci_disable_msi(pdev);
+        spin_lock_irqsave(&dev_lock, flags);
+        list_del_init(&dd->remove_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
        kfree(dd);
        pcim_iounmap_regions(pdev, 1 << MTIP_ABAR);
 }
@@ -4513,6 +4638,11 @@ static int __init mtip_init(void)
        pr_info(MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
+        spin_lock_init(&dev_lock);
+        INIT_LIST_HEAD(&online_list);
+        INIT_LIST_HEAD(&removing_list);
        /* Allocate a major block device number to use with this driver. */
        error = register_blkdev(0, MTIP_DRV_NAME);
        if (error <= 0) {
@@ -4522,11 +4652,18 @@ static int __init mtip_init(void)
        }
        mtip_major = error;
-        if (!dfs_parent) {
+        dfs_parent = debugfs_create_dir("rssd", NULL);
-                dfs_parent = debugfs_create_dir("rssd", NULL);
+        if (IS_ERR_OR_NULL(dfs_parent)) {
-                if (IS_ERR_OR_NULL(dfs_parent)) {
+                pr_warn("Error creating debugfs parent\n");
-                        pr_warn("Error creating debugfs parent\n");
+                dfs_parent = NULL;
-                        dfs_parent = NULL;
+        }
+        if (dfs_parent) {
+                dfs_device_status = debugfs_create_file("device_status",
+                                        S_IRUGO, dfs_parent, NULL,
+                                        &mtip_device_status_fops);
+                if (IS_ERR_OR_NULL(dfs_device_status)) {
+                        pr_err("Error creating device_status node\n");
+                        dfs_device_status = NULL;
                }
        }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index 3bffff5f670c..8e8334c9dd0f 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -129,9 +129,9 @@ enum {
        MTIP_PF_EH_ACTIVE_BIT       = 1, /* error handling */
        MTIP_PF_SE_ACTIVE_BIT       = 2, /* secure erase */
        MTIP_PF_DM_ACTIVE_BIT       = 3, /* download microcde */
-        MTIP_PF_PAUSE_IO      = ((1 << MTIP_PF_IC_ACTIVE_BIT) | \
+        MTIP_PF_PAUSE_IO      = ((1 << MTIP_PF_IC_ACTIVE_BIT) |
-                                (1 << MTIP_PF_EH_ACTIVE_BIT) | \
+                                (1 << MTIP_PF_EH_ACTIVE_BIT) |
-                                (1 << MTIP_PF_SE_ACTIVE_BIT) | \
+                                (1 << MTIP_PF_SE_ACTIVE_BIT) |
                                (1 << MTIP_PF_DM_ACTIVE_BIT)),
        MTIP_PF_SVC_THD_ACTIVE_BIT  = 4,
@@ -144,9 +144,9 @@ enum {
        MTIP_DDF_REMOVE_PENDING_BIT = 1,
        MTIP_DDF_OVER_TEMP_BIT      = 2,
        MTIP_DDF_WRITE_PROTECT_BIT  = 3,
-        MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
+        MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) |
-                                (1 << MTIP_DDF_SEC_LOCK_BIT) | \
+                                (1 << MTIP_DDF_SEC_LOCK_BIT) |
-                                (1 << MTIP_DDF_OVER_TEMP_BIT) | \
+                                (1 << MTIP_DDF_OVER_TEMP_BIT) |
                                (1 << MTIP_DDF_WRITE_PROTECT_BIT)),
        MTIP_DDF_CLEANUP_BIT        = 5,
@@ -180,7 +180,7 @@ struct mtip_work {
 #define MTIP_TRIM_TIMEOUT_MS            240000
 #define MTIP_MAX_TRIM_ENTRIES           8
-#define MTIP_MAX_TRIM_ENTRY_LEN         0xfff8
+#define MTIP_MAX_TRIM_ENTRY_LEN         0xfff8
 struct mtip_trim_entry {
        u32 lba;   /* starting lba of region */
@@ -501,6 +501,10 @@ struct driver_data {
        atomic_t irq_workers_active;
        int isr_binding;
+        struct list_head online_list; /* linkage for online list */
+        struct list_head remove_list; /* linkage for removing list */
 };
 #endif
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index ad72922919ed..6133ef5cf671 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -502,7 +502,6 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
        sample_time = cpu->pstate_policy->sample_rate_ms;
        delay = msecs_to_jiffies(sample_time);
-        delay -= jiffies % delay;
        mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
index 8bc5fef07e7a..22c9063e0120 100644
--- a/drivers/crypto/ux500/cryp/cryp_core.c
+++ b/drivers/crypto/ux500/cryp/cryp_core.c
@@ -1750,7 +1750,7 @@ static struct platform_driver cryp_driver = {
        .shutdown = ux500_cryp_shutdown,
        .driver = {
                .owner = THIS_MODULE,
-                .name  = "cryp1"
+                .name  = "cryp1",
                .pm    = &ux500_cryp_pm,
        }
 };
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index c4b4fd2acc42..08b43bf37158 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -276,12 +276,20 @@ static void omap_dma_issue_pending(struct dma_chan *chan)
        spin_lock_irqsave(&c->vc.lock, flags);
        if (vchan_issue_pending(&c->vc) && !c->desc) {
-                struct omap_dmadev *d = to_omap_dma_dev(chan->device);
+                /*
-                spin_lock(&d->lock);
+                 * c->cyclic is used only by audio and in this case the DMA need
-                if (list_empty(&c->node))
+                 * to be started without delay.
-                        list_add_tail(&c->node, &d->pending);
+                 */
-                spin_unlock(&d->lock);
+                if (!c->cyclic) {
-                tasklet_schedule(&d->task);
+                        struct omap_dmadev *d = to_omap_dma_dev(chan->device);
+                        spin_lock(&d->lock);
+                        if (list_empty(&c->node))
+                                list_add_tail(&c->node, &d->pending);
+                        spin_unlock(&d->lock);
+                        tasklet_schedule(&d->task);
+                } else {
+                        omap_dma_start_desc(c);
+                }
        }
        spin_unlock_irqrestore(&c->vc.lock, flags);
 }
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 718153122759..5dbc5946c4c3 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2882,7 +2882,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 {
        struct dma_pl330_platdata *pdat;
        struct dma_pl330_dmac *pdmac;
-        struct dma_pl330_chan *pch;
+        struct dma_pl330_chan *pch, *_p;
        struct pl330_info *pi;
        struct dma_device *pd;
        struct resource *res;
@@ -2984,7 +2984,16 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
        ret = dma_async_device_register(pd);
        if (ret) {
                dev_err(&adev->dev, "unable to register DMAC\n");
-                goto probe_err2;
+                goto probe_err3;
+        }
+        if (adev->dev.of_node) {
+                ret = of_dma_controller_register(adev->dev.of_node,
+                                         of_dma_pl330_xlate, pdmac);
+                if (ret) {
+                        dev_err(&adev->dev,
+                        "unable to register DMA to the generic DT DMA helpers\n");
+                }
        }
        dev_info(&adev->dev,
@@ -2995,16 +3004,21 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                pi->pcfg.data_bus_width / 8, pi->pcfg.num_chan,
                pi->pcfg.num_peri, pi->pcfg.num_events);
-        ret = of_dma_controller_register(adev->dev.of_node,
-                                         of_dma_pl330_xlate, pdmac);
-        if (ret) {
-                dev_err(&adev->dev,
-                "unable to register DMA to the generic DT DMA helpers\n");
-                goto probe_err2;
-        }
        return 0;
+probe_err3:
+        amba_set_drvdata(adev, NULL);
+        /* Idle the DMAC */
+        list_for_each_entry_safe(pch, _p, &pdmac->ddma.channels,
+                        chan.device_node) {
+                /* Remove the channel */
+                list_del(&pch->chan.device_node);
+                /* Flush the channel */
+                pl330_control(&pch->chan, DMA_TERMINATE_ALL, 0);
+                pl330_free_chan_resources(&pch->chan);
+        }
 probe_err2:
        pl330_del(pi);
 probe_err1:
@@ -3023,8 +3037,10 @@ static int pl330_remove(struct amba_device *adev)
        if (!pdmac)
                return 0;
-        of_dma_controller_free(adev->dev.of_node);
+        if (adev->dev.of_node)
+                of_dma_controller_free(adev->dev.of_node);
+        dma_async_device_unregister(&pdmac->ddma);
        amba_set_drvdata(adev, NULL);
        /* Idle the DMAC */
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 24059462c87f..9391cf16e990 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -575,7 +575,7 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
                                                chip->gpio_chip.ngpio,
                                                irq_base,
                                                &pca953x_irq_simple_ops,
-                                                NULL);
+                                                chip);
                if (!chip->domain)
                        return -ENODEV;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 59d6b9bf204b..892ff9f95975 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1544,10 +1544,10 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
        if (!fb_helper->fb)
                return 0;
-        drm_modeset_lock_all(dev);
+        mutex_lock(&fb_helper->dev->mode_config.mutex);
        if (!drm_fb_helper_is_bound(fb_helper)) {
                fb_helper->delayed_hotplug = true;
-                drm_modeset_unlock_all(dev);
+                mutex_unlock(&fb_helper->dev->mode_config.mutex);
                return 0;
        }
        DRM_DEBUG_KMS("\n");
@@ -1558,9 +1558,11 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
        count = drm_fb_helper_probe_connector_modes(fb_helper, max_width,
                                                    max_height);
+        mutex_unlock(&fb_helper->dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
        drm_setup_crtcs(fb_helper);
        drm_modeset_unlock_all(dev);
        drm_fb_helper_set_par(fb_helper->fbdev);
        return 0;
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index fe22bb780e1d..78d8e919509f 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        int i;
        unsigned char misc = 0;
        unsigned char ext_vga[6];
-        unsigned char ext_vga_index24;
-        unsigned char dac_index90 = 0;
        u8 bppshift;
        static unsigned char dacvalue[] = {
@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
                option2 = 0x0000b000;
                break;
        case G200_ER:
-                dac_index90 = 0;
                break;
        }
@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
                WREG_DAC(i, dacvalue[i]);
        }
-        if (mdev->type == G200_ER) {
+        if (mdev->type == G200_ER)
-                WREG_DAC(0x90, dac_index90);
+                WREG_DAC(0x90, 0);
-        }
        if (option)
                pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        if (mdev->type == G200_WB)
                ext_vga[1] |= 0x88;
-        ext_vga_index24 = 0x05;
        /* Set pixel clocks */
        misc = 0x2d;
        WREG8(MGA_MISC_OUT, misc);
@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        }
        if (mdev->type == G200_ER)
-                WREG_ECRT(24, ext_vga_index24);
+                WREG_ECRT(0x24, 0x5);
        if (mdev->type == G200_EV) {
                WREG_ECRT(6, 0);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 7f0e6c3f37d1..1ddc03e51bf4 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -479,7 +479,7 @@ nv50_display_flip_wait(void *data)
 {
        struct nv50_display_flip *flip = data;
        if (nouveau_bo_rd32(flip->disp->sync, flip->chan->addr / 4) ==
-                                              flip->chan->data);
+                                              flip->chan->data)
                return true;
        usleep_range(1, 2);
        return false;
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index fe5cdbcf2636..b44d548c56f8 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -61,6 +61,10 @@ static int udl_get_modes(struct drm_connector *connector)
        int ret;
        edid = (struct edid *)udl_get_edid(udl);
+        if (!edid) {
+                drm_mode_connector_update_edid_property(connector, NULL);
+                return 0;
+        }
        /*
         * We only read the main block, but if the monitor reports extension
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index db713c0dfba4..461a0d739d75 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
        ret = pm_runtime_get_sync(dev);
        if (ret < 0) {
                dev_err(dev, "%s: can't power on device\n", __func__);
+                pm_runtime_put_noidle(dev);
+                module_put(dev->driver->owner);
                return ret;
        }
diff --git a/drivers/misc/vmw_vmci/Kconfig b/drivers/misc/vmw_vmci/Kconfig
index 39c2ecadb273..ea98f7e9ccd1 100644
--- a/drivers/misc/vmw_vmci/Kconfig
+++ b/drivers/misc/vmw_vmci/Kconfig
@@ -4,7 +4,7 @@
 config VMWARE_VMCI
        tristate "VMware VMCI Driver"
-        depends on X86 && PCI
+        depends on X86 && PCI && NET
        help
          This is VMware's Virtual Machine Communication Interface.  It enables
          high-speed communication between host and guest in a virtual
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 171b10f167a5..07401a3e256b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4846,9 +4846,18 @@ static int __net_init bond_net_init(struct net *net)
 static void __net_exit bond_net_exit(struct net *net)
 {
        struct bond_net *bn = net_generic(net, bond_net_id);
+        struct bonding *bond, *tmp_bond;
+        LIST_HEAD(list);
        bond_destroy_sysfs(bn);
        bond_destroy_proc_dir(bn);
+        /* Kill off any bonds created after unregistering bond rtnl ops */
+        rtnl_lock();
+        list_for_each_entry_safe(bond, tmp_bond, &bn->dev_list, bond_list)
+                unregister_netdevice_queue(bond->dev, &list);
+        unregister_netdevice_many(&list);
+        rtnl_unlock();
 }
 static struct pernet_operations bond_net_ops = {
@@ -4902,8 +4911,8 @@ static void __exit bonding_exit(void)
        bond_destroy_debugfs();
-        unregister_pernet_subsys(&bond_net_ops);
        rtnl_link_unregister(&bond_link_ops);
+        unregister_pernet_subsys(&bond_net_ops);
 #ifdef CONFIG_NET_POLL_CONTROLLER
        /*
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 77ebae0ac64a..0283f343b0d1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -13437,13 +13437,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
 {
        struct bnx2x *bp = params->bp;
        u16 base_page, next_page, not_kr2_device, lane;
-        int sigdet = bnx2x_warpcore_get_sigdet(phy, params);
+        int sigdet;
-        if (!sigdet) {
-                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE))
-                        bnx2x_kr2_recovery(params, vars, phy);
-                return;
-        }
        /* Once KR2 was disabled, wait 5 seconds before checking KR2 recovery
         * since some switches tend to reinit the AN process and clear the
@@ -13454,6 +13448,16 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                vars->check_kr2_recovery_cnt--;
                return;
        }
+        sigdet = bnx2x_warpcore_get_sigdet(phy, params);
+        if (!sigdet) {
+                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
+                        bnx2x_kr2_recovery(params, vars, phy);
+                        DP(NETIF_MSG_LINK, "No sigdet\n");
+                }
+                return;
+        }
        lane = bnx2x_get_warpcore_lane(phy, params);
        CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
                          MDIO_AER_BLOCK_AER_REG, lane);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e81a747ea8ce..8e58da909f5c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4947,7 +4947,7 @@ static void bnx2x_after_function_update(struct bnx2x *bp)
                                  q);
        }
-        if (!NO_FCOE(bp)) {
+        if (!NO_FCOE(bp) && CNIC_ENABLED(bp)) {
                fp = &bp->fp[FCOE_IDX(bp)];
                queue_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj;
@@ -13354,6 +13354,7 @@ static int bnx2x_unregister_cnic(struct net_device *dev)
        RCU_INIT_POINTER(bp->cnic_ops, NULL);
        mutex_unlock(&bp->cnic_mutex);
        synchronize_rcu();
+        bp->cnic_enabled = false;
        kfree(bp->cnic_kwq);
        bp->cnic_kwq = NULL;
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index ec800b093e7e..d2bea3f07c73 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -870,7 +870,7 @@ err_unlock:
 }
 static int e100_exec_cb(struct nic *nic, struct sk_buff *skb,
-        void (*cb_prepare)(struct nic *, struct cb *, struct sk_buff *))
+        int (*cb_prepare)(struct nic *, struct cb *, struct sk_buff *))
 {
        struct cb *cb;
        unsigned long flags;
@@ -888,10 +888,13 @@ static int e100_exec_cb(struct nic *nic, struct sk_buff *skb,
        nic->cbs_avail--;
        cb->skb = skb;
+        err = cb_prepare(nic, cb, skb);
+        if (err)
+                goto err_unlock;
        if (unlikely(!nic->cbs_avail))
                err = -ENOSPC;
-        cb_prepare(nic, cb, skb);
        /* Order is important otherwise we'll be in a race with h/w:
         * set S-bit in current first, then clear S-bit in previous. */
@@ -1091,7 +1094,7 @@ static void e100_get_defaults(struct nic *nic)
        nic->mii.mdio_write = mdio_write;
 }
-static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
        struct config *config = &cb->u.config;
        u8 *c = (u8 *)config;
@@ -1181,6 +1184,7 @@ static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
        netif_printk(nic, hw, KERN_DEBUG, nic->netdev,
                     "[16-23]=%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
                     c[16], c[17], c[18], c[19], c[20], c[21], c[22], c[23]);
+        return 0;
 }
 /*************************************************************************
@@ -1331,7 +1335,7 @@ static const struct firmware *e100_request_firmware(struct nic *nic)
        return fw;
 }
-static void e100_setup_ucode(struct nic *nic, struct cb *cb,
+static int e100_setup_ucode(struct nic *nic, struct cb *cb,
                             struct sk_buff *skb)
 {
        const struct firmware *fw = (void *)skb;
@@ -1358,6 +1362,7 @@ static void e100_setup_ucode(struct nic *nic, struct cb *cb,
        cb->u.ucode[min_size] |= cpu_to_le32((BUNDLESMALL) ? 0xFFFF : 0xFF80);
        cb->command = cpu_to_le16(cb_ucode | cb_el);
+        return 0;
 }
 static inline int e100_load_ucode_wait(struct nic *nic)
@@ -1400,18 +1405,20 @@ static inline int e100_load_ucode_wait(struct nic *nic)
        return err;
 }
-static void e100_setup_iaaddr(struct nic *nic, struct cb *cb,
+static int e100_setup_iaaddr(struct nic *nic, struct cb *cb,
        struct sk_buff *skb)
 {
        cb->command = cpu_to_le16(cb_iaaddr);
        memcpy(cb->u.iaaddr, nic->netdev->dev_addr, ETH_ALEN);
+        return 0;
 }
-static void e100_dump(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_dump(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
        cb->command = cpu_to_le16(cb_dump);
        cb->u.dump_buffer_addr = cpu_to_le32(nic->dma_addr +
                offsetof(struct mem, dump_buf));
+        return 0;
 }
 static int e100_phy_check_without_mii(struct nic *nic)
@@ -1581,7 +1588,7 @@ static int e100_hw_init(struct nic *nic)
        return 0;
 }
-static void e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
        struct net_device *netdev = nic->netdev;
        struct netdev_hw_addr *ha;
@@ -1596,6 +1603,7 @@ static void e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
                memcpy(&cb->u.multi.addr[i++ * ETH_ALEN], &ha->addr,
                        ETH_ALEN);
        }
+        return 0;
 }
 static void e100_set_multicast_list(struct net_device *netdev)
@@ -1756,11 +1764,18 @@ static void e100_watchdog(unsigned long data)
                  round_jiffies(jiffies + E100_WATCHDOG_PERIOD));
 }
-static void e100_xmit_prepare(struct nic *nic, struct cb *cb,
+static int e100_xmit_prepare(struct nic *nic, struct cb *cb,
        struct sk_buff *skb)
 {
+        dma_addr_t dma_addr;
        cb->command = nic->tx_command;
+        dma_addr = pci_map_single(nic->pdev,
+                                  skb->data, skb->len, PCI_DMA_TODEVICE);
+        /* If we can't map the skb, have the upper layer try later */
+        if (pci_dma_mapping_error(nic->pdev, dma_addr))
+                return -ENOMEM;
        /*
         * Use the last 4 bytes of the SKB payload packet as the CRC, used for
         * testing, ie sending frames with bad CRC.
@@ -1777,11 +1792,10 @@ static void e100_xmit_prepare(struct nic *nic, struct cb *cb,
        cb->u.tcb.tcb_byte_count = 0;
        cb->u.tcb.threshold = nic->tx_threshold;
        cb->u.tcb.tbd_count = 1;
-        cb->u.tcb.tbd.buf_addr = cpu_to_le32(pci_map_single(nic->pdev,
+        cb->u.tcb.tbd.buf_addr = cpu_to_le32(dma_addr);
-                skb->data, skb->len, PCI_DMA_TODEVICE));
-        /* check for mapping failure? */
        cb->u.tcb.tbd.size = cpu_to_le16(skb->len);
        skb_tx_timestamp(skb);
+        return 0;
 }
 static netdev_tx_t e100_xmit_frame(struct sk_buff *skb,
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index cd345b8969bc..1e628ce57201 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2771,16 +2771,17 @@ static int mvneta_probe(struct platform_device *pdev)
        netif_napi_add(dev, &pp->napi, mvneta_poll, pp->weight);
+        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->hw_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->vlan_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->priv_flags |= IFF_UNICAST_FLT;
        err = register_netdev(dev);
        if (err < 0) {
                dev_err(&pdev->dev, "failed to register\n");
                goto err_deinit;
        }
-        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM;
-        dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM;
-        dev->priv_flags |= IFF_UNICAST_FLT;
        netdev_info(dev, "mac: %pM\n", dev->dev_addr);
        platform_set_drvdata(pdev, pp->dev);
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 1cd77483da50..f5f0f09e4cc5 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -470,8 +470,10 @@ static void netvsc_send_completion(struct hv_device *device,
                        packet->trans_id;
                /* Notify the layer above us */
-                nvsc_packet->completion.send.send_completion(
+                if (nvsc_packet)
-                        nvsc_packet->completion.send.send_completion_ctx);
+                        nvsc_packet->completion.send.send_completion(
+                                nvsc_packet->completion.send.
