420 files changed, 4098 insertions, 3018 deletions

diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index d4551e33fa71..8569b79e8b58 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -611,8 +611,8 @@ static int iort_dev_find_its_id(struct device *dev, u32 req_id,
 
         /* Move to ITS specific data */
         its = (struct acpi_iort_its_group *)node->node_data;
-        if (idx > its->its_count) {
-                dev_err(dev, "requested ITS ID index [%d] is greater than available [%d]\n",
+        if (idx >= its->its_count) {
+                dev_err(dev, "requested ITS ID index [%d] overruns ITS entries [%d]\n",
                         idx, its->its_count);
                 return -ENXIO;
         }
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 28cffaaf9d82..f616b16c1f0b 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -232,13 +232,15 @@ int acpi_device_set_power(struct acpi_device *device, int state)
                 if (device->power.flags.power_resources)
                         result = acpi_power_transition(device, target_state);
         } else {
+                int cur_state = device->power.state;
+
                 if (device->power.flags.power_resources) {
                         result = acpi_power_transition(device, ACPI_STATE_D0);
                         if (result)
                                 goto end;
                 }
 
-                if (device->power.state == ACPI_STATE_D0) {
+                if (cur_state == ACPI_STATE_D0) {
                         int psc;
 
                         /* Nothing to do here if _PSC is not present. */
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index c02fa27dd3f3..1413324982f0 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1282,7 +1282,7 @@ static ssize_t hw_error_scrub_store(struct device *dev,
         if (rc)
                 return rc;
 
-        device_lock(dev);
+        nfit_device_lock(dev);
         nd_desc = dev_get_drvdata(dev);
         if (nd_desc) {
                 struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
@@ -1299,7 +1299,7 @@ static ssize_t hw_error_scrub_store(struct device *dev,
                         break;
                 }
         }
-        device_unlock(dev);
+        nfit_device_unlock(dev);
         if (rc)
                 return rc;
         return size;
@@ -1319,7 +1319,7 @@ static ssize_t scrub_show(struct device *dev,
         ssize_t rc = -ENXIO;
         bool busy;
 
-        device_lock(dev);
+        nfit_device_lock(dev);
         nd_desc = dev_get_drvdata(dev);
         if (!nd_desc) {
                 device_unlock(dev);
@@ -1339,7 +1339,7 @@ static ssize_t scrub_show(struct device *dev,
         }
 
         mutex_unlock(&acpi_desc->init_mutex);
-        device_unlock(dev);
+        nfit_device_unlock(dev);
         return rc;
 }
 
@@ -1356,14 +1356,14 @@ static ssize_t scrub_store(struct device *dev,
         if (val != 1)
                 return -EINVAL;
 
-        device_lock(dev);
+        nfit_device_lock(dev);
         nd_desc = dev_get_drvdata(dev);
         if (nd_desc) {
                 struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
 
                 rc = acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
         }
-        device_unlock(dev);
+        nfit_device_unlock(dev);
         if (rc)
                 return rc;
         return size;
@@ -1749,9 +1749,9 @@ static void acpi_nvdimm_notify(acpi_handle handle, u32 event, void *data)
         struct acpi_device *adev = data;
         struct device *dev = &adev->dev;
 
-        device_lock(dev->parent);
+        nfit_device_lock(dev->parent);
         __acpi_nvdimm_notify(dev, event);
-        device_unlock(dev->parent);
+        nfit_device_unlock(dev->parent);
 }
 
 static bool acpi_nvdimm_has_method(struct acpi_device *adev, char *method)
@@ -3457,8 +3457,8 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
         struct device *dev = acpi_desc->dev;
 
         /* Bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
-        device_lock(dev);
-        device_unlock(dev);
+        nfit_device_lock(dev);
+        nfit_device_unlock(dev);
 
         /* Bounce the init_mutex to complete initial registration */
         mutex_lock(&acpi_desc->init_mutex);
@@ -3602,8 +3602,8 @@ void acpi_nfit_shutdown(void *data)
          * acpi_nfit_ars_rescan() submissions have had a chance to
          * either submit or see ->cancel set.
          */
-        device_lock(bus_dev);
-        device_unlock(bus_dev);
+        nfit_device_lock(bus_dev);
+        nfit_device_unlock(bus_dev);
 
         flush_workqueue(nfit_wq);
 }
@@ -3746,9 +3746,9 @@ EXPORT_SYMBOL_GPL(__acpi_nfit_notify);
 
 static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
 {
-        device_lock(&adev->dev);
+        nfit_device_lock(&adev->dev);
         __acpi_nfit_notify(&adev->dev, adev->handle, event);
-        device_unlock(&adev->dev);
+        nfit_device_unlock(&adev->dev);
 }
 
 static const struct acpi_device_id acpi_nfit_ids[] = {
diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
index 6ee2b02af73e..24241941181c 100644
--- a/drivers/acpi/nfit/nfit.h
+++ b/drivers/acpi/nfit/nfit.h
@@ -312,6 +312,30 @@ static inline struct acpi_nfit_desc *to_acpi_desc(
         return container_of(nd_desc, struct acpi_nfit_desc, nd_desc);
 }
 
+#ifdef CONFIG_PROVE_LOCKING
+static inline void nfit_device_lock(struct device *dev)
+{
+        device_lock(dev);
+        mutex_lock(&dev->lockdep_mutex);
+}
+
+static inline void nfit_device_unlock(struct device *dev)
+{
+        mutex_unlock(&dev->lockdep_mutex);
+        device_unlock(dev);
+}
+#else
+static inline void nfit_device_lock(struct device *dev)
+{
+        device_lock(dev);
+}
+
+static inline void nfit_device_unlock(struct device *dev)
+{
+        device_unlock(dev);
+}
+#endif
+
 const guid_t *to_nfit_uuid(enum nfit_uuids id);
 int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *nfit, acpi_size sz);
 void acpi_nfit_shutdown(void *data);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 0e28270b0fd8..aad6be5c0af0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2204,6 +2204,12 @@ int __init acpi_scan_init(void)
         acpi_gpe_apply_masked_gpes();
         acpi_update_all_gpes();
 
+        /*
+         * Although we call __add_memory() that is documented to require the
+         * device_hotplug_lock, it is not necessary here because this is an
+         * early code when userspace or any other code path cannot trigger
+         * hotplug/hotunplug operations.
+         */
         mutex_lock(&acpi_scan_lock);
         /*
          * Enumerate devices in the ACPI namespace.
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 38a59a630cd4..dc1c83eafc22 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2988,7 +2988,7 @@ static void binder_transaction(struct binder_proc *proc,
                         else
                                 return_error = BR_DEAD_REPLY;
                         mutex_unlock(&context->context_mgr_node_lock);
-                        if (target_node && target_proc == proc) {
+                        if (target_node && target_proc->pid == proc->pid) {
                                 binder_user_error("%d:%d got transaction to context manager from process owning it\n",
                                                   proc->pid, thread->pid);
                                 return_error = BR_FAILED_REPLY;
@@ -3239,7 +3239,8 @@ static void binder_transaction(struct binder_proc *proc,
         buffer_offset = off_start_offset;
         off_end_offset = off_start_offset + tr->offsets_size;
         sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
-        sg_buf_end_offset = sg_buf_offset + extra_buffers_size;
+        sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
+                ALIGN(secctx_sz, sizeof(u64));
         off_min = 0;
         for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
              buffer_offset += sizeof(binder_size_t)) {
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 72312ad2e142..9e9583a6bba9 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -338,6 +338,9 @@ static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port,
                 hpriv->phys[port] = NULL;
                 rc = 0;
                 break;
+        case -EPROBE_DEFER:
+                /* Do not complain yet */
+                break;
 
         default:
                 dev_err(dev,
@@ -408,7 +411,6 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
         hpriv->mmio = devm_ioremap_resource(dev,
                               platform_get_resource(pdev, IORESOURCE_MEM, 0));
         if (IS_ERR(hpriv->mmio)) {
-                dev_err(dev, "no mmio space\n");
                 rc = PTR_ERR(hpriv->mmio);
                 goto err_out;
         }
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 173e6f2dd9af..eefda51f97d3 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -56,7 +56,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
         unsigned int ret;
         struct rm_feature_desc *desc;
         struct ata_taskfile tf;
-        static const char cdb[] = {  GPCMD_GET_CONFIGURATION,
+        static const char cdb[ATAPI_CDB_LEN] = {  GPCMD_GET_CONFIGURATION,
                         2,      /* only 1 feature descriptor requested */
                         0, 3,   /* 3, removable medium feature */
                         0, 0, 0,/* reserved */
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 302cf0ba1600..8c7a996d1f16 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -63,6 +63,7 @@
 #include <asm/byteorder.h>  
 #include <linux/vmalloc.h>
 #include <linux/jiffies.h>
+#include <linux/nospec.h>
 #include "iphase.h"               
 #include "suni.h"                 
 #define swap_byte_order(x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8))
@@ -2760,8 +2761,11 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
    }
    if (copy_from_user(&ia_cmds, arg, sizeof ia_cmds)) return -EFAULT; 
    board = ia_cmds.status;
-   if ((board < 0) || (board > iadev_count))
-         board = 0;    
+
+        if ((board < 0) || (board > iadev_count))
+                board = 0;
+        board = array_index_nospec(board, iadev_count + 1);
+
    iadev = ia_dev[board];
    switch (ia_cmds.cmd) {
    case MEMDUMP:
diff --git a/drivers/base/core.c b/drivers/base/core.c
index da84a73f2ba6..636058bbf48a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1663,6 +1663,9 @@ void device_initialize(struct device *dev)
         kobject_init(&dev->kobj, &device_ktype);
         INIT_LIST_HEAD(&dev->dma_pools);
         mutex_init(&dev->mutex);
+#ifdef CONFIG_PROVE_LOCKING
+        mutex_init(&dev->lockdep_mutex);
+#endif
         lockdep_set_novalidate_class(&dev->mutex);
         spin_lock_init(&dev->devres_lock);
         INIT_LIST_HEAD(&dev->devres_head);
@@ -2211,6 +2214,24 @@ void put_device(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(put_device);
 
+bool kill_device(struct device *dev)
+{
+        /*
+         * Require the device lock and set the "dead" flag to guarantee that
+         * the update behavior is consistent with the other bitfields near
+         * it and that we cannot have an asynchronous probe routine trying
+         * to run while we are tearing out the bus/class/sysfs from
+         * underneath the device.
+         */
+        lockdep_assert_held(&dev->mutex);
+
+        if (dev->p->dead)
+                return false;
+        dev->p->dead = true;
+        return true;
+}
+EXPORT_SYMBOL_GPL(kill_device);
+
 /**
  * device_del - delete device from system.
  * @dev: device.
@@ -2230,15 +2251,8 @@ void device_del(struct device *dev)
         struct kobject *glue_dir = NULL;
         struct class_interface *class_intf;
 
-        /*
-         * Hold the device lock and set the "dead" flag to guarantee that
-         * the update behavior is consistent with the other bitfields near
-         * it and that we cannot have an asynchronous probe routine trying
-         * to run while we are tearing out the bus/class/sysfs from
-         * underneath the device.
-         */
         device_lock(dev);
-        dev->p->dead = true;
+        kill_device(dev);
         device_unlock(dev);
 
         /* Notify clients of device removal.  This call must come
diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h
index 7048a41973ed..7ecd590e67fe 100644
--- a/drivers/base/firmware_loader/firmware.h
+++ b/drivers/base/firmware_loader/firmware.h
@@ -141,8 +141,8 @@ int fw_grow_paged_buf(struct fw_priv *fw_priv, int pages_needed);
 int fw_map_paged_buf(struct fw_priv *fw_priv);
 #else
 static inline void fw_free_paged_buf(struct fw_priv *fw_priv) {}
-int fw_grow_paged_buf(struct fw_priv *fw_priv, int pages_needed) { return -ENXIO; }
-int fw_map_paged_buf(struct fw_priv *fw_priv) { return -ENXIO; }
+static inline int fw_grow_paged_buf(struct fw_priv *fw_priv, int pages_needed) { return -ENXIO; }
+static inline int fw_map_paged_buf(struct fw_priv *fw_priv) { return -ENXIO; }
 #endif
 
 #endif /* __FIRMWARE_LOADER_H */
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 85f20e371f2f..bd7d3bb8b890 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1726,6 +1726,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode,
                 /* MSch: invalidate default_params */
                 default_params[drive].blocks  = 0;
                 set_capacity(floppy->disk, MAX_DISK_SIZE * 2);
+                /* Fall through */
         case FDFMTEND:
         case FDFLUSH:
                 /* invalidate the buffer track to force a reread */
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 90ebfcae0ce6..2b3103c30857 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -5417,7 +5417,7 @@ static int drbd_do_auth(struct drbd_connection *connection)
         unsigned int key_len;
         char secret[SHARED_SECRET_MAX]; /* 64 byte */
         unsigned int resp_size;
-        SHASH_DESC_ON_STACK(desc, connection->cram_hmac_tfm);
+        struct shash_desc *desc;
         struct packet_info pi;
         struct net_conf *nc;
         int err, rv;
@@ -5430,6 +5430,13 @@ static int drbd_do_auth(struct drbd_connection *connection)
         memcpy(secret, nc->shared_secret, key_len);
         rcu_read_unlock();
 
+        desc = kmalloc(sizeof(struct shash_desc) +
+                       crypto_shash_descsize(connection->cram_hmac_tfm),
+                       GFP_KERNEL);
+        if (!desc) {
+                rv = -1;
+                goto fail;
+        }
         desc->tfm = connection->cram_hmac_tfm;
 
         rv = crypto_shash_setkey(connection->cram_hmac_tfm, (u8 *)secret, key_len);
@@ -5571,7 +5578,10 @@ static int drbd_do_auth(struct drbd_connection *connection)
         kfree(peers_ch);
         kfree(response);
         kfree(right_response);
-        shash_desc_zero(desc);
+        if (desc) {
+                shash_desc_zero(desc);
+                kfree(desc);
+        }
 
         return rv;
 }
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 44c9985f352a..3036883fc9f8 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -924,6 +924,7 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
         struct file     *file;
         struct inode    *inode;
         struct address_space *mapping;
+        struct block_device *claimed_bdev = NULL;
         int             lo_flags = 0;
         int             error;
         loff_t          size;
@@ -942,10 +943,11 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
          * here to avoid changing device under exclusive owner.
          */
         if (!(mode & FMODE_EXCL)) {
-                bdgrab(bdev);
-                error = blkdev_get(bdev, mode | FMODE_EXCL, loop_set_fd);
-                if (error)
+                claimed_bdev = bd_start_claiming(bdev, loop_set_fd);
+                if (IS_ERR(claimed_bdev)) {
+                        error = PTR_ERR(claimed_bdev);
                         goto out_putf;
+                }
         }
 
         error = mutex_lock_killable(&loop_ctl_mutex);
@@ -1015,15 +1017,15 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
         mutex_unlock(&loop_ctl_mutex);
         if (partscan)
                 loop_reread_partitions(lo, bdev);
-        if (!(mode & FMODE_EXCL))
-                blkdev_put(bdev, mode | FMODE_EXCL);
+        if (claimed_bdev)
+                bd_abort_claiming(bdev, claimed_bdev, loop_set_fd);
         return 0;
 
 out_unlock:
         mutex_unlock(&loop_ctl_mutex);
 out_bdev:
-        if (!(mode & FMODE_EXCL))
-                blkdev_put(bdev, mode | FMODE_EXCL);
+        if (claimed_bdev)
+                bd_abort_claiming(bdev, claimed_bdev, loop_set_fd);
 out_putf:
         fput(file);
 out:
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9bcde2325893..e21d2ded732b 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1231,7 +1231,7 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
                                  struct block_device *bdev)
 {
         sock_shutdown(nbd);
-        kill_bdev(bdev);
+        __invalidate_device(bdev, true);
         nbd_bdev_reset(bdev);
         if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
                                &nbd->config->runtime_flags))
diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index a55be205b91a..dbfe34664633 100644
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -98,6 +98,9 @@ static int ath_open(struct hci_uart *hu)
 
         BT_DBG("hu %p", hu);
 
+        if (!hci_uart_has_flow_control(hu))
+                return -EOPNOTSUPP;
+
         ath = kzalloc(sizeof(*ath), GFP_KERNEL);
         if (!ath)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 8905ad2edde7..ae2624fce913 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -406,6 +406,9 @@ static int bcm_open(struct hci_uart *hu)
 
         bt_dev_dbg(hu->hdev, "hu %p", hu);
 
+        if (!hci_uart_has_flow_control(hu))
+                return -EOPNOTSUPP;
+
         bcm = kzalloc(sizeof(*bcm), GFP_KERNEL);
         if (!bcm)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 207bae5e0d46..31f25153087d 100644
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -391,6 +391,9 @@ static int intel_open(struct hci_uart *hu)
 
         BT_DBG("hu %p", hu);
 
+        if (!hci_uart_has_flow_control(hu))
+                return -EOPNOTSUPP;
+
         intel = kzalloc(sizeof(*intel), GFP_KERNEL);
         if (!intel)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 8950e07889fe..85a30fb9177b 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -292,6 +292,19 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
         return 0;
 }
 
+/* Check the underlying device or tty has flow control support */
+bool hci_uart_has_flow_control(struct hci_uart *hu)
+{
+        /* serdev nodes check if the needed operations are present */
+        if (hu->serdev)
+                return true;
+
+        if (hu->tty->driver->ops->tiocmget && hu->tty->driver->ops->tiocmset)
+                return true;
+
+        return false;
+}
+
 /* Flow control or un-flow control the device */
 void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
 {
diff --git a/drivers/bluetooth/hci_mrvl.c b/drivers/bluetooth/hci_mrvl.c
index f98e5cc343b2..fbc3f7c3a5c7 100644
--- a/drivers/bluetooth/hci_mrvl.c
+++ b/drivers/bluetooth/hci_mrvl.c
@@ -59,6 +59,9 @@ static int mrvl_open(struct hci_uart *hu)
 
         BT_DBG("hu %p", hu);
 
+        if (!hci_uart_has_flow_control(hu))
+                return -EOPNOTSUPP;
+
         mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
         if (!mrvl)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 9a5c9c1f9484..82a0a3691a63 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -473,6 +473,9 @@ static int qca_open(struct hci_uart *hu)
 
         BT_DBG("hu %p qca_open", hu);
 
+        if (!hci_uart_has_flow_control(hu))
+                return -EOPNOTSUPP;
+
         qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
         if (!qca)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
index f11af3912ce6..6ab631101019 100644
--- a/drivers/bluetooth/hci_uart.h
+++ b/drivers/bluetooth/hci_uart.h
@@ -104,6 +104,7 @@ int hci_uart_wait_until_sent(struct hci_uart *hu);
 int hci_uart_init_ready(struct hci_uart *hu);
 void hci_uart_init_work(struct work_struct *work);
 void hci_uart_set_baudrate(struct hci_uart *hu, unsigned int speed);
+bool hci_uart_has_flow_control(struct hci_uart *hu);
 void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);
 void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,
                          unsigned int oper_speed);
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 5c39f20378b8..9ac6671bb514 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -567,8 +567,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
         unsigned long long m;
 
         m = hpets->hp_tick_freq + (dis >> 1);
-        do_div(m, dis);
-        return (unsigned long)m;
+        return div64_ul(m, dis);
 }
 
 static int
diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c
index 57204335c5f5..285e0b8f9a97 100644
--- a/drivers/char/ipmi/ipmb_dev_int.c
+++ b/drivers/char/ipmi/ipmb_dev_int.c
@@ -76,7 +76,7 @@ static ssize_t ipmb_read(struct file *file, char __user *buf, size_t count,
         struct ipmb_dev *ipmb_dev = to_ipmb_dev(file);
         struct ipmb_request_elem *queue_elem;
         struct ipmb_msg msg;
-        ssize_t ret;
+        ssize_t ret = 0;
 
         memset(&msg, 0, sizeof(msg));
 