+                                send_completion_ctx);
                num_outstanding_sends =
                        atomic_dec_return(&net_device->num_outstanding_sends);
@@ -498,6 +500,7 @@ int netvsc_send(struct hv_device *device,
        int ret = 0;
        struct nvsp_message sendMessage;
        struct net_device *ndev;
+        u64 req_id;
        net_device = get_outbound_net_device(device);
        if (!net_device)
@@ -518,20 +521,24 @@ int netvsc_send(struct hv_device *device,
                0xFFFFFFFF;
        sendMessage.msg.v1_msg.send_rndis_pkt.send_buf_section_size = 0;
+        if (packet->completion.send.send_completion)
+                req_id = (u64)packet;
+        else
+                req_id = 0;
        if (packet->page_buf_cnt) {
                ret = vmbus_sendpacket_pagebuffer(device->channel,
                                                  packet->page_buf,
                                                  packet->page_buf_cnt,
                                                  &sendMessage,
                                                  sizeof(struct nvsp_message),
-                                                  (unsigned long)packet);
+                                                  req_id);
        } else {
                ret = vmbus_sendpacket(device->channel, &sendMessage,
                                sizeof(struct nvsp_message),
-                                (unsigned long)packet,
+                                req_id,
                                VM_PKT_DATA_INBAND,
                                VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
        }
        if (ret == 0) {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 5f85205cd12b..8341b62e5521 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -241,13 +241,11 @@ void netvsc_linkstatus_callback(struct hv_device *device_obj,
        if (status == 1) {
                netif_carrier_on(net);
-                netif_wake_queue(net);
                ndev_ctx = netdev_priv(net);
                schedule_delayed_work(&ndev_ctx->dwork, 0);
                schedule_delayed_work(&ndev_ctx->dwork, msecs_to_jiffies(20));
        } else {
                netif_carrier_off(net);
-                netif_tx_disable(net);
        }
 }
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 2b657d4d63a8..0775f0aefd1e 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -61,9 +61,6 @@ struct rndis_request {
 static void rndis_filter_send_completion(void *ctx);
-static void rndis_filter_send_request_completion(void *ctx);
 static struct rndis_device *get_rndis_device(void)
 {
@@ -241,10 +238,7 @@ static int rndis_filter_send_request(struct rndis_device *dev,
                        packet->page_buf[0].len;
        }
-        packet->completion.send.send_completion_ctx = req;/* packet; */
+        packet->completion.send.send_completion = NULL;
-        packet->completion.send.send_completion =
-                rndis_filter_send_request_completion;
-        packet->completion.send.send_completion_tid = (unsigned long)dev;
        ret = netvsc_send(dev->net_dev->dev, packet);
        return ret;
@@ -999,9 +993,3 @@ static void rndis_filter_send_completion(void *ctx)
        /* Pass it back to the original handler */
        filter_pkt->completion(filter_pkt->completion_ctx);
 }
-static void rndis_filter_send_request_completion(void *ctx)
-{
-        /* Noop */
-}
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6e66f9c6782b..988372d218a4 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -280,6 +280,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
        if (r) {
                ath_err(common,
                        "Unable to reset channel, reset status %d\n", r);
+                ath9k_hw_enable_interrupts(ah);
+                ath9k_queue_reset(sc, RESET_TYPE_BB_HANG);
                goto out;
        }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 4469321c0eb3..35fc68be158d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -3317,15 +3317,15 @@ static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
                goto err;
        }
-        /* External image takes precedence if specified */
        if (brcmf_sdbrcm_download_code_file(bus)) {
                brcmf_err("dongle image file download failed\n");
                goto err;
        }
-        /* External nvram takes precedence if specified */
+        if (brcmf_sdbrcm_download_nvram(bus)) {
-        if (brcmf_sdbrcm_download_nvram(bus))
                brcmf_err("dongle nvram file download failed\n");
+                goto err;
+        }
        /* Take arm out of reset */
        if (brcmf_sdbrcm_download_state(bus, false)) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 2af9c0f0798d..ec46ffff5409 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1891,8 +1891,10 @@ static s32
 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
              u8 key_idx, const u8 *mac_addr, struct key_params *params)
 {
+        struct brcmf_if *ifp = netdev_priv(ndev);
        struct brcmf_wsec_key key;
        s32 err = 0;
+        u8 keybuf[8];
        memset(&key, 0, sizeof(key));
        key.index = (u32) key_idx;
@@ -1916,8 +1918,9 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
                memcpy(key.data, params->key, key.len);
-                if (params->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                if ((ifp->vif->mode != WL_MODE_AP) &&
-                        u8 keybuf[8];
+                    (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2013,7 +2016,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                break;
        case WLAN_CIPHER_SUITE_TKIP:
                if (ifp->vif->mode != WL_MODE_AP) {
-                        brcmf_dbg(CONN, "Swapping key\n");
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2118,8 +2121,7 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                err = -EAGAIN;
                goto done;
        }
-        switch (wsec & ~SES_OW_ENABLED) {
+        if (wsec & WEP_ENABLED) {
-        case WEP_ENABLED:
                sec = &profile->sec;
                if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
                        params.cipher = WLAN_CIPHER_SUITE_WEP40;
@@ -2128,16 +2130,13 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                        params.cipher = WLAN_CIPHER_SUITE_WEP104;
                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                }
-                break;
+        } else if (wsec & TKIP_ENABLED) {
-        case TKIP_ENABLED:
                params.cipher = WLAN_CIPHER_SUITE_TKIP;
                brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
-                break;
+        } else if (wsec & AES_ENABLED) {
-        case AES_ENABLED:
                params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
                brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
-                break;
+        } else  {
-        default:
                brcmf_err("Invalid algo (0x%x)\n", wsec);
                err = -EINVAL;
                goto done;
@@ -3824,8 +3823,9 @@ exit:
 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 {
        struct brcmf_if *ifp = netdev_priv(ndev);
-        s32 err = -EPERM;
+        s32 err;
        struct brcmf_fil_bss_enable_le bss_enable;
+        struct brcmf_join_params join_params;
        brcmf_dbg(TRACE, "Enter\n");
@@ -3833,16 +3833,21 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                /* Due to most likely deauths outstanding we sleep */
                /* first to make sure they get processed by fw. */
                msleep(400);
-                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
-                if (err < 0) {
+                memset(&join_params, 0, sizeof(join_params));
-                        brcmf_err("setting AP mode failed %d\n", err);
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
-                        goto exit;
+                                             &join_params, sizeof(join_params));
-                }
+                if (err < 0)
+                        brcmf_err("SET SSID error (%d)\n", err);
                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
-                if (err < 0) {
+                if (err < 0)
                        brcmf_err("BRCMF_C_UP error %d\n", err);
-                        goto exit;
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
-                }
+                if (err < 0)
+                        brcmf_err("setting AP mode failed %d\n", err);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
+                if (err < 0)
+                        brcmf_err("setting INFRA mode failed %d\n", err);
        } else {
                bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
                bss_enable.enable = cpu_to_le32(0);
@@ -3855,7 +3860,6 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
        set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
        clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
-exit:
        return err;
 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index d215b4d3c51b..e7f6deaf715e 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1393,8 +1393,10 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                        queue_work(adapter->workqueue, &adapter->main_work);
                        /* Perform internal scan synchronously */
-                        if (!priv->scan_request)
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev, "wait internal scan\n");
                                mwifiex_wait_queue_complete(adapter, cmd_node);
+                        }
                } else {
                        spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                               flags);
@@ -1793,7 +1795,12 @@ check_next_scan:
                /* Need to indicate IOCTL complete */
                if (adapter->curr_cmd->wait_q_enabled) {
                        adapter->cmd_wait_q.status = 0;
-                        mwifiex_complete_cmd(adapter, adapter->curr_cmd);
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev,
+                                        "complete internal scan\n");
+                                mwifiex_complete_cmd(adapter,
+                                                     adapter->curr_cmd);
+                        }
                }
                if (priv->report_scan_result)
                        priv->report_scan_result = false;
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 2bf4efa33186..76cd47eb901e 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -20,6 +20,7 @@ if RT2X00
 config RT2400PCI
        tristate "Ralink rt2400 (PCI/PCMCIA) support"
        depends on PCI
+        select RT2X00_LIB_MMIO
        select RT2X00_LIB_PCI
        select EEPROM_93CX6
        ---help---
@@ -31,6 +32,7 @@ config RT2400PCI
 config RT2500PCI
        tristate "Ralink rt2500 (PCI/PCMCIA) support"
        depends on PCI
+        select RT2X00_LIB_MMIO
        select RT2X00_LIB_PCI
        select EEPROM_93CX6
        ---help---
@@ -43,6 +45,7 @@ config RT61PCI
        tristate "Ralink rt2501/rt61 (PCI/PCMCIA) support"
        depends on PCI
        select RT2X00_LIB_PCI
+        select RT2X00_LIB_MMIO
        select RT2X00_LIB_FIRMWARE
        select RT2X00_LIB_CRYPTO
        select CRC_ITU_T
@@ -57,6 +60,7 @@ config RT2800PCI
        tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
        depends on PCI || SOC_RT288X || SOC_RT305X
        select RT2800_LIB
+        select RT2X00_LIB_MMIO
        select RT2X00_LIB_PCI if PCI
        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
        select RT2X00_LIB_FIRMWARE
@@ -185,6 +189,9 @@ endif
 config RT2800_LIB
        tristate
+config RT2X00_LIB_MMIO
+        tristate
 config RT2X00_LIB_PCI
        tristate
        select RT2X00_LIB
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 349d5b8284a4..f069d8bc5b67 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -9,6 +9,7 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)     += rt2x00leds.o
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
+obj-$(CONFIG_RT2X00_LIB_MMIO)           += rt2x00mmio.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
 obj-$(CONFIG_RT2X00_LIB_SOC)            += rt2x00soc.o
 obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 221beaaa83f1..dcfb54e0c516 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2400pci.h"
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 39edc59e8d03..e1d2dc9ed28a 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2500pci.h"
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index ded73da4de0b..ba5a05625aaa 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -41,6 +41,7 @@
 #include <linux/eeprom_93cx6.h>
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2x00soc.h"
 #include "rt2800lib.h"
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.c b/drivers/net/wireless/rt2x00/rt2x00mmio.c
new file mode 100644
index 000000000000..d84a680ba0c9
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.c
@@ -0,0 +1,216 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+/*
+        Module: rt2x00mmio
+        Abstract: rt2x00 generic mmio device routines.
+ */
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include "rt2x00.h"
+#include "rt2x00mmio.h"
+/*
+ * Register access.
+ */
+int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                           const unsigned int offset,
+                           const struct rt2x00_field32 field,
+                           u32 *reg)
+{
+        unsigned int i;
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return 0;
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, offset, reg);
+                if (!rt2x00_get_field32(*reg, field))
+                        return 1;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+        printk_once(KERN_ERR "%s() Indirect register access failed: "
+              "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+        *reg = ~0;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
+bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue = rt2x00dev->rx;
+        struct queue_entry *entry;
+        struct queue_entry_priv_pci *entry_priv;
+        struct skb_frame_desc *skbdesc;
+        int max_rx = 16;
+        while (--max_rx) {
+                entry = rt2x00queue_get_entry(queue, Q_INDEX);
+                entry_priv = entry->priv_data;
+                if (rt2x00dev->ops->lib->get_entry_state(entry))
+                        break;
+                /*
+                 * Fill in desc fields of the skb descriptor
+                 */
+                skbdesc = get_skb_frame_desc(entry->skb);
+                skbdesc->desc = entry_priv->desc;
+                skbdesc->desc_len = entry->queue->desc_size;
+                /*
+                 * DMA is already done, notify rt2x00lib that
+                 * it finished successfully.
+                 */
+                rt2x00lib_dmastart(entry);
+                rt2x00lib_dmadone(entry);
+                /*
+                 * Send the frame to rt2x00lib for further processing.
+                 */
+                rt2x00lib_rxdone(entry, GFP_ATOMIC);
+        }
+        return !max_rx;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
+void rt2x00pci_flush_queue(struct data_queue *queue, bool drop)
+{
+        unsigned int i;
+        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
+                msleep(10);
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_flush_queue);
+/*
+ * Device initialization handlers.
+ */
+static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
+{
+        struct queue_entry_priv_pci *entry_priv;
+        void *addr;
+        dma_addr_t dma;
+        unsigned int i;
+        /*
+         * Allocate DMA memory for descriptor and buffer.
+         */
+        addr = dma_alloc_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  &dma, GFP_KERNEL);
+        if (!addr)
+                return -ENOMEM;
+        memset(addr, 0, queue->limit * queue->desc_size);
+        /*
+         * Initialize all queue entries to contain valid addresses.
+         */
+        for (i = 0; i < queue->limit; i++) {
+                entry_priv = queue->entries[i].priv_data;
+                entry_priv->desc = addr + i * queue->desc_size;
+                entry_priv->desc_dma = dma + i * queue->desc_size;
+        }
+        return 0;
+}
+static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
+{
+        struct queue_entry_priv_pci *entry_priv =
+            queue->entries[0].priv_data;
+        if (entry_priv->desc)
+                dma_free_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  entry_priv->desc, entry_priv->desc_dma);
+        entry_priv->desc = NULL;
+}
+int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        int status;
+        /*
+         * Allocate DMA
+         */
+        queue_for_each(rt2x00dev, queue) {
+                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
+                if (status)
+                        goto exit;
+        }
+        /*
+         * Register interrupt handler.
+         */
+        status = request_irq(rt2x00dev->irq,
+                             rt2x00dev->ops->lib->irq_handler,
+                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
+        if (status) {
+                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
+                      rt2x00dev->irq, status);
+                goto exit;
+        }
+        return 0;
+exit:
+        queue_for_each(rt2x00dev, queue)
+                rt2x00pci_free_queue_dma(rt2x00dev, queue);
+        return status;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
+void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        /*
+         * Free irq line.
+         */
+        free_irq(rt2x00dev->irq, rt2x00dev);
+        /*
+         * Free DMA
+         */
+        queue_for_each(rt2x00dev, queue)
+                rt2x00pci_free_queue_dma(rt2x00dev, queue);
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
+/*
+ * rt2x00mmio module information.
+ */
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("rt2x00 mmio library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.h b/drivers/net/wireless/rt2x00/rt2x00mmio.h
new file mode 100644
index 000000000000..4ecaf60175bf
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.h
@@ -0,0 +1,119 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+/*
+        Module: rt2x00mmio
+        Abstract: Data structures for the rt2x00mmio module.
+ */
+#ifndef RT2X00MMIO_H
+#define RT2X00MMIO_H
+#include <linux/io.h>
+/*
+ * Register access.
+ */
+static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
+                                           const unsigned int offset,
+                                           u32 *value)
+{
+        *value = readl(rt2x00dev->csr.base + offset);
+}
+static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
+                                                const unsigned int offset,
+                                                void *value, const u32 length)
+{
+        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
+}
+static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
+                                            const unsigned int offset,
+                                            u32 value)
+{
+        writel(value, rt2x00dev->csr.base + offset);
+}
+static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
+                                                 const unsigned int offset,
+                                                 const void *value,
+                                                 const u32 length)
+{
+        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
+}
+/**
+ * rt2x00pci_regbusy_read - Read from register with busy check
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ * @offset: Register offset
+ * @field: Field to check if register is busy
+ * @reg: Pointer to where register contents should be stored
+ *
+ * This function will read the given register, and checks if the
+ * register is busy. If it is, it will sleep for a couple of
+ * microseconds before reading the register again. If the register
+ * is not read after a certain timeout, this function will return
+ * FALSE.
+ */
+int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                           const unsigned int offset,
+                           const struct rt2x00_field32 field,
+                           u32 *reg);
+/**
+ * struct queue_entry_priv_pci: Per entry PCI specific information
+ *
+ * @desc: Pointer to device descriptor
+ * @desc_dma: DMA pointer to &desc.
+ * @data: Pointer to device's entry memory.
+ * @data_dma: DMA pointer to &data.
+ */
+struct queue_entry_priv_pci {
+        __le32 *desc;
+        dma_addr_t desc_dma;
+};
+/**
+ * rt2x00pci_rxdone - Handle RX done events
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ *
+ * Returns true if there are still rx frames pending and false if all
+ * pending rx frames were processed.
+ */
+bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
+/**
+ * rt2x00pci_flush_queue - Flush data queue
+ * @queue: Data queue to stop
+ * @drop: True to drop all pending frames.
+ *
+ * This will wait for a maximum of 100ms, waiting for the queues
+ * to become empty.
+ */
+void rt2x00pci_flush_queue(struct data_queue *queue, bool drop);
+/*
+ * Device initialization handlers.
+ */
+int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev);
+void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev);
+#endif /* RT2X00MMIO_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index a0c8caef3b0a..e87865e33113 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -33,182 +33,6 @@
 #include "rt2x00pci.h"
 /*
- * Register access.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg)
-{
-        unsigned int i;
-        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                return 0;
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, offset, reg);
-                if (!rt2x00_get_field32(*reg, field))
-                        return 1;
-                udelay(REGISTER_BUSY_DELAY);
-        }
-        ERROR(rt2x00dev, "Indirect register access failed: "
-              "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
-        *reg = ~0;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue = rt2x00dev->rx;
-        struct queue_entry *entry;
-        struct queue_entry_priv_pci *entry_priv;
-        struct skb_frame_desc *skbdesc;
-        int max_rx = 16;
-        while (--max_rx) {
-                entry = rt2x00queue_get_entry(queue, Q_INDEX);
-                entry_priv = entry->priv_data;
-                if (rt2x00dev->ops->lib->get_entry_state(entry))
-                        break;
-                /*
-                 * Fill in desc fields of the skb descriptor
-                 */
-                skbdesc = get_skb_frame_desc(entry->skb);
-                skbdesc->desc = entry_priv->desc;
-                skbdesc->desc_len = entry->queue->desc_size;
-                /*
-                 * DMA is already done, notify rt2x00lib that
-                 * it finished successfully.
-                 */
-                rt2x00lib_dmastart(entry);
-                rt2x00lib_dmadone(entry);
-                /*
-                 * Send the frame to rt2x00lib for further processing.
-                 */
-                rt2x00lib_rxdone(entry, GFP_ATOMIC);
-        }
-        return !max_rx;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop)
-{
-        unsigned int i;
-        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
-                msleep(10);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_flush_queue);
-/*
- * Device initialization handlers.
- */
-static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv;
-        void *addr;
-        dma_addr_t dma;
-        unsigned int i;
-        /*
-         * Allocate DMA memory for descriptor and buffer.
-         */
-        addr = dma_alloc_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  &dma, GFP_KERNEL);
-        if (!addr)
-                return -ENOMEM;
-        memset(addr, 0, queue->limit * queue->desc_size);
-        /*
-         * Initialize all queue entries to contain valid addresses.
-         */
-        for (i = 0; i < queue->limit; i++) {
-                entry_priv = queue->entries[i].priv_data;
-                entry_priv->desc = addr + i * queue->desc_size;
-                entry_priv->desc_dma = dma + i * queue->desc_size;
-        }
-        return 0;
-}
-static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv =
-            queue->entries[0].priv_data;
-        if (entry_priv->desc)
-                dma_free_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  entry_priv->desc, entry_priv->desc_dma);
-        entry_priv->desc = NULL;
-}
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-        int status;
-        /*
-         * Allocate DMA
-         */
-        queue_for_each(rt2x00dev, queue) {
-                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
-                if (status)
-                        goto exit;
-        }
-        /*
-         * Register interrupt handler.
-         */
-        status = request_irq(rt2x00dev->irq,
-                             rt2x00dev->ops->lib->irq_handler,
-                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
-        if (status) {
-                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
-                      rt2x00dev->irq, status);
-                goto exit;
-        }
-        return 0;
-exit:
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-        return status;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-        /*
-         * Free irq line.
-         */
-        free_irq(rt2x00dev->irq, rt2x00dev);
-        /*
-         * Free DMA
-         */
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
-/*
 * PCI driver handlers.
 */
 static void rt2x00pci_free_reg(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index e2c99f2b9a14..60d90b20f8b9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -36,94 +36,6 @@
 #define PCI_DEVICE_DATA(__ops)  .driver_data = (kernel_ulong_t)(__ops)
 /*
- * Register access.
- */
-static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
-                                           const unsigned int offset,
-                                           u32 *value)
-{
-        *value = readl(rt2x00dev->csr.base + offset);
-}
-static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
-                                                const unsigned int offset,
-                                                void *value, const u32 length)
-{
-        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
-}
-static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
-                                            const unsigned int offset,
-                                            u32 value)
-{
-        writel(value, rt2x00dev->csr.base + offset);
-}
-static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
-                                                 const unsigned int offset,
-                                                 const void *value,
-                                                 const u32 length)
-{
-        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
-}
-/**
- * rt2x00pci_regbusy_read - Read from register with busy check
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- * @offset: Register offset
- * @field: Field to check if register is busy
- * @reg: Pointer to where register contents should be stored
- *
- * This function will read the given register, and checks if the
- * register is busy. If it is, it will sleep for a couple of
- * microseconds before reading the register again. If the register
- * is not read after a certain timeout, this function will return
- * FALSE.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg);
-/**
- * struct queue_entry_priv_pci: Per entry PCI specific information
- *
- * @desc: Pointer to device descriptor
- * @desc_dma: DMA pointer to &desc.
- * @data: Pointer to device's entry memory.
- * @data_dma: DMA pointer to &data.
- */
-struct queue_entry_priv_pci {
-        __le32 *desc;
-        dma_addr_t desc_dma;
-};
-/**
- * rt2x00pci_rxdone - Handle RX done events
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- *
- * Returns true if there are still rx frames pending and false if all
- * pending rx frames were processed.
- */
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
-/**
- * rt2x00pci_flush_queue - Flush data queue
- * @queue: Data queue to stop
- * @drop: True to drop all pending frames.
- *
- * This will wait for a maximum of 100ms, waiting for the queues
- * to become empty.
- */
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop);
-/*
- * Device initialization handlers.
- */
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev);
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev);
-/*
 * PCI driver handlers.
 */
 int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f95792cfcf89..9e3c8ff53e3f 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -35,6 +35,7 @@
 #include <linux/eeprom_93cx6.h>
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt61pci.h"
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index cc1f7bf53fd0..c6d77e20622c 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -4,7 +4,7 @@ menu "Remoteproc drivers"
 config REMOTEPROC
        tristate
        depends on HAS_DMA
-        select FW_CONFIG
+        select FW_LOADER
        select VIRTIO
 config OMAP_REMOTEPROC
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 29387df4bfc9..8edb4aed5d36 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -217,7 +217,7 @@ int rproc_alloc_vring(struct rproc_vdev *rvdev, int i)
         * TODO: support predefined notifyids (via resource table)
         */
        ret = idr_alloc(&rproc->notifyids, rvring, 0, 0, GFP_KERNEL);
-        if (ret) {
+        if (ret < 0) {
                dev_err(dev, "idr_alloc failed: %d\n", ret);
                dma_free_coherent(dev->parent, size, va, dma);
                return ret;
@@ -366,10 +366,12 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
        /* it is now safe to add the virtio device */
        ret = rproc_add_virtio_dev(rvdev, rsc->id);
        if (ret)
-                goto free_rvdev;
+                goto remove_rvdev;
        return 0;
+remove_rvdev:
+        list_del(&rvdev->node);
 free_rvdev:
        kfree(rvdev);
        return ret;
diff --git a/drivers/remoteproc/ste_modem_rproc.c b/drivers/remoteproc/ste_modem_rproc.c
index a7743c069339..fb95c4220052 100644
--- a/drivers/remoteproc/ste_modem_rproc.c
+++ b/drivers/remoteproc/ste_modem_rproc.c
@@ -240,6 +240,8 @@ static int sproc_drv_remove(struct platform_device *pdev)
        /* Unregister as remoteproc device */
        rproc_del(sproc->rproc);
+        dma_free_coherent(sproc->rproc->dev.parent, SPROC_FW_SIZE,
+                          sproc->fw_addr, sproc->fw_dma_addr);
        rproc_put(sproc->rproc);
        mdev->drv_data = NULL;
@@ -297,10 +299,13 @@ static int sproc_probe(struct platform_device *pdev)
        /* Register as a remoteproc device */
        err = rproc_add(rproc);
        if (err)
-                goto free_rproc;
+                goto free_mem;
        return 0;
+free_mem:
+        dma_free_coherent(rproc->dev.parent, SPROC_FW_SIZE,
+                          sproc->fw_addr, sproc->fw_dma_addr);
 free_rproc:
        /* Reset device data upon error */
        mdev->drv_data = NULL;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 8c0622399fcd..6ccb7457746b 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -769,6 +769,7 @@ struct qeth_card {
        unsigned long thread_start_mask;
        unsigned long thread_allowed_mask;
        unsigned long thread_running_mask;
+        struct task_struct *recovery_task;
        spinlock_t ip_lock;
        struct list_head ip_list;
        struct list_head *ip_tbd_list;
@@ -862,6 +863,8 @@ extern struct qeth_card_list_struct qeth_core_card_list;
 extern struct kmem_cache *qeth_core_header_cache;
 extern struct qeth_dbf_info qeth_dbf[QETH_DBF_INFOS];
+void qeth_set_recovery_task(struct qeth_card *);
+void qeth_clear_recovery_task(struct qeth_card *);
 void qeth_set_allowed_threads(struct qeth_card *, unsigned long , int);
 int qeth_threads_running(struct qeth_card *, unsigned long);
 int qeth_wait_for_threads(struct qeth_card *, unsigned long);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 0d73a999983d..451f92020599 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -177,6 +177,23 @@ const char *qeth_get_cardname_short(struct qeth_card *card)
        return "n/a";
 }
+void qeth_set_recovery_task(struct qeth_card *card)
+{
+        card->recovery_task = current;
+}
+EXPORT_SYMBOL_GPL(qeth_set_recovery_task);
+void qeth_clear_recovery_task(struct qeth_card *card)
+{
+        card->recovery_task = NULL;
+}
+EXPORT_SYMBOL_GPL(qeth_clear_recovery_task);
+static bool qeth_is_recovery_task(const struct qeth_card *card)
+{
+        return card->recovery_task == current;
+}
 void qeth_set_allowed_threads(struct qeth_card *card, unsigned long threads,
                         int clear_start_mask)
 {
@@ -205,6 +222,8 @@ EXPORT_SYMBOL_GPL(qeth_threads_running);
 int qeth_wait_for_threads(struct qeth_card *card, unsigned long threads)
 {
+        if (qeth_is_recovery_task(card))
+                return 0;
        return wait_event_interruptible(card->wait_q,
                        qeth_threads_running(card, threads) == 0);
 }
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index d690166efeaf..155b101bd730 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1143,6 +1143,7 @@ static int qeth_l2_recover(void *ptr)
        QETH_CARD_TEXT(card, 2, "recover2");
        dev_warn(&card->gdev->dev,
                "A recovery process has been started for the device\n");
+        qeth_set_recovery_task(card);
        __qeth_l2_set_offline(card->gdev, 1);
        rc = __qeth_l2_set_online(card->gdev, 1);
        if (!rc)
@@ -1153,6 +1154,7 @@ static int qeth_l2_recover(void *ptr)
                dev_warn(&card->gdev->dev, "The qeth device driver "
                                "failed to recover an error on the device\n");
        }
+        qeth_clear_recovery_task(card);
        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
        return 0;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 8710337dab3e..1f7edf1b26c3 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3515,6 +3515,7 @@ static int qeth_l3_recover(void *ptr)
        QETH_CARD_TEXT(card, 2, "recover2");
        dev_warn(&card->gdev->dev,
                "A recovery process has been started for the device\n");
+        qeth_set_recovery_task(card);
        __qeth_l3_set_offline(card->gdev, 1);
        rc = __qeth_l3_set_online(card->gdev, 1);
        if (!rc)
@@ -3525,6 +3526,7 @@ static int qeth_l3_recover(void *ptr)
                dev_warn(&card->gdev->dev, "The qeth device driver "
                                "failed to recover an error on the device\n");
        }
+        qeth_clear_recovery_task(card);
        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
        return 0;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index a044f593e8b9..d0fa4b6c551f 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1899,8 +1899,8 @@ static int ibmvscsi_slave_configure(struct scsi_device *sdev)
                sdev->allow_restart = 1;
                blk_queue_rq_timeout(sdev->request_queue, 120 * HZ);
        }
-        scsi_adjust_queue_depth(sdev, 0, shost->cmd_per_lun);
        spin_unlock_irqrestore(shost->host_lock, lock_flags);
+        scsi_adjust_queue_depth(sdev, 0, shost->cmd_per_lun);
        return 0;
 }
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index f328089a1060..2197b57fb225 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -5148,7 +5148,7 @@ static int ipr_cancel_op(struct scsi_cmnd *scsi_cmd)
                ipr_trace;
        }
-        list_add_tail(&ipr_cmd->queue, &hrrq->hrrq_free_q);
+        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
        if (!ipr_is_naca_model(res))
                res->needs_sync_complete = 1;
@@ -9349,7 +9349,10 @@ static int ipr_test_msi(struct ipr_ioa_cfg *ioa_cfg, struct pci_dev *pdev)
        int_reg = readl(ioa_cfg->regs.sense_interrupt_mask_reg);
        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-        rc = request_irq(pdev->irq, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
+        if (ioa_cfg->intr_flag == IPR_USE_MSIX)
+                rc = request_irq(ioa_cfg->vectors_info[0].vec, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
+        else
+                rc = request_irq(pdev->irq, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
        if (rc) {
                dev_err(&pdev->dev, "Can not assign irq %d\n", pdev->irq);
                return rc;
@@ -9371,7 +9374,10 @@ static int ipr_test_msi(struct ipr_ioa_cfg *ioa_cfg, struct pci_dev *pdev)
        spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
-        free_irq(pdev->irq, ioa_cfg);
+        if (ioa_cfg->intr_flag == IPR_USE_MSIX)
+                free_irq(ioa_cfg->vectors_info[0].vec, ioa_cfg);
+        else
+                free_irq(pdev->irq, ioa_cfg);
        LEAVE;
@@ -9722,6 +9728,7 @@ static void __ipr_remove(struct pci_dev *pdev)
        spin_unlock_irqrestore(ioa_cfg->host->host_lock, host_lock_flags);
        wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
        flush_work(&ioa_cfg->work_q);
+        INIT_LIST_HEAD(&ioa_cfg->used_res_q);
        spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
        spin_lock(&ipr_driver_lock);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index aec2e0da5016..55cbd0180159 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -235,6 +235,17 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
        linkrate  = phy->linkrate;
        memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
+        /* Handle vacant phy - rest of dr data is not valid so skip it */
+        if (phy->phy_state == PHY_VACANT) {
+                memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+                phy->attached_dev_type = NO_DEVICE;
+                if (!test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)) {
+                        phy->phy_id = phy_id;
+                        goto skip;
+                } else
+                        goto out;
+        }
        phy->attached_dev_type = to_dev_type(dr);
        if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
                goto out;
@@ -272,6 +283,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
        phy->phy->maximum_linkrate = dr->pmax_linkrate;
        phy->phy->negotiated_linkrate = phy->linkrate;
+ skip:
        if (new_phy)
                if (sas_phy_add(phy->phy)) {
                        sas_phy_free(phy->phy);
@@ -388,7 +400,7 @@ int sas_ex_phy_discover(struct domain_device *dev, int single)
        if (!disc_req)
                return -ENOMEM;
-        disc_resp = alloc_smp_req(DISCOVER_RESP_SIZE);
+        disc_resp = alloc_smp_resp(DISCOVER_RESP_SIZE);
        if (!disc_resp) {
                kfree(disc_req);
                return -ENOMEM;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 74b67d98e952..d43faf34c1e2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -438,11 +438,12 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
        struct lpfc_rqe *temp_hrqe;
        struct lpfc_rqe *temp_drqe;
        struct lpfc_register doorbell;
-        int put_index = hq->host_index;
+        int put_index;
        /* sanity check on queue memory */
        if (unlikely(!hq) || unlikely(!dq))
                return -ENOMEM;
+        put_index = hq->host_index;
        temp_hrqe = hq->qe[hq->host_index].rqe;
        temp_drqe = dq->qe[dq->host_index].rqe;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 1d82eef4e1eb..b3db9dcc2619 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1938,11 +1938,6 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                    "Timer for the VP[%d] has stopped\n", vha->vp_idx);
        }
-        /* No pending activities shall be there on the vha now */
-        if (ql2xextended_error_logging & ql_dbg_user)
-                msleep(random32()%10);  /* Just to see if something falls on
-                                        * the net we have placed below */
        BUG_ON(atomic_read(&vha->vref_count));
        qla2x00_free_fcports(vha);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 1626de52e32a..fbc305f1c87c 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -15,6 +15,7 @@
 * | Mailbox commands             |       0x115b       | 0x111a-0x111b  |
 * |                              |                    | 0x112c-0x112e  |
 * |                              |                    | 0x113a         |
+ * |                              |                    | 0x1155-0x1158  |
 * | Device Discovery             |       0x2087       | 0x2020-0x2022, |
 * |                              |                    | 0x2016         |
 * | Queue Command and IO tracing |       0x3031       | 0x3006-0x300b  |
@@ -401,7 +402,7 @@ qla2xxx_copy_atioqueues(struct qla_hw_data *ha, void *ptr,
                void *ring;
        } aq, *aqp;
-        if (!ha->tgt.atio_q_length)
+        if (!ha->tgt.atio_ring)
                return ptr;
        num_queues = 1;
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index c6509911772b..65c5ff75936b 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -863,7 +863,6 @@ typedef struct {
 #define MBX_1           BIT_1
 #define MBX_0           BIT_0
-#define RNID_TYPE_SET_VERSION   0x9
 #define RNID_TYPE_ASIC_TEMP     0xC
 /*
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index eb3ca21a7f17..b310fa97b545 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -358,9 +358,6 @@ extern int
 qla2x00_disable_fce_trace(scsi_qla_host_t *, uint64_t *, uint64_t *);
 extern int
-qla2x00_set_driver_version(scsi_qla_host_t *, char *);
-extern int
 qla2x00_read_sfp(scsi_qla_host_t *, dma_addr_t, uint8_t *,
        uint16_t, uint16_t, uint16_t, uint16_t);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index edf4d14a1335..b59203393cb2 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -619,8 +619,6 @@ qla2x00_initialize_adapter(scsi_qla_host_t *vha)
        if (IS_QLA24XX_TYPE(ha) || IS_QLA25XX(ha))
                qla24xx_read_fcp_prio_cfg(vha);
-        qla2x00_set_driver_version(vha, QLA2XXX_VERSION);
        return (rval);
 }
@@ -1399,7 +1397,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                        mq_size += ha->max_rsp_queues *
                            (rsp->length * sizeof(response_t));
                }
-                if (ha->tgt.atio_q_length)
+                if (ha->tgt.atio_ring)
                        mq_size += ha->tgt.atio_q_length * sizeof(request_t);
                /* Allocate memory for Fibre Channel Event Buffer. */
                if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 186dd59ce4fa..43345af56431 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3866,64 +3866,6 @@ qla81xx_restart_mpi_firmware(scsi_qla_host_t *vha)
        return rval;
 }
-int
-qla2x00_set_driver_version(scsi_qla_host_t *vha, char *version)
-{
-        int rval;
-        mbx_cmd_t mc;
-        mbx_cmd_t *mcp = &mc;
-        int len;
-        uint16_t dwlen;
-        uint8_t *str;
-        dma_addr_t str_dma;
-        struct qla_hw_data *ha = vha->hw;
-        if (!IS_FWI2_CAPABLE(ha) || IS_QLA82XX(ha))
-                return QLA_FUNCTION_FAILED;
-        ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1155,
-            "Entered %s.\n", __func__);
-        str = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &str_dma);
-        if (!str) {
-                ql_log(ql_log_warn, vha, 0x1156,
-                    "Failed to allocate driver version param.\n");
-                return QLA_MEMORY_ALLOC_FAILED;
-        }
-        memcpy(str, "\x7\x3\x11\x0", 4);
-        dwlen = str[0];
-        len = dwlen * sizeof(uint32_t) - 4;
-        memset(str + 4, 0, len);
-        if (len > strlen(version))
-                len = strlen(version);
-        memcpy(str + 4, version, len);
-        mcp->mb[0] = MBC_SET_RNID_PARAMS;
-        mcp->mb[1] = RNID_TYPE_SET_VERSION << 8 | dwlen;
-        mcp->mb[2] = MSW(LSD(str_dma));
-        mcp->mb[3] = LSW(LSD(str_dma));
-        mcp->mb[6] = MSW(MSD(str_dma));
-        mcp->mb[7] = LSW(MSD(str_dma));
-        mcp->out_mb = MBX_7|MBX_6|MBX_3|MBX_2|MBX_1|MBX_0;
-        mcp->in_mb = MBX_0;
-        mcp->tov = MBX_TOV_SECONDS;
-        mcp->flags = 0;
-        rval = qla2x00_mailbox_command(vha, mcp);
-        if (rval != QLA_SUCCESS) {
-                ql_dbg(ql_dbg_mbx, vha, 0x1157,
-                    "Failed=%x mb[0]=%x.\n", rval, mcp->mb[0]);
-        } else {
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1158,
-                    "Done %s.\n", __func__);
-        }
-        dma_pool_free(ha->s_dma_pool, str, str_dma);
-        return rval;
-}
 static int
 qla2x00_read_asic_temperature(scsi_qla_host_t *vha, uint16_t *temp)
 {
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 2b6e478d9e33..ec54036d1e12 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.04.00.08-k"
+#define QLA2XXX_VERSION      "8.04.00.13-k"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    4
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 86974471af68..2a32036a9404 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4112,6 +4112,10 @@ static int st_probe(struct device *dev)
        tpnt->disk = disk;
        disk->private_data = &tpnt->driver;
        disk->queue = SDp->request_queue;
+        /* SCSI tape doesn't register this gendisk via add_disk().  Manually
+         * take queue reference that release_disk() expects. */
+        if (!blk_get_queue(disk->queue))
+                goto out_put_disk;
        tpnt->driver = &st_template;
        tpnt->device = SDp;
@@ -4185,7 +4189,7 @@ static int st_probe(struct device *dev)
        idr_preload_end();
        if (error < 0) {
                pr_warn("st: idr allocation failed: %d\n", error);
-                goto out_put_disk;
+                goto out_put_queue;
        }
        tpnt->index = error;
        sprintf(disk->disk_name, "st%d", tpnt->index);
@@ -4211,6 +4215,8 @@ out_remove_devs:
        spin_lock(&st_index_lock);
        idr_remove(&st_index_idr, tpnt->index);
        spin_unlock(&st_index_lock);
+out_put_queue:
+        blk_put_queue(disk->queue);
 out_put_disk:
        put_disk(disk);
        kfree(tpnt);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index ff1c5ee352cb..cbe48ab41745 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -409,6 +409,7 @@ static inline int core_alua_state_standby(
        case REPORT_LUNS:
        case RECEIVE_DIAGNOSTIC:
        case SEND_DIAGNOSTIC:
+                return 0;
        case MAINTENANCE_IN:
                switch (cdb[1] & 0x1f) {
                case MI_REPORT_TARGET_PGS:
@@ -451,6 +452,7 @@ static inline int core_alua_state_unavailable(
        switch (cdb[0]) {
        case INQUIRY:
        case REPORT_LUNS:
+                return 0;
        case MAINTENANCE_IN:
                switch (cdb[1] & 0x1f) {
                case MI_REPORT_TARGET_PGS:
@@ -491,6 +493,7 @@ static inline int core_alua_state_transition(
        switch (cdb[0]) {
        case INQUIRY:
        case REPORT_LUNS:
+                return 0;
        case MAINTENANCE_IN:
                switch (cdb[1] & 0x1f) {
                case MI_REPORT_TARGET_PGS:
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 484b6a3c9b03..302909ccf183 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -2643,9 +2643,9 @@ static int mxser_probe(struct pci_dev *pdev,
                                mxvar_sdriver, brd->idx + i, &pdev->dev);
                if (IS_ERR(tty_dev)) {
                        retval = PTR_ERR(tty_dev);
-                        for (i--; i >= 0; i--)
+                        for (; i > 0; i--)
                                tty_unregister_device(mxvar_sdriver,
-                                        brd->idx + i);
+                                        brd->idx + i - 1);
                        goto err_relbrd;
                }
        }
@@ -2751,9 +2751,9 @@ static int __init mxser_module_init(void)
                        tty_dev = tty_port_register_device(&brd->ports[i].port,
                                        mxvar_sdriver, brd->idx + i, NULL);
                        if (IS_ERR(tty_dev)) {
-                                for (i--; i >= 0; i--)
+                                for (; i > 0; i--)
                                        tty_unregister_device(mxvar_sdriver,
-                                                brd->idx + i);
+                                                brd->idx + i - 1);
                                for (i = 0; i < brd->info->nports; i++)
                                        tty_port_destroy(&brd->ports[i].port);
                                free_irq(brd->irq, brd);
diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
index b3455a970a1d..35d9ab95c5cb 100644
--- a/drivers/tty/serial/8250/8250_pnp.c
+++ b/drivers/tty/serial/8250/8250_pnp.c
@@ -429,7 +429,6 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
 {
        struct uart_8250_port uart;
        int ret, line, flags = dev_id->driver_data;
-        struct resource *res = NULL;
        if (flags & UNKNOWN_DEV) {
                ret = serial_pnp_guess_board(dev);
@@ -440,12 +439,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
        memset(&uart, 0, sizeof(uart));
        if (pnp_irq_valid(dev, 0))
                uart.port.irq = pnp_irq(dev, 0);
-        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
+        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
-                res = pnp_get_resource(dev, IORESOURCE_IO, 2);
+                uart.port.iobase = pnp_port_start(dev, 2);
-        else if (pnp_port_valid(dev, 0))
+                uart.port.iotype = UPIO_PORT;
-                res = pnp_get_resource(dev, IORESOURCE_IO, 0);
+        } else if (pnp_port_valid(dev, 0)) {
-        if (pnp_resource_enabled(res)) {
+                uart.port.iobase = pnp_port_start(dev, 0);
-                uart.port.iobase = res->start;
                uart.port.iotype = UPIO_PORT;
        } else if (pnp_mem_valid(dev, 0)) {
                uart.port.mapbase = pnp_mem_start(dev, 0);
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 4dc41408ecb7..30d4f7a783cd 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -886,6 +886,17 @@ serial_omap_set_termios(struct uart_port *port, struct ktermios *termios,
        serial_out(up, UART_MCR, up->mcr | UART_MCR_TCRTLR);
        /* FIFO ENABLE, DMA MODE */
+        up->scr |= OMAP_UART_SCR_RX_TRIG_GRANU1_MASK;
+        /*
+         * NOTE: Setting OMAP_UART_SCR_RX_TRIG_GRANU1_MASK
+         * sets Enables the granularity of 1 for TRIGGER RX
+         * level. Along with setting RX FIFO trigger level
+         * to 1 (as noted below, 16 characters) and TLR[3:0]
+         * to zero this will result RX FIFO threshold level
+         * to 1 character, instead of 16 as noted in comment
+         * below.
+         */
        /* Set receive FIFO threshold to 16 characters and
         * transmit FIFO threshold to 16 spaces
         */
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 8189cb6a86af..7abc5c81af2c 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -346,6 +346,7 @@ static long vfio_pci_ioctl(void *device_data,
                if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
                        size_t size;
+                        int max = vfio_pci_get_irq_count(vdev, hdr.index);
                        if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
                                size = sizeof(uint8_t);
@@ -355,7 +356,7 @@ static long vfio_pci_ioctl(void *device_data,
                                return -EINVAL;
                        if (hdr.argsz - minsz < hdr.count * size ||
-                            hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
+                            hdr.start >= max || hdr.start + hdr.count > max)
                                return -EINVAL;
                        data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 2968b4934659..957a0b98a5d9 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -74,9 +74,8 @@ enum {
 struct vhost_scsi {
        /* Protected by vhost_scsi->dev.mutex */
-        struct tcm_vhost_tpg *vs_tpg[VHOST_SCSI_MAX_TARGET];
+        struct tcm_vhost_tpg **vs_tpg;
        char vs_vhost_wwpn[TRANSPORT_IQN_LEN];
-        bool vs_endpoint;
        struct vhost_dev dev;
        struct vhost_virtqueue vqs[VHOST_SCSI_MAX_VQ];
@@ -579,9 +578,27 @@ static void tcm_vhost_submission_work(struct work_struct *work)
        }
 }
+static void vhost_scsi_send_bad_target(struct vhost_scsi *vs,
+        struct vhost_virtqueue *vq, int head, unsigned out)
+{
+        struct virtio_scsi_cmd_resp __user *resp;
+        struct virtio_scsi_cmd_resp rsp;
+        int ret;
+        memset(&rsp, 0, sizeof(rsp));
+        rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
+        resp = vq->iov[out].iov_base;
+        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        if (!ret)
+                vhost_add_used_and_signal(&vs->dev, vq, head, 0);
+        else
+                pr_err("Faulted on virtio_scsi_cmd_resp\n");
+}
 static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
        struct vhost_virtqueue *vq)
 {
+        struct tcm_vhost_tpg **vs_tpg;
        struct virtio_scsi_cmd_req v_req;
        struct tcm_vhost_tpg *tv_tpg;
        struct tcm_vhost_cmd *tv_cmd;
@@ -590,8 +607,16 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
        int head, ret;
        u8 target;
-        /* Must use ioctl VHOST_SCSI_SET_ENDPOINT */
+        /*
-        if (unlikely(!vs->vs_endpoint))
+         * We can handle the vq only after the endpoint is setup by calling the
+         * VHOST_SCSI_SET_ENDPOINT ioctl.
+         *
+         * TODO: Check that we are running from vhost_worker which acts
+         * as read-side critical section for vhost kind of RCU.
+         * See the comments in struct vhost_virtqueue in drivers/vhost/vhost.h
+         */
+        vs_tpg = rcu_dereference_check(vq->private_data, 1);
+        if (!vs_tpg)
                return;
        mutex_lock(&vq->mutex);
@@ -661,23 +686,11 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                /* Extract the tpgt */
                target = v_req.lun[1];
-                tv_tpg = vs->vs_tpg[target];
+                tv_tpg = ACCESS_ONCE(vs_tpg[target]);
                /* Target does not exist, fail the request */
                if (unlikely(!tv_tpg)) {
-                        struct virtio_scsi_cmd_resp __user *resp;
+                        vhost_scsi_send_bad_target(vs, vq, head, out);
-                        struct virtio_scsi_cmd_resp rsp;
-                        memset(&rsp, 0, sizeof(rsp));
-                        rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
-                        resp = vq->iov[out].iov_base;
-                        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
-                        if (!ret)
-                                vhost_add_used_and_signal(&vs->dev,
-                                                          vq, head, 0);
-                        else
-                                pr_err("Faulted on virtio_scsi_cmd_resp\n");
                        continue;
                }
@@ -690,22 +703,13 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                if (IS_ERR(tv_cmd)) {
                        vq_err(vq, "vhost_scsi_allocate_cmd failed %ld\n",
                                        PTR_ERR(tv_cmd));
-                        break;
+                        goto err_cmd;
                }
                pr_debug("Allocated tv_cmd: %p exp_data_len: %d, data_direction"
                        ": %d\n", tv_cmd, exp_data_len, data_direction);
                tv_cmd->tvc_vhost = vs;
                tv_cmd->tvc_vq = vq;
-                if (unlikely(vq->iov[out].iov_len !=
-                                sizeof(struct virtio_scsi_cmd_resp))) {
-                        vq_err(vq, "Expecting virtio_scsi_cmd_resp, got %zu"
-                                " bytes, out: %d, in: %d\n",
-                                vq->iov[out].iov_len, out, in);
-                        break;
-                }
                tv_cmd->tvc_resp = vq->iov[out].iov_base;
                /*
@@ -725,7 +729,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                                " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
                                scsi_command_size(tv_cmd->tvc_cdb),
                                TCM_VHOST_MAX_CDB_SIZE);
-                        break; /* TODO */
+                        goto err_free;
                }
                tv_cmd->tvc_lun = ((v_req.lun[2] << 8) | v_req.lun[3]) & 0x3FFF;
@@ -738,7 +742,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                                        data_direction == DMA_TO_DEVICE);
                        if (unlikely(ret)) {
                                vq_err(vq, "Failed to map iov to sgl\n");
-                                break; /* TODO */
+                                goto err_free;
                        }
                }
@@ -759,6 +763,13 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
        }
        mutex_unlock(&vq->mutex);
+        return;
+err_free:
+        vhost_scsi_free_cmd(tv_cmd);
+err_cmd:
+        vhost_scsi_send_bad_target(vs, vq, head, out);
+        mutex_unlock(&vq->mutex);
 }
 static void vhost_scsi_ctl_handle_kick(struct vhost_work *work)
@@ -780,6 +791,20 @@ static void vhost_scsi_handle_kick(struct vhost_work *work)
        vhost_scsi_handle_vq(vs, vq);
 }
+static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
+{
+        vhost_poll_flush(&vs->dev.vqs[index].poll);
+}
+static void vhost_scsi_flush(struct vhost_scsi *vs)
+{
+        int i;
+        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
+                vhost_scsi_flush_vq(vs, i);
+        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
+}
 /*
 * Called from vhost_scsi_ioctl() context to walk the list of available
 * tcm_vhost_tpg with an active struct tcm_vhost_nexus
@@ -790,8 +815,10 @@ static int vhost_scsi_set_endpoint(
 {
        struct tcm_vhost_tport *tv_tport;
        struct tcm_vhost_tpg *tv_tpg;
+        struct tcm_vhost_tpg **vs_tpg;
+        struct vhost_virtqueue *vq;
+        int index, ret, i, len;
        bool match = false;
-        int index, ret;
        mutex_lock(&vs->dev.mutex);
        /* Verify that ring has been setup correctly. */
@@ -803,6 +830,15 @@ static int vhost_scsi_set_endpoint(
                }
        }
+        len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
+        vs_tpg = kzalloc(len, GFP_KERNEL);
+        if (!vs_tpg) {
+                mutex_unlock(&vs->dev.mutex);
+                return -ENOMEM;
+        }
+        if (vs->vs_tpg)
+                memcpy(vs_tpg, vs->vs_tpg, len);
        mutex_lock(&tcm_vhost_mutex);
        list_for_each_entry(tv_tpg, &tcm_vhost_list, tv_tpg_list) {
                mutex_lock(&tv_tpg->tv_tpg_mutex);
@@ -817,14 +853,15 @@ static int vhost_scsi_set_endpoint(
                tv_tport = tv_tpg->tport;
                if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
-                        if (vs->vs_tpg[tv_tpg->tport_tpgt]) {
+                        if (vs->vs_tpg && vs->vs_tpg[tv_tpg->tport_tpgt]) {
                                mutex_unlock(&tv_tpg->tv_tpg_mutex);
                                mutex_unlock(&tcm_vhost_mutex);
                                mutex_unlock(&vs->dev.mutex);
+                                kfree(vs_tpg);
                                return -EEXIST;
                        }
                        tv_tpg->tv_tpg_vhost_count++;
-                        vs->vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
+                        vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
                        smp_mb__after_atomic_inc();
                        match = true;
                }
@@ -835,12 +872,27 @@ static int vhost_scsi_set_endpoint(
        if (match) {
                memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
                       sizeof(vs->vs_vhost_wwpn));
-                vs->vs_endpoint = true;
+                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+                        vq = &vs->vqs[i];
+                        /* Flushing the vhost_work acts as synchronize_rcu */
+                        mutex_lock(&vq->mutex);
+                        rcu_assign_pointer(vq->private_data, vs_tpg);
+                        vhost_init_used(vq);
+                        mutex_unlock(&vq->mutex);
+                }
                ret = 0;
        } else {
                ret = -EEXIST;
        }
+        /*
+         * Act as synchronize_rcu to make sure access to
+         * old vs->vs_tpg is finished.