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index d47ad10a35fe..4838c6a9f0f2 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -77,6 +77,18 @@ static int tpm_go_idle(struct tpm_chip *chip)
         return chip->ops->go_idle(chip);
 }
 
+static void tpm_clk_enable(struct tpm_chip *chip)
+{
+        if (chip->ops->clk_enable)
+                chip->ops->clk_enable(chip, true);
+}
+
+static void tpm_clk_disable(struct tpm_chip *chip)
+{
+        if (chip->ops->clk_enable)
+                chip->ops->clk_enable(chip, false);
+}
+
 /**
  * tpm_chip_start() - power on the TPM
  * @chip:       a TPM chip to use
@@ -89,13 +101,12 @@ int tpm_chip_start(struct tpm_chip *chip)
 {
         int ret;
 
-        if (chip->ops->clk_enable)
-                chip->ops->clk_enable(chip, true);
+        tpm_clk_enable(chip);
 
         if (chip->locality == -1) {
                 ret = tpm_request_locality(chip);
                 if (ret) {
-                        chip->ops->clk_enable(chip, false);
+                        tpm_clk_disable(chip);
                         return ret;
                 }
         }
@@ -103,8 +114,7 @@ int tpm_chip_start(struct tpm_chip *chip)
         ret = tpm_cmd_ready(chip);
         if (ret) {
                 tpm_relinquish_locality(chip);
-                if (chip->ops->clk_enable)
-                        chip->ops->clk_enable(chip, false);
+                tpm_clk_disable(chip);
                 return ret;
         }
 
@@ -124,8 +134,7 @@ void tpm_chip_stop(struct tpm_chip *chip)
 {
         tpm_go_idle(chip);
         tpm_relinquish_locality(chip);
-        if (chip->ops->clk_enable)
-                chip->ops->clk_enable(chip, false);
+        tpm_clk_disable(chip);
 }
 EXPORT_SYMBOL_GPL(tpm_chip_stop);
 
@@ -545,6 +554,20 @@ static int tpm_add_hwrng(struct tpm_chip *chip)
         return hwrng_register(&chip->hwrng);
 }
 
+static int tpm_get_pcr_allocation(struct tpm_chip *chip)
+{
+        int rc;
+
+        rc = (chip->flags & TPM_CHIP_FLAG_TPM2) ?
+             tpm2_get_pcr_allocation(chip) :
+             tpm1_get_pcr_allocation(chip);
+
+        if (rc > 0)
+                return -ENODEV;
+
+        return rc;
+}
+
 /*
  * tpm_chip_register() - create a character device for the TPM chip
  * @chip: TPM chip to use.
@@ -564,6 +587,12 @@ int tpm_chip_register(struct tpm_chip *chip)
         if (rc)
                 return rc;
         rc = tpm_auto_startup(chip);
+        if (rc) {
+                tpm_chip_stop(chip);
+                return rc;
+        }
+
+        rc = tpm_get_pcr_allocation(chip);
         tpm_chip_stop(chip);
         if (rc)
                 return rc;
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index e503ffc3aa39..a7fea3e0ca86 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -394,6 +394,7 @@ int tpm1_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf);
 ssize_t tpm1_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
                     const char *desc, size_t min_cap_length);
 int tpm1_get_random(struct tpm_chip *chip, u8 *out, size_t max);
+int tpm1_get_pcr_allocation(struct tpm_chip *chip);
 unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
 int tpm_pm_suspend(struct device *dev);
 int tpm_pm_resume(struct device *dev);
@@ -449,6 +450,7 @@ int tpm2_unseal_trusted(struct tpm_chip *chip,
 ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,
                         u32 *value, const char *desc);
 
+ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip);
 int tpm2_auto_startup(struct tpm_chip *chip);
 void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
 unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c
index faacbe1ffa1a..149e953ca369 100644
--- a/drivers/char/tpm/tpm1-cmd.c
+++ b/drivers/char/tpm/tpm1-cmd.c
@@ -699,18 +699,6 @@ int tpm1_auto_startup(struct tpm_chip *chip)
                 goto out;
         }
 
-        chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),
-                                        GFP_KERNEL);
-        if (!chip->allocated_banks) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;
-        chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];
-        chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;
-        chip->nr_allocated_banks = 1;
-
         return rc;
 out:
         if (rc > 0)
@@ -779,3 +767,27 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
         return rc;
 }
 
+/**
+ * tpm1_get_pcr_allocation() - initialize the allocated bank
+ * @chip: TPM chip to use.
+ *
+ * The function initializes the SHA1 allocated bank to extend PCR
+ *
+ * Return:
+ * * 0 on success,
+ * * < 0 on error.
+ */
+int tpm1_get_pcr_allocation(struct tpm_chip *chip)
+{
+        chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),
+                                        GFP_KERNEL);
+        if (!chip->allocated_banks)
+                return -ENOMEM;
+
+        chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;
+        chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];
+        chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;
+        chip->nr_allocated_banks = 1;
+
+        return 0;
+}
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index d103545e4055..ba9acae83bff 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -840,7 +840,7 @@ struct tpm2_pcr_selection {
         u8  pcr_select[3];
 } __packed;
 
-static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
+ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 {
         struct tpm2_pcr_selection pcr_selection;
         struct tpm_buf buf;
@@ -1040,10 +1040,6 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                         goto out;
         }
 
-        rc = tpm2_get_pcr_allocation(chip);
-        if (rc)
-                goto out;
-
         rc = tpm2_get_cc_attrs_tbl(chip);
 
 out:
diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
index 44db83a6d01c..44a46dcc0518 100644
--- a/drivers/clk/at91/clk-generated.c
+++ b/drivers/clk/at91/clk-generated.c
@@ -141,6 +141,8 @@ static int clk_generated_determine_rate(struct clk_hw *hw,
                         continue;
 
                 div = DIV_ROUND_CLOSEST(parent_rate, req->rate);
+                if (div > GENERATED_MAX_DIV + 1)
+                        div = GENERATED_MAX_DIV + 1;
 
                 clk_generated_best_diff(req, parent, parent_rate, div,
                                         &best_diff, &best_rate);
diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c
index 1aa5f4059251..73b7e238eee7 100644
--- a/drivers/clk/mediatek/clk-mt8183.c
+++ b/drivers/clk/mediatek/clk-mt8183.c
@@ -25,9 +25,11 @@ static const struct mtk_fixed_clk top_fixed_clks[] = {
         FIXED_CLK(CLK_TOP_UNIVP_192M, "univpll_192m", "univpll", 192000000),
 };
 
+static const struct mtk_fixed_factor top_early_divs[] = {
+        FACTOR(CLK_TOP_CLK13M, "clk13m", "clk26m", 1, 2),
+};
+
 static const struct mtk_fixed_factor top_divs[] = {
-        FACTOR(CLK_TOP_CLK13M, "clk13m", "clk26m", 1,
-                2),
         FACTOR(CLK_TOP_F26M_CK_D2, "csw_f26m_ck_d2", "clk26m", 1,
                 2),
         FACTOR(CLK_TOP_SYSPLL_CK, "syspll_ck", "mainpll", 1,
@@ -1148,37 +1150,57 @@ static int clk_mt8183_apmixed_probe(struct platform_device *pdev)
         return of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
 }
 
+static struct clk_onecell_data *top_clk_data;
+
+static void clk_mt8183_top_init_early(struct device_node *node)
+{
+        int i;
+
+        top_clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
+
+        for (i = 0; i < CLK_TOP_NR_CLK; i++)
+                top_clk_data->clks[i] = ERR_PTR(-EPROBE_DEFER);
+
+        mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs),
+                        top_clk_data);
+
+        of_clk_add_provider(node, of_clk_src_onecell_get, top_clk_data);
+}
+
+CLK_OF_DECLARE_DRIVER(mt8183_topckgen, "mediatek,mt8183-topckgen",
+                        clk_mt8183_top_init_early);
+
 static int clk_mt8183_top_probe(struct platform_device *pdev)
 {
         struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         void __iomem *base;
-        struct clk_onecell_data *clk_data;
         struct device_node *node = pdev->dev.of_node;
 
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
                 return PTR_ERR(base);
 
-        clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
-
         mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
-                clk_data);
+                top_clk_data);
+
+        mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs),
+                top_clk_data);
 
-        mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
+        mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data);
 
         mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes),
-                node, &mt8183_clk_lock, clk_data);
+                node, &mt8183_clk_lock, top_clk_data);
 
         mtk_clk_register_composites(top_aud_muxes, ARRAY_SIZE(top_aud_muxes),
-                base, &mt8183_clk_lock, clk_data);
+                base, &mt8183_clk_lock, top_clk_data);
 
         mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs),
-                base, &mt8183_clk_lock, clk_data);
+                base, &mt8183_clk_lock, top_clk_data);
 
         mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks),
-                clk_data);
+                top_clk_data);
 
-        return of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+        return of_clk_add_provider(node, of_clk_src_onecell_get, top_clk_data);
 }
 
 static int clk_mt8183_infra_probe(struct platform_device *pdev)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index 52bbb9ce3807..d4075b130674 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -572,17 +572,11 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
         unsigned int reg = id / 32;
         unsigned int bit = id % 32;
         u32 bitmask = BIT(bit);
-        unsigned long flags;
-        u32 value;
 
         dev_dbg(priv->dev, "reset %u%02u\n", reg, bit);
 
         /* Reset module */
-        spin_lock_irqsave(&priv->rmw_lock, flags);
-        value = readl(priv->base + SRCR(reg));
-        value |= bitmask;
-        writel(value, priv->base + SRCR(reg));
-        spin_unlock_irqrestore(&priv->rmw_lock, flags);
+        writel(bitmask, priv->base + SRCR(reg));
 
         /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
         udelay(35);
@@ -599,16 +593,10 @@ static int cpg_mssr_assert(struct reset_controller_dev *rcdev, unsigned long id)
         unsigned int reg = id / 32;
         unsigned int bit = id % 32;
         u32 bitmask = BIT(bit);
-        unsigned long flags;
-        u32 value;
 
         dev_dbg(priv->dev, "assert %u%02u\n", reg, bit);
 
-        spin_lock_irqsave(&priv->rmw_lock, flags);
-        value = readl(priv->base + SRCR(reg));
-        value |= bitmask;
-        writel(value, priv->base + SRCR(reg));
-        spin_unlock_irqrestore(&priv->rmw_lock, flags);
+        writel(bitmask, priv->base + SRCR(reg));
         return 0;
 }
 
diff --git a/drivers/clk/sprd/Kconfig b/drivers/clk/sprd/Kconfig
index 91d3d721c801..3c219af25100 100644
--- a/drivers/clk/sprd/Kconfig
+++ b/drivers/clk/sprd/Kconfig
@@ -3,6 +3,7 @@ config SPRD_COMMON_CLK
         tristate "Clock support for Spreadtrum SoCs"
         depends on ARCH_SPRD || COMPILE_TEST
         default ARCH_SPRD
+        select REGMAP_MMIO
 
 if SPRD_COMMON_CLK
 
diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
index 93f39a1d4c3d..c66f566a854c 100644
--- a/drivers/cpufreq/pasemi-cpufreq.c
+++ b/drivers/cpufreq/pasemi-cpufreq.c
@@ -131,10 +131,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
         int err = -ENODEV;
 
         cpu = of_get_cpu_node(policy->cpu, NULL);
+        if (!cpu)
+                goto out;
 
+        max_freqp = of_get_property(cpu, "clock-frequency", NULL);
         of_node_put(cpu);
-        if (!cpu)
+        if (!max_freqp) {
+                err = -EINVAL;
                 goto out;
+        }
+
+        /* we need the freq in kHz */
+        max_freq = *max_freqp / 1000;
 
         dn = of_find_compatible_node(NULL, NULL, "1682m-sdc");
         if (!dn)
@@ -171,16 +179,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
         }
 
         pr_debug("init cpufreq on CPU %d\n", policy->cpu);
-
-        max_freqp = of_get_property(cpu, "clock-frequency", NULL);
-        if (!max_freqp) {
-                err = -EINVAL;
-                goto out_unmap_sdcpwr;
-        }
-
-        /* we need the freq in kHz */
-        max_freq = *max_freqp / 1000;
-
         pr_debug("max clock-frequency is at %u kHz\n", max_freq);
         pr_debug("initializing frequency table\n");
 
@@ -199,9 +197,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
         cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());
         return 0;
 
-out_unmap_sdcpwr:
-        iounmap(sdcpwr_mapbase);
-
 out_unmap_sdcasr:
         iounmap(sdcasr_mapbase);
 out:
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 3dc1cbf849db..b785e936244f 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -957,7 +957,7 @@ static void set_broadcast_channel(struct fw_device *device, int generation)
                                 device->bc_implemented = BC_IMPLEMENTED;
                                 break;
                         }
-                        /* else fall through to case address error */
+                        /* else, fall through - to case address error */
                 case RCODE_ADDRESS_ERROR:
                         device->bc_implemented = BC_UNIMPLEMENTED;
                 }
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 42566b7be8f5..df8a56a979b9 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -284,7 +284,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                         if ((data[0] & bit) == (data[1] & bit))
                                 continue;
 
-                        /* 1394-1995 IRM, fall through to retry. */
+                        /* fall through - It's a 1394-1995 IRM, retry. */
                 default:
                         if (retry) {
                                 retry--;
diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c
index 46bd22dde535..94a13fca8267 100644
--- a/drivers/firewire/core-topology.c
+++ b/drivers/firewire/core-topology.c
@@ -54,6 +54,7 @@ static u32 *count_ports(u32 *sid, int *total_port_count, int *child_port_count)
                 switch (port_type) {
                 case SELFID_PORT_CHILD:
                         (*child_port_count)++;
+                        /* fall through */
                 case SELFID_PORT_PARENT:
                 case SELFID_PORT_NCONN:
                         (*total_port_count)++;
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 53446e39a32c..ba8d3d0ef32c 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -157,7 +157,7 @@ config DMI_SCAN_MACHINE_NON_EFI_FALLBACK
 
 config ISCSI_IBFT_FIND
         bool "iSCSI Boot Firmware Table Attributes"
-        depends on X86 && ACPI
+        depends on X86 && ISCSI_IBFT
         default n
         help
           This option enables the kernel to find the region of memory
@@ -168,7 +168,8 @@ config ISCSI_IBFT_FIND
 config ISCSI_IBFT
         tristate "iSCSI Boot Firmware Table Attributes module"
         select ISCSI_BOOT_SYSFS
-        depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL
+        select ISCSI_IBFT_FIND if X86
+        depends on ACPI && SCSI && SCSI_LOWLEVEL
         default n
         help
           This option enables support for detection and exposing of iSCSI
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index ab3aa3983833..7e12cbdf957c 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -84,6 +84,10 @@ MODULE_DESCRIPTION("sysfs interface to BIOS iBFT information");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBFT_ISCSI_VERSION);
 
+#ifndef CONFIG_ISCSI_IBFT_FIND
+struct acpi_table_ibft *ibft_addr;
+#endif
+
 struct ibft_hdr {
         u8 id;
         u8 version;
diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
index 474f304ec109..cdd4f73b4869 100644
--- a/drivers/fpga/Kconfig
+++ b/drivers/fpga/Kconfig
@@ -40,6 +40,7 @@ config ALTERA_PR_IP_CORE_PLAT
 config FPGA_MGR_ALTERA_PS_SPI
         tristate "Altera FPGA Passive Serial over SPI"
         depends on SPI
+        select BITREVERSE
         help
           FPGA manager driver support for Altera Arria/Cyclone/Stratix
           using the passive serial interface over SPI.
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 3ee99d070608..f497003f119c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -956,9 +956,11 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
         }
 
         if (eflags & GPIOEVENT_REQUEST_RISING_EDGE)
-                irqflags |= IRQF_TRIGGER_RISING;
+                irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+                        IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING;
         if (eflags & GPIOEVENT_REQUEST_FALLING_EDGE)
-                irqflags |= IRQF_TRIGGER_FALLING;
+                irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+                        IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
         irqflags |= IRQF_ONESHOT;
 
         INIT_KFIFO(le->events);
@@ -1392,12 +1394,17 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         for (i = 0; i < chip->ngpio; i++) {
                 struct gpio_desc *desc = &gdev->descs[i];
 
-                if (chip->get_direction && gpiochip_line_is_valid(chip, i))
-                        desc->flags = !chip->get_direction(chip, i) ?
-                                        (1 << FLAG_IS_OUT) : 0;
-                else
-                        desc->flags = !chip->direction_input ?
-                                        (1 << FLAG_IS_OUT) : 0;
+                if (chip->get_direction && gpiochip_line_is_valid(chip, i)) {
+                        if (!chip->get_direction(chip, i))
+                                set_bit(FLAG_IS_OUT, &desc->flags);
+                        else
+                                clear_bit(FLAG_IS_OUT, &desc->flags);
+                } else {
+                        if (!chip->direction_input)
+                                set_bit(FLAG_IS_OUT, &desc->flags);
+                        else
+                                clear_bit(FLAG_IS_OUT, &desc->flags);
+                }
         }
 
         acpi_gpiochip_add(chip);
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 1d80222587ad..3c88420e3497 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -394,7 +394,7 @@ config DRM_R128
 config DRM_I810
         tristate "Intel I810"
         # !PREEMPT because of missing ioctl locking
-        depends on DRM && AGP && AGP_INTEL && (!PREEMPT || BROKEN)
+        depends on DRM && AGP && AGP_INTEL && (!PREEMPTION || BROKEN)
         help
           Choose this option if you have an Intel I810 graphics card.  If M is
           selected, the module will be called i810.  AGP support is required
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 1d3ee9c42f7e..6a5c96e519b1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1140,7 +1140,8 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
                         adev->asic_type != CHIP_FIJI &&
                         adev->asic_type != CHIP_POLARIS10 &&
                         adev->asic_type != CHIP_POLARIS11 &&
-                        adev->asic_type != CHIP_POLARIS12) ?
+                        adev->asic_type != CHIP_POLARIS12 &&
+                        adev->asic_type != CHIP_VEGAM) ?
                         VI_BO_SIZE_ALIGN : 1;
 
         mapping_flags = AMDGPU_VM_PAGE_READABLE;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index e069de8b54e6..4e4094f842e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1044,29 +1044,27 @@ static int amdgpu_cs_process_fence_dep(struct amdgpu_cs_parser *p,
                         return r;
                 }
 
-                fence = amdgpu_ctx_get_fence(ctx, entity,
-                                             deps[i].handle);
+                fence = amdgpu_ctx_get_fence(ctx, entity, deps[i].handle);
+                amdgpu_ctx_put(ctx);
+
+                if (IS_ERR(fence))
+                        return PTR_ERR(fence);
+                else if (!fence)
+                        continue;
 
                 if (chunk->chunk_id == AMDGPU_CHUNK_ID_SCHEDULED_DEPENDENCIES) {
-                        struct drm_sched_fence *s_fence = to_drm_sched_fence(fence);
+                        struct drm_sched_fence *s_fence;
                         struct dma_fence *old = fence;
 
+                        s_fence = to_drm_sched_fence(fence);
                         fence = dma_fence_get(&s_fence->scheduled);
                         dma_fence_put(old);
                 }
 
-                if (IS_ERR(fence)) {
-                        r = PTR_ERR(fence);
-                        amdgpu_ctx_put(ctx);
+                r = amdgpu_sync_fence(p->adev, &p->job->sync, fence, true);
+                dma_fence_put(fence);
+                if (r)
                         return r;
-                } else if (fence) {
-                        r = amdgpu_sync_fence(p->adev, &p->job->sync, fence,
-                                        true);
-                        dma_fence_put(fence);
-                        amdgpu_ctx_put(ctx);
-                        if (r)
-                                return r;
-                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 6d54decef7f8..5652cc72ed3a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -707,7 +707,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
         thread = (*pos & GENMASK_ULL(59, 52)) >> 52;
         bank = (*pos & GENMASK_ULL(61, 60)) >> 60;
 
-        data = kmalloc_array(1024, sizeof(*data), GFP_KERNEL);
+        data = kcalloc(1024, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index f2e8b4238efd..5376328d3fd0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -148,7 +148,7 @@ struct amdgpu_mgpu_info mgpu_info = {
         .mutex = __MUTEX_INITIALIZER(mgpu_info.mutex),
 };
 int amdgpu_ras_enable = -1;
-uint amdgpu_ras_mask = 0xffffffff;
+uint amdgpu_ras_mask = 0xfffffffb;
 
 /**
  * DOC: vramlimit (int)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 8b7efd0a7028..2b546567853b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -159,12 +159,16 @@ static ssize_t amdgpu_get_dpm_state(struct device *dev,
         struct amdgpu_device *adev = ddev->dev_private;
         enum amd_pm_state_type pm;
 
-        if (is_support_sw_smu(adev) && adev->smu.ppt_funcs->get_current_power_state)
-                pm = amdgpu_smu_get_current_power_state(adev);
-        else if (adev->powerplay.pp_funcs->get_current_power_state)
+        if (is_support_sw_smu(adev)) {
+                if (adev->smu.ppt_funcs->get_current_power_state)
+                        pm = amdgpu_smu_get_current_power_state(adev);
+                else
+                        pm = adev->pm.dpm.user_state;
+        } else if (adev->powerplay.pp_funcs->get_current_power_state) {
                 pm = amdgpu_dpm_get_current_power_state(adev);
-        else
+        } else {
                 pm = adev->pm.dpm.user_state;
+        }
 
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         (pm == POWER_STATE_TYPE_BATTERY) ? "battery" :
@@ -191,7 +195,11 @@ static ssize_t amdgpu_set_dpm_state(struct device *dev,
                 goto fail;
         }
 
-        if (adev->powerplay.pp_funcs->dispatch_tasks) {
+        if (is_support_sw_smu(adev)) {
+                mutex_lock(&adev->pm.mutex);
+                adev->pm.dpm.user_state = state;
+                mutex_unlock(&adev->pm.mutex);
+        } else if (adev->powerplay.pp_funcs->dispatch_tasks) {
                 amdgpu_dpm_dispatch_task(adev, AMD_PP_TASK_ENABLE_USER_STATE, &state);
         } else {
                 mutex_lock(&adev->pm.mutex);
@@ -1734,7 +1742,7 @@ static ssize_t amdgpu_hwmon_get_fan1_input(struct device *dev,
                 return -EINVAL;
 
         if (is_support_sw_smu(adev)) {
-                err = smu_get_current_rpm(&adev->smu, &speed);
+                err = smu_get_fan_speed_rpm(&adev->smu, &speed);
                 if (err)
                         return err;
         } else if (adev->powerplay.pp_funcs->get_fan_speed_rpm) {
@@ -1794,7 +1802,7 @@ static ssize_t amdgpu_hwmon_get_fan1_target(struct device *dev,
                 return -EINVAL;
 
         if (is_support_sw_smu(adev)) {
-                err = smu_get_current_rpm(&adev->smu, &rpm);
+                err = smu_get_fan_speed_rpm(&adev->smu, &rpm);
                 if (err)
                         return err;
         } else if (adev->powerplay.pp_funcs->get_fan_speed_rpm) {
@@ -3067,28 +3075,44 @@ static int amdgpu_debugfs_pm_info_pp(struct seq_file *m, struct amdgpu_device *a
         if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_ENABLED_SMC_FEATURES_MASK, (void *)&value64, &size))
                 seq_printf(m, "SMC Feature Mask: 0x%016llx\n", value64);
 
-        /* UVD clocks */
-        if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_POWER, (void *)&value, &size)) {
-                if (!value) {
-                        seq_printf(m, "UVD: Disabled\n");
-                } else {
-                        seq_printf(m, "UVD: Enabled\n");
-                        if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_DCLK, (void *)&value, &size))
-                                seq_printf(m, "\t%u MHz (DCLK)\n", value/100);
-                        if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_VCLK, (void *)&value, &size))
-                                seq_printf(m, "\t%u MHz (VCLK)\n", value/100);
+        if (adev->asic_type > CHIP_VEGA20) {
+                /* VCN clocks */
+                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VCN_POWER_STATE, (void *)&value, &size)) {
+                        if (!value) {
+                                seq_printf(m, "VCN: Disabled\n");
+                        } else {
+                                seq_printf(m, "VCN: Enabled\n");
+                                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_DCLK, (void *)&value, &size))
+                                        seq_printf(m, "\t%u MHz (DCLK)\n", value/100);
+                                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_VCLK, (void *)&value, &size))
+                                        seq_printf(m, "\t%u MHz (VCLK)\n", value/100);
+                        }
                 }
-        }
-        seq_printf(m, "\n");
+                seq_printf(m, "\n");
+        } else {
+                /* UVD clocks */
+                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_POWER, (void *)&value, &size)) {
+                        if (!value) {
+                                seq_printf(m, "UVD: Disabled\n");
+                        } else {
+                                seq_printf(m, "UVD: Enabled\n");
+                                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_DCLK, (void *)&value, &size))
+                                        seq_printf(m, "\t%u MHz (DCLK)\n", value/100);
+                                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_UVD_VCLK, (void *)&value, &size))
+                                        seq_printf(m, "\t%u MHz (VCLK)\n", value/100);
+                        }
+                }
+                seq_printf(m, "\n");
 
-        /* VCE clocks */
-        if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VCE_POWER, (void *)&value, &size)) {
-                if (!value) {
-                        seq_printf(m, "VCE: Disabled\n");
-                } else {
-                        seq_printf(m, "VCE: Enabled\n");
-                        if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VCE_ECCLK, (void *)&value, &size))
-                                seq_printf(m, "\t%u MHz (ECCLK)\n", value/100);
+                /* VCE clocks */
+                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VCE_POWER, (void *)&value, &size)) {
+                        if (!value) {
+                                seq_printf(m, "VCE: Disabled\n");
+                        } else {
+                                seq_printf(m, "VCE: Enabled\n");
+                                if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VCE_ECCLK, (void *)&value, &size))
+                                        seq_printf(m, "\t%u MHz (ECCLK)\n", value/100);
+                        }
                 }
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 1a4412e47810..fac7aa2c244f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -136,11 +136,6 @@ static int amdgpu_ras_reserve_vram(struct amdgpu_device *adev,
 static int amdgpu_ras_release_vram(struct amdgpu_device *adev,
                 struct amdgpu_bo **bo_ptr);
 
-static void amdgpu_ras_self_test(struct amdgpu_device *adev)
-{
-        /* TODO */
-}
-
 static ssize_t amdgpu_ras_debugfs_read(struct file *f, char __user *buf,
                                         size_t size, loff_t *pos)
 {
@@ -689,6 +684,12 @@ int amdgpu_ras_error_inject(struct amdgpu_device *adev,
         if (!obj)
                 return -EINVAL;
 
+        if (block_info.block_id != TA_RAS_BLOCK__UMC) {
+                DRM_INFO("%s error injection is not supported yet\n",
+                         ras_block_str(info->head.block));
+                return -EINVAL;
+        }
+
         ret = psp_ras_trigger_error(&adev->psp, &block_info);
         if (ret)
                 DRM_ERROR("RAS ERROR: inject %s error failed ret %d\n",
@@ -1557,6 +1558,12 @@ int amdgpu_ras_init(struct amdgpu_device *adev)
 
         amdgpu_ras_check_supported(adev, &con->hw_supported,
                         &con->supported);
+        if (!con->hw_supported) {
+                amdgpu_ras_set_context(adev, NULL);
+                kfree(con);
+                return 0;
+        }
+
         con->features = 0;
         INIT_LIST_HEAD(&con->head);
         /* Might need get this flag from vbios. */
@@ -1570,8 +1577,6 @@ int amdgpu_ras_init(struct amdgpu_device *adev)
         if (amdgpu_ras_fs_init(adev))
                 goto fs_out;
 
-        amdgpu_ras_self_test(adev);
-
         DRM_INFO("RAS INFO: ras initialized successfully, "
                         "hardware ability[%x] ras_mask[%x]\n",
                         con->hw_supported, con->supported);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 1675d5837c3c..32773b7523d2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -1441,6 +1441,15 @@ static void gfx_v10_0_init_compute_vmid(struct amdgpu_device *adev)
         }
         nv_grbm_select(adev, 0, 0, 0, 0);
         mutex_unlock(&adev->srbm_mutex);
+
+        /* Initialize all compute VMIDs to have no GDS, GWS, or OA
+           acccess. These should be enabled by FW for target VMIDs. */
+        for (i = FIRST_COMPUTE_VMID; i < LAST_COMPUTE_VMID; i++) {
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_VMID0_BASE, 2 * i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_VMID0_SIZE, 2 * i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_GWS_VMID0, i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_OA_VMID0, i, 0);
+        }
 }
 
 static void gfx_v10_0_tcp_harvest(struct amdgpu_device *adev)
@@ -4611,6 +4620,7 @@ gfx_v10_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
                 cp_int_cntl = REG_SET_FIELD(cp_int_cntl, CP_INT_CNTL_RING0,
                                             TIME_STAMP_INT_ENABLE, 0);
                 WREG32(cp_int_cntl_reg, cp_int_cntl);
+                break;
         case AMDGPU_IRQ_STATE_ENABLE:
                 cp_int_cntl = RREG32(cp_int_cntl_reg);
                 cp_int_cntl = REG_SET_FIELD(cp_int_cntl, CP_INT_CNTL_RING0,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 0db9f488da7e..21187275dfd3 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -1879,6 +1879,15 @@ static void gfx_v7_0_init_compute_vmid(struct amdgpu_device *adev)
         }
         cik_srbm_select(adev, 0, 0, 0, 0);
         mutex_unlock(&adev->srbm_mutex);
+
+        /* Initialize all compute VMIDs to have no GDS, GWS, or OA
+           acccess. These should be enabled by FW for target VMIDs. */
+        for (i = FIRST_COMPUTE_VMID; i < LAST_COMPUTE_VMID; i++) {
+                WREG32(amdgpu_gds_reg_offset[i].mem_base, 0);
+                WREG32(amdgpu_gds_reg_offset[i].mem_size, 0);
+                WREG32(amdgpu_gds_reg_offset[i].gws, 0);
+                WREG32(amdgpu_gds_reg_offset[i].oa, 0);
+        }
 }
 
 static void gfx_v7_0_config_init(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 5f401b41ef7c..751567f78567 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -3706,6 +3706,15 @@ static void gfx_v8_0_init_compute_vmid(struct amdgpu_device *adev)
         }
         vi_srbm_select(adev, 0, 0, 0, 0);
         mutex_unlock(&adev->srbm_mutex);
+
+        /* Initialize all compute VMIDs to have no GDS, GWS, or OA
+           acccess. These should be enabled by FW for target VMIDs. */
+        for (i = FIRST_COMPUTE_VMID; i < LAST_COMPUTE_VMID; i++) {
+                WREG32(amdgpu_gds_reg_offset[i].mem_base, 0);
+                WREG32(amdgpu_gds_reg_offset[i].mem_size, 0);
+                WREG32(amdgpu_gds_reg_offset[i].gws, 0);
+                WREG32(amdgpu_gds_reg_offset[i].oa, 0);
+        }
 }
 
 static void gfx_v8_0_config_init(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index f4c4eea62526..1cf639a51178 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1918,6 +1918,15 @@ static void gfx_v9_0_init_compute_vmid(struct amdgpu_device *adev)
         }
         soc15_grbm_select(adev, 0, 0, 0, 0);
         mutex_unlock(&adev->srbm_mutex);
+
+        /* Initialize all compute VMIDs to have no GDS, GWS, or OA
+           acccess. These should be enabled by FW for target VMIDs. */
+        for (i = FIRST_COMPUTE_VMID; i < LAST_COMPUTE_VMID; i++) {
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_VMID0_BASE, 2 * i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_VMID0_SIZE, 2 * i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_GWS_VMID0, i, 0);
+                WREG32_SOC15_OFFSET(GC, 0, mmGDS_OA_VMID0, i, 0);
+        }
 }
 
 static void gfx_v9_0_constants_init(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
index 988c0adaca91..1cfc2620b2dd 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
@@ -372,11 +372,8 @@ static void vcn_v2_0_mc_resume(struct amdgpu_device *adev)
                 WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH,
                         upper_32_bits(adev->vcn.gpu_addr));
                 offset = size;
-                /* No signed header for now from firmware
                 WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0,
                         AMDGPU_UVD_FIRMWARE_OFFSET >> 3);
-                */
-                WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0, 0);
         }
 
         WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE0, size);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index 792371442195..4e3fc284f6ac 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -668,6 +668,7 @@ static int kfd_fill_gpu_cache_info(struct kfd_dev *kdev,
         case CHIP_RAVEN:
                 pcache_info = raven_cache_info;
                 num_of_cache_types = ARRAY_SIZE(raven_cache_info);
+                break;
         case CHIP_NAVI10:
                 pcache_info = navi10_cache_info;
                 num_of_cache_types = ARRAY_SIZE(navi10_cache_info);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
index 4f8a6ffc5775..9cd3eb2d90bd 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
@@ -429,7 +429,6 @@ struct mqd_manager *mqd_manager_init_v10(enum KFD_MQD_TYPE type,
 
         switch (type) {
         case KFD_MQD_TYPE_CP:
-                pr_debug("%s@%i\n", __func__, __LINE__);
         case KFD_MQD_TYPE_COMPUTE:
                 pr_debug("%s@%i\n", __func__, __LINE__);
                 mqd->allocate_mqd = allocate_mqd;
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
index c1a92c16535c..5cc3acccda2a 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
@@ -262,12 +262,12 @@ void dce110_clk_mgr_construct(
                 struct dc_context *ctx,
                 struct clk_mgr_internal *clk_mgr)
 {
+        dce_clk_mgr_construct(ctx, clk_mgr);
+
         memcpy(clk_mgr->max_clks_by_state,
                 dce110_max_clks_by_state,
                 sizeof(dce110_max_clks_by_state));
 
-        dce_clk_mgr_construct(ctx, clk_mgr);
-
         clk_mgr->regs = &disp_clk_regs;
         clk_mgr->clk_mgr_shift = &disp_clk_shift;
         clk_mgr->clk_mgr_mask = &disp_clk_mask;
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce112/dce112_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce112/dce112_clk_mgr.c
index 778392c73187..7c746ef1e32e 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce112/dce112_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce112/dce112_clk_mgr.c
@@ -226,12 +226,12 @@ void dce112_clk_mgr_construct(
                 struct dc_context *ctx,
                 struct clk_mgr_internal *clk_mgr)
 {
+        dce_clk_mgr_construct(ctx, clk_mgr);
+
         memcpy(clk_mgr->max_clks_by_state,
                 dce112_max_clks_by_state,
                 sizeof(dce112_max_clks_by_state));
 
-        dce_clk_mgr_construct(ctx, clk_mgr);
-
         clk_mgr->regs = &disp_clk_regs;
         clk_mgr->clk_mgr_shift = &disp_clk_shift;
         clk_mgr->clk_mgr_mask = &disp_clk_mask;
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce120/dce120_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce120/dce120_clk_mgr.c
index 906310c3e2eb..5399b8cf6b75 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce120/dce120_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce120/dce120_clk_mgr.c
@@ -127,12 +127,12 @@ static struct clk_mgr_funcs dce120_funcs = {
 
 void dce120_clk_mgr_construct(struct dc_context *ctx, struct clk_mgr_internal *clk_mgr)
 {
+        dce_clk_mgr_construct(ctx, clk_mgr);
+
         memcpy(clk_mgr->max_clks_by_state,
                 dce120_max_clks_by_state,
                 sizeof(dce120_max_clks_by_state));
 
-        dce_clk_mgr_construct(ctx, clk_mgr);
-
         clk_mgr->base.dprefclk_khz = 600000;
         clk_mgr->base.funcs = &dce120_funcs;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
index 08a774fc7b67..50bfb5921de0 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
@@ -301,6 +301,8 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr,
 void dcn2_init_clocks(struct clk_mgr *clk_mgr)
 {
         memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+        // Assumption is that boot state always supports pstate
+        clk_mgr->clks.p_state_change_support = true;
 }
 
 void dcn2_enable_pme_wa(struct clk_mgr *clk_mgr_base)
@@ -331,6 +333,7 @@ void dcn20_clk_mgr_construct(
                 struct dccg *dccg)
 {
         clk_mgr->base.ctx = ctx;
+        clk_mgr->pp_smu = pp_smu;
         clk_mgr->base.funcs = &dcn2_funcs;
         clk_mgr->regs = &clk_mgr_regs;
         clk_mgr->clk_mgr_shift = &clk_mgr_shift;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 4ef4dc63e221..fa20201eef3a 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -502,8 +502,10 @@ void dc_stream_set_static_screen_events(struct dc *dc,
 
 static void destruct(struct dc *dc)
 {
-        dc_release_state(dc->current_state);
-        dc->current_state = NULL;
+        if (dc->current_state) {
+                dc_release_state(dc->current_state);
+                dc->current_state = NULL;
+        }
 
         destroy_links(dc);
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 8dbf759eba45..355b4ba12796 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -532,6 +532,7 @@ static void read_edp_current_link_settings_on_detect(struct dc_link *link)
         uint32_t read_dpcd_retry_cnt = 10;
         enum dc_status status = DC_ERROR_UNEXPECTED;
         int i;
+        union max_down_spread max_down_spread = { {0} };
 
         // Read DPCD 00101h to find out the number of lanes currently set
         for (i = 0; i < read_dpcd_retry_cnt; i++) {
@@ -553,8 +554,6 @@ static void read_edp_current_link_settings_on_detect(struct dc_link *link)
                 msleep(8);
         }
 