+         */
+        vhost_scsi_flush(vs);
+        kfree(vs->vs_tpg);
+        vs->vs_tpg = vs_tpg;
        mutex_unlock(&vs->dev.mutex);
        return ret;
 }
@@ -851,6 +903,8 @@ static int vhost_scsi_clear_endpoint(
 {
        struct tcm_vhost_tport *tv_tport;
        struct tcm_vhost_tpg *tv_tpg;
+        struct vhost_virtqueue *vq;
+        bool match = false;
        int index, ret, i;
        u8 target;
@@ -862,9 +916,14 @@ static int vhost_scsi_clear_endpoint(
                        goto err_dev;
                }
        }
+        if (!vs->vs_tpg) {
+                mutex_unlock(&vs->dev.mutex);
+                return 0;
+        }
        for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
                target = i;
                tv_tpg = vs->vs_tpg[target];
                if (!tv_tpg)
                        continue;
@@ -886,10 +945,27 @@ static int vhost_scsi_clear_endpoint(
                }
                tv_tpg->tv_tpg_vhost_count--;
                vs->vs_tpg[target] = NULL;
-                vs->vs_endpoint = false;
+                match = true;
                mutex_unlock(&tv_tpg->tv_tpg_mutex);
        }
+        if (match) {
+                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+                        vq = &vs->vqs[i];
+                        /* Flushing the vhost_work acts as synchronize_rcu */
+                        mutex_lock(&vq->mutex);
+                        rcu_assign_pointer(vq->private_data, NULL);
+                        mutex_unlock(&vq->mutex);
+                }
+        }
+        /*
+         * Act as synchronize_rcu to make sure access to
+         * old vs->vs_tpg is finished.
+         */
+        vhost_scsi_flush(vs);
+        kfree(vs->vs_tpg);
+        vs->vs_tpg = NULL;
        mutex_unlock(&vs->dev.mutex);
        return 0;
 err_tpg:
@@ -899,6 +975,24 @@ err_dev:
        return ret;
 }
+static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
+{
+        if (features & ~VHOST_SCSI_FEATURES)
+                return -EOPNOTSUPP;
+        mutex_lock(&vs->dev.mutex);
+        if ((features & (1 << VHOST_F_LOG_ALL)) &&
+            !vhost_log_access_ok(&vs->dev)) {
+                mutex_unlock(&vs->dev.mutex);
+                return -EFAULT;
+        }
+        vs->dev.acked_features = features;
+        smp_wmb();
+        vhost_scsi_flush(vs);
+        mutex_unlock(&vs->dev.mutex);
+        return 0;
+}
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
        struct vhost_scsi *s;
@@ -939,38 +1033,6 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
        return 0;
 }
-static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
-{
-        vhost_poll_flush(&vs->dev.vqs[index].poll);
-}
-static void vhost_scsi_flush(struct vhost_scsi *vs)
-{
-        int i;
-        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
-                vhost_scsi_flush_vq(vs, i);
-        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
-}
-static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
-{
-        if (features & ~VHOST_SCSI_FEATURES)
-                return -EOPNOTSUPP;
-        mutex_lock(&vs->dev.mutex);
-        if ((features & (1 << VHOST_F_LOG_ALL)) &&
-            !vhost_log_access_ok(&vs->dev)) {
-                mutex_unlock(&vs->dev.mutex);
-                return -EFAULT;
-        }
-        vs->dev.acked_features = features;
-        smp_wmb();
-        vhost_scsi_flush(vs);
-        mutex_unlock(&vs->dev.mutex);
-        return 0;
-}
 static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
                                unsigned long arg)
 {
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 9fcc70c11cea..e89fc3133972 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -117,7 +117,7 @@ config ARM_SP805_WATCHDOG
 config AT91RM9200_WATCHDOG
        tristate "AT91RM9200 watchdog"
-        depends on ARCH_AT91
+        depends on ARCH_AT91RM9200
        help
          Watchdog timer embedded into AT91RM9200 chips. This will reboot your
          system when the timeout is reached.
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index aa85881d17b2..2647ad8e1f19 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -1316,7 +1316,7 @@ static void __xen_evtchn_do_upcall(void)
 {
        int start_word_idx, start_bit_idx;
        int word_idx, bit_idx;
-        int i;
+        int i, irq;
        int cpu = get_cpu();
        struct shared_info *s = HYPERVISOR_shared_info;
        struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
@@ -1324,6 +1324,8 @@ static void __xen_evtchn_do_upcall(void)
        do {
                xen_ulong_t pending_words;
+                xen_ulong_t pending_bits;
+                struct irq_desc *desc;
                vcpu_info->evtchn_upcall_pending = 0;
@@ -1335,6 +1337,17 @@ static void __xen_evtchn_do_upcall(void)
                 * selector flag. xchg_xen_ulong must contain an
                 * appropriate barrier.
                 */
+                if ((irq = per_cpu(virq_to_irq, cpu)[VIRQ_TIMER]) != -1) {
+                        int evtchn = evtchn_from_irq(irq);
+                        word_idx = evtchn / BITS_PER_LONG;
+                        pending_bits = evtchn % BITS_PER_LONG;
+                        if (active_evtchns(cpu, s, word_idx) & (1ULL << pending_bits)) {
+                                desc = irq_to_desc(irq);
+                                if (desc)
+                                        generic_handle_irq_desc(irq, desc);
+                        }
+                }
                pending_words = xchg_xen_ulong(&vcpu_info->evtchn_pending_sel, 0);
                start_word_idx = __this_cpu_read(current_word_idx);
@@ -1343,7 +1356,6 @@ static void __xen_evtchn_do_upcall(void)
                word_idx = start_word_idx;
                for (i = 0; pending_words != 0; i++) {
-                        xen_ulong_t pending_bits;
                        xen_ulong_t words;
                        words = MASK_LSBS(pending_words, word_idx);
@@ -1372,8 +1384,7 @@ static void __xen_evtchn_do_upcall(void)
                        do {
                                xen_ulong_t bits;
-                                int port, irq;
+                                int port;
-                                struct irq_desc *desc;
                                bits = MASK_LSBS(pending_bits, bit_idx);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 451fad96ecd1..ef96381569a4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -317,6 +317,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
        unsigned long src_ptr;
        unsigned long dst_ptr;
        int overwrite_root = 0;
+        bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
        if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
                overwrite_root = 1;
@@ -326,6 +327,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
        /* look for the key in the destination tree */
        ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
+        if (ret < 0)
+                return ret;
        if (ret == 0) {
                char *src_copy;
                char *dst_copy;
@@ -367,6 +371,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                        return 0;
                }
+                /*
+                 * We need to load the old nbytes into the inode so when we
+                 * replay the extents we've logged we get the right nbytes.
+                 */
+                if (inode_item) {
+                        struct btrfs_inode_item *item;
+                        u64 nbytes;
+                        item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                              struct btrfs_inode_item);
+                        nbytes = btrfs_inode_nbytes(path->nodes[0], item);
+                        item = btrfs_item_ptr(eb, slot,
+                                              struct btrfs_inode_item);
+                        btrfs_set_inode_nbytes(eb, item, nbytes);
+                }
+        } else if (inode_item) {
+                struct btrfs_inode_item *item;
+                /*
+                 * New inode, set nbytes to 0 so that the nbytes comes out
+                 * properly when we replay the extents.
+                 */
+                item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
+                btrfs_set_inode_nbytes(eb, item, 0);
        }
 insert:
        btrfs_release_path(path);
@@ -486,7 +514,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
        int found_type;
        u64 extent_end;
        u64 start = key->offset;
-        u64 saved_nbytes;
+        u64 nbytes = 0;
        struct btrfs_file_extent_item *item;
        struct inode *inode = NULL;
        unsigned long size;
@@ -496,10 +524,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
        found_type = btrfs_file_extent_type(eb, item);
        if (found_type == BTRFS_FILE_EXTENT_REG ||
-            found_type == BTRFS_FILE_EXTENT_PREALLOC)
+            found_type == BTRFS_FILE_EXTENT_PREALLOC) {
-                extent_end = start + btrfs_file_extent_num_bytes(eb, item);
+                nbytes = btrfs_file_extent_num_bytes(eb, item);
-        else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+                extent_end = start + nbytes;
+                /*
+                 * We don't add to the inodes nbytes if we are prealloc or a
+                 * hole.
+                 */
+                if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
+                        nbytes = 0;
+        } else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
                size = btrfs_file_extent_inline_len(eb, item);
+                nbytes = btrfs_file_extent_ram_bytes(eb, item);
                extent_end = ALIGN(start + size, root->sectorsize);
        } else {
                ret = 0;
@@ -548,7 +585,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
        }
        btrfs_release_path(path);
-        saved_nbytes = inode_get_bytes(inode);
        /* drop any overlapping extents */
        ret = btrfs_drop_extents(trans, root, inode, start, extent_end, 1);
        BUG_ON(ret);
@@ -635,7 +671,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                BUG_ON(ret);
        }
-        inode_set_bytes(inode, saved_nbytes);
+        inode_add_bytes(inode, nbytes);
        ret = btrfs_update_inode(trans, root, inode);
 out:
        if (inode)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 991c63c6bdd0..21b3a291c327 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1575,14 +1575,24 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        }
                        break;
                case Opt_blank_pass:
-                        vol->password = NULL;
-                        break;
-                case Opt_pass:
                        /* passwords have to be handled differently
                         * to allow the character used for deliminator
                         * to be passed within them
                         */
+                        /*
+                         * Check if this is a case where the  password
+                         * starts with a delimiter
+                         */
+                        tmp_end = strchr(data, '=');
+                        tmp_end++;
+                        if (!(tmp_end < end && tmp_end[1] == delim)) {
+                                /* No it is not. Set the password to NULL */
+                                vol->password = NULL;
+                                break;
+                        }
+                        /* Yes it is. Drop down to Opt_pass below.*/
+                case Opt_pass:
                        /* Obtain the value string */
                        value = strchr(data, '=');
                        value++;
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 412e6eda25f8..e4141f257495 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -80,13 +80,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
        int rc;
        mutex_lock(&ecryptfs_daemon_hash_mux);
-        rc = try_module_get(THIS_MODULE);
-        if (rc == 0) {
-                rc = -EIO;
-                printk(KERN_ERR "%s: Error attempting to increment module use "
-                       "count; rc = [%d]\n", __func__, rc);
-                goto out_unlock_daemon_list;
-        }
        rc = ecryptfs_find_daemon_by_euid(&daemon);
        if (!rc) {
                rc = -EINVAL;
@@ -96,7 +89,7 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
        if (rc) {
                printk(KERN_ERR "%s: Error attempting to spawn daemon; "
                       "rc = [%d]\n", __func__, rc);
-                goto out_module_put_unlock_daemon_list;
+                goto out_unlock_daemon_list;
        }
        mutex_lock(&daemon->mux);
        if (daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN) {
@@ -108,9 +101,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
        atomic_inc(&ecryptfs_num_miscdev_opens);
 out_unlock_daemon:
        mutex_unlock(&daemon->mux);
-out_module_put_unlock_daemon_list:
-        if (rc)
-                module_put(THIS_MODULE);
 out_unlock_daemon_list:
        mutex_unlock(&ecryptfs_daemon_hash_mux);
        return rc;
@@ -147,7 +137,6 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
                       "bug.\n", __func__, rc);
                BUG();
        }
-        module_put(THIS_MODULE);
        return rc;
 }
@@ -471,6 +460,7 @@ out_free:
 static const struct file_operations ecryptfs_miscdev_fops = {
+        .owner   = THIS_MODULE,
        .open    = ecryptfs_miscdev_open,
        .poll    = ecryptfs_miscdev_poll,
        .read    = ecryptfs_miscdev_read,
diff --git a/fs/inode.c b/fs/inode.c
index f5f7c06c36fb..a898b3d43ccf 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -725,7 +725,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
                 * inode to the back of the list so we don't spin on it.
                 */
                if (!spin_trylock(&inode->i_lock)) {
-                        list_move_tail(&inode->i_lru, &sb->s_inode_lru);
+                        list_move(&inode->i_lru, &sb->s_inode_lru);
                        continue;
                }
diff --git a/fs/namespace.c b/fs/namespace.c
index d581e45c0a9f..341d3f564082 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1690,7 +1690,7 @@ static int do_loopback(struct path *path, const char *old_name,
        if (IS_ERR(mnt)) {
                err = PTR_ERR(mnt);
-                goto out;
+                goto out2;
        }
        err = graft_tree(mnt, path);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index ac4fc9a8fdbc..66b6664dcd4c 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
                           struct rpc_cred *cred)
 {
        struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-        struct nfs_client *pos, *n, *prev = NULL;
+        struct nfs_client *pos, *prev = NULL;
        struct nfs4_setclientid_res clid = {
                .clientid       = new->cl_clientid,
                .confirm        = new->cl_confirm,
@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
        int status = -NFS4ERR_STALE_CLIENTID;
        spin_lock(&nn->nfs_client_lock);
-        list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
+        list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
                /* If "pos" isn't marked ready, we can't trust the
                 * remaining fields in "pos" */
-                if (pos->cl_cons_state < NFS_CS_READY)
+                if (pos->cl_cons_state > NFS_CS_READY) {
+                        atomic_inc(&pos->cl_count);
+                        spin_unlock(&nn->nfs_client_lock);
+                        if (prev)
+                                nfs_put_client(prev);
+                        prev = pos;
+                        status = nfs_wait_client_init_complete(pos);
+                        spin_lock(&nn->nfs_client_lock);
+                        if (status < 0)
+                                continue;
+                }
+                if (pos->cl_cons_state != NFS_CS_READY)
                        continue;
                if (pos->rpc_ops != new->rpc_ops)
@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
                           struct rpc_cred *cred)
 {
        struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-        struct nfs_client *pos, *n, *prev = NULL;
+        struct nfs_client *pos, *prev = NULL;
        int status = -NFS4ERR_STALE_CLIENTID;
        spin_lock(&nn->nfs_client_lock);
-        list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
+        list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
                /* If "pos" isn't marked ready, we can't trust the
                 * remaining fields in "pos", especially the client
                 * ID and serverowner fields.  Wait for CREATE_SESSION
                 * to finish. */
-                if (pos->cl_cons_state < NFS_CS_READY) {
+                if (pos->cl_cons_state > NFS_CS_READY) {
                        atomic_inc(&pos->cl_count);
                        spin_unlock(&nn->nfs_client_lock);
@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
                                nfs_put_client(prev);
                        prev = pos;
-                        nfs4_schedule_lease_recovery(pos);
                        status = nfs_wait_client_init_complete(pos);
-                        if (status < 0) {
+                        if (status == 0) {
-                                nfs_put_client(pos);
+                                nfs4_schedule_lease_recovery(pos);
-                                spin_lock(&nn->nfs_client_lock);
+                                status = nfs4_wait_clnt_recover(pos);
-                                continue;
                        }
-                        status = pos->cl_cons_state;
                        spin_lock(&nn->nfs_client_lock);
                        if (status < 0)
                                continue;
                }
+                if (pos->cl_cons_state != NFS_CS_READY)
+                        continue;
                if (pos->rpc_ops != new->rpc_ops)
                        continue;
@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
                        continue;
                atomic_inc(&pos->cl_count);
-                spin_unlock(&nn->nfs_client_lock);
+                *result = pos;
+                status = 0;
                dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
                        __func__, pos, atomic_read(&pos->cl_count));
+                break;
-                *result = pos;
-                return 0;
        }
        /* No matching nfs_client found. */
        spin_unlock(&nn->nfs_client_lock);
        dprintk("NFS: <-- %s status = %d\n", __func__, status);
+        if (prev)
+                nfs_put_client(prev);
        return status;
 }
 #endif  /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 26431cf62ddb..0ad025eb523b 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1046,6 +1046,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
                /* Save the delegation */
                nfs4_stateid_copy(&stateid, &delegation->stateid);
                rcu_read_unlock();
+                nfs_release_seqid(opendata->o_arg.seqid);
                ret = nfs_may_open(state->inode, state->owner->so_cred, open_mode);
                if (ret != 0)
                        goto out;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6ace365c6334..d41a3518509f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1886,7 +1886,13 @@ again:
                        status = PTR_ERR(clnt);
                        break;
                }
-                clp->cl_rpcclient = clnt;
+                /* Note: this is safe because we haven't yet marked the
+                 * client as ready, so we are the only user of
+                 * clp->cl_rpcclient
+                 */
+                clnt = xchg(&clp->cl_rpcclient, clnt);
+                rpc_shutdown_client(clnt);
+                clnt = clp->cl_rpcclient;
                goto again;
        case -NFS4ERR_MINOR_VERS_MISMATCH:
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 4b3b3ffb52f1..21e1a8f1659d 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -755,37 +755,8 @@ void pde_put(struct proc_dir_entry *pde)
                free_proc_entry(pde);
 }
-/*
+static void entry_rundown(struct proc_dir_entry *de)
- * Remove a /proc entry and free it if it's not currently in use.
- */
-void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
 {
-        struct proc_dir_entry **p;
-        struct proc_dir_entry *de = NULL;
-        const char *fn = name;
-        unsigned int len;
-        spin_lock(&proc_subdir_lock);
-        if (__xlate_proc_name(name, &parent, &fn) != 0) {
-                spin_unlock(&proc_subdir_lock);
-                return;
-        }
-        len = strlen(fn);
-        for (p = &parent->subdir; *p; p=&(*p)->next ) {
-                if (proc_match(len, fn, *p)) {
-                        de = *p;
-                        *p = de->next;
-                        de->next = NULL;
-                        break;
-                }
-        }
-        spin_unlock(&proc_subdir_lock);
-        if (!de) {
-                WARN(1, "name '%s'\n", name);
-                return;
-        }
        spin_lock(&de->pde_unload_lock);
        /*
         * Stop accepting new callers into module. If you're
@@ -817,6 +788,40 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
                spin_lock(&de->pde_unload_lock);
        }
        spin_unlock(&de->pde_unload_lock);
+}
+/*
+ * Remove a /proc entry and free it if it's not currently in use.
+ */
+void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
+{
+        struct proc_dir_entry **p;
+        struct proc_dir_entry *de = NULL;
+        const char *fn = name;
+        unsigned int len;
+        spin_lock(&proc_subdir_lock);
+        if (__xlate_proc_name(name, &parent, &fn) != 0) {
+                spin_unlock(&proc_subdir_lock);
+                return;
+        }
+        len = strlen(fn);
+        for (p = &parent->subdir; *p; p=&(*p)->next ) {
+                if (proc_match(len, fn, *p)) {
+                        de = *p;
+                        *p = de->next;
+                        de->next = NULL;
+                        break;
+                }
+        }
+        spin_unlock(&proc_subdir_lock);
+        if (!de) {
+                WARN(1, "name '%s'\n", name);
+                return;
+        }
+        entry_rundown(de);
        if (S_ISDIR(de->mode))
                parent->nlink--;
@@ -827,3 +832,57 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
        pde_put(de);
 }
 EXPORT_SYMBOL(remove_proc_entry);
+int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)
+{
+        struct proc_dir_entry **p;
+        struct proc_dir_entry *root = NULL, *de, *next;
+        const char *fn = name;
+        unsigned int len;
+        spin_lock(&proc_subdir_lock);
+        if (__xlate_proc_name(name, &parent, &fn) != 0) {
+                spin_unlock(&proc_subdir_lock);
+                return -ENOENT;
+        }
+        len = strlen(fn);
+        for (p = &parent->subdir; *p; p=&(*p)->next ) {
+                if (proc_match(len, fn, *p)) {
+                        root = *p;
+                        *p = root->next;
+                        root->next = NULL;
+                        break;
+                }
+        }
+        if (!root) {
+                spin_unlock(&proc_subdir_lock);
+                return -ENOENT;
+        }
+        de = root;
+        while (1) {
+                next = de->subdir;
+                if (next) {
+                        de->subdir = next->next;
+                        next->next = NULL;
+                        de = next;
+                        continue;
+                }
+                spin_unlock(&proc_subdir_lock);
+                entry_rundown(de);
+                next = de->parent;
+                if (S_ISDIR(de->mode))
+                        next->nlink--;
+                de->nlink = 0;
+                if (de == root)
+                        break;
+                pde_put(de);
+                spin_lock(&proc_subdir_lock);
+                de = next;
+        }
+        pde_put(root);
+        return 0;
+}
+EXPORT_SYMBOL(remove_proc_subtree);
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 25f01d0bc149..b1b1fa6ffffe 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -99,7 +99,12 @@ struct mmu_gather {
        unsigned int            need_flush : 1, /* Did free PTEs */
                                fast_mode  : 1; /* No batching   */
-        unsigned int            fullmm;
+        /* we are in the middle of an operation to clear
+         * a full mm and can make some optimizations */
+        unsigned int            fullmm : 1,
+        /* we have performed an operation which
+         * requires a complete flush of the tlb */
+                                need_flush_all : 1;
        struct mmu_gather_batch *active;
        struct mmu_gather_batch local;
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 8f7a3d68371a..ee0bd9524055 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -954,7 +954,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
        }
 }
-static inline bool atapi_command_packet_set(const u16 *dev_id)
+static inline int atapi_command_packet_set(const u16 *dev_id)
 {
        return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
 }
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 98503b792369..d9a4f7f40f32 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data {
 #define _KERNEL_CAP_T_SIZE     (sizeof(kernel_cap_t))
+struct file;
 struct inode;
 struct dentry;
 struct user_namespace;
@@ -211,6 +212,7 @@ extern bool capable(int cap);
 extern bool ns_capable(struct user_namespace *ns, int cap);
 extern bool nsown_capable(int cap);
 extern bool inode_capable(const struct inode *inode, int cap);
+extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
 /* audit system wants to get cap info from files as well */
 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index e5ca8ef50e9b..52da2a250795 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -89,6 +89,7 @@ typedef void (*ftrace_func_t)(unsigned long ip, unsigned long parent_ip,
 *            that the call back has its own recursion protection. If it does
 *            not set this, then the ftrace infrastructure will add recursion
 *            protection for the caller.
+ * STUB   - The ftrace_ops is just a place holder.
 */
 enum {
        FTRACE_OPS_FL_ENABLED                   = 1 << 0,
@@ -98,6 +99,7 @@ enum {
        FTRACE_OPS_FL_SAVE_REGS                 = 1 << 4,
        FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED    = 1 << 5,
        FTRACE_OPS_FL_RECURSION_SAFE            = 1 << 6,
+        FTRACE_OPS_FL_STUB                      = 1 << 7,
 };
 struct ftrace_ops {
@@ -394,7 +396,6 @@ ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf,
                            size_t cnt, loff_t *ppos);
 ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
                             size_t cnt, loff_t *ppos);
-loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence);
 int ftrace_regex_release(struct inode *inode, struct file *file);
 void __init
@@ -567,6 +568,8 @@ static inline int
 ftrace_regex_release(struct inode *inode, struct file *file) { return -ENODEV; }
 #endif /* CONFIG_DYNAMIC_FTRACE */
+loff_t ftrace_filter_lseek(struct file *file, loff_t offset, int whence);
 /* totally disable ftrace - can not re-enable after this */
 void ftrace_kill(void);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 91c9d109e5f1..eae7a053dc51 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -398,6 +398,7 @@ enum {
        ATA_HORKAGE_NOSETXFER   = (1 << 14),    /* skip SETXFER, SATA only */
        ATA_HORKAGE_BROKEN_FPDMA_AA     = (1 << 15),    /* skip AA */
        ATA_HORKAGE_DUMP_ID     = (1 << 16),    /* dump IDENTIFY data */
+        ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),  /* Set max sects to 65535 */
         /* DMA mask for user DMA control: User visible values; DO NOT
            renumber */
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index 5a710b9c578e..87a03c746f17 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -93,14 +93,20 @@ do { \
 #else /* !CONFIG_PREEMPT_COUNT */
-#define preempt_disable()               do { } while (0)
+/*
-#define sched_preempt_enable_no_resched()       do { } while (0)
+ * Even if we don't have any preemption, we need preempt disable/enable
-#define preempt_enable_no_resched()     do { } while (0)
+ * to be barriers, so that we don't have things like get_user/put_user
-#define preempt_enable()                do { } while (0)
+ * that can cause faults and scheduling migrate into our preempt-protected
+ * region.
-#define preempt_disable_notrace()               do { } while (0)
+ */
-#define preempt_enable_no_resched_notrace()     do { } while (0)
+#define preempt_disable()               barrier()
-#define preempt_enable_notrace()                do { } while (0)
+#define sched_preempt_enable_no_resched()       barrier()
+#define preempt_enable_no_resched()     barrier()
+#define preempt_enable()                barrier()
+#define preempt_disable_notrace()               barrier()
+#define preempt_enable_no_resched_notrace()     barrier()
+#define preempt_enable_notrace()                barrier()
 #endif /* CONFIG_PREEMPT_COUNT */
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 8307f2f94d86..94dfb2aa5533 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -117,6 +117,7 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
                                const struct file_operations *proc_fops,
                                void *data);
 extern void remove_proc_entry(const char *name, struct proc_dir_entry *parent);
+extern int remove_proc_subtree(const char *name, struct proc_dir_entry *parent);
 struct pid_namespace;
@@ -202,6 +203,7 @@ static inline struct proc_dir_entry *proc_create_data(const char *name,
        return NULL;
 }
 #define remove_proc_entry(name, parent) do {} while (0)
+#define remove_proc_subtree(name, parent) do {} while (0)
 static inline struct proc_dir_entry *proc_symlink(const char *name,
                struct proc_dir_entry *parent,const char *dest) {return NULL;}
diff --git a/include/linux/security.h b/include/linux/security.h
index eee7478cda70..032c366ef1c6 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1012,6 +1012,10 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
 *      This hook can be used by the module to update any security state
 *      associated with the TUN device's security structure.