-        ASSERT(status == DC_OK);
-
         // Read DPCD 00100h to find if standard link rates are set
         core_link_read_dpcd(link, DP_LINK_BW_SET,
                         &link_bw_set, sizeof(link_bw_set));
@@ -576,6 +575,12 @@ static void read_edp_current_link_settings_on_detect(struct dc_link *link)
                 link->cur_link_settings.link_rate = link_bw_set;
                 link->cur_link_settings.use_link_rate_set = false;
         }
+        // Read DPCD 00003h to find the max down spread.
+        core_link_read_dpcd(link, DP_MAX_DOWNSPREAD,
+                        &max_down_spread.raw, sizeof(max_down_spread));
+        link->cur_link_settings.link_spread =
+                max_down_spread.bits.MAX_DOWN_SPREAD ?
+                LINK_SPREAD_05_DOWNSPREAD_30KHZ : LINK_SPREAD_DISABLED;
 }
 
 static bool detect_dp(
@@ -717,13 +722,6 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
                 return false;
         }
 
-        if (link->connector_signal == SIGNAL_TYPE_EDP) {
-                /* On detect, we want to make sure current link settings are
-                 * up to date, especially if link was powered on by GOP.
-                 */
-                read_edp_current_link_settings_on_detect(link);
-        }
-
         prev_sink = link->local_sink;
         if (prev_sink != NULL) {
                 dc_sink_retain(prev_sink);
@@ -765,6 +763,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
                 }
 
                 case SIGNAL_TYPE_EDP: {
+                        read_edp_current_link_settings_on_detect(link);
                         detect_edp_sink_caps(link);
                         sink_caps.transaction_type =
                                 DDC_TRANSACTION_TYPE_I2C_OVER_AUX;
@@ -2329,7 +2328,7 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
                         if (core_dc->current_state->res_ctx.pipe_ctx[i].stream) {
                                 if (core_dc->current_state->res_ctx.
                                                 pipe_ctx[i].stream->link
-                                                == link)
+                                                == link) {
                                         /* DMCU -1 for all controller id values,
                                          * therefore +1 here
                                          */
@@ -2337,6 +2336,13 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
                                                 core_dc->current_state->
                                                 res_ctx.pipe_ctx[i].stream_res.tg->inst +
                                                 1;
+
+                                        /* Disable brightness ramping when the display is blanked
+                                         * as it can hang the DMCU
+                                         */
+                                        if (core_dc->current_state->res_ctx.pipe_ctx[i].plane_state == NULL)
+                                                frame_ramp = 0;
+                                }
                         }
                 }
                 abm->funcs->set_backlight_level_pwm(
@@ -2984,8 +2990,10 @@ void dc_link_set_preferred_link_settings(struct dc *dc,
 
         /* Retrain with preferred link settings only relevant for
          * DP signal type
+         * Check for non-DP signal or if passive dongle present
          */
-        if (!dc_is_dp_signal(link->connector_signal))
+        if (!dc_is_dp_signal(link->connector_signal) ||
+                link->dongle_max_pix_clk > 0)
                 return;
 
         for (i = 0; i < MAX_PIPES; i++) {
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 056be4c34a98..2c7aaed907b9 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -2230,18 +2230,25 @@ static void get_active_converter_info(
                 link->dpcd_caps.dongle_type = DISPLAY_DONGLE_NONE;
                 ddc_service_set_dongle_type(link->ddc,
                                 link->dpcd_caps.dongle_type);
+                link->dpcd_caps.is_branch_dev = false;
                 return;
         }
 
         /* DPCD 0x5 bit 0 = 1, it indicate it's branch device */
-        link->dpcd_caps.is_branch_dev = ds_port.fields.PORT_PRESENT;
+        if (ds_port.fields.PORT_TYPE == DOWNSTREAM_DP) {
+                link->dpcd_caps.is_branch_dev = false;
+        }
+
+        else {
+                link->dpcd_caps.is_branch_dev = ds_port.fields.PORT_PRESENT;
+        }
 
         switch (ds_port.fields.PORT_TYPE) {
         case DOWNSTREAM_VGA:
                 link->dpcd_caps.dongle_type = DISPLAY_DONGLE_DP_VGA_CONVERTER;
                 break;
-        case DOWNSTREAM_DVI_HDMI:
-                /* At this point we don't know is it DVI or HDMI,
+        case DOWNSTREAM_DVI_HDMI_DP_PLUS_PLUS:
+                /* At this point we don't know is it DVI or HDMI or DP++,
                  * assume DVI.*/
                 link->dpcd_caps.dongle_type = DISPLAY_DONGLE_DP_DVI_CONVERTER;
                 break;
@@ -2258,6 +2265,10 @@ static void get_active_converter_info(
                                 det_caps, sizeof(det_caps));
 
                 switch (port_caps->bits.DWN_STRM_PORTX_TYPE) {
+                /*Handle DP case as DONGLE_NONE*/
+                case DOWN_STREAM_DETAILED_DP:
+                        link->dpcd_caps.dongle_type = DISPLAY_DONGLE_NONE;
+                        break;
                 case DOWN_STREAM_DETAILED_VGA:
                         link->dpcd_caps.dongle_type =
                                 DISPLAY_DONGLE_DP_VGA_CONVERTER;
@@ -2267,6 +2278,8 @@ static void get_active_converter_info(
                                 DISPLAY_DONGLE_DP_DVI_CONVERTER;
                         break;
                 case DOWN_STREAM_DETAILED_HDMI:
+                case DOWN_STREAM_DETAILED_DP_PLUS_PLUS:
+                        /*Handle DP++ active converter case, process DP++ case as HDMI case according DP1.4 spec*/
                         link->dpcd_caps.dongle_type =
                                 DISPLAY_DONGLE_DP_HDMI_CONVERTER;
 
@@ -2282,14 +2295,18 @@ static void get_active_converter_info(
 
                                 link->dpcd_caps.dongle_caps.is_dp_hdmi_s3d_converter =
                                         hdmi_caps.bits.FRAME_SEQ_TO_FRAME_PACK;
-                                link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr422_pass_through =
-                                        hdmi_caps.bits.YCrCr422_PASS_THROUGH;
-                                link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr420_pass_through =
-                                        hdmi_caps.bits.YCrCr420_PASS_THROUGH;
-                                link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr422_converter =
-                                        hdmi_caps.bits.YCrCr422_CONVERSION;
-                                link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr420_converter =
-                                        hdmi_caps.bits.YCrCr420_CONVERSION;
+                                /*YCBCR capability only for HDMI case*/
+                                if (port_caps->bits.DWN_STRM_PORTX_TYPE
+                                                == DOWN_STREAM_DETAILED_HDMI) {
+                                        link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr422_pass_through =
+                                                        hdmi_caps.bits.YCrCr422_PASS_THROUGH;
+                                        link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr420_pass_through =
+                                                        hdmi_caps.bits.YCrCr420_PASS_THROUGH;
+                                        link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr422_converter =
+                                                        hdmi_caps.bits.YCrCr422_CONVERSION;
+                                        link->dpcd_caps.dongle_caps.is_dp_hdmi_ycbcr420_converter =
+                                                        hdmi_caps.bits.YCrCr420_CONVERSION;
+                                }
 
                                 link->dpcd_caps.dongle_caps.dp_hdmi_max_bpc =
                                         translate_dpcd_max_bpc(
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 51a78283a86d..2ceaab4fb5de 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -258,7 +258,7 @@ bool resource_construct(
                  * PORT_CONNECTIVITY == 1 (as instructed by HW team).
                  */
                 update_num_audio(&straps, &num_audio, &pool->audio_support);
-                for (i = 0; i < pool->pipe_count && i < num_audio; i++) {
+                for (i = 0; i < caps->num_audio; i++) {
                         struct audio *aud = create_funcs->create_audio(ctx, i);
 
                         if (aud == NULL) {
@@ -1669,6 +1669,12 @@ static struct audio *find_first_free_audio(
                         return pool->audios[i];
                 }
         }
+
+    /* use engine id to find free audio */
+        if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
+                return pool->audios[id];
+        }
+
         /*not found the matching one, first come first serve*/
         for (i = 0; i < pool->audio_count; i++) {
                 if (res_ctx->is_audio_acquired[i] == false) {
@@ -1833,6 +1839,7 @@ static int get_norm_pix_clk(const struct dc_crtc_timing *timing)
                 pix_clk /= 2;
         if (timing->pixel_encoding != PIXEL_ENCODING_YCBCR422) {
                 switch (timing->display_color_depth) {
+                case COLOR_DEPTH_666:
                 case COLOR_DEPTH_888:
                         normalized_pix_clk = pix_clk;
                         break;
@@ -1979,7 +1986,7 @@ enum dc_status resource_map_pool_resources(
         /* TODO: Add check if ASIC support and EDID audio */
         if (!stream->converter_disable_audio &&
             dc_is_audio_capable_signal(pipe_ctx->stream->signal) &&
-            stream->audio_info.mode_count) {
+            stream->audio_info.mode_count && stream->audio_info.flags.all) {
                 pipe_ctx->stream_res.audio = find_first_free_audio(
                 &context->res_ctx, pool, pipe_ctx->stream_res.stream_enc->id);
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index af7f8be230f7..352862370390 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -612,7 +612,8 @@ bool dc_stream_set_dynamic_metadata(struct dc *dc,
 
         pipe_ctx->stream->dmdata_address = attr->address;
 
-        if (pipe_ctx->stream_res.stream_enc->funcs->set_dynamic_metadata != NULL) {
+        if (pipe_ctx->stream_res.stream_enc &&
+                        pipe_ctx->stream_res.stream_enc->funcs->set_dynamic_metadata != NULL) {
                 if (pipe_ctx->stream->dmdata_address.quad_part != 0) {
                         /* if using dynamic meta, don't set up generic infopackets */
                         pipe_ctx->stream_res.encoder_info_frame.hdrsmd.valid = false;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
index f8903bcabe49..58bd131d5b48 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
@@ -239,6 +239,10 @@ static void dmcu_set_backlight_level(
         s2 |= (backlight_8_bit << ATOM_S2_CURRENT_BL_LEVEL_SHIFT);
 
         REG_WRITE(BIOS_SCRATCH_2, s2);
+
+        /* waitDMCUReadyForCmd */
+        REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT,
+                        0, 1, 80000);
 }
 
 static void dce_abm_init(struct abm *abm)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 858a58856ebd..fafb4b470140 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -965,11 +965,17 @@ void hwss_edp_backlight_control(
 void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
 {
         /* notify audio driver for audio modes of monitor */
-        struct dc *core_dc = pipe_ctx->stream->ctx->dc;
+        struct dc *core_dc;
         struct pp_smu_funcs *pp_smu = NULL;
-        struct clk_mgr *clk_mgr = core_dc->clk_mgr;
+        struct clk_mgr *clk_mgr;
         unsigned int i, num_audio = 1;
 
+        if (!pipe_ctx->stream)
+                return;
+
+        core_dc = pipe_ctx->stream->ctx->dc;
+        clk_mgr = core_dc->clk_mgr;
+
         if (pipe_ctx->stream_res.audio && pipe_ctx->stream_res.audio->enabled == true)
                 return;
 
@@ -999,9 +1005,15 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
 
 void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
 {
-        struct dc *dc = pipe_ctx->stream->ctx->dc;
+        struct dc *dc;
         struct pp_smu_funcs *pp_smu = NULL;
-        struct clk_mgr *clk_mgr = dc->clk_mgr;
+        struct clk_mgr *clk_mgr;
+
+        if (!pipe_ctx || !pipe_ctx->stream)
+                return;
+
+        dc = pipe_ctx->stream->ctx->dc;
+        clk_mgr = dc->clk_mgr;
 
         if (pipe_ctx->stream_res.audio && pipe_ctx->stream_res.audio->enabled == false)
                 return;
@@ -1009,6 +1021,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
         pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
                         pipe_ctx->stream_res.stream_enc, true);
         if (pipe_ctx->stream_res.audio) {
+                pipe_ctx->stream_res.audio->enabled = false;
+
                 if (dc->res_pool->pp_smu)
                         pp_smu = dc->res_pool->pp_smu;
 
@@ -1039,8 +1053,6 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
                 /* dal_audio_disable_azalia_audio_jack_presence(stream->audio,
                  * stream->stream_engine_id);
                  */
-                if (pipe_ctx->stream_res.audio)
-                        pipe_ctx->stream_res.audio->enabled = false;
         }
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index e50a696fcb5d..2118ea21d7e9 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -1195,16 +1195,7 @@ static void dcn10_init_hw(struct dc *dc)
          * everything down.
          */
         if (dcb->funcs->is_accelerated_mode(dcb) || dc->config.power_down_display_on_boot) {
-                for (i = 0; i < dc->res_pool->pipe_count; i++) {
-                        struct hubp *hubp = dc->res_pool->hubps[i];
-                        struct dpp *dpp = dc->res_pool->dpps[i];
-
-                        hubp->funcs->hubp_init(hubp);
-                        dc->res_pool->opps[i]->mpc_tree_params.opp_id = dc->res_pool->opps[i]->inst;
-                        plane_atomic_power_down(dc, dpp, hubp);
-                }
-
-                apply_DEGVIDCN10_253_wa(dc);
+                dc->hwss.init_pipes(dc, dc->current_state);
         }
 
         for (i = 0; i < dc->res_pool->audio_count; i++) {
@@ -1375,10 +1366,6 @@ static bool dcn10_set_input_transfer_func(struct pipe_ctx *pipe_ctx,
         return result;
 }
 
-
-
-
-
 static bool
 dcn10_set_output_transfer_func(struct pipe_ctx *pipe_ctx,
                                const struct dc_stream_state *stream)
@@ -2516,6 +2503,12 @@ static void dcn10_apply_ctx_for_surface(
                 if (removed_pipe[i])
                         dcn10_disable_plane(dc, &dc->current_state->res_ctx.pipe_ctx[i]);
 
+        for (i = 0; i < dc->res_pool->pipe_count; i++)
+                if (removed_pipe[i]) {
+                        dc->hwss.optimize_bandwidth(dc, context);
+                        break;
+                }
+
         if (dc->hwseq->wa.DEGVIDCN10_254)
                 hubbub1_wm_change_req_wa(dc->res_pool->hubbub);
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
index 1a20461c2937..a12530a3ab9c 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
@@ -508,7 +508,7 @@ static const struct resource_caps rv2_res_cap = {
                 .num_audio = 3,
                 .num_stream_encoder = 3,
                 .num_pll = 3,
-                .num_ddc = 3,
+                .num_ddc = 4,
 };
 
 static const struct dc_plane_cap plane_cap = {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
index 51a3dfe97f0e..31aa6ee5cd5b 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
@@ -102,14 +102,19 @@ void dccg2_init(struct dccg *dccg)
         switch (dccg_dcn->base.ctx->dc->res_pool->pipe_count) {
         case 6:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[5], 1);
+                /* Fall through */
         case 5:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[4], 1);
+                /* Fall through */
         case 4:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[3], 1);
+                /* Fall through */
         case 3:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[2], 1);
+                /* Fall through */
         case 2:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[1], 1);
+                /* Fall through */
         case 1:
                 REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_DB_EN[0], 1);
                 break;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c
index ece6e136437b..6e2dbd03f9bf 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c
@@ -337,6 +337,7 @@ static enum dcn_hubbub_page_table_block_size page_table_block_size_to_hw(unsigne
                 break;
         default:
                 ASSERT(false);
+                block_size = page_table_block_size;
                 break;
         }
 
@@ -366,25 +367,24 @@ int hubbub2_init_dchub_sys_ctx(struct hubbub *hubbub,
         struct dcn_vmid_page_table_config phys_config;
 
         REG_SET(DCN_VM_FB_LOCATION_BASE, 0,
-                        FB_BASE, pa_config->system_aperture.fb_base);
+                        FB_BASE, pa_config->system_aperture.fb_base >> 24);
         REG_SET(DCN_VM_FB_LOCATION_TOP, 0,
-                        FB_TOP, pa_config->system_aperture.fb_top);
+                        FB_TOP, pa_config->system_aperture.fb_top >> 24);
         REG_SET(DCN_VM_FB_OFFSET, 0,
-                        FB_OFFSET, pa_config->system_aperture.fb_offset);
+                        FB_OFFSET, pa_config->system_aperture.fb_offset >> 24);
         REG_SET(DCN_VM_AGP_BOT, 0,
-                        AGP_BOT, pa_config->system_aperture.agp_bot);
+                        AGP_BOT, pa_config->system_aperture.agp_bot >> 24);
         REG_SET(DCN_VM_AGP_TOP, 0,
-                        AGP_TOP, pa_config->system_aperture.agp_top);
+                        AGP_TOP, pa_config->system_aperture.agp_top >> 24);
         REG_SET(DCN_VM_AGP_BASE, 0,
-                        AGP_BASE, pa_config->system_aperture.agp_base);
+                        AGP_BASE, pa_config->system_aperture.agp_base >> 24);
 
         if (pa_config->gart_config.page_table_start_addr != pa_config->gart_config.page_table_end_addr) {
-                phys_config.depth = 1;
-                phys_config.block_size = 4096;
                 phys_config.page_table_start_addr = pa_config->gart_config.page_table_start_addr >> 12;
                 phys_config.page_table_end_addr = pa_config->gart_config.page_table_end_addr >> 12;
                 phys_config.page_table_base_addr = pa_config->gart_config.page_table_base_addr;
-
+                phys_config.depth = 0;
+                phys_config.block_size = 0;
                 // Init VMID 0 based on PA config
                 dcn20_vmid_setup(&hubbub1->vmid[0], &phys_config);
         }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 0b84a322b8a2..d810c8940129 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1153,8 +1153,8 @@ void dcn20_enable_plane(
 
                 apt.sys_default.quad_part = 0;
 
-                apt.sys_high.quad_part = dc->vm_pa_config.system_aperture.start_addr;
-                apt.sys_low.quad_part = dc->vm_pa_config.system_aperture.end_addr;
+                apt.sys_low.quad_part = dc->vm_pa_config.system_aperture.start_addr;
+                apt.sys_high.quad_part = dc->vm_pa_config.system_aperture.end_addr;
 
                 // Program system aperture settings
                 pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt);
@@ -1242,6 +1242,8 @@ void dcn20_pipe_control_lock_global(
                                 CRTC_STATE_VACTIVE);
                 pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg,
                                 CRTC_STATE_VBLANK);
+                pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg,
+                                CRTC_STATE_VACTIVE);
                 pipe->stream_res.tg->funcs->lock_doublebuffer_disable(
                                 pipe->stream_res.tg);
         }
@@ -1263,6 +1265,17 @@ void dcn20_pipe_control_lock(
         if (pipe->plane_state != NULL)
                 flip_immediate = pipe->plane_state->flip_immediate;
 
+        if (flip_immediate && lock) {
+                while (pipe->plane_res.hubp->funcs->hubp_is_flip_pending(pipe->plane_res.hubp)) {
+                        udelay(1);
+                }
+
+                if (pipe->bottom_pipe != NULL)
+                        while (pipe->bottom_pipe->plane_res.hubp->funcs->hubp_is_flip_pending(pipe->bottom_pipe->plane_res.hubp))       {
+                                udelay(1);
+                        }
+        }
+
         /* In flip immediate and pipe splitting case, we need to use GSL
          * for synchronization. Only do setup on locking and on flip type change.
          */
@@ -1740,8 +1753,11 @@ static void dcn20_reset_back_end_for_pipe(
                 else if (pipe_ctx->stream_res.audio) {
                         dc->hwss.disable_audio_stream(pipe_ctx, FREE_ACQUIRED_RESOURCE);
                 }
-
         }
+#ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
+        else if (pipe_ctx->stream_res.dsc)
+                dp_set_dsc_enable(pipe_ctx, false);
+#endif
 
         /* by upper caller loop, parent pipe: pipe0, will be reset last.
          * back end share by all pipes and will be disable only when disable
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
index 26a66ccf6e72..1ae973962d53 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
@@ -535,7 +535,7 @@ void dcn20_timing_generator_init(struct optc *optc1)
         optc1->min_h_blank = 32;
         optc1->min_v_blank = 3;
         optc1->min_v_blank_interlace = 5;
-        optc1->min_h_sync_width = 8;
+        optc1->min_h_sync_width = 4;//  Minimum HSYNC = 8 pixels asked By HW in the first place for no actual reason. Oculus Rift S will not light up with 8 as it's hsyncWidth is 6. Changing it to 4 to fix that issue.
         optc1->min_v_sync_width = 1;
         optc1->comb_opp_id = 0xf;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index d200bc3cec71..b949e202d6cb 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2643,6 +2643,10 @@ static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_
 
         if (dc->bb_overrides.min_dcfclk_mhz > 0)
                 min_dcfclk = dc->bb_overrides.min_dcfclk_mhz;
+        else
+                // Accounting for SOC/DCF relationship, we can go as high as
+                // 506Mhz in Vmin.  We need to code 507 since SMU will round down to 506.
+                min_dcfclk = 507;
 
         for (i = 0; i < num_states; i++) {
                 int min_fclk_required_by_uclk;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_vmid.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_vmid.c
index 27679ef6ebe8..96c263223315 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_vmid.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_vmid.c
@@ -23,6 +23,8 @@
  *
  */
 
+#include <linux/delay.h>
+
 #include "dcn20_vmid.h"
 #include "reg_helper.h"
 
@@ -36,6 +38,38 @@
 #define FN(reg_name, field_name) \
         vmid->shifts->field_name, vmid->masks->field_name
 
+static void dcn20_wait_for_vmid_ready(struct dcn20_vmid *vmid)
+{
+        /* According the hardware spec, we need to poll for the lowest
+         * bit of PAGE_TABLE_BASE_ADDR_LO32 = 1 any time a GPUVM
+         * context is updated. We can't use REG_WAIT here since we
+         * don't have a seperate field to wait on.
+         *
+         * TODO: Confirm timeout / poll interval with hardware team
+         */
+
+        int max_times = 10000;
+        int delay_us  = 5;
+        int i;
+
+        for (i = 0; i < max_times; ++i) {
+                uint32_t entry_lo32;
+
+                REG_GET(PAGE_TABLE_BASE_ADDR_LO32,
+                        VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_LO32,
+                        &entry_lo32);
+
+                if (entry_lo32 & 0x1)
+                        return;
+
+                udelay(delay_us);
+        }
+
+        /* VM setup timed out */
+        DC_LOG_WARNING("Timeout while waiting for GPUVM context update\n");
+        ASSERT(0);
+}
+
 void dcn20_vmid_setup(struct dcn20_vmid *vmid, const struct dcn_vmid_page_table_config *config)
 {
         REG_SET(PAGE_TABLE_START_ADDR_HI32, 0,
@@ -54,6 +88,9 @@ void dcn20_vmid_setup(struct dcn20_vmid *vmid, const struct dcn_vmid_page_table_
 
         REG_SET(PAGE_TABLE_BASE_ADDR_HI32, 0,
                         VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_HI32, (config->page_table_base_addr >> 32) & 0xFFFFFFFF);
+        /* Note: per hardware spec PAGE_TABLE_BASE_ADDR_LO32 must be programmed last in sequence */
         REG_SET(PAGE_TABLE_BASE_ADDR_LO32, 0,
                         VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_LO32, config->page_table_base_addr & 0xFFFFFFFF);
+
+        dcn20_wait_for_vmid_ready(vmid);
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dsc/drm_dsc_dc.c b/drivers/gpu/drm/amd/display/dc/dsc/drm_dsc_dc.c
index 67089765780b..340ef4d41ebd 100644
--- a/drivers/gpu/drm/amd/display/dc/dsc/drm_dsc_dc.c
+++ b/drivers/gpu/drm/amd/display/dc/dsc/drm_dsc_dc.c
@@ -377,6 +377,12 @@ int drm_dsc_compute_rc_parameters(struct drm_dsc_config *vdsc_cfg)
         vdsc_cfg->rc_bits = (hrd_delay * vdsc_cfg->bits_per_pixel) / 16;
         vdsc_cfg->initial_dec_delay = hrd_delay - vdsc_cfg->initial_xmit_delay;
 
+        /* As per DSC spec v1.2a recommendation: */
+        if (vdsc_cfg->native_420)
+                vdsc_cfg->second_line_offset_adj = 512;
+        else
+                vdsc_cfg->second_line_offset_adj = 0;
+
         return 0;
 }
 EXPORT_SYMBOL(drm_dsc_compute_rc_parameters);
diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
index c89393c19232..a148ffde8b12 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
@@ -212,7 +212,7 @@ struct resource_pool {
         struct clock_source *clock_sources[MAX_CLOCK_SOURCES];
         unsigned int clk_src_count;
 
-        struct audio *audios[MAX_PIPES];
+        struct audio *audios[MAX_AUDIOS];
         unsigned int audio_count;
         struct audio_support audio_support;
 
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h
index 959f5b654611..9502478c4a1b 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h
@@ -61,8 +61,8 @@ enum dcn_hubbub_page_table_depth {
 };
 
 enum dcn_hubbub_page_table_block_size {
-        DCN_PAGE_TABLE_BLOCK_SIZE_4KB,
-        DCN_PAGE_TABLE_BLOCK_SIZE_64KB
+        DCN_PAGE_TABLE_BLOCK_SIZE_4KB = 0,
+        DCN_PAGE_TABLE_BLOCK_SIZE_64KB = 4,
 };
 
 struct dcn_hubbub_phys_addr_config {
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
index 8759ec03aede..f82365e2d03c 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
@@ -34,6 +34,7 @@
  * Data types shared between different Virtual HW blocks
  ******************************************************************************/
 
+#define MAX_AUDIOS 7
 #define MAX_PIPES 6
 #if defined(CONFIG_DRM_AMD_DC_DCN2_0)
 #define MAX_DWB_PIPES   1
diff --git a/drivers/gpu/drm/amd/display/include/dpcd_defs.h b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
index 1c66166d0a94..2c90d1b46c8b 100644
--- a/drivers/gpu/drm/amd/display/include/dpcd_defs.h
+++ b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
@@ -43,7 +43,7 @@ enum dpcd_revision {
 enum dpcd_downstream_port_type {
         DOWNSTREAM_DP = 0,
         DOWNSTREAM_VGA,
-        DOWNSTREAM_DVI_HDMI,
+        DOWNSTREAM_DVI_HDMI_DP_PLUS_PLUS,/* DVI, HDMI, DP++ */
         DOWNSTREAM_NONDDC /* has no EDID (TV,CV) */
 };
 
diff --git a/drivers/gpu/drm/amd/include/kgd_pp_interface.h b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
index 9f661bf96ed0..5b1ebb7f995a 100644
--- a/drivers/gpu/drm/amd/include/kgd_pp_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
@@ -123,6 +123,7 @@ enum amd_pp_sensors {
         AMDGPU_PP_SENSOR_ENABLED_SMC_FEATURES_MASK,
         AMDGPU_PP_SENSOR_MIN_FAN_RPM,
         AMDGPU_PP_SENSOR_MAX_FAN_RPM,
+        AMDGPU_PP_SENSOR_VCN_POWER_STATE,
 };
 
 enum amd_pp_task {
diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index f1565c448de5..0685a3388e38 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -137,12 +137,37 @@ int smu_get_dpm_freq_range(struct smu_context *smu, enum smu_clk_type clk_type,
 {
         int ret = 0, clk_id = 0;
         uint32_t param = 0;
+        uint32_t clock_limit;
 
         if (!min && !max)
                 return -EINVAL;
 
-        if (!smu_clk_dpm_is_enabled(smu, clk_type))
+        if (!smu_clk_dpm_is_enabled(smu, clk_type)) {
+                switch (clk_type) {
+                case SMU_MCLK:
+                case SMU_UCLK:
+                        clock_limit = smu->smu_table.boot_values.uclk;
+                        break;
+                case SMU_GFXCLK:
+                case SMU_SCLK:
+                        clock_limit = smu->smu_table.boot_values.gfxclk;
+                        break;
+                case SMU_SOCCLK:
+                        clock_limit = smu->smu_table.boot_values.socclk;
+                        break;
+                default:
+                        clock_limit = 0;
+                        break;
+                }
+
+                /* clock in Mhz unit */
+                if (min)
+                        *min = clock_limit / 100;
+                if (max)
+                        *max = clock_limit / 100;
+
                 return 0;
+        }
 
         mutex_lock(&smu->mutex);
         clk_id = smu_clk_get_index(smu, clk_type);
@@ -281,7 +306,8 @@ int smu_get_power_num_states(struct smu_context *smu,
 
         /* not support power state */
         memset(state_info, 0, sizeof(struct pp_states_info));
-        state_info->nums = 0;
+        state_info->nums = 1;
+        state_info->states[0] = POWER_STATE_TYPE_DEFAULT;
 
         return 0;
 }
@@ -312,6 +338,10 @@ int smu_common_read_sensor(struct smu_context *smu, enum amd_pp_sensors sensor,
                 *(uint32_t *)data = smu_feature_is_enabled(smu, SMU_FEATURE_DPM_VCE_BIT) ? 1 : 0;
                 *size = 4;
                 break;
+        case AMDGPU_PP_SENSOR_VCN_POWER_STATE:
+                *(uint32_t *)data = smu_feature_is_enabled(smu, SMU_FEATURE_VCN_PG_BIT) ? 1 : 0;
+                *size = 4;
+                break;
         default:
                 ret = -EINVAL;
                 break;
@@ -698,6 +728,12 @@ static int smu_sw_init(void *handle)
                 return ret;
         }
 
+        ret = smu_register_irq_handler(smu);
+        if (ret) {
+                pr_err("Failed to register smc irq handler!\n");
+                return ret;
+        }
+
         return 0;
 }
 
@@ -707,6 +743,9 @@ static int smu_sw_fini(void *handle)
         struct smu_context *smu = &adev->smu;
         int ret;
 
+        kfree(smu->irq_source);
+        smu->irq_source = NULL;
+
         ret = smu_smc_table_sw_fini(smu);
         if (ret) {
                 pr_err("Failed to sw fini smc table!\n");
@@ -1063,10 +1102,6 @@ static int smu_hw_init(void *handle)
         if (ret)
                 goto failed;
 
-        ret = smu_register_irq_handler(smu);
-        if (ret)
-                goto failed;
-
         if (!smu->pm_enabled)
                 adev->pm.dpm_enabled = false;
         else
@@ -1096,9 +1131,6 @@ static int smu_hw_fini(void *handle)
         kfree(table_context->overdrive_table);
         table_context->overdrive_table = NULL;
 
-        kfree(smu->irq_source);
-        smu->irq_source = NULL;
-
         ret = smu_fini_fb_allocations(smu);
         if (ret)
                 return ret;
@@ -1349,13 +1381,49 @@ static int smu_enable_umd_pstate(void *handle,
         return 0;
 }
 
+static int smu_default_set_performance_level(struct smu_context *smu, enum amd_dpm_forced_level level)
+{
+        int ret = 0;
+        uint32_t sclk_mask, mclk_mask, soc_mask;
+
+        switch (level) {
+        case AMD_DPM_FORCED_LEVEL_HIGH:
+                ret = smu_force_dpm_limit_value(smu, true);
+                break;
+        case AMD_DPM_FORCED_LEVEL_LOW:
+                ret = smu_force_dpm_limit_value(smu, false);
+                break;
+        case AMD_DPM_FORCED_LEVEL_AUTO:
+        case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+                ret = smu_unforce_dpm_levels(smu);
+                break;
+        case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+        case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+        case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+                ret = smu_get_profiling_clk_mask(smu, level,
+                                                 &sclk_mask,
+                                                 &mclk_mask,
+                                                 &soc_mask);
+                if (ret)
+                        return ret;
+                smu_force_clk_levels(smu, SMU_SCLK, 1 << sclk_mask);
+                smu_force_clk_levels(smu, SMU_MCLK, 1 << mclk_mask);
+                smu_force_clk_levels(smu, SMU_SOCCLK, 1 << soc_mask);
+                break;
+        case AMD_DPM_FORCED_LEVEL_MANUAL:
+        case AMD_DPM_FORCED_LEVEL_PROFILE_EXIT:
+        default:
+                break;
+        }
+        return ret;
+}
+
 int smu_adjust_power_state_dynamic(struct smu_context *smu,
                                    enum amd_dpm_forced_level level,
                                    bool skip_display_settings)
 {
         int ret = 0;
         int index = 0;
-        uint32_t sclk_mask, mclk_mask, soc_mask;
         long workload;
         struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
 
@@ -1386,39 +1454,10 @@ int smu_adjust_power_state_dynamic(struct smu_context *smu,
         }
 
         if (smu_dpm_ctx->dpm_level != level) {
-                switch (level) {
-                case AMD_DPM_FORCED_LEVEL_HIGH:
-                        ret = smu_force_dpm_limit_value(smu, true);
-                        break;
-                case AMD_DPM_FORCED_LEVEL_LOW:
-                        ret = smu_force_dpm_limit_value(smu, false);
-                        break;
-
-                case AMD_DPM_FORCED_LEVEL_AUTO:
-                case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
-                        ret = smu_unforce_dpm_levels(smu);
-                        break;
-
-                case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
-                case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
-                case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
-                        ret = smu_get_profiling_clk_mask(smu, level,
-                                                         &sclk_mask,
-                                                         &mclk_mask,
-                                                         &soc_mask);
-                        if (ret)
-                                return ret;
-                        smu_force_clk_levels(smu, SMU_SCLK, 1 << sclk_mask);
-                        smu_force_clk_levels(smu, SMU_MCLK, 1 << mclk_mask);
-                        smu_force_clk_levels(smu, SMU_SOCCLK, 1 << soc_mask);
-                        break;
-
-                case AMD_DPM_FORCED_LEVEL_MANUAL:
-                case AMD_DPM_FORCED_LEVEL_PROFILE_EXIT:
-                default:
-                        break;
+                ret = smu_asic_set_performance_level(smu, level);
+                if (ret) {
+                        ret = smu_default_set_performance_level(smu, level);
                 }
-
                 if (!ret)
                         smu_dpm_ctx->dpm_level = level;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
index e32ae9d3373c..18e780f566fa 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
@@ -1111,6 +1111,7 @@ static int smu10_thermal_get_temperature(struct pp_hwmgr *hwmgr)
 static int smu10_read_sensor(struct pp_hwmgr *hwmgr, int idx,
                           void *value, int *size)
 {
+        struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend);
         uint32_t sclk, mclk;
         int ret = 0;
 
@@ -1132,6 +1133,10 @@ static int smu10_read_sensor(struct pp_hwmgr *hwmgr, int idx,
         case AMDGPU_PP_SENSOR_GPU_TEMP:
                 *((uint32_t *)value) = smu10_thermal_get_temperature(hwmgr);
                 break;
+        case AMDGPU_PP_SENSOR_VCN_POWER_STATE:
+                *(uint32_t *)value =  smu10_data->vcn_power_gated ? 0 : 1;
+                *size = 4;
+                break;
         default:
                 ret = -EINVAL;
                 break;
@@ -1175,18 +1180,22 @@ static int smu10_powergate_sdma(struct pp_hwmgr *hwmgr, bool gate)
 
 static void smu10_powergate_vcn(struct pp_hwmgr *hwmgr, bool bgate)
 {
+        struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend);
+
         if (bgate) {
                 amdgpu_device_ip_set_powergating_state(hwmgr->adev,
                                                 AMD_IP_BLOCK_TYPE_VCN,
                                                 AMD_PG_STATE_GATE);
                 smum_send_msg_to_smc_with_parameter(hwmgr,
                                         PPSMC_MSG_PowerDownVcn, 0);
+                smu10_data->vcn_power_gated = true;
         } else {
                 smum_send_msg_to_smc_with_parameter(hwmgr,
                                                 PPSMC_MSG_PowerUpVcn, 0);
                 amdgpu_device_ip_set_powergating_state(hwmgr->adev,
                                                 AMD_IP_BLOCK_TYPE_VCN,
                                                 AMD_PG_STATE_UNGATE);
+                smu10_data->vcn_power_gated = false;
         }
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
index 1af992fb0bde..208e6711d506 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
@@ -429,7 +429,6 @@ struct smu_table_context
         struct smu_table                *tables;
         uint32_t                        table_count;
         struct smu_table                memory_pool;
-        uint16_t                        software_shutdown_temp;
         uint8_t                         thermal_controller_type;
         uint16_t                        TDPODLimit;
 
@@ -613,6 +612,7 @@ struct pptable_funcs {
         int (*tables_init)(struct smu_context *smu, struct smu_table *tables);
         int (*set_thermal_fan_table)(struct smu_context *smu);
         int (*get_fan_speed_percent)(struct smu_context *smu, uint32_t *speed);
+        int (*get_fan_speed_rpm)(struct smu_context *smu, uint32_t *speed);
         int (*set_watermarks_table)(struct smu_context *smu, void *watermarks,
                                     struct dm_pp_wm_sets_with_clock_ranges_soc15 *clock_ranges);
         int (*get_current_clk_freq_by_table)(struct smu_context *smu,
@@ -621,6 +621,7 @@ struct pptable_funcs {
         int (*get_thermal_temperature_range)(struct smu_context *smu, struct smu_temperature_range *range);
         int (*get_uclk_dpm_states)(struct smu_context *smu, uint32_t *clocks_in_khz, uint32_t *num_states);
         int (*set_default_od_settings)(struct smu_context *smu, bool initialize);
+        int (*set_performance_level)(struct smu_context *smu, enum amd_dpm_forced_level level);
 };
 
 struct smu_funcs
@@ -685,7 +686,6 @@ struct smu_funcs
         int (*set_watermarks_for_clock_ranges)(struct smu_context *smu,
                                                struct dm_pp_wm_sets_with_clock_ranges_soc15 *clock_ranges);
         int (*conv_power_profile_to_pplib_workload)(int power_profile);
-        int (*get_current_rpm)(struct smu_context *smu, uint32_t *speed);
         uint32_t (*get_fan_control_mode)(struct smu_context *smu);
         int (*set_fan_control_mode)(struct smu_context *smu, uint32_t mode);
         int (*set_fan_speed_percent)(struct smu_context *smu, uint32_t speed);
@@ -751,8 +751,6 @@ struct smu_funcs
         ((smu)->funcs->init_max_sustainable_clocks ? (smu)->funcs->init_max_sustainable_clocks((smu)) : 0)
 #define smu_set_default_od_settings(smu, initialize) \
         ((smu)->ppt_funcs->set_default_od_settings ? (smu)->ppt_funcs->set_default_od_settings((smu), (initialize)) : 0)
-#define smu_get_current_rpm(smu, speed) \
-        ((smu)->funcs->get_current_rpm ? (smu)->funcs->get_current_rpm((smu), (speed)) : 0)
 #define smu_set_fan_speed_rpm(smu, speed) \
         ((smu)->funcs->set_fan_speed_rpm ? (smu)->funcs->set_fan_speed_rpm((smu), (speed)) : 0)
 #define smu_send_smc_msg(smu, msg) \
@@ -841,6 +839,8 @@ struct smu_funcs
         ((smu)->ppt_funcs->get_fan_speed_percent ? (smu)->ppt_funcs->get_fan_speed_percent((smu), (speed)) : 0)
 #define smu_set_fan_speed_percent(smu, speed) \
         ((smu)->funcs->set_fan_speed_percent ? (smu)->funcs->set_fan_speed_percent((smu), (speed)) : 0)
+#define smu_get_fan_speed_rpm(smu, speed) \
+        ((smu)->ppt_funcs->get_fan_speed_rpm ? (smu)->ppt_funcs->get_fan_speed_rpm((smu), (speed)) : 0)
 