 *      @security pointer to the TUN devices's security structure.
+ * @skb_owned_by:
+ *      This hook sets the packet's owning sock.
+ *      @skb is the packet.
+ *      @sk the sock which owns the packet.
 *
 * Security hooks for XFRM operations.
 *
@@ -1638,6 +1642,7 @@ struct security_operations {
        int (*tun_dev_attach_queue) (void *security);
        int (*tun_dev_attach) (struct sock *sk, void *security);
        int (*tun_dev_open) (void *security);
+        void (*skb_owned_by) (struct sk_buff *skb, struct sock *sk);
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -2588,6 +2593,8 @@ int security_tun_dev_attach_queue(void *security);
 int security_tun_dev_attach(struct sock *sk, void *security);
 int security_tun_dev_open(void *security);
+void security_skb_owned_by(struct sk_buff *skb, struct sock *sk);
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct sock *sock,
                                               struct sock *other,
@@ -2779,6 +2786,11 @@ static inline int security_tun_dev_open(void *security)
 {
        return 0;
 }
+static inline void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
index a26e2fb604e6..e2369c167dbd 100644
--- a/include/linux/spinlock_up.h
+++ b/include/linux/spinlock_up.h
@@ -16,7 +16,10 @@
 * In the debug case, 1 means unlocked, 0 means locked. (the values
 * are inverted, to catch initialization bugs)
 *
- * No atomicity anywhere, we are on UP.
+ * No atomicity anywhere, we are on UP. However, we still need
+ * the compiler barriers, because we do not want the compiler to
+ * move potentially faulting instructions (notably user accesses)
+ * into the locked sequence, resulting in non-atomic execution.
 */
 #ifdef CONFIG_DEBUG_SPINLOCK
@@ -25,6 +28,7 @@
 static inline void arch_spin_lock(arch_spinlock_t *lock)
 {
        lock->slock = 0;
+        barrier();
 }
 static inline void
@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
 {
        local_irq_save(flags);
        lock->slock = 0;
+        barrier();
 }
 static inline int arch_spin_trylock(arch_spinlock_t *lock)
@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
        char oldval = lock->slock;
        lock->slock = 0;
+        barrier();
        return oldval > 0;
 }
 static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
+        barrier();
        lock->slock = 1;
 }
 /*
 * Read-write spinlocks. No debug version.
 */
-#define arch_read_lock(lock)            do { (void)(lock); } while (0)
+#define arch_read_lock(lock)            do { barrier(); (void)(lock); } while (0)
-#define arch_write_lock(lock)           do { (void)(lock); } while (0)
+#define arch_write_lock(lock)           do { barrier(); (void)(lock); } while (0)
-#define arch_read_trylock(lock) ({ (void)(lock); 1; })
+#define arch_read_trylock(lock) ({ barrier(); (void)(lock); 1; })
-#define arch_write_trylock(lock)        ({ (void)(lock); 1; })
+#define arch_write_trylock(lock)        ({ barrier(); (void)(lock); 1; })
-#define arch_read_unlock(lock)          do { (void)(lock); } while (0)
+#define arch_read_unlock(lock)          do { barrier(); (void)(lock); } while (0)
-#define arch_write_unlock(lock) do { (void)(lock); } while (0)
+#define arch_write_unlock(lock) do { barrier(); (void)(lock); } while (0)
 #else /* DEBUG_SPINLOCK */
 #define arch_spin_is_locked(lock)       ((void)(lock), 0)
 /* for sched.c and kernel_lock.c: */
-# define arch_spin_lock(lock)           do { (void)(lock); } while (0)
+# define arch_spin_lock(lock)           do { barrier(); (void)(lock); } while (0)
-# define arch_spin_lock_flags(lock, flags)      do { (void)(lock); } while (0)
+# define arch_spin_lock_flags(lock, flags)      do { barrier(); (void)(lock); } while (0)
-# define arch_spin_unlock(lock) do { (void)(lock); } while (0)
+# define arch_spin_unlock(lock) do { barrier(); (void)(lock); } while (0)
-# define arch_spin_trylock(lock)        ({ (void)(lock); 1; })
+# define arch_spin_trylock(lock)        ({ barrier(); (void)(lock); 1; })
 #endif /* DEBUG_SPINLOCK */
 #define arch_spin_is_contended(lock)    (((void)(lock), 0))
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index cc7c19732389..714cc9a54a4c 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -130,6 +130,14 @@ struct iucv_sock {
                                               enum iucv_tx_notify n);
 };
+struct iucv_skb_cb {
+        u32     class;          /* target class of message */
+        u32     tag;            /* tag associated with message */
+        u32     offset;         /* offset for skb receival */
+};
+#define IUCV_SKB_CB(__skb)      ((struct iucv_skb_cb *)&((__skb)->cb[0]))
 /* iucv socket options (SOL_IUCV) */
 #define SO_IPRMDATA_MSG 0x0080          /* send/recv IPRM_DATA msgs */
 #define SO_MSGLIMIT     0x1000          /* get/set IUCV MSGLIMIT */
diff --git a/include/sound/dmaengine_pcm.h b/include/sound/dmaengine_pcm.h
index 95620428a59b..b1d1150c1d60 100644
--- a/include/sound/dmaengine_pcm.h
+++ b/include/sound/dmaengine_pcm.h
@@ -16,6 +16,7 @@
 #define __SOUND_DMAENGINE_PCM_H__
 #include <sound/pcm.h>
+#include <sound/soc.h>
 #include <linux/dmaengine.h>
 /**
@@ -39,9 +40,15 @@ snd_pcm_uframes_t snd_dmaengine_pcm_pointer(struct snd_pcm_substream *substream)
 snd_pcm_uframes_t snd_dmaengine_pcm_pointer_no_residue(struct snd_pcm_substream *substream);
 int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream,
-        dma_filter_fn filter_fn, void *filter_data);
+        struct dma_chan *chan);
 int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream);
+int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream,
+        dma_filter_fn filter_fn, void *filter_data);
+int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream);
+struct dma_chan *snd_dmaengine_pcm_request_channel(dma_filter_fn filter_fn,
+        void *filter_data);
 struct dma_chan *snd_dmaengine_pcm_get_chan(struct snd_pcm_substream *substream);
 /**
@@ -68,4 +75,60 @@ void snd_dmaengine_pcm_set_config_from_dai_data(
        const struct snd_dmaengine_dai_dma_data *dma_data,
        struct dma_slave_config *config);
+/*
+ * Try to request the DMA channel using compat_request_channel or
+ * compat_filter_fn if it couldn't be requested through devicetree.
+ */
+#define SND_DMAENGINE_PCM_FLAG_COMPAT BIT(0)
+/*
+ * Don't try to request the DMA channels through devicetree. This flag only
+ * makes sense if SND_DMAENGINE_PCM_FLAG_COMPAT is set as well.
+ */
+#define SND_DMAENGINE_PCM_FLAG_NO_DT BIT(1)
+/*
+ * The platforms dmaengine driver does not support reporting the amount of
+ * bytes that are still left to transfer.
+ */
+#define SND_DMAENGINE_PCM_FLAG_NO_RESIDUE BIT(2)
+/**
+ * struct snd_dmaengine_pcm_config - Configuration data for dmaengine based PCM
+ * @prepare_slave_config: Callback used to fill in the DMA slave_config for a
+ *   PCM substream. Will be called from the PCM drivers hwparams callback.
+ * @compat_request_channel: Callback to request a DMA channel for platforms
+ *   which do not use devicetree.
+ * @compat_filter_fn: Will be used as the filter function when requesting a
+ *  channel for platforms which do not use devicetree. The filter parameter
+ *  will be the DAI's DMA data.
+ * @pcm_hardware: snd_pcm_hardware struct to be used for the PCM.
+ * @prealloc_buffer_size: Size of the preallocated audio buffer.
+ *
+ * Note: If both compat_request_channel and compat_filter_fn are set
+ * compat_request_channel will be used to request the channel and
+ * compat_filter_fn will be ignored. Otherwise the channel will be requested
+ * using dma_request_channel with compat_filter_fn as the filter function.
+ */
+struct snd_dmaengine_pcm_config {
+        int (*prepare_slave_config)(struct snd_pcm_substream *substream,
+                        struct snd_pcm_hw_params *params,
+                        struct dma_slave_config *slave_config);
+        struct dma_chan *(*compat_request_channel)(
+                        struct snd_soc_pcm_runtime *rtd,
+                        struct snd_pcm_substream *substream);
+        dma_filter_fn compat_filter_fn;
+        const struct snd_pcm_hardware *pcm_hardware;
+        unsigned int prealloc_buffer_size;
+};
+int snd_dmaengine_pcm_register(struct device *dev,
+        const struct snd_dmaengine_pcm_config *config,
+        unsigned int flags);
+void snd_dmaengine_pcm_unregister(struct device *dev);
+int snd_dmaengine_pcm_prepare_slave_config(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params,
+        struct dma_slave_config *slave_config);
 #endif
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 9eb0e4db4835..85c15226103b 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -375,6 +375,10 @@ int snd_soc_poweroff(struct device *dev);
 int snd_soc_register_platform(struct device *dev,
                const struct snd_soc_platform_driver *platform_drv);
 void snd_soc_unregister_platform(struct device *dev);
+int snd_soc_add_platform(struct device *dev, struct snd_soc_platform *platform,
+                const struct snd_soc_platform_driver *platform_drv);
+void snd_soc_remove_platform(struct snd_soc_platform *platform);
+struct snd_soc_platform *snd_soc_lookup_platform(struct device *dev);
 int snd_soc_register_codec(struct device *dev,
                const struct snd_soc_codec_driver *codec_drv,
                struct snd_soc_dai_driver *dai_drv, int num_dai);
diff --git a/kernel/capability.c b/kernel/capability.c
index 493d97259484..f6c2ce5701e1 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -393,6 +393,30 @@ bool ns_capable(struct user_namespace *ns, int cap)
 EXPORT_SYMBOL(ns_capable);
 /**
+ * file_ns_capable - Determine if the file's opener had a capability in effect
+ * @file:  The file we want to check
+ * @ns:  The usernamespace we want the capability in
+ * @cap: The capability to be tested for
+ *
+ * Return true if task that opened the file had a capability in effect
+ * when the file was opened.
+ *
+ * This does not set PF_SUPERPRIV because the caller may not
+ * actually be privileged.
+ */
+bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
+{
+        if (WARN_ON_ONCE(!cap_valid(cap)))
+                return false;
+        if (security_capable(file->f_cred, ns, cap) == 0)
+                return true;
+        return false;
+}
+EXPORT_SYMBOL(file_ns_capable);
+/**
 * capable - Determine if the current task has a superior capability in effect
 * @cap: The capability to be tested for
 *
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 59412d037eed..7e0962ed7f8a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4737,7 +4737,8 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
        } else {
                if (arch_vma_name(mmap_event->vma)) {
                        name = strncpy(tmp, arch_vma_name(mmap_event->vma),
-                                       sizeof(tmp));
+                                       sizeof(tmp) - 1);
+                        tmp[sizeof(tmp) - 1] = '\0';
                        goto got_name;
                }
@@ -5986,6 +5987,7 @@ skip_type:
        if (pmu->pmu_cpu_context)
                goto got_cpu_context;
+        ret = -ENOMEM;
        pmu->pmu_cpu_context = alloc_percpu(struct perf_cpu_context);
        if (!pmu->pmu_cpu_context)
                goto free_dev;
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index d56a64c99a8b..eb675c4d59df 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -16,7 +16,7 @@ struct ring_buffer {
        int                             page_order;     /* allocation order  */
 #endif
        int                             nr_pages;       /* nr of data pages  */
-        int                             writable;       /* are we writable   */
+        int                             overwrite;      /* can overwrite itself */
        atomic_t                        poll;           /* POLL_ for wakeups */
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 23cb34ff3973..97fddb09762b 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -18,12 +18,24 @@
 static bool perf_output_space(struct ring_buffer *rb, unsigned long tail,
                              unsigned long offset, unsigned long head)
 {
-        unsigned long mask;
+        unsigned long sz = perf_data_size(rb);
+        unsigned long mask = sz - 1;
-        if (!rb->writable)
+        /*
+         * check if user-writable
+         * overwrite : over-write its own tail
+         * !overwrite: buffer possibly drops events.
+         */
+        if (rb->overwrite)
                return true;
-        mask = perf_data_size(rb) - 1;
+        /*
+         * verify that payload is not bigger than buffer
+         * otherwise masking logic may fail to detect
+         * the "not enough space" condition
+         */
+        if ((head - offset) > sz)
+                return false;
        offset = (offset - tail) & mask;
        head   = (head   - tail) & mask;
@@ -212,7 +224,9 @@ ring_buffer_init(struct ring_buffer *rb, long watermark, int flags)
                rb->watermark = max_size / 2;
        if (flags & RING_BUFFER_WRITABLE)
-                rb->writable = 1;
+                rb->overwrite = 0;
+        else
+                rb->overwrite = 1;
        atomic_set(&rb->refcount, 1);
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index c685e31492df..c3ae1446461c 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
        u64 this_clock, remote_clock;
        u64 *ptr, old_val, val;
+#if BITS_PER_LONG != 64
+again:
+        /*
+         * Careful here: The local and the remote clock values need to
+         * be read out atomic as we need to compare the values and
+         * then update either the local or the remote side. So the
+         * cmpxchg64 below only protects one readout.
+         *
+         * We must reread via sched_clock_local() in the retry case on
+         * 32bit as an NMI could use sched_clock_local() via the
+         * tracer and hit between the readout of
+         * the low32bit and the high 32bit portion.
+         */
+        this_clock = sched_clock_local(my_scd);
+        /*
+         * We must enforce atomic readout on 32bit, otherwise the
+         * update on the remote cpu can hit inbetween the readout of
+         * the low32bit and the high 32bit portion.
+         */
+        remote_clock = cmpxchg64(&scd->clock, 0, 0);
+#else
+        /*
+         * On 64bit the read of [my]scd->clock is atomic versus the
+         * update, so we can avoid the above 32bit dance.
+         */
        sched_clock_local(my_scd);
 again:
        this_clock = my_scd->clock;
        remote_clock = scd->clock;
+#endif
        /*
         * Use the opportunity that we have both locks
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 7f12624a393c..67d04651f44b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1498,8 +1498,10 @@ static void try_to_wake_up_local(struct task_struct *p)
 {
        struct rq *rq = task_rq(p);
-        BUG_ON(rq != this_rq());
+        if (WARN_ON_ONCE(rq != this_rq()) ||
-        BUG_ON(p == current);
+            WARN_ON_ONCE(p == current))
+                return;
        lockdep_assert_held(&rq->lock);
        if (!raw_spin_trylock(&p->pi_lock)) {
@@ -4999,7 +5001,7 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
 }
 static int min_load_idx = 0;
-static int max_load_idx = CPU_LOAD_IDX_MAX;
+static int max_load_idx = CPU_LOAD_IDX_MAX-1;
 static void
 set_table_entry(struct ctl_table *entry,
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index ed12cbb135f4..e93cca92f38b 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -310,7 +310,7 @@ void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
        t = tsk;
        do {
-                task_cputime(tsk, &utime, &stime);
+                task_cputime(t, &utime, &stime);
                times->utime += utime;
                times->stime += stime;
                times->sum_exec_runtime += task_sched_runtime(t);
diff --git a/kernel/sys.c b/kernel/sys.c
index 39c9c4a2949f..0da73cf73e60 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -324,7 +324,6 @@ void kernel_restart_prepare(char *cmd)
        system_state = SYSTEM_RESTART;
        usermodehelper_disable();
        device_shutdown();
-        syscore_shutdown();
 }
 /**
@@ -370,6 +369,7 @@ void kernel_restart(char *cmd)
 {
        kernel_restart_prepare(cmd);
        disable_nonboot_cpus();
+        syscore_shutdown();
        if (!cmd)
                printk(KERN_EMERG "Restarting system.\n");
        else
@@ -395,6 +395,7 @@ static void kernel_shutdown_prepare(enum system_states state)
 void kernel_halt(void)
 {
        kernel_shutdown_prepare(SYSTEM_HALT);
+        disable_nonboot_cpus();
        syscore_shutdown();
        printk(KERN_EMERG "System halted.\n");
        kmsg_dump(KMSG_DUMP_HALT);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6893d5a2bf08..b3fde6d7b7fc 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -66,7 +66,7 @@
 static struct ftrace_ops ftrace_list_end __read_mostly = {
        .func           = ftrace_stub,
-        .flags          = FTRACE_OPS_FL_RECURSION_SAFE,
+        .flags          = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_STUB,
 };
 /* ftrace_enabled is a method to turn ftrace on or off */
@@ -694,7 +694,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
                free_page(tmp);
        }
-        free_page((unsigned long)stat->pages);
        stat->pages = NULL;
        stat->start = NULL;
@@ -1053,6 +1052,19 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
+loff_t
+ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
+{
+        loff_t ret;
+        if (file->f_mode & FMODE_READ)
+                ret = seq_lseek(file, offset, whence);
+        else
+                file->f_pos = ret = 1;
+        return ret;
+}
 #ifdef CONFIG_DYNAMIC_FTRACE
 #ifndef CONFIG_FTRACE_MCOUNT_RECORD
@@ -2613,7 +2625,7 @@ static void ftrace_filter_reset(struct ftrace_hash *hash)
 * routine, you can use ftrace_filter_write() for the write
 * routine if @flag has FTRACE_ITER_FILTER set, or
 * ftrace_notrace_write() if @flag has FTRACE_ITER_NOTRACE set.
- * ftrace_regex_lseek() should be used as the lseek routine, and
+ * ftrace_filter_lseek() should be used as the lseek routine, and
 * release must call ftrace_regex_release().
 */
 int
@@ -2697,19 +2709,6 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
                                 inode, file);
 }
-loff_t
-ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
-{
-        loff_t ret;
-        if (file->f_mode & FMODE_READ)
-                ret = seq_lseek(file, offset, whence);
-        else
-                file->f_pos = ret = 1;
-        return ret;
-}
 static int ftrace_match(char *str, char *regex, int len, int type)
 {
        int matched = 0;
@@ -3441,14 +3440,14 @@ static char ftrace_filter_buf[FTRACE_FILTER_SIZE] __initdata;
 static int __init set_ftrace_notrace(char *str)
 {
-        strncpy(ftrace_notrace_buf, str, FTRACE_FILTER_SIZE);
+        strlcpy(ftrace_notrace_buf, str, FTRACE_FILTER_SIZE);
        return 1;
 }
 __setup("ftrace_notrace=", set_ftrace_notrace);
 static int __init set_ftrace_filter(char *str)
 {
-        strncpy(ftrace_filter_buf, str, FTRACE_FILTER_SIZE);
+        strlcpy(ftrace_filter_buf, str, FTRACE_FILTER_SIZE);
        return 1;
 }
 __setup("ftrace_filter=", set_ftrace_filter);
@@ -3571,7 +3570,7 @@ static const struct file_operations ftrace_filter_fops = {
        .open = ftrace_filter_open,
        .read = seq_read,
        .write = ftrace_filter_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
        .release = ftrace_regex_release,
 };
@@ -3579,7 +3578,7 @@ static const struct file_operations ftrace_notrace_fops = {
        .open = ftrace_notrace_open,
        .read = seq_read,
        .write = ftrace_notrace_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
        .release = ftrace_regex_release,
 };
@@ -3784,8 +3783,8 @@ static const struct file_operations ftrace_graph_fops = {
        .open           = ftrace_graph_open,
        .read           = seq_read,
        .write          = ftrace_graph_write,
+        .llseek         = ftrace_filter_lseek,
        .release        = ftrace_graph_release,
-        .llseek         = seq_lseek,
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
@@ -4131,7 +4130,8 @@ ftrace_ops_control_func(unsigned long ip, unsigned long parent_ip,
        preempt_disable_notrace();
        trace_recursion_set(TRACE_CONTROL_BIT);
        do_for_each_ftrace_op(op, ftrace_control_list) {
-                if (!ftrace_function_local_disabled(op) &&
+                if (!(op->flags & FTRACE_OPS_FL_STUB) &&
+                    !ftrace_function_local_disabled(op) &&
                    ftrace_ops_test(op, ip))
                        op->func(ip, parent_ip, op, regs);
        } while_for_each_ftrace_op(op);
@@ -4439,7 +4439,7 @@ static const struct file_operations ftrace_pid_fops = {
        .open           = ftrace_pid_open,
        .write          = ftrace_pid_write,
        .read           = seq_read,
-        .llseek         = seq_lseek,
+        .llseek         = ftrace_filter_lseek,
        .release        = ftrace_pid_release,
 };
@@ -4555,12 +4555,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
                ftrace_startup_sysctl();
                /* we are starting ftrace again */
-                if (ftrace_ops_list != &ftrace_list_end) {
+                if (ftrace_ops_list != &ftrace_list_end)
-                        if (ftrace_ops_list->next == &ftrace_list_end)
+                        update_ftrace_function();
-                                ftrace_trace_function = ftrace_ops_list->func;
-                        else
-                                ftrace_trace_function = ftrace_ops_list_func;
-                }
        } else {
                /* stopping ftrace calls (just send to ftrace_stub) */
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4f1dade56981..66338c4f7f4b 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -132,7 +132,7 @@ static char *default_bootup_tracer;
 static int __init set_cmdline_ftrace(char *str)
 {
-        strncpy(bootup_tracer_buf, str, MAX_TRACER_SIZE);
+        strlcpy(bootup_tracer_buf, str, MAX_TRACER_SIZE);
        default_bootup_tracer = bootup_tracer_buf;
        /* We are using ftrace early, expand it */
        ring_buffer_expanded = 1;
@@ -162,7 +162,7 @@ static char *trace_boot_options __initdata;
 static int __init set_trace_boot_options(char *str)
 {
-        strncpy(trace_boot_options_buf, str, MAX_TRACER_SIZE);
+        strlcpy(trace_boot_options_buf, str, MAX_TRACER_SIZE);
        trace_boot_options = trace_boot_options_buf;
        return 0;
 }
@@ -744,8 +744,11 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
                return;
        WARN_ON_ONCE(!irqs_disabled());
-        if (WARN_ON_ONCE(!current_trace->allocated_snapshot))
+        if (!current_trace->allocated_snapshot) {
+                /* Only the nop tracer should hit this when disabling */
+                WARN_ON_ONCE(current_trace != &nop_trace);
                return;
+        }
        arch_spin_lock(&ftrace_max_lock);
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 42ca822fc701..83a8b5b7bd35 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -322,7 +322,7 @@ static const struct file_operations stack_trace_filter_fops = {
        .open = stack_trace_filter_open,
        .read = seq_read,
        .write = ftrace_filter_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
        .release = ftrace_regex_release,
 };
diff --git a/lib/kobject.c b/lib/kobject.c
index e07ee1fcd6f1..a65486613d79 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -529,6 +529,13 @@ struct kobject *kobject_get(struct kobject *kobj)
        return kobj;
 }
+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
+{
+        if (!kref_get_unless_zero(&kobj->kref))
+                kobj = NULL;
+        return kobj;
+}
 /*
 * kobject_cleanup - free kobject resources.