 #define smu_msg_get_index(smu, msg) \
         ((smu)->ppt_funcs? ((smu)->ppt_funcs->get_smu_msg_index? (smu)->ppt_funcs->get_smu_msg_index((smu), (msg)) : -EINVAL) : -EINVAL)
@@ -918,6 +918,9 @@ struct smu_funcs
         ((smu)->funcs->baco_get_state? (smu)->funcs->baco_get_state((smu), (state)) : 0)
 #define smu_baco_reset(smu) \
         ((smu)->funcs->baco_reset? (smu)->funcs->baco_reset((smu)) : 0)
+#define smu_asic_set_performance_level(smu, level) \
+        ((smu)->ppt_funcs->set_performance_level? (smu)->ppt_funcs->set_performance_level((smu), (level)) : -EINVAL);
+
 
 extern int smu_get_atom_data_table(struct smu_context *smu, uint32_t table,
                                    uint16_t *size, uint8_t *frev, uint8_t *crev,
diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
index 2dae0ae0829e..cc0a3b2256af 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
@@ -23,6 +23,7 @@
 
 #include "pp_debug.h"
 #include <linux/firmware.h>
+#include <linux/pci.h>
 #include "amdgpu.h"
 #include "amdgpu_smu.h"
 #include "atomfirmware.h"
@@ -577,28 +578,20 @@ static int navi10_set_default_dpm_table(struct smu_context *smu)
 static int navi10_dpm_set_uvd_enable(struct smu_context *smu, bool enable)
 {
         int ret = 0;
-        struct smu_power_context *smu_power = &smu->smu_power;
-        struct smu_power_gate *power_gate = &smu_power->power_gate;
 
-        if (enable && power_gate->uvd_gated) {
-                if (smu_feature_is_enabled(smu, SMU_FEATURE_DPM_UVD_BIT)) {
-                        ret = smu_send_smc_msg_with_param(smu, SMU_MSG_PowerUpVcn, 1);
-                        if (ret)
-                                return ret;
-                }
-                power_gate->uvd_gated = false;
+        if (enable) {
+                ret = smu_send_smc_msg_with_param(smu, SMU_MSG_PowerUpVcn, 1);
+                if (ret)
+                        return ret;
         } else {
-                if (!enable && !power_gate->uvd_gated) {
-                        if (smu_feature_is_enabled(smu, SMU_FEATURE_DPM_UVD_BIT)) {
-                                ret = smu_send_smc_msg(smu, SMU_MSG_PowerDownVcn);
-                                if (ret)
-                                        return ret;
-                        }
-                        power_gate->uvd_gated = true;
-                }
+                ret = smu_send_smc_msg(smu, SMU_MSG_PowerDownVcn);
+                if (ret)
+                        return ret;
         }
 
-        return 0;
+        ret = smu_feature_set_enabled(smu, SMU_FEATURE_VCN_PG_BIT, enable);
+
+        return ret;
 }
 
 static int navi10_get_current_clk_freq_by_table(struct smu_context *smu,
@@ -626,11 +619,26 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu,
         return ret;
 }
 
+static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type)
+{
+        PPTable_t *pptable = smu->smu_table.driver_pptable;
+        DpmDescriptor_t *dpm_desc = NULL;
+        uint32_t clk_index = 0;
+
+        clk_index = smu_clk_get_index(smu, clk_type);
+        dpm_desc = &pptable->DpmDescriptor[clk_index];
+
+        /* 0 - Fine grained DPM, 1 - Discrete DPM */
+        return dpm_desc->SnapToDiscrete == 0 ? true : false;
+}
+
 static int navi10_print_clk_levels(struct smu_context *smu,
                         enum smu_clk_type clk_type, char *buf)
 {
         int i, size = 0, ret = 0;
         uint32_t cur_value = 0, value = 0, count = 0;
+        uint32_t freq_values[3] = {0};
+        uint32_t mark_index = 0;
 
         switch (clk_type) {
         case SMU_GFXCLK:
@@ -643,22 +651,42 @@ static int navi10_print_clk_levels(struct smu_context *smu,
                 ret = smu_get_current_clk_freq(smu, clk_type, &cur_value);
                 if (ret)
                         return size;
+
                 /* 10KHz -> MHz */
                 cur_value = cur_value / 100;
 
-                size += sprintf(buf, "current clk: %uMhz\n", cur_value);
-
                 ret = smu_get_dpm_level_count(smu, clk_type, &count);
                 if (ret)
                         return size;
 
-                for (i = 0; i < count; i++) {
-                        ret = smu_get_dpm_freq_by_index(smu, clk_type, i, &value);
+                if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) {
+                        for (i = 0; i < count; i++) {
+                                ret = smu_get_dpm_freq_by_index(smu, clk_type, i, &value);
+                                if (ret)
+                                        return size;
+
+                                size += sprintf(buf + size, "%d: %uMhz %s\n", i, value,
+                                                cur_value == value ? "*" : "");
+                        }
+                } else {
+                        ret = smu_get_dpm_freq_by_index(smu, clk_type, 0, &freq_values[0]);
+                        if (ret)
+                                return size;
+                        ret = smu_get_dpm_freq_by_index(smu, clk_type, count - 1, &freq_values[2]);
                         if (ret)
                                 return size;
 
-                        size += sprintf(buf + size, "%d: %uMhz %s\n", i, value,
-                                        cur_value == value ? "*" : "");
+                        freq_values[1] = cur_value;
+                        mark_index = cur_value == freq_values[0] ? 0 :
+                                     cur_value == freq_values[2] ? 2 : 1;
+                        if (mark_index != 1)
+                                freq_values[1] = (freq_values[0] + freq_values[2]) / 2;
+
+                        for (i = 0; i < 3; i++) {
+                                size += sprintf(buf + size, "%d: %uMhz %s\n", i, freq_values[i],
+                                                i == mark_index ? "*" : "");
+                        }
+
                 }
                 break;
         default:
@@ -919,12 +947,13 @@ static bool navi10_is_dpm_running(struct smu_context *smu)
         return !!(feature_enabled & SMC_DPM_FEATURE);
 }
 
-static int navi10_get_fan_speed(struct smu_context *smu, uint16_t *value)
+static int navi10_get_fan_speed_rpm(struct smu_context *smu,
+                                    uint32_t *speed)
 {
         SmuMetrics_t metrics;
         int ret = 0;
 
-        if (!value)
+        if (!speed)
                 return -EINVAL;
 
         memset(&metrics, 0, sizeof(metrics));
@@ -934,7 +963,7 @@ static int navi10_get_fan_speed(struct smu_context *smu, uint16_t *value)
         if (ret)
                 return ret;
 
-        *value = metrics.CurrFanSpeed;
+        *speed = metrics.CurrFanSpeed;
 
         return ret;
 }
@@ -944,10 +973,10 @@ static int navi10_get_fan_speed_percent(struct smu_context *smu,
 {
         int ret = 0;
         uint32_t percent = 0;
-        uint16_t current_rpm;
+        uint32_t current_rpm;
         PPTable_t *pptable = smu->smu_table.driver_pptable;
 
-        ret = navi10_get_fan_speed(smu, &current_rpm);
+        ret = navi10_get_fan_speed_rpm(smu, &current_rpm);
         if (ret)
                 return ret;
 
@@ -1530,6 +1559,76 @@ static int navi10_set_ppfeature_status(struct smu_context *smu,
         return 0;
 }
 
+static int navi10_set_peak_clock_by_device(struct smu_context *smu)
+{
+        struct amdgpu_device *adev = smu->adev;
+        int ret = 0;
+        uint32_t sclk_freq = 0, uclk_freq = 0;
+        uint32_t uclk_level = 0;
+
+        switch (adev->pdev->revision) {
+        case 0xf0: /* XTX */
+        case 0xc0:
+                sclk_freq = NAVI10_PEAK_SCLK_XTX;
+                break;
+        case 0xf1: /* XT */
+        case 0xc1:
+                sclk_freq = NAVI10_PEAK_SCLK_XT;
+                break;
+        default: /* XL */
+                sclk_freq = NAVI10_PEAK_SCLK_XL;
+                break;
+        }
+
+        ret = smu_get_dpm_level_count(smu, SMU_UCLK, &uclk_level);
+        if (ret)
+                return ret;
+        ret = smu_get_dpm_freq_by_index(smu, SMU_UCLK, uclk_level - 1, &uclk_freq);
+        if (ret)
+                return ret;
+
+        ret = smu_set_soft_freq_range(smu, SMU_SCLK, sclk_freq, sclk_freq);
+        if (ret)
+                return ret;
+        ret = smu_set_soft_freq_range(smu, SMU_UCLK, uclk_freq, uclk_freq);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
+static int navi10_set_performance_level(struct smu_context *smu, enum amd_dpm_forced_level level)
+{
+        int ret = 0;
+
+        switch (level) {
+        case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+                ret = navi10_set_peak_clock_by_device(smu);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        return ret;
+}
+
+static int navi10_get_thermal_temperature_range(struct smu_context *smu,
+                                                struct smu_temperature_range *range)
+{
+        struct smu_table_context *table_context = &smu->smu_table;
+        struct smu_11_0_powerplay_table *powerplay_table = table_context->power_play_table;
+
+        if (!range || !powerplay_table)
+                return -EINVAL;
+
+        /* The unit is temperature */
+        range->min = 0;
+        range->max = powerplay_table->software_shutdown_temp;
+
+        return 0;
+}
+
 static const struct pptable_funcs navi10_ppt_funcs = {
         .tables_init = navi10_tables_init,
         .alloc_dpm_context = navi10_allocate_dpm_context,
@@ -1557,6 +1656,7 @@ static const struct pptable_funcs navi10_ppt_funcs = {
         .unforce_dpm_levels = navi10_unforce_dpm_levels,
         .is_dpm_running = navi10_is_dpm_running,
         .get_fan_speed_percent = navi10_get_fan_speed_percent,
+        .get_fan_speed_rpm = navi10_get_fan_speed_rpm,
         .get_power_profile_mode = navi10_get_power_profile_mode,
         .set_power_profile_mode = navi10_set_power_profile_mode,
         .get_profiling_clk_mask = navi10_get_profiling_clk_mask,
@@ -1565,6 +1665,8 @@ static const struct pptable_funcs navi10_ppt_funcs = {
         .get_uclk_dpm_states = navi10_get_uclk_dpm_states,
         .get_ppfeature_status = navi10_get_ppfeature_status,
         .set_ppfeature_status = navi10_set_ppfeature_status,
+        .set_performance_level = navi10_set_performance_level,
+        .get_thermal_temperature_range = navi10_get_thermal_temperature_range,
 };
 
 void navi10_set_ppt_funcs(struct smu_context *smu)
diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.h b/drivers/gpu/drm/amd/powerplay/navi10_ppt.h
index 957288e22f47..620ff17c2fef 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.h
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.h
@@ -23,6 +23,10 @@
 #ifndef __NAVI10_PPT_H__
 #define __NAVI10_PPT_H__
 
+#define NAVI10_PEAK_SCLK_XTX            (1830)
+#define NAVI10_PEAK_SCLK_XT             (1755)
+#define NAVI10_PEAK_SCLK_XL             (1625)
+
 extern void navi10_set_ppt_funcs(struct smu_context *smu);
 
 #endif
diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
index 95c7c4dae523..ac5b26228e75 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
@@ -1124,10 +1124,8 @@ static int smu_v11_0_set_thermal_range(struct smu_context *smu,
                                        struct smu_temperature_range *range)
 {
         struct amdgpu_device *adev = smu->adev;
-        int low = SMU_THERMAL_MINIMUM_ALERT_TEMP *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        int high = SMU_THERMAL_MAXIMUM_ALERT_TEMP *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        int low = SMU_THERMAL_MINIMUM_ALERT_TEMP;
+        int high = SMU_THERMAL_MAXIMUM_ALERT_TEMP;
         uint32_t val;
 
         if (!range)
@@ -1138,6 +1136,9 @@ static int smu_v11_0_set_thermal_range(struct smu_context *smu,
         if (high > range->max)
                 high = range->max;
 
+        low = max(SMU_THERMAL_MINIMUM_ALERT_TEMP, range->min);
+        high = min(SMU_THERMAL_MAXIMUM_ALERT_TEMP, range->max);
+
         if (low > high)
                 return -EINVAL;
 
@@ -1146,8 +1147,8 @@ static int smu_v11_0_set_thermal_range(struct smu_context *smu,
         val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1);
         val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_INTH_MASK, 0);
         val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_INTL_MASK, 0);
-        val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / SMU_TEMPERATURE_UNITS_PER_CENTIGRADES));
-        val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / SMU_TEMPERATURE_UNITS_PER_CENTIGRADES));
+        val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high & 0xff));
+        val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low & 0xff));
         val = val & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK);
 
         WREG32_SOC15(THM, 0, mmTHM_THERMAL_INT_CTRL, val);
@@ -1186,7 +1187,10 @@ static int smu_v11_0_start_thermal_control(struct smu_context *smu)
 
         if (!smu->pm_enabled)
                 return ret;
+
         ret = smu_get_thermal_temperature_range(smu, &range);
+        if (ret)
+                return ret;
 
         if (smu->smu_table.thermal_controller_type) {
                 ret = smu_v11_0_set_thermal_range(smu, &range);
@@ -1202,15 +1206,17 @@ static int smu_v11_0_start_thermal_control(struct smu_context *smu)
                         return ret;
         }
 
-        adev->pm.dpm.thermal.min_temp = range.min;
-        adev->pm.dpm.thermal.max_temp = range.max;
-        adev->pm.dpm.thermal.max_edge_emergency_temp = range.edge_emergency_max;
-        adev->pm.dpm.thermal.min_hotspot_temp = range.hotspot_min;
-        adev->pm.dpm.thermal.max_hotspot_crit_temp = range.hotspot_crit_max;
-        adev->pm.dpm.thermal.max_hotspot_emergency_temp = range.hotspot_emergency_max;
-        adev->pm.dpm.thermal.min_mem_temp = range.mem_min;
-        adev->pm.dpm.thermal.max_mem_crit_temp = range.mem_crit_max;
-        adev->pm.dpm.thermal.max_mem_emergency_temp = range.mem_emergency_max;
+        adev->pm.dpm.thermal.min_temp = range.min * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_temp = range.max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_edge_emergency_temp = range.edge_emergency_max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.min_hotspot_temp = range.hotspot_min * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_hotspot_crit_temp = range.hotspot_crit_max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_hotspot_emergency_temp = range.hotspot_emergency_max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.min_mem_temp = range.mem_min * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_mem_crit_temp = range.mem_crit_max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_mem_emergency_temp = range.mem_emergency_max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.min_temp = range.min * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        adev->pm.dpm.thermal.max_temp = range.max * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
 
         return ret;
 }
@@ -1371,23 +1377,6 @@ static int smu_v11_0_gfx_off_control(struct smu_context *smu, bool enable)
         return ret;
 }
 
-static int smu_v11_0_get_current_rpm(struct smu_context *smu,
-                                     uint32_t *current_rpm)
-{
-        int ret;
-
-        ret = smu_send_smc_msg(smu, SMU_MSG_GetCurrentRpm);
-
-        if (ret) {
-                pr_err("Attempt to get current RPM from SMC Failed!\n");
-                return ret;
-        }
-
-        smu_read_smc_arg(smu, current_rpm);
-
-        return 0;
-}
-
 static uint32_t
 smu_v11_0_get_fan_control_mode(struct smu_context *smu)
 {
@@ -1773,7 +1762,6 @@ static const struct smu_funcs smu_v11_0_funcs = {
         .set_deep_sleep_dcefclk = smu_v11_0_set_deep_sleep_dcefclk,
         .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
         .set_watermarks_for_clock_ranges = smu_v11_0_set_watermarks_for_clock_ranges,
-        .get_current_rpm = smu_v11_0_get_current_rpm,
         .get_fan_control_mode = smu_v11_0_get_fan_control_mode,
         .set_fan_control_mode = smu_v11_0_set_fan_control_mode,
         .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
index bb9bb09cfc7a..dd6fd1c8bf24 100644
--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
@@ -450,7 +450,6 @@ static int vega20_store_powerplay_table(struct smu_context *smu)
         memcpy(table_context->driver_pptable, &powerplay_table->smcPPTable,
                sizeof(PPTable_t));
 
-        table_context->software_shutdown_temp = powerplay_table->usSoftwareShutdownTemp;
         table_context->thermal_controller_type = powerplay_table->ucThermalControllerType;
         table_context->TDPODLimit = le32_to_cpu(powerplay_table->OverDrive8Table.ODSettingsMax[ATOM_VEGA20_ODSETTING_POWERPERCENTAGE]);
 
@@ -3015,6 +3014,23 @@ static int vega20_set_thermal_fan_table(struct smu_context *smu)
         return ret;
 }
 
+static int vega20_get_fan_speed_rpm(struct smu_context *smu,
+                                    uint32_t *speed)
+{
+        int ret;
+
+        ret = smu_send_smc_msg(smu, SMU_MSG_GetCurrentRpm);
+
+        if (ret) {
+                pr_err("Attempt to get current RPM from SMC Failed!\n");
+                return ret;
+        }
+
+        smu_read_smc_arg(smu, speed);
+
+        return 0;
+}
+
 static int vega20_get_fan_speed_percent(struct smu_context *smu,
                                         uint32_t *speed)
 {
@@ -3022,7 +3038,7 @@ static int vega20_get_fan_speed_percent(struct smu_context *smu,
         uint32_t current_rpm = 0, percent = 0;
         PPTable_t *pptable = smu->smu_table.driver_pptable;
 
-        ret = smu_get_current_rpm(smu, &current_rpm);
+        ret = vega20_get_fan_speed_rpm(smu, &current_rpm);
         if (ret)
                 return ret;
 
@@ -3217,35 +3233,24 @@ static int vega20_set_watermarks_table(struct smu_context *smu,
         return 0;
 }
 
-static const struct smu_temperature_range vega20_thermal_policy[] =
-{
-        {-273150,  99000, 99000, -273150, 99000, 99000, -273150, 99000, 99000},
-        { 120000, 120000, 120000, 120000, 120000, 120000, 120000, 120000, 120000},
-};
-
 static int vega20_get_thermal_temperature_range(struct smu_context *smu,
                                                 struct smu_temperature_range *range)
 {
-
+        struct smu_table_context *table_context = &smu->smu_table;
+        ATOM_Vega20_POWERPLAYTABLE *powerplay_table = table_context->power_play_table;
         PPTable_t *pptable = smu->smu_table.driver_pptable;
 
-        if (!range)
+        if (!range || !powerplay_table)
                 return -EINVAL;
 
-        memcpy(range, &vega20_thermal_policy[0], sizeof(struct smu_temperature_range));
-
-        range->max = pptable->TedgeLimit *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        range->edge_emergency_max = (pptable->TedgeLimit + CTF_OFFSET_EDGE) *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        range->hotspot_crit_max = pptable->ThotspotLimit *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        range->hotspot_emergency_max = (pptable->ThotspotLimit + CTF_OFFSET_HOTSPOT) *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        range->mem_crit_max = pptable->ThbmLimit *
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
-        range->mem_emergency_max = (pptable->ThbmLimit + CTF_OFFSET_HBM)*
-                SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        /* The unit is temperature */
+        range->min = 0;
+        range->max = powerplay_table->usSoftwareShutdownTemp;
+        range->edge_emergency_max = (pptable->TedgeLimit + CTF_OFFSET_EDGE);
+        range->hotspot_crit_max = pptable->ThotspotLimit;
+        range->hotspot_emergency_max = (pptable->ThotspotLimit + CTF_OFFSET_HOTSPOT);
+        range->mem_crit_max = pptable->ThbmLimit;
+        range->mem_emergency_max = (pptable->ThbmLimit + CTF_OFFSET_HBM);
 
 
         return 0;
@@ -3293,6 +3298,7 @@ static const struct pptable_funcs vega20_ppt_funcs = {
         .is_dpm_running = vega20_is_dpm_running,
         .set_thermal_fan_table = vega20_set_thermal_fan_table,
         .get_fan_speed_percent = vega20_get_fan_speed_percent,
+        .get_fan_speed_rpm = vega20_get_fan_speed_rpm,
         .set_watermarks_table = vega20_set_watermarks_table,
         .get_thermal_temperature_range = vega20_get_thermal_temperature_range
 };
diff --git a/drivers/gpu/drm/bochs/bochs_kms.c b/drivers/gpu/drm/bochs/bochs_kms.c
index bc19dbd531ef..359030d5d818 100644
--- a/drivers/gpu/drm/bochs/bochs_kms.c
+++ b/drivers/gpu/drm/bochs/bochs_kms.c
@@ -191,6 +191,7 @@ int bochs_kms_init(struct bochs_device *bochs)
         bochs->dev->mode_config.fb_base = bochs->fb_base;
         bochs->dev->mode_config.preferred_depth = 24;
         bochs->dev->mode_config.prefer_shadow = 0;
+        bochs->dev->mode_config.prefer_shadow_fbdev = 1;
         bochs->dev->mode_config.quirk_addfb_prefer_host_byte_order = true;
 
         bochs->dev->mode_config.funcs = &bochs_mode_funcs;
diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index ee777469293a..e4e22bbae2a7 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -48,6 +48,7 @@ config DRM_DUMB_VGA_DAC
 config DRM_LVDS_ENCODER
         tristate "Transparent parallel to LVDS encoder support"
         depends on OF
+        select DRM_KMS_HELPER
         select DRM_PANEL_BRIDGE
         help
           Support for transparent parallel to LVDS encoders that don't require
@@ -116,9 +117,10 @@ config DRM_THINE_THC63LVD1024
 
 config DRM_TOSHIBA_TC358764
         tristate "TC358764 DSI/LVDS bridge"
-        depends on DRM && DRM_PANEL
         depends on OF
         select DRM_MIPI_DSI
+        select DRM_KMS_HELPER
+        select DRM_PANEL
         help
           Toshiba TC358764 DSI/LVDS bridge driver.
 
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index 410572f14257..e1dafb0cc5e2 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -254,7 +254,6 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u
         struct drm_device *dev = client->dev;
         struct drm_client_buffer *buffer;
         struct drm_gem_object *obj;
-        void *vaddr;
         int ret;
 
         buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
@@ -281,6 +280,36 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u
 
         buffer->gem = obj;
 
+        return buffer;
+
+err_delete:
+        drm_client_buffer_delete(buffer);
+
+        return ERR_PTR(ret);
+}
+
+/**
+ * drm_client_buffer_vmap - Map DRM client buffer into address space
+ * @buffer: DRM client buffer
+ *
+ * This function maps a client buffer into kernel address space. If the
+ * buffer is already mapped, it returns the mapping's address.
+ *
+ * Client buffer mappings are not ref'counted. Each call to
+ * drm_client_buffer_vmap() should be followed by a call to
+ * drm_client_buffer_vunmap(); or the client buffer should be mapped
+ * throughout its lifetime.
+ *
+ * Returns:
+ *      The mapped memory's address
+ */
+void *drm_client_buffer_vmap(struct drm_client_buffer *buffer)
+{
+        void *vaddr;
+
+        if (buffer->vaddr)
+                return buffer->vaddr;
+
         /*
          * FIXME: The dependency on GEM here isn't required, we could
          * convert the driver handle to a dma-buf instead and use the
@@ -289,21 +318,30 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u
          * fd_install step out of the driver backend hooks, to make that
          * final step optional for internal users.
          */
-        vaddr = drm_gem_vmap(obj);
-        if (IS_ERR(vaddr)) {
-                ret = PTR_ERR(vaddr);
-                goto err_delete;
-        }
+        vaddr = drm_gem_vmap(buffer->gem);
+        if (IS_ERR(vaddr))
+                return vaddr;
 
         buffer->vaddr = vaddr;
 
-        return buffer;
-
-err_delete:
-        drm_client_buffer_delete(buffer);
+        return vaddr;
+}
+EXPORT_SYMBOL(drm_client_buffer_vmap);
 
-        return ERR_PTR(ret);
+/**
+ * drm_client_buffer_vunmap - Unmap DRM client buffer
+ * @buffer: DRM client buffer
+ *
+ * This function removes a client buffer's memory mapping. Calling this
+ * function is only required by clients that manage their buffer mappings
+ * by themselves.
+ */
+void drm_client_buffer_vunmap(struct drm_client_buffer *buffer)
+{
+        drm_gem_vunmap(buffer->gem, buffer->vaddr);
+        buffer->vaddr = NULL;
 }
+EXPORT_SYMBOL(drm_client_buffer_vunmap);
 
 static void drm_client_buffer_rmfb(struct drm_client_buffer *buffer)
 {
diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
index 56d36779d213..c8922b7cac09 100644
--- a/drivers/gpu/drm/drm_client_modeset.c
+++ b/drivers/gpu/drm/drm_client_modeset.c
@@ -859,7 +859,7 @@ bool drm_client_rotation(struct drm_mode_set *modeset, unsigned int *rotation)
          * simple XOR between the two handle the addition nicely.
          */
         cmdline = &connector->cmdline_mode;
-        if (cmdline->specified) {
+        if (cmdline->specified && cmdline->rotation_reflection) {
                 unsigned int cmdline_rest, panel_rest;
                 unsigned int cmdline_rot, panel_rot;
                 unsigned int sum_rot, sum_rest;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 1984e5c54d58..a7ba5b4902d6 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -403,6 +403,7 @@ static void drm_fb_helper_dirty_work(struct work_struct *work)
         struct drm_clip_rect *clip = &helper->dirty_clip;
         struct drm_clip_rect clip_copy;
         unsigned long flags;
+        void *vaddr;
 
         spin_lock_irqsave(&helper->dirty_lock, flags);
         clip_copy = *clip;
@@ -412,10 +413,20 @@ static void drm_fb_helper_dirty_work(struct work_struct *work)
 
         /* call dirty callback only when it has been really touched */
         if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2) {
+
                 /* Generic fbdev uses a shadow buffer */
-                if (helper->buffer)
+                if (helper->buffer) {
+                        vaddr = drm_client_buffer_vmap(helper->buffer);
+                        if (IS_ERR(vaddr))
+                                return;
                         drm_fb_helper_dirty_blit_real(helper, &clip_copy);
-                helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
+                }
+                if (helper->fb->funcs->dirty)
+                        helper->fb->funcs->dirty(helper->fb, NULL, 0, 0,
+                                                 &clip_copy, 1);
+
+                if (helper->buffer)
+                        drm_client_buffer_vunmap(helper->buffer);
         }
 }
 
@@ -604,6 +615,16 @@ void drm_fb_helper_unlink_fbi(struct drm_fb_helper *fb_helper)
 }
 EXPORT_SYMBOL(drm_fb_helper_unlink_fbi);
 
+static bool drm_fbdev_use_shadow_fb(struct drm_fb_helper *fb_helper)
+{
+        struct drm_device *dev = fb_helper->dev;
+        struct drm_framebuffer *fb = fb_helper->fb;
+
+        return dev->mode_config.prefer_shadow_fbdev ||
+               dev->mode_config.prefer_shadow ||
+               fb->funcs->dirty;
+}
+
 static void drm_fb_helper_dirty(struct fb_info *info, u32 x, u32 y,
                                 u32 width, u32 height)
 {
@@ -611,7 +632,7 @@ static void drm_fb_helper_dirty(struct fb_info *info, u32 x, u32 y,
         struct drm_clip_rect *clip = &helper->dirty_clip;
         unsigned long flags;
 
-        if (!helper->fb->funcs->dirty)
+        if (!drm_fbdev_use_shadow_fb(helper))
                 return;
 
         spin_lock_irqsave(&helper->dirty_lock, flags);
@@ -2178,6 +2199,7 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
         struct drm_framebuffer *fb;
         struct fb_info *fbi;
         u32 format;
+        void *vaddr;
 
         DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
                       sizes->surface_width, sizes->surface_height,
@@ -2200,16 +2222,10 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
         fbi->fbops = &drm_fbdev_fb_ops;
         fbi->screen_size = fb->height * fb->pitches[0];
         fbi->fix.smem_len = fbi->screen_size;
-        fbi->screen_buffer = buffer->vaddr;
-        /* Shamelessly leak the physical address to user-space */
-#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
-        if (drm_leak_fbdev_smem && fbi->fix.smem_start == 0)
-                fbi->fix.smem_start =
-                        page_to_phys(virt_to_page(fbi->screen_buffer));
-#endif
+
         drm_fb_helper_fill_info(fbi, fb_helper, sizes);
 
-        if (fb->funcs->dirty) {
+        if (drm_fbdev_use_shadow_fb(fb_helper)) {
                 struct fb_ops *fbops;
                 void *shadow;
 
@@ -2231,6 +2247,19 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
                 fbi->fbdefio = &drm_fbdev_defio;
 
                 fb_deferred_io_init(fbi);
+        } else {
+                /* buffer is mapped for HW framebuffer */
+                vaddr = drm_client_buffer_vmap(fb_helper->buffer);
+                if (IS_ERR(vaddr))
+                        return PTR_ERR(vaddr);
+
+                fbi->screen_buffer = vaddr;
+                /* Shamelessly leak the physical address to user-space */
+#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
+                if (drm_leak_fbdev_smem && fbi->fix.smem_start == 0)
+                        fbi->fix.smem_start =
+                                page_to_phys(virt_to_page(fbi->screen_buffer));
+#endif
         }
 
         return 0;
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 0b72468e8131..57564318ceea 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -835,7 +835,7 @@ static int atomic_remove_fb(struct drm_framebuffer *fb)
         struct drm_device *dev = fb->dev;
         struct drm_atomic_state *state;
         struct drm_plane *plane;
-        struct drm_connector *conn;
+        struct drm_connector *conn __maybe_unused;
         struct drm_connector_state *conn_state;
         int i, ret;
         unsigned plane_mask;
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 74a5739df506..80fcd5dc1558 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1686,7 +1686,7 @@ static int drm_mode_parse_cmdline_options(char *str, size_t len,
  *
  * Additionals options can be provided following the mode, using a comma to
  * separate each option. Valid options can be found in
- * Documentation/fb/modedb.txt.
+ * Documentation/fb/modedb.rst.
  *
  * The intermediate drm_cmdline_mode structure is required to store additional
  * options from the command line modline like the force-enable/disable flag.
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 60ce4a8ad9e1..6f7d3b3b3628 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -2,6 +2,7 @@
 config DRM_EXYNOS
         tristate "DRM Support for Samsung SoC EXYNOS Series"
         depends on OF && DRM && (ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || ARCH_MULTIPLATFORM || COMPILE_TEST)
+        depends on MMU
         select DRM_KMS_HELPER
         select VIDEOMODE_HELPERS
         select SND_SOC_HDMI_CODEC if SND_SOC
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index a594ab7be2c0..164d914cbe9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -44,7 +44,7 @@ static unsigned int fimc_mask = 0xc;
 module_param_named(fimc_devs, fimc_mask, uint, 0644);
 MODULE_PARM_DESC(fimc_devs, "Alias mask for assigning FIMC devices to Exynos DRM");
 
-#define get_fimc_context(dev)   platform_get_drvdata(to_platform_device(dev))
+#define get_fimc_context(dev)   dev_get_drvdata(dev)
 
 enum {
         FIMC_CLK_LCLK,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 50904eee96f7..2a3382d43bc9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -267,7 +267,7 @@ static inline void g2d_hw_reset(struct g2d_data *g2d)
 static int g2d_init_cmdlist(struct g2d_data *g2d)
 {
         struct device *dev = g2d->dev;
-        struct g2d_cmdlist_node *node = g2d->cmdlist_node;
+        struct g2d_cmdlist_node *node;
         int nr;
         int ret;
         struct g2d_buf_info *buf_info;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 1e4b21c49a06..1c524db9570f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -58,7 +58,7 @@
 #define GSC_COEF_DEPTH  3
 #define GSC_AUTOSUSPEND_DELAY           2000
 
-#define get_gsc_context(dev)    platform_get_drvdata(to_platform_device(dev))
+#define get_gsc_context(dev)    dev_get_drvdata(dev)
 #define gsc_read(offset)                readl(ctx->regs + (offset))
 #define gsc_write(cfg, offset)  writel(cfg, ctx->regs + (offset))
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_scaler.c b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
index 9af096479e1c..b24ba948b725 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
@@ -94,12 +94,12 @@ static inline int scaler_reset(struct scaler_context *scaler)
         scaler_write(SCALER_CFG_SOFT_RESET, SCALER_CFG);
         do {
                 cpu_relax();
-        } while (retry > 1 &&
+        } while (--retry > 1 &&
                  scaler_read(SCALER_CFG) & SCALER_CFG_SOFT_RESET);
         do {
                 cpu_relax();
                 scaler_write(1, SCALER_INT_EN);
-        } while (retry > 0 && scaler_read(SCALER_INT_EN) != 1);
+        } while (--retry > 0 && scaler_read(SCALER_INT_EN) != 1);
 
         return retry ? 0 : -EIO;
 }
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index 91355c2ea8a5..8cace65f50ce 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -16,7 +16,6 @@ subdir-ccflags-y := -Wall -Wextra
 subdir-ccflags-y += $(call cc-disable-warning, unused-parameter)
 subdir-ccflags-y += $(call cc-disable-warning, type-limits)
 subdir-ccflags-y += $(call cc-disable-warning, missing-field-initializers)
-subdir-ccflags-y += $(call cc-disable-warning, implicit-fallthrough)
 subdir-ccflags-y += $(call cc-disable-warning, unused-but-set-variable)
 # clang warnings
 subdir-ccflags-y += $(call cc-disable-warning, sign-compare)
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index c4710889cb32..3ef4e9f573cf 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -765,7 +765,7 @@ parse_psr(struct drm_i915_private *dev_priv, const struct bdb_header *bdb)
         }
 
         if (bdb->version >= 226) {
-                u32 wakeup_time = psr_table->psr2_tp2_tp3_wakeup_time;
+                u32 wakeup_time = psr->psr2_tp2_tp3_wakeup_time;
 
                 wakeup_time = (wakeup_time >> (2 * panel_type)) & 0x3;
                 switch (wakeup_time) {
diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
index 753ac3165061..7b908e10d32e 100644
--- a/drivers/gpu/drm/i915/display/intel_bw.c
+++ b/drivers/gpu/drm/i915/display/intel_bw.c
@@ -178,6 +178,8 @@ static int icl_get_bw_info(struct drm_i915_private *dev_priv)
                 clpchgroup = (sa->deburst * deinterleave / num_channels) << i;
                 bi->num_planes = (ipqdepth - clpchgroup) / clpchgroup + 1;
 
+                bi->num_qgv_points = qi.num_points;
+
                 for (j = 0; j < qi.num_points; j++) {
                         const struct intel_qgv_point *sp = &qi.points[j];
                         int ct, bw;
@@ -195,7 +197,7 @@ static int icl_get_bw_info(struct drm_i915_private *dev_priv)
                         bi->deratedbw[j] = min(maxdebw,
                                                bw * 9 / 10); /* 90% */
 
-                        DRM_DEBUG_KMS("BW%d / QGV %d: num_planes=%d deratedbw=%d\n",
+                        DRM_DEBUG_KMS("BW%d / QGV %d: num_planes=%d deratedbw=%u\n",
                                       i, j, bi->num_planes, bi->deratedbw[j]);
                 }
 
@@ -211,14 +213,17 @@ static unsigned int icl_max_bw(struct drm_i915_private *dev_priv,
 {
         int i;
 
-        /* Did we initialize the bw limits successfully? */
-        if (dev_priv->max_bw[0].num_planes == 0)
-                return UINT_MAX;
-
         for (i = 0; i < ARRAY_SIZE(dev_priv->max_bw); i++) {
                 const struct intel_bw_info *bi =
                         &dev_priv->max_bw[i];
 
+                /*
+                 * Pcode will not expose all QGV points when
+                 * SAGV is forced to off/min/med/max.
+                 */
+                if (qgv_point >= bi->num_qgv_points)
+                        return UINT_MAX;
+
                 if (num_planes >= bi->num_planes)
                         return bi->deratedbw[qgv_point];
         }
diff --git a/drivers/gpu/drm/i915/display/intel_cdclk.c b/drivers/gpu/drm/i915/display/intel_cdclk.c
index 8993ab283562..0d19bbd08122 100644
--- a/drivers/gpu/drm/i915/display/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/display/intel_cdclk.c
@@ -2240,6 +2240,17 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
         /*
+         * "For DP audio configuration, cdclk frequency shall be set to
+         *  meet the following requirements:
+         *  DP Link Frequency(MHz) | Cdclk frequency(MHz)
+         *  270                    | 320 or higher
+         *  162                    | 200 or higher"
+         */
+        if ((IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+            intel_crtc_has_dp_encoder(crtc_state) && crtc_state->has_audio)
+                min_cdclk = max(crtc_state->port_clock, min_cdclk);
+
+        /*
          * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
          * than 320000KHz.
          */
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 8592a7d422de..592b92782fab 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -1839,7 +1839,7 @@ static void intel_enable_pipe(const struct intel_crtc_state *new_crtc_state)
                 /* FIXME: assert CPU port conditions for SNB+ */
         }
 
-        trace_intel_pipe_enable(dev_priv, pipe);
+        trace_intel_pipe_enable(crtc);
 
         reg = PIPECONF(cpu_transcoder);
         val = I915_READ(reg);
@@ -1880,7 +1880,7 @@ static void intel_disable_pipe(const struct intel_crtc_state *old_crtc_state)
          */
         assert_planes_disabled(crtc);
 