 * @kobj: object to cleanup
@@ -751,7 +758,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
        list_for_each_entry(k, &kset->list, entry) {
                if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
-                        ret = kobject_get(k);
+                        ret = kobject_get_unless_zero(k);
                        break;
                }
        }
diff --git a/mm/memory.c b/mm/memory.c
index 494526ae024a..13cbc420fead 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -216,6 +216,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
        tlb->mm = mm;
        tlb->fullmm     = fullmm;
+        tlb->need_flush_all = 0;
        tlb->start      = -1UL;
        tlb->end        = 0;
        tlb->need_flush = 0;
diff --git a/net/atm/common.c b/net/atm/common.c
index 7b491006eaf4..737bef59ce89 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,6 +531,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
        struct sk_buff *skb;
        int copied, error = -EINVAL;
+        msg->msg_namelen = 0;
        if (sock->state != SS_CONNECTED)
                return -ENOTCONN;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 7b11f8bc5071..e277e38f736b 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1642,6 +1642,7 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
                ax25_address src;
                const unsigned char *mac = skb_mac_header(skb);
+                memset(sax, 0, sizeof(struct full_sockaddr_ax25));
                ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
                                &digi, NULL, NULL);
                sax->sax25_family = AF_AX25;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index d3ee69b35a78..0d1b08cc76e1 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -230,6 +230,8 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (flags & (MSG_OOB))
                return -EOPNOTSUPP;
+        msg->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb) {
                if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -237,8 +239,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                return err;
        }
-        msg->msg_namelen = 0;
        copied = skb->len;
        if (len < copied) {
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c23bae86263b..7c9224bcce17 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -608,6 +608,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                rfcomm_dlc_accept(d);
+                msg->msg_namelen = 0;
                return 0;
        }
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index fad0302bdb32..fb6192c9812e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -665,6 +665,7 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
            test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                hci_conn_accept(pi->conn->hcon, 0);
                sk->sk_state = BT_CONFIG;
+                msg->msg_namelen = 0;
                release_sock(sk);
                return 0;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 095259f83902..ff2ff3ce6965 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -286,6 +286,8 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (m->msg_flags&MSG_OOB)
                goto read_error;
+        m->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags, 0 , &ret);
        if (!skb)
                goto read_error;
diff --git a/net/can/gw.c b/net/can/gw.c
index 2d117dc5ebea..117814a7e73c 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -466,7 +466,7 @@ static int cgw_notifier(struct notifier_block *nb,
                        if (gwj->src.dev == dev || gwj->dst.dev == dev) {
                                hlist_del(&gwj->list);
                                cgw_unregister_filter(gwj);
-                                kfree(gwj);
+                                kmem_cache_free(cgw_cache, gwj);
                        }
                }
        }
@@ -864,7 +864,7 @@ static void cgw_remove_all_jobs(void)
        hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
                hlist_del(&gwj->list);
                cgw_unregister_filter(gwj);
-                kfree(gwj);
+                kmem_cache_free(cgw_cache, gwj);
        }
 }
@@ -920,7 +920,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
                hlist_del(&gwj->list);
                cgw_unregister_filter(gwj);
-                kfree(gwj);
+                kmem_cache_free(cgw_cache, gwj);
                err = 0;
                break;
        }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b65441da74ab..23854b51a259 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1072,7 +1072,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        cb->seq = net->dev_base_seq;
-        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
                        ifla_policy) >= 0) {
                if (tb[IFLA_EXT_MASK])
@@ -1922,7 +1922,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
        u32 ext_filter_mask = 0;
        u16 min_ifinfo_dump_size = 0;
-        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+        if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
                        ifla_policy) >= 0) {
                if (tb[IFLA_EXT_MASK])
                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 96083b7a436b..c6287cd978c2 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -587,13 +587,16 @@ static void check_lifetime(struct work_struct *work)
 {
        unsigned long now, next, next_sec, next_sched;
        struct in_ifaddr *ifa;
+        struct hlist_node *n;
        int i;
        now = jiffies;
        next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
-        rcu_read_lock();
        for (i = 0; i < IN4_ADDR_HSIZE; i++) {
+                bool change_needed = false;
+                rcu_read_lock();
                hlist_for_each_entry_rcu(ifa, &inet_addr_lst[i], hash) {
                        unsigned long age;
@@ -606,16 +609,7 @@ static void check_lifetime(struct work_struct *work)
                        if (ifa->ifa_valid_lft != INFINITY_LIFE_TIME &&
                            age >= ifa->ifa_valid_lft) {
-                                struct in_ifaddr **ifap ;
+                                change_needed = true;
-                                rtnl_lock();
-                                for (ifap = &ifa->ifa_dev->ifa_list;
-                                     *ifap != NULL; ifap = &ifa->ifa_next) {
-                                        if (*ifap == ifa)
-                                                inet_del_ifa(ifa->ifa_dev,
-                                                             ifap, 1);
-                                }
-                                rtnl_unlock();
                        } else if (ifa->ifa_preferred_lft ==
                                   INFINITY_LIFE_TIME) {
                                continue;
@@ -625,10 +619,8 @@ static void check_lifetime(struct work_struct *work)
                                        next = ifa->ifa_tstamp +
                                               ifa->ifa_valid_lft * HZ;
-                                if (!(ifa->ifa_flags & IFA_F_DEPRECATED)) {
+                                if (!(ifa->ifa_flags & IFA_F_DEPRECATED))
-                                        ifa->ifa_flags |= IFA_F_DEPRECATED;
+                                        change_needed = true;
-                                        rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
-                                }
                        } else if (time_before(ifa->ifa_tstamp +
                                               ifa->ifa_preferred_lft * HZ,
                                               next)) {
@@ -636,8 +628,42 @@ static void check_lifetime(struct work_struct *work)
                                       ifa->ifa_preferred_lft * HZ;
                        }
                }
+                rcu_read_unlock();
+                if (!change_needed)
+                        continue;
+                rtnl_lock();
+                hlist_for_each_entry_safe(ifa, n, &inet_addr_lst[i], hash) {
+                        unsigned long age;
+                        if (ifa->ifa_flags & IFA_F_PERMANENT)
+                                continue;
+                        /* We try to batch several events at once. */
+                        age = (now - ifa->ifa_tstamp +
+                               ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
+                        if (ifa->ifa_valid_lft != INFINITY_LIFE_TIME &&
+                            age >= ifa->ifa_valid_lft) {
+                                struct in_ifaddr **ifap;
+                                for (ifap = &ifa->ifa_dev->ifa_list;
+                                     *ifap != NULL; ifap = &(*ifap)->ifa_next) {
+                                        if (*ifap == ifa) {
+                                                inet_del_ifa(ifa->ifa_dev,
+                                                             ifap, 1);
+                                                break;
+                                        }
+                                }
+                        } else if (ifa->ifa_preferred_lft !=
+                                   INFINITY_LIFE_TIME &&
+                                   age >= ifa->ifa_preferred_lft &&
+                                   !(ifa->ifa_flags & IFA_F_DEPRECATED)) {
+                                ifa->ifa_flags |= IFA_F_DEPRECATED;
+                                rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
+                        }
+                }
+                rtnl_unlock();
        }
-        rcu_read_unlock();
        next_sec = round_jiffies_up(next);
        next_sched = next;
@@ -804,6 +830,8 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                        return -EEXIST;
                ifa = ifa_existing;
                set_ifa_lifetime(ifa, valid_lft, prefered_lft);
+                cancel_delayed_work(&check_lifetime_work);
+                schedule_delayed_work(&check_lifetime_work, 0);
                rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
                blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
        }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5d0b4387cba6..b44cf81d8178 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2709,6 +2709,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
        skb_reserve(skb, MAX_TCP_HEADER);
        skb_dst_set(skb, dst);
+        security_skb_owned_by(skb, sk);
        mss = dst_metric_advmss(dst);
        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6d629fd6aee..46a5be85be87 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -386,6 +386,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                if (dst)
                        dst->ops->redirect(dst, sk, skb);
+                goto out;
        }
        if (type == ICMPV6_PKT_TOOBIG) {
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index d28e7f014cc6..e493b3397ae3 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1386,6 +1386,8 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
        IRDA_DEBUG(4, "%s()\n", __func__);
+        msg->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                flags & MSG_DONTWAIT, &err);
        if (!skb)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index a7d11ffe4284..206ce6db2c36 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -49,12 +49,6 @@ static const u8 iprm_shutdown[8] =
 #define TRGCLS_SIZE     (sizeof(((struct iucv_message *)0)->class))
-/* macros to set/get socket control buffer at correct offset */
-#define CB_TAG(skb)     ((skb)->cb)             /* iucv message tag */
-#define CB_TAG_LEN      (sizeof(((struct iucv_message *) 0)->tag))
-#define CB_TRGCLS(skb)  ((skb)->cb + CB_TAG_LEN) /* iucv msg target class */
-#define CB_TRGCLS_LEN   (TRGCLS_SIZE)
 #define __iucv_sock_wait(sk, condition, timeo, ret)                     \
 do {                                                                    \
        DEFINE_WAIT(__wait);                                            \
@@ -1141,7 +1135,7 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        /* increment and save iucv message tag for msg_completion cbk */
        txmsg.tag = iucv->send_tag++;
-        memcpy(CB_TAG(skb), &txmsg.tag, CB_TAG_LEN);
+        IUCV_SKB_CB(skb)->tag = txmsg.tag;
        if (iucv->transport == AF_IUCV_TRANS_HIPER) {
                atomic_inc(&iucv->msg_sent);
@@ -1224,7 +1218,7 @@ static int iucv_fragment_skb(struct sock *sk, struct sk_buff *skb, int len)
                        return -ENOMEM;
                /* copy target class to control buffer of new skb */
-                memcpy(CB_TRGCLS(nskb), CB_TRGCLS(skb), CB_TRGCLS_LEN);
+                IUCV_SKB_CB(nskb)->class = IUCV_SKB_CB(skb)->class;
                /* copy data fragment */
                memcpy(nskb->data, skb->data + copied, size);
@@ -1256,7 +1250,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
        /* store msg target class in the second 4 bytes of skb ctrl buffer */
        /* Note: the first 4 bytes are reserved for msg tag */
-        memcpy(CB_TRGCLS(skb), &msg->class, CB_TRGCLS_LEN);
+        IUCV_SKB_CB(skb)->class = msg->class;
        /* check for special IPRM messages (e.g. iucv_sock_shutdown) */
        if ((msg->flags & IUCV_IPRMDATA) && len > 7) {
@@ -1292,6 +1286,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                }
        }
+        IUCV_SKB_CB(skb)->offset = 0;
        if (sock_queue_rcv_skb(sk, skb))
                skb_queue_head(&iucv_sk(sk)->backlog_skb_q, skb);
 }
@@ -1327,6 +1322,9 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        unsigned int copied, rlen;
        struct sk_buff *skb, *rskb, *cskb;
        int err = 0;
+        u32 offset;
+        msg->msg_namelen = 0;
        if ((sk->sk_state == IUCV_DISCONN) &&
            skb_queue_empty(&iucv->backlog_skb_q) &&
@@ -1346,13 +1344,14 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                return err;
        }
-        rlen   = skb->len;              /* real length of skb */
+        offset = IUCV_SKB_CB(skb)->offset;
+        rlen   = skb->len - offset;             /* real length of skb */
        copied = min_t(unsigned int, rlen, len);
        if (!rlen)
                sk->sk_shutdown = sk->sk_shutdown | RCV_SHUTDOWN;
        cskb = skb;
-        if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
+        if (skb_copy_datagram_iovec(cskb, offset, msg->msg_iov, copied)) {
                if (!(flags & MSG_PEEK))
                        skb_queue_head(&sk->sk_receive_queue, skb);
                return -EFAULT;
@@ -1370,7 +1369,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         * get the trgcls from the control buffer of the skb due to
         * fragmentation of original iucv message. */
        err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
-                        CB_TRGCLS_LEN, CB_TRGCLS(skb));
+                       sizeof(IUCV_SKB_CB(skb)->class),
+                       (void *)&IUCV_SKB_CB(skb)->class);
        if (err) {
                if (!(flags & MSG_PEEK))
                        skb_queue_head(&sk->sk_receive_queue, skb);
@@ -1382,9 +1382,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                /* SOCK_STREAM: re-queue skb if it contains unreceived data */
                if (sk->sk_type == SOCK_STREAM) {
-                        skb_pull(skb, copied);
+                        if (copied < rlen) {
-                        if (skb->len) {
+                                IUCV_SKB_CB(skb)->offset = offset + copied;
-                                skb_queue_head(&sk->sk_receive_queue, skb);
                                goto done;
                        }
                }
@@ -1403,6 +1402,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                spin_lock_bh(&iucv->message_q.lock);
                rskb = skb_dequeue(&iucv->backlog_skb_q);
                while (rskb) {
+                        IUCV_SKB_CB(rskb)->offset = 0;
                        if (sock_queue_rcv_skb(sk, rskb)) {
                                skb_queue_head(&iucv->backlog_skb_q,
                                                rskb);
@@ -1830,7 +1830,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                spin_lock_irqsave(&list->lock, flags);
                while (list_skb != (struct sk_buff *)list) {
-                        if (!memcmp(&msg->tag, CB_TAG(list_skb), CB_TAG_LEN)) {
+                        if (msg->tag != IUCV_SKB_CB(list_skb)->tag) {
                                this = list_skb;
                                break;
                        }
@@ -2091,6 +2091,7 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
        skb_pull(skb, sizeof(struct af_iucv_trans_hdr));
        skb_reset_transport_header(skb);
        skb_reset_network_header(skb);
+        IUCV_SKB_CB(skb)->offset = 0;
        spin_lock(&iucv->message_q.lock);
        if (skb_queue_empty(&iucv->backlog_skb_q)) {
                if (sock_queue_rcv_skb(sk, skb)) {
@@ -2195,8 +2196,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
                /* fall through and receive zero length data */
        case 0:
                /* plain data frame */
-                memcpy(CB_TRGCLS(skb), &trans_hdr->iucv_hdr.class,
+                IUCV_SKB_CB(skb)->class = trans_hdr->iucv_hdr.class;
-                       CB_TRGCLS_LEN);
                err = afiucv_hs_callback_rx(sk, skb);
                break;
        default:
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index c74f5a91ff6a..b8a6039314e8 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -690,6 +690,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                lsa->l2tp_addr = ipv6_hdr(skb)->saddr;
                lsa->l2tp_flowinfo = 0;
                lsa->l2tp_scope_id = 0;
+                lsa->l2tp_conn_id = 0;
                if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
                        lsa->l2tp_scope_id = IP6CB(skb)->iif;
        }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 88709882c464..48aaa89253e0 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -720,6 +720,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
        int target;     /* Read at least this many bytes */
        long timeo;
+        msg->msg_namelen = 0;
        lock_sock(sk);
        copied = -ENOTCONN;
        if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index d1fa1d9ffd2e..103bd704b5fc 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1173,6 +1173,7 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
        }
        if (sax != NULL) {
+                memset(sax, 0, sizeof(*sax));
                sax->sax25_family = AF_NETROM;
                skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
                              AX25_ADDR_LEN);
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 8f025746f337..6c94447ec414 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -646,6 +646,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        pr_debug("%p %zu\n", sk, len);
+        msg->msg_namelen = 0;
        lock_sock(sk);
        if (sk->sk_state == LLCP_CLOSED &&
@@ -691,6 +693,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
+                memset(sockaddr, 0, sizeof(*sockaddr));
                sockaddr->sa_family = AF_NFC;
                sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
                sockaddr->dsap = ui_cb->dsap;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index cf68e6e4054a..9c8347451597 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
        if (srose != NULL) {
+                memset(srose, 0, msg->msg_namelen);
                srose->srose_family = AF_ROSE;
                srose->srose_addr   = rose->dest_addr;
                srose->srose_call   = rose->dest_call;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index dcc446e7fbf6..d5f35f15af98 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -304,10 +304,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
        err = rpciod_up();
        if (err)
                goto out_no_rpciod;
-        err = -EINVAL;
-        if (!xprt)
-                goto out_no_xprt;
+        err = -EINVAL;
        if (args->version >= program->nrvers)
                goto out_err;
        version = program->version[args->version];
@@ -382,10 +380,9 @@ out_no_principal:
 out_no_stats:
        kfree(clnt);
 out_err:
-        xprt_put(xprt);
-out_no_xprt:
        rpciod_down();
 out_no_rpciod:
+        xprt_put(xprt);
        return ERR_PTR(err);
 }
@@ -512,7 +509,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
        new = rpc_new_client(args, xprt);
        if (IS_ERR(new)) {
                err = PTR_ERR(new);
-                goto out_put;
+                goto out_err;
        }
        atomic_inc(&clnt->cl_count);
@@ -525,8 +522,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
        new->cl_chatty = clnt->cl_chatty;
        return new;
-out_put:
-        xprt_put(xprt);
 out_err:
        dprintk("RPC:       %s: returned error %d\n", __func__, err);
        return ERR_PTR(err);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a9622b6cd916..515ce38e4f4c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -790,6 +790,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
        if (addr) {
                addr->family = AF_TIPC;
                addr->addrtype = TIPC_ADDR_ID;
+                memset(&addr->addr, 0, sizeof(addr->addr));
                addr->addr.id.ref = msg_origport(msg);
                addr->addr.id.node = msg_orignode(msg);
                addr->addr.name.domain = 0;     /* could leave uninitialized */
@@ -904,6 +905,9 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                goto exit;
        }
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
        timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
@@ -1013,6 +1017,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                goto exit;
        }
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
        target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
        timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index d8079daf1bde..7f93e2a42d7a 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1670,6 +1670,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
        vsk = vsock_sk(sk);
        err = 0;
+        msg->msg_namelen = 0;
        lock_sock(sk);
        if (sk->sk_state != SS_CONNECTED) {
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 1f6508e249ae..5e04d3d96285 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1736,6 +1736,8 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
        if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
                return -EOPNOTSUPP;
+        msg->msg_namelen = 0;
        /* Retrieve the head sk_buff from the socket's receive queue. */
        err = 0;
        skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
@@ -1768,7 +1770,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
        if (err)
                goto out;
-        msg->msg_namelen = 0;
        if (msg->msg_name) {
                struct sockaddr_vm *vm_addr;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 09d994d192ff..482c70e70127 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -224,6 +224,7 @@ void cfg80211_conn_work(struct work_struct *work)
        rtnl_lock();
        cfg80211_lock_rdev(rdev);
        mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
        list_for_each_entry(wdev, &rdev->wdev_list, list) {
                wdev_lock(wdev);
@@ -248,6 +249,7 @@ void cfg80211_conn_work(struct work_struct *work)
                wdev_unlock(wdev);
        }
+        mutex_unlock(&rdev->sched_scan_mtx);
        mutex_unlock(&rdev->devlist_mtx);
        cfg80211_unlock_rdev(rdev);
        rtnl_unlock();
diff --git a/security/capability.c b/security/capability.c
index 579775088967..6783c3e6c88e 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -737,6 +737,11 @@ static int cap_tun_dev_open(void *security)
 {
        return 0;
 }
+static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -1071,6 +1076,7 @@ void __init security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, tun_dev_open);
        set_to_cap_if_null(ops, tun_dev_attach_queue);
        set_to_cap_if_null(ops, tun_dev_attach);
+        set_to_cap_if_null(ops, skb_owned_by);
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        set_to_cap_if_null(ops, xfrm_policy_alloc_security);
diff --git a/security/security.c b/security/security.c
index 7b88c6aeaed4..03f248b84e9f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1290,6 +1290,11 @@ int security_tun_dev_open(void *security)
 }
 EXPORT_SYMBOL(security_tun_dev_open);
+void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+        security_ops->skb_owned_by(skb, sk);
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2fa28c88900c..7171a957b933 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -51,6 +51,7 @@
 #include <linux/tty.h>
 #include <net/icmp.h>
 #include <net/ip.h>             /* for local_port_range[] */
+#include <net/sock.h>
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 #include <net/net_namespace.h>
 #include <net/netlabel.h>
@@ -4363,6 +4364,11 @@ static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
        selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
 }
+static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+        skb_set_owner_w(skb, sk);
+}
 static int selinux_secmark_relabel_packet(u32 sid)
 {
        const struct task_security_struct *__tsec;
@@ -5664,6 +5670,7 @@ static struct security_operations selinux_ops = {
        .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
        .tun_dev_attach =               selinux_tun_dev_attach,
        .tun_dev_open =                 selinux_tun_dev_open,
+        .skb_owned_by =                 selinux_skb_owned_by,
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
diff --git a/sound/soc/Kconfig b/sound/soc/Kconfig
index 5da8ca7aee05..9e675c76436c 100644
--- a/sound/soc/Kconfig
+++ b/sound/soc/Kconfig
@@ -29,6 +29,10 @@ config SND_SOC_AC97_BUS
 config SND_SOC_DMAENGINE_PCM
        bool
+config SND_SOC_GENERIC_DMAENGINE_PCM
+        bool
+        select SND_SOC_DMAENGINE_PCM
 # All the supported SoCs
 source "sound/soc/atmel/Kconfig"
 source "sound/soc/au1x/Kconfig"
diff --git a/sound/soc/Makefile b/sound/soc/Makefile
index 99f32f7c0692..197b6ae54c8d 100644
--- a/sound/soc/Makefile
+++ b/sound/soc/Makefile
@@ -5,6 +5,10 @@ ifneq ($(CONFIG_SND_SOC_DMAENGINE_PCM),)
 snd-soc-core-objs += soc-dmaengine-pcm.o
 endif
+ifneq ($(CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM),)
+snd-soc-core-objs += soc-generic-dmaengine-pcm.o
+endif
 obj-$(CONFIG_SND_SOC)   += snd-soc-core.o
 obj-$(CONFIG_SND_SOC)   += codecs/
 obj-$(CONFIG_SND_SOC)   += generic/
diff --git a/sound/soc/atmel/atmel-pcm-dma.c b/sound/soc/atmel/atmel-pcm-dma.c
index bb07989762d5..1d38fd0bc4e2 100644
--- a/sound/soc/atmel/atmel-pcm-dma.c
+++ b/sound/soc/atmel/atmel-pcm-dma.c
@@ -155,7 +155,7 @@ static int atmel_pcm_hw_params(struct snd_pcm_substream *substream,
        if (ssc->pdev)
                sdata = ssc->pdev->dev.platform_data;
-        ret = snd_dmaengine_pcm_open(substream, filter, sdata);
+        ret = snd_dmaengine_pcm_open_request_chan(substream, filter, sdata);
        if (ret) {
                pr_err("atmel-pcm: dmaengine pcm open failed\n");
                return -EINVAL;
@@ -171,7 +171,7 @@ static int atmel_pcm_hw_params(struct snd_pcm_substream *substream,
        return 0;
 err:
-        snd_dmaengine_pcm_close(substream);
+        snd_dmaengine_pcm_close_release_chan(substream);
        return ret;
 }
@@ -197,7 +197,7 @@ static int atmel_pcm_open(struct snd_pcm_substream *substream)
 static struct snd_pcm_ops atmel_pcm_ops = {
        .open           = atmel_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = atmel_pcm_hw_params,
        .prepare        = atmel_pcm_dma_prepare,
diff --git a/sound/soc/cirrus/ep93xx-pcm.c b/sound/soc/cirrus/ep93xx-pcm.c
index 298946f790eb..488032690378 100644
--- a/sound/soc/cirrus/ep93xx-pcm.c
+++ b/sound/soc/cirrus/ep93xx-pcm.c
@@ -69,7 +69,8 @@ static int ep93xx_pcm_open(struct snd_pcm_substream *substream)
        snd_soc_set_runtime_hwparams(substream, &ep93xx_pcm_hardware);
-        return snd_dmaengine_pcm_open(substream, ep93xx_pcm_dma_filter,
+        return snd_dmaengine_pcm_open_request_chan(substream,
+                        ep93xx_pcm_dma_filter,
                        snd_soc_dai_get_dma_data(rtd->cpu_dai, substream));
 }
@@ -100,7 +101,7 @@ static int ep93xx_pcm_mmap(struct snd_pcm_substream *substream,
 static struct snd_pcm_ops ep93xx_pcm_ops = {
        .open           = ep93xx_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = ep93xx_pcm_hw_params,
        .hw_free        = ep93xx_pcm_hw_free,
diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
index 3a7b7fd14e3e..3eeada57e87d 100644
--- a/sound/soc/codecs/max98088.c
+++ b/sound/soc/codecs/max98088.c
@@ -2024,7 +2024,7 @@ static int max98088_probe(struct snd_soc_codec *codec)
                       ret);
               goto err_access;
       }
-       dev_info(codec->dev, "revision %c\n", ret + 'A');
+       dev_info(codec->dev, "revision %c\n", ret - 0x40 + 'A');
       snd_soc_write(codec, M98088_REG_51_PWR_SYS, M98088_PWRSV);
diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
index 3b98159d9645..3843a18d4e56 100644
--- a/sound/soc/fsl/Kconfig
+++ b/sound/soc/fsl/Kconfig
@@ -118,7 +118,7 @@ config SND_SOC_IMX_PCM_FIQ
 config SND_SOC_IMX_PCM_DMA
        bool
-        select SND_SOC_DMAENGINE_PCM
+        select SND_SOC_GENERIC_DMAENGINE_PCM
        select SND_SOC_IMX_PCM
 config SND_SOC_IMX_AUDMUX
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 42366d776f62..0f0bed6def9e 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -425,12 +425,6 @@ static int fsl_ssi_startup(struct snd_pcm_substream *substream,
                ssi_private->second_stream = substream;
        }
-        if (ssi_private->ssi_on_imx)
-                snd_soc_dai_set_dma_data(dai, substream,
-                        (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
-                                &ssi_private->dma_params_tx :
-                                &ssi_private->dma_params_rx);
        return 0;
 }
@@ -552,6 +546,18 @@ static void fsl_ssi_shutdown(struct snd_pcm_substream *substream,
        }
 }
+static int fsl_ssi_dai_probe(struct snd_soc_dai *dai)
+{
+        struct fsl_ssi_private *ssi_private = snd_soc_dai_get_drvdata(dai);
+        if (ssi_private->ssi_on_imx) {
+                dai->playback_dma_data = &ssi_private->dma_params_tx;
+                dai->capture_dma_data = &ssi_private->dma_params_rx;
+        }
+        return 0;
+}
 static const struct snd_soc_dai_ops fsl_ssi_dai_ops = {
        .startup        = fsl_ssi_startup,
        .hw_params      = fsl_ssi_hw_params,
@@ -561,6 +567,7 @@ static const struct snd_soc_dai_ops fsl_ssi_dai_ops = {
 /* Template for the CPU dai driver structure */
 static struct snd_soc_dai_driver fsl_ssi_dai_template = {
+        .probe = fsl_ssi_dai_probe,
        .playback = {
                /* The SSI does not support monaural audio. */
                .channels_min = 2,
diff --git a/sound/soc/fsl/fsl_ssi.h b/sound/soc/fsl/fsl_ssi.h
index 217300029b5b..e6b9a69e2a68 100644
--- a/sound/soc/fsl/fsl_ssi.h
+++ b/sound/soc/fsl/fsl_ssi.h
@@ -196,5 +196,13 @@ struct ccsr_ssi {
 #define CCSR_SSI_SOR_WAIT(x) (((x) & 3) << CCSR_SSI_SOR_WAIT_SHIFT)
 #define CCSR_SSI_SOR_SYNRST             0x00000001
+#define CCSR_SSI_SACNT_FRDIV(x)         (((x) & 0x3f) << 5)
+#define CCSR_SSI_SACNT_WR               0x00000010
+#define CCSR_SSI_SACNT_RD               0x00000008
+#define CCSR_SSI_SACNT_RDWR_MASK        0x00000018
+#define CCSR_SSI_SACNT_TIF              0x00000004
+#define CCSR_SSI_SACNT_FV               0x00000002
+#define CCSR_SSI_SACNT_AC97EN           0x00000001
 #endif
diff --git a/sound/soc/fsl/imx-pcm-dma.c b/sound/soc/fsl/imx-pcm-dma.c
index ee838c8a3b11..c246fb514930 100644
--- a/sound/soc/fsl/imx-pcm-dma.c
+++ b/sound/soc/fsl/imx-pcm-dma.c
@@ -11,22 +11,12 @@
 *  Free Software Foundation;  either version 2 of the  License, or (at your
 *  option) any later version.
 */
-#include <linux/clk.h>
-#include <linux/delay.h>
-#include <linux/device.h>
-#include <linux/dma-mapping.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
-#include <linux/slab.h>
 #include <linux/dmaengine.h>
 #include <linux/types.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/pcm_params.h>
 #include <sound/soc.h>
 #include <sound/dmaengine_pcm.h>
@@ -44,32 +34,7 @@ static bool filter(struct dma_chan *chan, void *param)
        return true;
 }
-static int snd_imx_pcm_hw_params(struct snd_pcm_substream *substream,
+static const struct snd_pcm_hardware imx_pcm_hardware = {
-                                struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct dma_chan *chan = snd_dmaengine_pcm_get_chan(substream);
-        struct dma_slave_config slave_config;
-        int ret;
-        ret = snd_hwparams_to_dma_slave_config(substream, params, &slave_config);
-        if (ret)
-                return ret;
-        snd_dmaengine_pcm_set_config_from_dai_data(substream,
-                        snd_soc_dai_get_dma_data(rtd->cpu_dai, substream),
-                        &slave_config);
-        ret = dmaengine_slave_config(chan, &slave_config);
-        if (ret)
-                return ret;
-        snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
-        return 0;
-}
-static struct snd_pcm_hardware snd_imx_hardware = {
        .info = SNDRV_PCM_INFO_INTERLEAVED |
                SNDRV_PCM_INFO_BLOCK_TRANSFER |
                SNDRV_PCM_INFO_MMAP |
@@ -88,33 +53,22 @@ static struct snd_pcm_hardware snd_imx_hardware = {
        .fifo_size = 0,
 };
-static int snd_imx_open(struct snd_pcm_substream *substream)
+static const struct snd_dmaengine_pcm_config imx_dmaengine_pcm_config = {
-{
+        .pcm_hardware = &imx_pcm_hardware,
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+        .compat_filter_fn = filter,
-        snd_soc_set_runtime_hwparams(substream, &snd_imx_hardware);
+        .prealloc_buffer_size = IMX_SSI_DMABUF_SIZE,
-        return snd_dmaengine_pcm_open(substream, filter,
-                snd_soc_dai_get_dma_data(rtd->cpu_dai, substream));
-}
-static struct snd_pcm_ops imx_pcm_ops = {
-        .open           = snd_imx_open,
-        .close          = snd_dmaengine_pcm_close,
-        .ioctl          = snd_pcm_lib_ioctl,
-        .hw_params      = snd_imx_pcm_hw_params,
-        .trigger        = snd_dmaengine_pcm_trigger,
-        .pointer        = snd_dmaengine_pcm_pointer_no_residue,
-        .mmap           = snd_imx_pcm_mmap,
-};
-static struct snd_soc_platform_driver imx_soc_platform_mx2 = {
-        .ops            = &imx_pcm_ops,
-        .pcm_new        = imx_pcm_new,
-        .pcm_free       = imx_pcm_free,
 };
 int imx_pcm_dma_init(struct platform_device *pdev)
 {
-        return snd_soc_register_platform(&pdev->dev, &imx_soc_platform_mx2);
+        return snd_dmaengine_pcm_register(&pdev->dev, &imx_dmaengine_pcm_config,
+                SND_DMAENGINE_PCM_FLAG_NO_RESIDUE |
+                SND_DMAENGINE_PCM_FLAG_NO_DT |
+                SND_DMAENGINE_PCM_FLAG_COMPAT);
+}
+void imx_pcm_dma_exit(struct platform_device *pdev)
+{
+        snd_dmaengine_pcm_unregister(&pdev->dev);
 }
diff --git a/sound/soc/fsl/imx-pcm.c b/sound/soc/fsl/imx-pcm.c
index 0d0625bfcb65..c49896442d8e 100644
--- a/sound/soc/fsl/imx-pcm.c
+++ b/sound/soc/fsl/imx-pcm.c
@@ -114,7 +114,11 @@ static int imx_pcm_probe(struct platform_device *pdev)
 static int imx_pcm_remove(struct platform_device *pdev)
 {
-        snd_soc_unregister_platform(&pdev->dev);
+        if (strcmp(pdev->id_entry->name, "imx-fiq-pcm-audio") == 0)
+                snd_soc_unregister_platform(&pdev->dev);
+        else
+                imx_pcm_dma_exit(pdev);
        return 0;
 }
diff --git a/sound/soc/fsl/imx-pcm.h b/sound/soc/fsl/imx-pcm.h
index be9cc64a208b..b7fa0d75c687 100644
--- a/sound/soc/fsl/imx-pcm.h
+++ b/sound/soc/fsl/imx-pcm.h
@@ -39,11 +39,16 @@ void imx_pcm_free(struct snd_pcm *pcm);
 #ifdef CONFIG_SND_SOC_IMX_PCM_DMA
 int imx_pcm_dma_init(struct platform_device *pdev);
+void imx_pcm_dma_exit(struct platform_device *pdev);
 #else
 static inline int imx_pcm_dma_init(struct platform_device *pdev)
 {
        return -ENODEV;
 }
+static inline void imx_pcm_dma_exit(struct platform_device *pdev)
+{
+}
 #endif
 #ifdef CONFIG_SND_SOC_IMX_PCM_FIQ
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index 4ce2d608b37a..902fab02b851 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -232,23 +232,6 @@ static int imx_ssi_set_dai_clkdiv(struct snd_soc_dai *cpu_dai,
        return 0;
 }
-static int imx_ssi_startup(struct snd_pcm_substream *substream,
-                           struct snd_soc_dai *cpu_dai)
-{
-        struct imx_ssi *ssi = snd_soc_dai_get_drvdata(cpu_dai);
-        struct snd_dmaengine_dai_dma_data *dma_data;
-        /* Tx/Rx config */
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                dma_data = &ssi->dma_params_tx;
-        else
-                dma_data = &ssi->dma_params_rx;
-        snd_soc_dai_set_dma_data(cpu_dai, substream, dma_data);
-        return 0;
-}
 /*
 * Should only be called when port is inactive (i.e. SSIEN = 0),
 * although can be called multiple times by upper layers.
@@ -353,7 +336,6 @@ static int imx_ssi_trigger(struct snd_pcm_substream *substream, int cmd,
 }
 static const struct snd_soc_dai_ops imx_ssi_pcm_dai_ops = {
-        .startup        = imx_ssi_startup,
        .hw_params      = imx_ssi_hw_params,
        .set_fmt        = imx_ssi_set_dai_fmt,
        .set_clkdiv     = imx_ssi_set_dai_clkdiv,
@@ -373,6 +355,10 @@ static int imx_ssi_dai_probe(struct snd_soc_dai *dai)
                SSI_SFCSR_RFWM0(ssi->dma_params_rx.maxburst);
        writel(val, ssi->base + SSI_SFCSR);
+        /* Tx/Rx config */
+        dai->playback_dma_data = &ssi->dma_params_tx;
+        dai->capture_dma_data = &ssi->dma_params_rx;
        return 0;
 }
diff --git a/sound/soc/mxs/mxs-pcm.c b/sound/soc/mxs/mxs-pcm.c
index ebbef8597554..7bceb16d0fd9 100644
--- a/sound/soc/mxs/mxs-pcm.c
+++ b/sound/soc/mxs/mxs-pcm.c
@@ -87,7 +87,7 @@ static int snd_mxs_open(struct snd_pcm_substream *substream)
        snd_soc_set_runtime_hwparams(substream, &snd_mxs_hardware);
-        return snd_dmaengine_pcm_open(substream, filter,
+        return snd_dmaengine_pcm_open_request_chan(substream, filter,
                snd_soc_dai_get_dma_data(rtd->cpu_dai, substream));
 }
@@ -104,7 +104,7 @@ static int snd_mxs_pcm_mmap(struct snd_pcm_substream *substream,
 static struct snd_pcm_ops mxs_pcm_ops = {
        .open           = snd_mxs_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = snd_mxs_pcm_hw_params,
        .trigger        = snd_dmaengine_pcm_trigger,
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index c8e272f9c2de..c28e042f2208 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -118,8 +118,9 @@ static int omap_pcm_open(struct snd_pcm_substream *substream)
        dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
-        return snd_dmaengine_pcm_open(substream, omap_dma_filter_fn,
+        return snd_dmaengine_pcm_open_request_chan(substream,
-                                      dma_data->filter_data);
+                                                   omap_dma_filter_fn,
+                                                   dma_data->filter_data);
 }
 static int omap_pcm_mmap(struct snd_pcm_substream *substream,
@@ -135,7 +136,7 @@ static int omap_pcm_mmap(struct snd_pcm_substream *substream,
 static struct snd_pcm_ops omap_pcm_ops = {
        .open           = omap_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = omap_pcm_hw_params,
        .hw_free        = omap_pcm_hw_free,
diff --git a/sound/soc/pxa/mmp-pcm.c b/sound/soc/pxa/mmp-pcm.c
index 6c3980252bf6..349930015264 100644
--- a/sound/soc/pxa/mmp-pcm.c
+++ b/sound/soc/pxa/mmp-pcm.c
@@ -131,7 +131,8 @@ static int mmp_pcm_open(struct snd_pcm_substream *substream)
        dma_data.dma_res = r;
        dma_data.ssp_id = cpu_dai->id;
-        return snd_dmaengine_pcm_open(substream, filter, &dma_data);
+        return snd_dmaengine_pcm_open_request_chan(substream, filter,
+                    &dma_data);
 }
 static int mmp_pcm_mmap(struct snd_pcm_substream *substream,
@@ -148,7 +149,7 @@ static int mmp_pcm_mmap(struct snd_pcm_substream *substream,
 struct snd_pcm_ops mmp_pcm_ops = {
        .open           = mmp_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = mmp_pcm_hw_params,
        .trigger        = snd_dmaengine_pcm_trigger,
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 7bf21a1035ea..d56bbea6e75e 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3900,21 +3900,14 @@ static void snd_soc_unregister_dais(struct device *dev, size_t count)
 }
 /**
- * snd_soc_register_platform - Register a platform with the ASoC core
+ * snd_soc_add_platform - Add a platform to the ASoC core
- *
+ * @dev: The parent device for the platform
- * @platform: platform to register
+ * @platform: The platform to add
+ * @platform_driver: The driver for the platform
 */
-int snd_soc_register_platform(struct device *dev,
+int snd_soc_add_platform(struct device *dev, struct snd_soc_platform *platform,
                const struct snd_soc_platform_driver *platform_drv)
 {
-        struct snd_soc_platform *platform;
-        dev_dbg(dev, "ASoC: platform register %s\n", dev_name(dev));
-        platform = kzalloc(sizeof(struct snd_soc_platform), GFP_KERNEL);
-        if (platform == NULL)
-                return -ENOMEM;
        /* create platform component name */
        platform->name = fmt_single_name(dev, &platform->id);
        if (platform->name == NULL) {
@@ -3937,30 +3930,76 @@ int snd_soc_register_platform(struct device *dev,
        return 0;
 }
-EXPORT_SYMBOL_GPL(snd_soc_register_platform);
+EXPORT_SYMBOL_GPL(snd_soc_add_platform);
 /**
- * snd_soc_unregister_platform - Unregister a platform from the ASoC core
+ * snd_soc_register_platform - Register a platform with the ASoC core
 *
- * @platform: platform to unregister
+ * @platform: platform to register
 */
-void snd_soc_unregister_platform(struct device *dev)
+int snd_soc_register_platform(struct device *dev,
+                const struct snd_soc_platform_driver *platform_drv)
 {
        struct snd_soc_platform *platform;
+        int ret;
-        list_for_each_entry(platform, &platform_list, list) {
+        dev_dbg(dev, "ASoC: platform register %s\n", dev_name(dev));
-                if (dev == platform->dev)
-                        goto found;
-        }
-        return;
-found:
+        platform = kzalloc(sizeof(struct snd_soc_platform), GFP_KERNEL);
+        if (platform == NULL)
+                return -ENOMEM;
+        ret = snd_soc_add_platform(dev, platform, platform_drv);
+        if (ret)
+                kfree(platform);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(snd_soc_register_platform);
+/**
+ * snd_soc_remove_platform - Remove a platform from the ASoC core
+ * @platform: the platform to remove
+ */
+void snd_soc_remove_platform(struct snd_soc_platform *platform)
+{
        mutex_lock(&client_mutex);
        list_del(&platform->list);
        mutex_unlock(&client_mutex);
-        dev_dbg(dev, "ASoC: Unregistered platform '%s'\n", platform->name);
+        dev_dbg(platform->dev, "ASoC: Unregistered platform '%s'\n",
+                platform->name);
        kfree(platform->name);
+}
+EXPORT_SYMBOL_GPL(snd_soc_remove_platform);
+struct snd_soc_platform *snd_soc_lookup_platform(struct device *dev)
+{
+        struct snd_soc_platform *platform;
+        list_for_each_entry(platform, &platform_list, list) {
+                if (dev == platform->dev)
+                        return platform;
+        }
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(snd_soc_lookup_platform);
+/**
+ * snd_soc_unregister_platform - Unregister a platform from the ASoC core
+ *
+ * @platform: platform to unregister
+ */
+void snd_soc_unregister_platform(struct device *dev)
+{
+        struct snd_soc_platform *platform;
+        platform = snd_soc_lookup_platform(dev);
+        if (!platform)
+                return;
+        snd_soc_remove_platform(platform);
        kfree(platform);
 }
 EXPORT_SYMBOL_GPL(snd_soc_unregister_platform);
diff --git a/sound/soc/soc-dmaengine-pcm.c b/sound/soc/soc-dmaengine-pcm.c
index a9a300acb506..aa924d9b7986 100644
--- a/sound/soc/soc-dmaengine-pcm.c
+++ b/sound/soc/soc-dmaengine-pcm.c
@@ -254,44 +254,48 @@ snd_pcm_uframes_t snd_dmaengine_pcm_pointer(struct snd_pcm_substream *substream)
 }
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_pointer);
-static int dmaengine_pcm_request_channel(struct dmaengine_pcm_runtime_data *prtd,
+/**
-        dma_filter_fn filter_fn, void *filter_data)
+ * snd_dmaengine_pcm_request_channel - Request channel for the dmaengine PCM
+ * @filter_fn: Filter function used to request the DMA channel
+ * @filter_data: Data passed to the DMA filter function
+ *
+ * Returns NULL or the requested DMA channel.
+ *
+ * This function request a DMA channel for usage with dmaengine PCM.
+ */
+struct dma_chan *snd_dmaengine_pcm_request_channel(dma_filter_fn filter_fn,
+        void *filter_data)
 {
        dma_cap_mask_t mask;
        dma_cap_zero(mask);
        dma_cap_set(DMA_SLAVE, mask);
        dma_cap_set(DMA_CYCLIC, mask);
-        prtd->dma_chan = dma_request_channel(mask, filter_fn, filter_data);
-        if (!prtd->dma_chan)
-                return -ENXIO;
-        return 0;
+        return dma_request_channel(mask, filter_fn, filter_data);
 }
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_request_channel);
 /**
 * snd_dmaengine_pcm_open - Open a dmaengine based PCM substream
 * @substream: PCM substream
- * @filter_fn: Filter function used to request the DMA channel
+ * @chan: DMA channel to use for data transfers
- * @filter_data: Data passed to the DMA filter function
 *
 * Returns 0 on success, a negative error code otherwise.
 *
- * This function will request a DMA channel using the passed filter function and
+ * The function should usually be called from the pcm open callback. Note that
- * data. The function should usually be called from the pcm open callback.
+ * this function will use private_data field of the substream's runtime. So it
- *
+ * is not availabe to your pcm driver implementation.
- * Note that this function will use private_data field of the substream's
- * runtime. So it is not availabe to your pcm driver implementation. If you need
- * to keep additional data attached to a substream use
- * snd_dmaengine_pcm_{set,get}_data.
 */
 int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream,
-        dma_filter_fn filter_fn, void *filter_data)
+        struct dma_chan *chan)
 {
        struct dmaengine_pcm_runtime_data *prtd;
        int ret;
+        if (!chan)
+                return -ENXIO;
        ret = snd_pcm_hw_constraint_integer(substream->runtime,
                                            SNDRV_PCM_HW_PARAM_PERIODS);
        if (ret < 0)
@@ -301,11 +305,7 @@ int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream,
        if (!prtd)
                return -ENOMEM;
-        ret = dmaengine_pcm_request_channel(prtd, filter_fn, filter_data);
+        prtd->dma_chan = chan;
-        if (ret < 0) {
-                kfree(prtd);
-                return ret;
-        }
        substream->runtime->private_data = prtd;
@@ -314,6 +314,27 @@ int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream,
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open);
 /**
+ * snd_dmaengine_pcm_open_request_chan - Open a dmaengine based PCM substream and request channel
+ * @substream: PCM substream
+ * @filter_fn: Filter function used to request the DMA channel
+ * @filter_data: Data passed to the DMA filter function
+ *
+ * Returns 0 on success, a negative error code otherwise.
+ *
+ * This function will request a DMA channel using the passed filter function and
+ * data. The function should usually be called from the pcm open callback. Note
+ * that this function will use private_data field of the substream's runtime. So
+ * it is not availabe to your pcm driver implementation.
+ */
+int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream,
+        dma_filter_fn filter_fn, void *filter_data)
+{
+        return snd_dmaengine_pcm_open(substream,
+                    snd_dmaengine_pcm_request_channel(filter_fn, filter_data));
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan);
+/**
 * snd_dmaengine_pcm_close - Close a dmaengine based PCM substream
 * @substream: PCM substream
 */
@@ -321,11 +342,26 @@ int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream)
 {
        struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
-        dma_release_channel(prtd->dma_chan);
        kfree(prtd);
        return 0;
 }
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close);
+/**
+ * snd_dmaengine_pcm_release_chan_close - Close a dmaengine based PCM substream and release channel
+ * @substream: PCM substream
+ *
+ * Releases the DMA channel associated with the PCM substream.
+ */
+int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream)
+{
+        struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+        dma_release_channel(prtd->dma_chan);
+        return snd_dmaengine_pcm_close(substream);
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close_release_chan);
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
new file mode 100644
index 000000000000..ae0c37e66ae0
--- /dev/null
+++ b/sound/soc/soc-generic-dmaengine-pcm.c
@@ -0,0 +1,284 @@
+/*
+ *  Copyright (C) 2013, Analog Devices Inc.
+ *      Author: Lars-Peter Clausen <lars@metafoo.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under  the terms of the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the License, or (at your
+ *  option) any later version.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/dmaengine.h>
+#include <linux/slab.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <linux/dma-mapping.h>
+#include <linux/of.h>
+#include <linux/of_dma.h>
+#include <sound/dmaengine_pcm.h>
+struct dmaengine_pcm {
+        struct dma_chan *chan[SNDRV_PCM_STREAM_CAPTURE + 1];
+        const struct snd_dmaengine_pcm_config *config;
+        struct snd_soc_platform platform;
+        bool compat;
+};
+static struct dmaengine_pcm *soc_platform_to_pcm(struct snd_soc_platform *p)
+{
+        return container_of(p, struct dmaengine_pcm, platform);
+}
+/**
+ * snd_dmaengine_pcm_prepare_slave_config() - Generic prepare_slave_config callback
+ * @substream: PCM substream
+ * @params: hw_params
+ * @slave_config: DMA slave config to prepare
+ *
+ * This function can be used as a generic prepare_slave_config callback for
+ * platforms which make use of the snd_dmaengine_dai_dma_data struct for their
+ * DAI DMA data. Internally the function will first call
+ * snd_hwparams_to_dma_slave_config to fill in the slave config based on the
+ * hw_params, followed by snd_dmaengine_set_config_from_dai_data to fill in the
+ * remaining fields based on the DAI DMA data.
+ */
+int snd_dmaengine_pcm_prepare_slave_config(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct dma_slave_config *slave_config)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_dmaengine_dai_dma_data *dma_data;
+        int ret;
+        dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
+        ret = snd_hwparams_to_dma_slave_config(substream, params, slave_config);
+        if (ret)
+                return ret;
+        snd_dmaengine_pcm_set_config_from_dai_data(substream, dma_data,
+                slave_config);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_prepare_slave_config);
+static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct dmaengine_pcm *pcm = soc_platform_to_pcm(rtd->platform);
+        struct dma_chan *chan = snd_dmaengine_pcm_get_chan(substream);
+        struct dma_slave_config slave_config;
+        int ret;
+        if (pcm->config->prepare_slave_config) {
+                ret = pcm->config->prepare_slave_config(substream, params,
+                                &slave_config);
+                if (ret)
+                        return ret;
+                ret = dmaengine_slave_config(chan, &slave_config);
+                if (ret)
+                        return ret;
+        }
+        return snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
+}
+static int dmaengine_pcm_open(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct dmaengine_pcm *pcm = soc_platform_to_pcm(rtd->platform);
+        struct dma_chan *chan = pcm->chan[substream->stream];
+        int ret;
+        ret = snd_soc_set_runtime_hwparams(substream,
+                                pcm->config->pcm_hardware);
+        if (ret)
+                return ret;
+        return snd_dmaengine_pcm_open(substream, chan);
+}
+static struct device *dmaengine_dma_dev(struct dmaengine_pcm *pcm,
+        struct snd_pcm_substream *substream)
+{
+        if (!pcm->chan[substream->stream])
+                return NULL;
+        return pcm->chan[substream->stream]->device->dev;
+}
+static void dmaengine_pcm_free(struct snd_pcm *pcm)
+{
+        snd_pcm_lib_preallocate_free_for_all(pcm);
+}
+static struct dma_chan *dmaengine_pcm_compat_request_channel(
+        struct snd_soc_pcm_runtime *rtd,
+        struct snd_pcm_substream *substream)
+{
+        struct dmaengine_pcm *pcm = soc_platform_to_pcm(rtd->platform);
+        if (pcm->config->compat_request_channel)
+                return pcm->config->compat_request_channel(rtd, substream);
+        return snd_dmaengine_pcm_request_channel(pcm->config->compat_filter_fn,
+                snd_soc_dai_get_dma_data(rtd->cpu_dai, substream));
+}
+static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd)
+{
+        struct dmaengine_pcm *pcm = soc_platform_to_pcm(rtd->platform);
+        const struct snd_dmaengine_pcm_config *config = pcm->config;
+        struct snd_pcm_substream *substream;
+        unsigned int i;
+        int ret;
+        for (i = SNDRV_PCM_STREAM_PLAYBACK; i <= SNDRV_PCM_STREAM_CAPTURE; i++) {
+                substream = rtd->pcm->streams[i].substream;
+                if (!substream)
+                        continue;
+                if (!pcm->chan[i] && pcm->compat) {
+                        pcm->chan[i] = dmaengine_pcm_compat_request_channel(rtd,
+                                substream);
+                }
+                if (!pcm->chan[i]) {
+                        dev_err(rtd->platform->dev,
+                                "Missing dma channel for stream: %d\n", i);
+                        ret = -EINVAL;
+                        goto err_free;
+                }
+                ret = snd_pcm_lib_preallocate_pages(substream,
+                                SNDRV_DMA_TYPE_DEV,
+                                dmaengine_dma_dev(pcm, substream),
+                                config->prealloc_buffer_size,
+                                config->pcm_hardware->buffer_bytes_max);
+                if (ret)
+                        goto err_free;
+        }
+        return 0;
+err_free:
+        dmaengine_pcm_free(rtd->pcm);
+        return ret;
+}
+static const struct snd_pcm_ops dmaengine_pcm_ops = {
+        .open           = dmaengine_pcm_open,
+        .close          = snd_dmaengine_pcm_close,
+        .ioctl          = snd_pcm_lib_ioctl,
+        .hw_params      = dmaengine_pcm_hw_params,
+        .hw_free        = snd_pcm_lib_free_pages,
+        .trigger        = snd_dmaengine_pcm_trigger,
+        .pointer        = snd_dmaengine_pcm_pointer,
+};
+static const struct snd_soc_platform_driver dmaengine_pcm_platform = {
+        .ops            = &dmaengine_pcm_ops,
+        .pcm_new        = dmaengine_pcm_new,
+        .pcm_free       = dmaengine_pcm_free,
+        .probe_order    = SND_SOC_COMP_ORDER_LATE,
+};
+static const struct snd_pcm_ops dmaengine_no_residue_pcm_ops = {
+        .open           = dmaengine_pcm_open,
+        .close          = snd_dmaengine_pcm_close,
+        .ioctl          = snd_pcm_lib_ioctl,
+        .hw_params      = dmaengine_pcm_hw_params,
+        .hw_free        = snd_pcm_lib_free_pages,
+        .trigger        = snd_dmaengine_pcm_trigger,
+        .pointer        = snd_dmaengine_pcm_pointer_no_residue,
+};
+static const struct snd_soc_platform_driver dmaengine_no_residue_pcm_platform = {
+        .ops            = &dmaengine_no_residue_pcm_ops,
+        .pcm_new        = dmaengine_pcm_new,
+        .pcm_free       = dmaengine_pcm_free,
+        .probe_order    = SND_SOC_COMP_ORDER_LATE,
+};
+static const char * const dmaengine_pcm_dma_channel_names[] = {
+        [SNDRV_PCM_STREAM_PLAYBACK] = "tx",
+        [SNDRV_PCM_STREAM_CAPTURE] = "rx",
+};
+/**
+ * snd_dmaengine_pcm_register - Register a dmaengine based PCM device
+ * @dev: The parent device for the PCM device
+ * @config: Platform specific PCM configuration
+ * @flags: Platform specific quirks
+ */
+int snd_dmaengine_pcm_register(struct device *dev,
+        const struct snd_dmaengine_pcm_config *config, unsigned int flags)
+{
+        struct dmaengine_pcm *pcm;
+        unsigned int i;
+        pcm = kzalloc(sizeof(*pcm), GFP_KERNEL);
+        if (!pcm)
+                return -ENOMEM;
+        pcm->config = config;
+        if (flags & SND_DMAENGINE_PCM_FLAG_COMPAT)
+                pcm->compat = true;
+        if (!(flags & SND_DMAENGINE_PCM_FLAG_NO_DT) && dev->of_node) {
+                for (i = SNDRV_PCM_STREAM_PLAYBACK; i <= SNDRV_PCM_STREAM_CAPTURE; i++) {
+                        pcm->chan[i] = of_dma_request_slave_channel(dev->of_node,
+                                        dmaengine_pcm_dma_channel_names[i]);
+                }
+        }
+        if (flags & SND_DMAENGINE_PCM_FLAG_NO_RESIDUE)
+                return snd_soc_add_platform(dev, &pcm->platform,
+                                &dmaengine_no_residue_pcm_platform);
+        else
+                return snd_soc_add_platform(dev, &pcm->platform,
+                                &dmaengine_pcm_platform);
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_register);
+/**
+ * snd_dmaengine_pcm_unregister - Removes a dmaengine based PCM device
+ * @dev: Parent device the PCM was register with
+ *
+ * Removes a dmaengine based PCM device previously registered with
+ * snd_dmaengine_pcm_register.
+ */
+void snd_dmaengine_pcm_unregister(struct device *dev)
+{
+        struct snd_soc_platform *platform;
+        struct dmaengine_pcm *pcm;
+        unsigned int i;
+        platform = snd_soc_lookup_platform(dev);
+        if (!platform)
+                return;
+        pcm = soc_platform_to_pcm(platform);
+        for (i = SNDRV_PCM_STREAM_PLAYBACK; i <= SNDRV_PCM_STREAM_CAPTURE; i++) {
+                if (pcm->chan[i])
+                        dma_release_channel(pcm->chan[i]);
+        }
+        snd_soc_remove_platform(platform);
+        kfree(pcm);
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_unregister);
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
index fe4541df498c..4b3be6c3c91e 100644
--- a/sound/soc/soc-utils.c
+++ b/sound/soc/soc-utils.c
@@ -90,8 +90,33 @@ static struct snd_soc_platform_driver dummy_platform = {
 };
 static struct snd_soc_codec_driver dummy_codec;
+#define STUB_RATES      SNDRV_PCM_RATE_8000_192000
+#define STUB_FORMATS    (SNDRV_PCM_FMTBIT_S8 | \
+                        SNDRV_PCM_FMTBIT_U8 | \
+                        SNDRV_PCM_FMTBIT_S16_LE | \
+                        SNDRV_PCM_FMTBIT_U16_LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE | \
+                        SNDRV_PCM_FMTBIT_U24_LE | \
+                        SNDRV_PCM_FMTBIT_S32_LE | \
+                        SNDRV_PCM_FMTBIT_U32_LE | \
+                        SNDRV_PCM_FMTBIT_IEC958_SUBFRAME_LE)
 static struct snd_soc_dai_driver dummy_dai = {
        .name = "snd-soc-dummy-dai",
+        .playback = {
+                .stream_name    = "Playback",
+                .channels_min   = 1,
+                .channels_max   = 384,
+                .rates          = STUB_RATES,
+                .formats        = STUB_FORMATS,
+        },
+        .capture = {
+                .stream_name    = "Capture",
+                .channels_min   = 1,
+                .channels_max   = 384,
+                .rates = STUB_RATES,
+                .formats = STUB_FORMATS,
+         },
 };
 static int snd_soc_dummy_probe(struct platform_device *pdev)
diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
index bfbcc1fcfe6f..2fbd4899d8ef 100644
--- a/sound/soc/spear/spear_pcm.c
+++ b/sound/soc/spear/spear_pcm.c
@@ -64,7 +64,8 @@ static int spear_pcm_open(struct snd_pcm_substream *substream)
        if (ret)
                return ret;
-        return snd_dmaengine_pcm_open(substream, dma_data->filter, dma_data)
+        return snd_dmaengine_pcm_open_request_chan(substream, dma_data->filter,
+                                dma_data);
 }
 static int spear_pcm_mmap(struct snd_pcm_substream *substream,
@@ -79,7 +80,7 @@ static int spear_pcm_mmap(struct snd_pcm_substream *substream,
 static struct snd_pcm_ops spear_pcm_ops = {
        .open           = spear_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
+        .close          = snd_dmaengine_pcm_close_release_chan,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = spear_pcm_hw_params,
        .hw_free        = spear_pcm_hw_free,
diff --git a/sound/soc/tegra/Kconfig b/sound/soc/tegra/Kconfig
index dbc27ce1d4de..b1c9d573da05 100644
--- a/sound/soc/tegra/Kconfig
+++ b/sound/soc/tegra/Kconfig
@@ -2,7 +2,7 @@ config SND_SOC_TEGRA
        tristate "SoC Audio for the Tegra System-on-Chip"
        depends on ARCH_TEGRA && TEGRA20_APB_DMA
        select REGMAP_MMIO
-        select SND_SOC_DMAENGINE_PCM if TEGRA20_APB_DMA
+        select SND_SOC_GENERIC_DMAENGINE_PCM if TEGRA20_APB_DMA
        help
          Say Y or M here if you want support for SoC audio on Tegra.
diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c
index 6d1c70c3d753..f056f632557c 100644
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -29,9 +29,7 @@
 *
 */
-#include <linux/dma-mapping.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
@@ -55,175 +53,24 @@ static const struct snd_pcm_hardware tegra_pcm_hardware = {
        .fifo_size              = 4,
 };
-static int tegra_pcm_open(struct snd_pcm_substream *substream)
+static const struct snd_dmaengine_pcm_config tegra_dmaengine_pcm_config = {
-{
+        .pcm_hardware = &tegra_pcm_hardware,
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
-        struct device *dev = rtd->platform->dev;
+        .compat_filter_fn = NULL,
-        int ret;
+        .prealloc_buffer_size = PAGE_SIZE * 8,
-        /* Set HW params now that initialization is complete */
-        snd_soc_set_runtime_hwparams(substream, &tegra_pcm_hardware);
-        ret = snd_dmaengine_pcm_open(substream, NULL, NULL);
-        if (ret) {
-                dev_err(dev, "dmaengine pcm open failed with err %d\n", ret);
-                return ret;
-        }
-        return 0;
-}
-static int tegra_pcm_hw_params(struct snd_pcm_substream *substream,
-                                struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct device *dev = rtd->platform->dev;
-        struct dma_chan *chan = snd_dmaengine_pcm_get_chan(substream);
-        struct dma_slave_config slave_config;
-        int ret;
-        ret = snd_hwparams_to_dma_slave_config(substream, params,
-                                                &slave_config);
-        if (ret) {
-                dev_err(dev, "hw params config failed with err %d\n", ret);
-                return ret;
-        }
-        snd_dmaengine_pcm_set_config_from_dai_data(substream,
-                        snd_soc_dai_get_dma_data(rtd->cpu_dai, substream),
-                        &slave_config);
-        ret = dmaengine_slave_config(chan, &slave_config);
-        if (ret < 0) {
-                dev_err(dev, "dma slave config failed with err %d\n", ret);
-                return ret;
-        }
-        snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
-        return 0;
-}
-static int tegra_pcm_hw_free(struct snd_pcm_substream *substream)
-{
-        snd_pcm_set_runtime_buffer(substream, NULL);
-        return 0;
-}
-static int tegra_pcm_mmap(struct snd_pcm_substream *substream,
-                                struct vm_area_struct *vma)
-{
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        return dma_mmap_writecombine(substream->pcm->card->dev, vma,
-                                        runtime->dma_area,
-                                        runtime->dma_addr,
-                                        runtime->dma_bytes);
-}
-static struct snd_pcm_ops tegra_pcm_ops = {
-        .open           = tegra_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
-        .ioctl          = snd_pcm_lib_ioctl,
-        .hw_params      = tegra_pcm_hw_params,
-        .hw_free        = tegra_pcm_hw_free,
-        .trigger        = snd_dmaengine_pcm_trigger,
-        .pointer        = snd_dmaengine_pcm_pointer,
-        .mmap           = tegra_pcm_mmap,
-};
-static int tegra_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
-{
-        struct snd_pcm_substream *substream = pcm->streams[stream].substream;
-        struct snd_dma_buffer *buf = &substream->dma_buffer;
-        size_t size = tegra_pcm_hardware.buffer_bytes_max;
-        buf->area = dma_alloc_writecombine(pcm->card->dev, size,
-                                                &buf->addr, GFP_KERNEL);
-        if (!buf->area)
-                return -ENOMEM;
-        buf->dev.type = SNDRV_DMA_TYPE_DEV;
-        buf->dev.dev = pcm->card->dev;
-        buf->private_data = NULL;
-        buf->bytes = size;
-        return 0;
-}
-static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream)
-{
-        struct snd_pcm_substream *substream;
-        struct snd_dma_buffer *buf;
-        substream = pcm->streams[stream].substream;
-        if (!substream)
-                return;
-        buf = &substream->dma_buffer;
-        if (!buf->area)
-                return;
-        dma_free_writecombine(pcm->card->dev, buf->bytes,
-                                buf->area, buf->addr);
-        buf->area = NULL;
-}
-static u64 tegra_dma_mask = DMA_BIT_MASK(32);
-static int tegra_pcm_new(struct snd_soc_pcm_runtime *rtd)
-{
-        struct snd_card *card = rtd->card->snd_card;
-        struct snd_pcm *pcm = rtd->pcm;
-        int ret = 0;
-        if (!card->dev->dma_mask)
-                card->dev->dma_mask = &tegra_dma_mask;
-        if (!card->dev->coherent_dma_mask)
-                card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
-        if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
-                ret = tegra_pcm_preallocate_dma_buffer(pcm,
-                                                SNDRV_PCM_STREAM_PLAYBACK);
-                if (ret)
-                        goto err;
-        }
-        if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
-                ret = tegra_pcm_preallocate_dma_buffer(pcm,
-                                                SNDRV_PCM_STREAM_CAPTURE);
-                if (ret)
-                        goto err_free_play;
-        }
-        return 0;
-err_free_play:
-        tegra_pcm_deallocate_dma_buffer(pcm, SNDRV_PCM_STREAM_PLAYBACK);
-err:
-        return ret;
-}
-static void tegra_pcm_free(struct snd_pcm *pcm)
-{
-        tegra_pcm_deallocate_dma_buffer(pcm, SNDRV_PCM_STREAM_CAPTURE);
-        tegra_pcm_deallocate_dma_buffer(pcm, SNDRV_PCM_STREAM_PLAYBACK);
-}
-static struct snd_soc_platform_driver tegra_pcm_platform = {
-        .ops            = &tegra_pcm_ops,
-        .pcm_new        = tegra_pcm_new,
-        .pcm_free       = tegra_pcm_free,
 };
 int tegra_pcm_platform_register(struct device *dev)
 {
-        return snd_soc_register_platform(dev, &tegra_pcm_platform);
+        return snd_dmaengine_pcm_register(dev, &tegra_dmaengine_pcm_config,
+                        SND_DMAENGINE_PCM_FLAG_NO_DT |
+                        SND_DMAENGINE_PCM_FLAG_COMPAT);
 }
 EXPORT_SYMBOL_GPL(tegra_pcm_platform_register);
 void tegra_pcm_platform_unregister(struct device *dev)
 {
-        snd_soc_unregister_platform(dev);
+        return snd_dmaengine_pcm_unregister(dev);
 }
 EXPORT_SYMBOL_GPL(tegra_pcm_platform_unregister);
diff --git a/sound/soc/ux500/Kconfig b/sound/soc/ux500/Kconfig
index 069330d82be5..c73c5907eb11 100644
--- a/sound/soc/ux500/Kconfig
+++ b/sound/soc/ux500/Kconfig
@@ -16,7 +16,7 @@ config SND_SOC_UX500_PLAT_MSP_I2S
 config SND_SOC_UX500_PLAT_DMA
        tristate "Platform - DB8500 (DMA)"
        depends on SND_SOC_UX500
-        select SND_SOC_DMAENGINE_PCM
+        select SND_SOC_GENERIC_DMAENGINE_PCM
        help
                Say Y if you want to enable the Ux500 platform-driver.
diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c
index 09b5364e5095..b6e5ae277299 100644
--- a/sound/soc/ux500/ux500_pcm.c
+++ b/sound/soc/ux500/ux500_pcm.c
@@ -40,7 +40,7 @@
 #define UX500_PLATFORM_PERIODS_MAX              48
 #define UX500_PLATFORM_BUFFER_BYTES_MAX         (2048 * PAGE_SIZE)
-static struct snd_pcm_hardware ux500_pcm_hw = {
+static const struct snd_pcm_hardware ux500_pcm_hw = {
        .info = SNDRV_PCM_INFO_INTERLEAVED |
                SNDRV_PCM_INFO_MMAP |
                SNDRV_PCM_INFO_RESUME |
@@ -61,43 +61,23 @@ static struct snd_pcm_hardware ux500_pcm_hw = {
        .periods_max = UX500_PLATFORM_PERIODS_MAX,
 };
-static void ux500_pcm_dma_hw_free(struct device *dev,
+static struct dma_chan *ux500_pcm_request_chan(struct snd_soc_pcm_runtime *rtd,
-                                struct snd_pcm_substream *substream)
+        struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct snd_dma_buffer *buf = runtime->dma_buffer_p;
-        if (runtime->dma_area == NULL)
-                return;
-        if (buf != &substream->dma_buffer) {
-                dma_free_coherent(buf->dev.dev, buf->bytes, buf->area,
-                                buf->addr);
-                kfree(runtime->dma_buffer_p);
-        }
-        snd_pcm_set_runtime_buffer(substream, NULL);
-}
-static int ux500_pcm_open(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_dai *dai = rtd->cpu_dai;
        struct device *dev = dai->dev;
-        int ret;
-        struct ux500_msp_dma_params *dma_params;
        u16 per_data_width, mem_data_width;
        struct stedma40_chan_cfg *dma_cfg;
+        struct ux500_msp_dma_params *dma_params;
        dev_dbg(dev, "%s: MSP %d (%s): Enter.\n", __func__, dai->id,
                snd_pcm_stream_str(substream));
-        dev_dbg(dev, "%s: Set runtime hwparams.\n", __func__);
+        dma_params = snd_soc_dai_get_dma_data(dai, substream);
-        snd_soc_set_runtime_hwparams(substream, &ux500_pcm_hw);
+        dma_cfg = dma_params->dma_cfg;
        mem_data_width = STEDMA40_HALFWORD_WIDTH;
-        dma_params = snd_soc_dai_get_dma_data(dai, substream);
        switch (dma_params->data_size) {
        case 32:
                per_data_width = STEDMA40_WORD_WIDTH;
@@ -110,13 +90,8 @@ static int ux500_pcm_open(struct snd_pcm_substream *substream)
                break;
        default:
                per_data_width = STEDMA40_WORD_WIDTH;
-                dev_warn(rtd->platform->dev,
-                        "%s: Unknown data-size (%d)! Assuming 32 bits.\n",
-                        __func__, dma_params->data_size);
        }
-        dma_cfg = dma_params->dma_cfg;
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                dma_cfg->src_info.data_width = mem_data_width;
                dma_cfg->dst_info.data_width = per_data_width;
@@ -125,123 +100,24 @@ static int ux500_pcm_open(struct snd_pcm_substream *substream)
                dma_cfg->dst_info.data_width = mem_data_width;
        }
+        return snd_dmaengine_pcm_request_channel(stedma40_filter, dma_cfg);
-        ret = snd_dmaengine_pcm_open(substream, stedma40_filter, dma_cfg);
-        if (ret) {
-                dev_dbg(dai->dev,
-                        "%s: ERROR: snd_dmaengine_pcm_open failed (%d)!\n",
-                        __func__, ret);
-                return ret;
-        }
-        return 0;
 }
-static int ux500_pcm_hw_params(struct snd_pcm_substream *substream,
+static const struct snd_dmaengine_pcm_config ux500_dmaengine_pcm_config = {
-                        struct snd_pcm_hw_params *hw_params)
+        .pcm_hardware = &ux500_pcm_hw,
-{
+        .compat_request_channel = ux500_pcm_request_chan,
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        .prealloc_buffer_size = 128 * 1024,
-        struct snd_dma_buffer *buf = runtime->dma_buffer_p;
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        int ret = 0;
-        int size;
-        dev_dbg(rtd->platform->dev, "%s: Enter\n", __func__);
-        size = params_buffer_bytes(hw_params);
-        if (buf) {
-                if (buf->bytes >= size)
-                        goto out;
-                ux500_pcm_dma_hw_free(NULL, substream);
-        }
-        if (substream->dma_buffer.area != NULL &&
-                substream->dma_buffer.bytes >= size) {
-                buf = &substream->dma_buffer;
-        } else {
-                buf = kmalloc(sizeof(struct snd_dma_buffer), GFP_KERNEL);
-                if (!buf)
-                        goto nomem;
-                buf->dev.type = SNDRV_DMA_TYPE_DEV;
-                buf->dev.dev = NULL;
-                buf->area = dma_alloc_coherent(NULL, size, &buf->addr,
-                                        GFP_KERNEL);
-                buf->bytes = size;
-                buf->private_data = NULL;
-                if (!buf->area)
-                        goto free;
-        }
-        snd_pcm_set_runtime_buffer(substream, buf);
-        ret = 1;
- out:
-        runtime->dma_bytes = size;
-        return ret;
- free:
-        kfree(buf);
- nomem:
-        return -ENOMEM;
-}
-static int ux500_pcm_hw_free(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        dev_dbg(rtd->platform->dev, "%s: Enter\n", __func__);
-        ux500_pcm_dma_hw_free(NULL, substream);
-        return 0;
-}
-static int ux500_pcm_mmap(struct snd_pcm_substream *substream,
-                        struct vm_area_struct *vma)
-{
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        dev_dbg(rtd->platform->dev, "%s: Enter.\n", __func__);
-        return dma_mmap_coherent(NULL, vma, runtime->dma_area,
-                                runtime->dma_addr, runtime->dma_bytes);
-}
-static struct snd_pcm_ops ux500_pcm_ops = {
-        .open           = ux500_pcm_open,
-        .close          = snd_dmaengine_pcm_close,
-        .ioctl          = snd_pcm_lib_ioctl,
-        .hw_params      = ux500_pcm_hw_params,
-        .hw_free        = ux500_pcm_hw_free,
-        .trigger        = snd_dmaengine_pcm_trigger,
-        .pointer        = snd_dmaengine_pcm_pointer_no_residue,
-        .mmap           = ux500_pcm_mmap
-};
-int ux500_pcm_new(struct snd_soc_pcm_runtime *rtd)
-{
-        struct snd_pcm *pcm = rtd->pcm;
-        dev_dbg(rtd->platform->dev, "%s: Enter (id = '%s').\n", __func__,
-                pcm->id);
-        pcm->info_flags = 0;
-        return 0;
-}
-static struct snd_soc_platform_driver ux500_pcm_soc_drv = {
-        .ops            = &ux500_pcm_ops,
-        .pcm_new        = ux500_pcm_new,
 };
 int ux500_pcm_register_platform(struct platform_device *pdev)
 {
        int ret;
-        ret = snd_soc_register_platform(&pdev->dev, &ux500_pcm_soc_drv);
+        ret = snd_dmaengine_pcm_register(&pdev->dev,
+                        &ux500_dmaengine_pcm_config,
+                        SND_DMAENGINE_PCM_FLAG_NO_RESIDUE |
+                        SND_DMAENGINE_PCM_FLAG_COMPAT |
+                        SND_DMAENGINE_PCM_FLAG_NO_DT);
        if (ret < 0) {
                dev_err(&pdev->dev,
                        "%s: ERROR: Failed to register platform '%s' (%d)!\n",
@@ -255,8 +131,7 @@ EXPORT_SYMBOL_GPL(ux500_pcm_register_platform);
 int ux500_pcm_unregister_platform(struct platform_device *pdev)
 {
-        snd_soc_unregister_platform(&pdev->dev);
+        snd_dmaengine_pcm_unregister(&pdev->dev);
        return 0;
 }
 EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform);
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 497d2741d119..ebe91440a068 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -509,7 +509,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
        else
                ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-                                  0, cpu_to_le16(wIndex),
+                                  0, wIndex,
                                  &tmp, sizeof(tmp), 1000);
        up_read(&mixer->chip->shutdown_rwsem);
@@ -540,7 +540,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
        else
                ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-                                  cpu_to_le16(wValue), cpu_to_le16(wIndex),
+                                  wValue, wIndex,
                                  NULL, 0, 1000);
        up_read(&mixer->chip->shutdown_rwsem);
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index e564adb74852..3879eae7e874 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -499,7 +499,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
 {
        int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                                  0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                  cpu_to_le16(1), 0, NULL, 0, 1000);
+                                  1, 0, NULL, 0, 1000);
        if (ret < 0)
                return ret;