-        trace_intel_pipe_disable(dev_priv, pipe);
+        trace_intel_pipe_disable(crtc);
 
         reg = PIPECONF(cpu_transcoder);
         val = I915_READ(reg);
@@ -12042,7 +12042,7 @@ static bool check_digital_port_conflicts(struct intel_atomic_state *state)
                 case INTEL_OUTPUT_DDI:
                         if (WARN_ON(!HAS_DDI(to_i915(dev))))
                                 break;
-                        /* else: fall through */
+                        /* else, fall through */
                 case INTEL_OUTPUT_DP:
                 case INTEL_OUTPUT_HDMI:
                 case INTEL_OUTPUT_EDP:
diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c
index c93ad512014c..2d1939db108f 100644
--- a/drivers/gpu/drm/i915/display/intel_display_power.c
+++ b/drivers/gpu/drm/i915/display/intel_display_power.c
@@ -438,16 +438,23 @@ icl_combo_phy_aux_power_well_disable(struct drm_i915_private *dev_priv,
 #define ICL_AUX_PW_TO_CH(pw_idx)        \
         ((pw_idx) - ICL_PW_CTL_IDX_AUX_A + AUX_CH_A)
 
+#define ICL_TBT_AUX_PW_TO_CH(pw_idx)    \
+        ((pw_idx) - ICL_PW_CTL_IDX_AUX_TBT1 + AUX_CH_C)
+
 static void
 icl_tc_phy_aux_power_well_enable(struct drm_i915_private *dev_priv,
                                  struct i915_power_well *power_well)
 {
-        enum aux_ch aux_ch = ICL_AUX_PW_TO_CH(power_well->desc->hsw.idx);
+        int pw_idx = power_well->desc->hsw.idx;
+        bool is_tbt = power_well->desc->hsw.is_tc_tbt;
+        enum aux_ch aux_ch;
         u32 val;
 
+        aux_ch = is_tbt ? ICL_TBT_AUX_PW_TO_CH(pw_idx) :
+                          ICL_AUX_PW_TO_CH(pw_idx);
         val = I915_READ(DP_AUX_CH_CTL(aux_ch));
         val &= ~DP_AUX_CH_CTL_TBT_IO;
-        if (power_well->desc->hsw.is_tc_tbt)
+        if (is_tbt)
                 val |= DP_AUX_CH_CTL_TBT_IO;
         I915_WRITE(DP_AUX_CH_CTL(aux_ch), val);
 
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index 4336df46fe78..d0fc34826771 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -231,6 +231,7 @@ static int intel_dp_get_fia_supported_lane_count(struct intel_dp *intel_dp)
         switch (lane_info) {
         default:
                 MISSING_CASE(lane_info);
+                /* fall through */
         case 1:
         case 2:
         case 4:
diff --git a/drivers/gpu/drm/i915/display/intel_vbt_defs.h b/drivers/gpu/drm/i915/display/intel_vbt_defs.h
index 2f4894e9a03d..5ddbe71ab423 100644
--- a/drivers/gpu/drm/i915/display/intel_vbt_defs.h
+++ b/drivers/gpu/drm/i915/display/intel_vbt_defs.h
@@ -478,13 +478,13 @@ struct psr_table {
         /* TP wake up time in multiple of 100 */
         u16 tp1_wakeup_time;
         u16 tp2_tp3_wakeup_time;
-
-        /* PSR2 TP2/TP3 wakeup time for 16 panels */
-        u32 psr2_tp2_tp3_wakeup_time;
 } __packed;
 
 struct bdb_psr {
         struct psr_table psr_table[16];
+
+        /* PSR2 TP2/TP3 wakeup time for 16 panels */
+        u32 psr2_tp2_tp3_wakeup_time;
 } __packed;
 
 /*
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
index 391621ee3cbb..39a661927d8e 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -341,7 +341,7 @@ err:
                  */
                 if (!i915_terminally_wedged(i915))
                         return VM_FAULT_SIGBUS;
-                /* else: fall through */
+                /* else, fall through */
         case -EAGAIN:
                 /*
                  * EAGAIN means the gpu is hung and we'll wait for the error
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
index b36ad269f4ea..65eb430cedba 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
@@ -268,7 +268,7 @@ static void *i915_gem_object_map(const struct drm_i915_gem_object *obj,
         switch (type) {
         default:
                 MISSING_CASE(type);
-                /* fallthrough to use PAGE_KERNEL anyway */
+                /* fallthrough - to use PAGE_KERNEL anyway */
         case I915_MAP_WB:
                 pgprot = PAGE_KERNEL;
                 break;
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pm.c b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
index 05011d4a3b88..914b5d4112bb 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
@@ -253,14 +253,15 @@ void i915_gem_resume(struct drm_i915_private *i915)
         i915_gem_restore_gtt_mappings(i915);
         i915_gem_restore_fences(i915);
 
+        if (i915_gem_init_hw(i915))
+                goto err_wedged;
+
         /*
          * As we didn't flush the kernel context before suspend, we cannot
          * guarantee that the context image is complete. So let's just reset
          * it and start again.
          */
-        intel_gt_resume(i915);
-
-        if (i915_gem_init_hw(i915))
+        if (intel_gt_resume(i915))
                 goto err_wedged;
 
         intel_uc_resume(i915);
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
index 528b61678334..2caa594322bc 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
@@ -664,7 +664,15 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
 
         for_each_sgt_page(page, sgt_iter, pages) {
                 if (obj->mm.dirty)
-                        set_page_dirty(page);
+                        /*
+                         * As this may not be anonymous memory (e.g. shmem)
+                         * but exist on a real mapping, we have to lock
+                         * the page in order to dirty it -- holding
+                         * the page reference is not sufficient to
+                         * prevent the inode from being truncated.
+                         * Play safe and take the lock.
+                         */
+                        set_page_dirty_lock(page);
 
                 mark_page_accessed(page);
                 put_page(page);
diff --git a/drivers/gpu/drm/i915/gt/intel_context.c b/drivers/gpu/drm/i915/gt/intel_context.c
index 2c454f227c2e..23120901c55f 100644
--- a/drivers/gpu/drm/i915/gt/intel_context.c
+++ b/drivers/gpu/drm/i915/gt/intel_context.c
@@ -126,6 +126,7 @@ static void intel_context_retire(struct i915_active *active)
         if (ce->state)
                 __context_unpin_state(ce->state);
 
+        intel_ring_unpin(ce->ring);
         intel_context_put(ce);
 }
 
@@ -160,27 +161,35 @@ int intel_context_active_acquire(struct intel_context *ce, unsigned long flags)
 
         intel_context_get(ce);
 
+        err = intel_ring_pin(ce->ring);
+        if (err)
+                goto err_put;
+
         if (!ce->state)
                 return 0;
 
         err = __context_pin_state(ce->state, flags);
-        if (err) {
-                i915_active_cancel(&ce->active);
-                intel_context_put(ce);
-                return err;
-        }
+        if (err)
+                goto err_ring;
 
         /* Preallocate tracking nodes */
         if (!i915_gem_context_is_kernel(ce->gem_context)) {
                 err = i915_active_acquire_preallocate_barrier(&ce->active,
                                                               ce->engine);
-                if (err) {
-                        i915_active_release(&ce->active);
-                        return err;
-                }
+                if (err)
+                        goto err_state;
         }
 
         return 0;
+
+err_state:
+        __context_unpin_state(ce->state);
+err_ring:
+        intel_ring_unpin(ce->ring);
+err_put:
+        intel_context_put(ce);
+        i915_active_cancel(&ce->active);
+        return err;
 }
 
 void intel_context_active_release(struct intel_context *ce)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 7fd33e81c2d9..f25632c9b292 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -969,9 +969,14 @@ const char *i915_cache_level_str(struct drm_i915_private *i915, int type)
 u32 intel_calculate_mcr_s_ss_select(struct drm_i915_private *dev_priv)
 {
         const struct sseu_dev_info *sseu = &RUNTIME_INFO(dev_priv)->sseu;
+        unsigned int slice = fls(sseu->slice_mask) - 1;
+        unsigned int subslice;
         u32 mcr_s_ss_select;
-        u32 slice = fls(sseu->slice_mask);
-        u32 subslice = fls(sseu->subslice_mask[slice]);
+
+        GEM_BUG_ON(slice >= ARRAY_SIZE(sseu->subslice_mask));
+        subslice = fls(sseu->subslice_mask[slice]);
+        GEM_BUG_ON(!subslice);
+        subslice--;
 
         if (IS_GEN(dev_priv, 10))
                 mcr_s_ss_select = GEN8_MCR_SLICE(slice) |
@@ -1471,6 +1476,7 @@ void intel_engine_dump(struct intel_engine_cs *engine,
         struct i915_gpu_error * const error = &engine->i915->gpu_error;
         struct i915_request *rq;
         intel_wakeref_t wakeref;
+        unsigned long flags;
 
         if (header) {
                 va_list ap;
@@ -1490,10 +1496,9 @@ void intel_engine_dump(struct intel_engine_cs *engine,
                    i915_reset_engine_count(error, engine),
                    i915_reset_count(error));
 
-        rcu_read_lock();
-
         drm_printf(m, "\tRequests:\n");
 
+        spin_lock_irqsave(&engine->active.lock, flags);
         rq = intel_engine_find_active_request(engine);
         if (rq) {
                 print_request(m, rq, "\t\tactive ");
@@ -1513,8 +1518,7 @@ void intel_engine_dump(struct intel_engine_cs *engine,
 
                 print_request_ring(m, rq);
         }
-
-        rcu_read_unlock();
+        spin_unlock_irqrestore(&engine->active.lock, flags);
 
         wakeref = intel_runtime_pm_get_if_in_use(&engine->i915->runtime_pm);
         if (wakeref) {
@@ -1672,7 +1676,6 @@ struct i915_request *
 intel_engine_find_active_request(struct intel_engine_cs *engine)
 {
         struct i915_request *request, *active = NULL;
-        unsigned long flags;
 
         /*
          * We are called by the error capture, reset and to dump engine
@@ -1685,7 +1688,7 @@ intel_engine_find_active_request(struct intel_engine_cs *engine)
          * At all other times, we must assume the GPU is still running, but
          * we only care about the snapshot of this moment.
          */
-        spin_lock_irqsave(&engine->active.lock, flags);
+        lockdep_assert_held(&engine->active.lock);
         list_for_each_entry(request, &engine->active.requests, sched.link) {
                 if (i915_request_completed(request))
                         continue;
@@ -1700,7 +1703,6 @@ intel_engine_find_active_request(struct intel_engine_cs *engine)
                 active = request;
                 break;
         }
-        spin_unlock_irqrestore(&engine->active.lock, flags);
 
         return active;
 }
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.c b/drivers/gpu/drm/i915/gt/intel_engine_pm.c
index 2ce00d3dc42a..ae5b6baf6dff 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c
@@ -142,27 +142,3 @@ void intel_engine_init__pm(struct intel_engine_cs *engine)
 {
         intel_wakeref_init(&engine->wakeref);
 }
-
-int intel_engines_resume(struct drm_i915_private *i915)
-{
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
-        int err = 0;
-
-        intel_gt_pm_get(i915);
-        for_each_engine(engine, i915, id) {
-                intel_engine_pm_get(engine);
-                engine->serial++; /* kernel context lost */
-                err = engine->resume(engine);
-                intel_engine_pm_put(engine);
-                if (err) {
-                        dev_err(i915->drm.dev,
-                                "Failed to restart %s (%d)\n",
-                                engine->name, err);
-                        break;
-                }
-        }
-        intel_gt_pm_put(i915);
-
-        return err;
-}
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.h b/drivers/gpu/drm/i915/gt/intel_engine_pm.h
index b326cd993d60..a11c893f64c6 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_pm.h
+++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.h
@@ -7,16 +7,22 @@
 #ifndef INTEL_ENGINE_PM_H
 #define INTEL_ENGINE_PM_H
 
+#include "intel_engine_types.h"
+#include "intel_wakeref.h"
+
 struct drm_i915_private;
-struct intel_engine_cs;
 
 void intel_engine_pm_get(struct intel_engine_cs *engine);
 void intel_engine_pm_put(struct intel_engine_cs *engine);
 
+static inline bool
+intel_engine_pm_get_if_awake(struct intel_engine_cs *engine)
+{
+        return intel_wakeref_get_if_active(&engine->wakeref);
+}
+
 void intel_engine_park(struct intel_engine_cs *engine);
 
 void intel_engine_init__pm(struct intel_engine_cs *engine);
 
-int intel_engines_resume(struct drm_i915_private *i915);
-
 #endif /* INTEL_ENGINE_PM_H */
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_types.h b/drivers/gpu/drm/i915/gt/intel_engine_types.h
index 868b220214f8..43e975a26016 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_types.h
+++ b/drivers/gpu/drm/i915/gt/intel_engine_types.h
@@ -70,6 +70,18 @@ struct intel_ring {
         struct list_head request_list;
         struct list_head active_link;
 
+        /*
+         * As we have two types of rings, one global to the engine used
+         * by ringbuffer submission and those that are exclusive to a
+         * context used by execlists, we have to play safe and allow
+         * atomic updates to the pin_count. However, the actual pinning
+         * of the context is either done during initialisation for
+         * ringbuffer submission or serialised as part of the context
+         * pinning for execlists, and so we do not need a mutex ourselves
+         * to serialise intel_ring_pin/intel_ring_unpin.
+         */
+        atomic_t pin_count;
+
         u32 head;
         u32 tail;
         u32 emit;
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_pm.c b/drivers/gpu/drm/i915/gt/intel_gt_pm.c
index 7b5967751762..9f8f7f54191f 100644
--- a/drivers/gpu/drm/i915/gt/intel_gt_pm.c
+++ b/drivers/gpu/drm/i915/gt/intel_gt_pm.c
@@ -5,6 +5,7 @@
  */
 
 #include "i915_drv.h"
+#include "intel_engine_pm.h"
 #include "intel_gt_pm.h"
 #include "intel_pm.h"
 #include "intel_wakeref.h"
@@ -118,10 +119,11 @@ void intel_gt_sanitize(struct drm_i915_private *i915, bool force)
                 intel_engine_reset(engine, false);
 }
 
-void intel_gt_resume(struct drm_i915_private *i915)
+int intel_gt_resume(struct drm_i915_private *i915)
 {
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
+        int err = 0;
 
         /*
          * After resume, we may need to poke into the pinned kernel
@@ -129,9 +131,12 @@ void intel_gt_resume(struct drm_i915_private *i915)
          * Only the kernel contexts should remain pinned over suspend,
          * allowing us to fixup the user contexts on their first pin.
          */
+        intel_gt_pm_get(i915);
         for_each_engine(engine, i915, id) {
                 struct intel_context *ce;
 
+                intel_engine_pm_get(engine);
+
                 ce = engine->kernel_context;
                 if (ce)
                         ce->ops->reset(ce);
@@ -139,5 +144,19 @@ void intel_gt_resume(struct drm_i915_private *i915)
                 ce = engine->preempt_context;
                 if (ce)
                         ce->ops->reset(ce);
+
+                engine->serial++; /* kernel context lost */
+                err = engine->resume(engine);
+
+                intel_engine_pm_put(engine);
+                if (err) {
+                        dev_err(i915->drm.dev,
+                                "Failed to restart %s (%d)\n",
+                                engine->name, err);
+                        break;
+                }
         }
+        intel_gt_pm_put(i915);
+
+        return err;
 }
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_pm.h b/drivers/gpu/drm/i915/gt/intel_gt_pm.h
index 7dd1130a19a4..53f342b20181 100644
--- a/drivers/gpu/drm/i915/gt/intel_gt_pm.h
+++ b/drivers/gpu/drm/i915/gt/intel_gt_pm.h
@@ -22,6 +22,6 @@ void intel_gt_pm_put(struct drm_i915_private *i915);
 void intel_gt_pm_init(struct drm_i915_private *i915);
 
 void intel_gt_sanitize(struct drm_i915_private *i915, bool force);
-void intel_gt_resume(struct drm_i915_private *i915);
+int intel_gt_resume(struct drm_i915_private *i915);
 
 #endif /* INTEL_GT_PM_H */
diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
index b42b5f158295..82b7ace62d97 100644
--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
+++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
@@ -1414,6 +1414,7 @@ static void execlists_context_destroy(struct kref *kref)
 {
         struct intel_context *ce = container_of(kref, typeof(*ce), ref);
 
+        GEM_BUG_ON(!i915_active_is_idle(&ce->active));
         GEM_BUG_ON(intel_context_is_pinned(ce));
 
         if (ce->state)
@@ -1426,7 +1427,6 @@ static void execlists_context_unpin(struct intel_context *ce)
 {
         i915_gem_context_unpin_hw_id(ce->gem_context);
         i915_gem_object_unpin_map(ce->state->obj);
-        intel_ring_unpin(ce->ring);
 }
 
 static void
@@ -1478,13 +1478,9 @@ __execlists_context_pin(struct intel_context *ce,
                 goto unpin_active;
         }
 
-        ret = intel_ring_pin(ce->ring);
-        if (ret)
-                goto unpin_map;
-
         ret = i915_gem_context_pin_hw_id(ce->gem_context);
         if (ret)
-                goto unpin_ring;
+                goto unpin_map;
 
         ce->lrc_desc = lrc_descriptor(ce, engine);
         ce->lrc_reg_state = vaddr + LRC_STATE_PN * PAGE_SIZE;
@@ -1492,8 +1488,6 @@ __execlists_context_pin(struct intel_context *ce,
 
         return 0;
 
-unpin_ring:
-        intel_ring_unpin(ce->ring);
 unpin_map:
         i915_gem_object_unpin_map(ce->state->obj);
 unpin_active:
diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c
index 4c478b38e420..3f907701ef4d 100644
--- a/drivers/gpu/drm/i915/gt/intel_reset.c
+++ b/drivers/gpu/drm/i915/gt/intel_reset.c
@@ -687,7 +687,6 @@ static void reset_prepare_engine(struct intel_engine_cs *engine)
          * written to the powercontext is undefined and so we may lose
          * GPU state upon resume, i.e. fail to restart after a reset.
          */
-        intel_engine_pm_get(engine);
         intel_uncore_forcewake_get(engine->uncore, FORCEWAKE_ALL);
         engine->reset.prepare(engine);
 }
@@ -718,16 +717,21 @@ static void revoke_mmaps(struct drm_i915_private *i915)
         }
 }
 
-static void reset_prepare(struct drm_i915_private *i915)
+static intel_engine_mask_t reset_prepare(struct drm_i915_private *i915)
 {
         struct intel_engine_cs *engine;
+        intel_engine_mask_t awake = 0;
         enum intel_engine_id id;
 
-        intel_gt_pm_get(i915);
-        for_each_engine(engine, i915, id)
+        for_each_engine(engine, i915, id) {
+                if (intel_engine_pm_get_if_awake(engine))
+                        awake |= engine->mask;
                 reset_prepare_engine(engine);
+        }
 
         intel_uc_reset_prepare(i915);
+
+        return awake;
 }
 
 static void gt_revoke(struct drm_i915_private *i915)
@@ -761,20 +765,22 @@ static int gt_reset(struct drm_i915_private *i915,
 static void reset_finish_engine(struct intel_engine_cs *engine)
 {
         engine->reset.finish(engine);
-        intel_engine_pm_put(engine);
         intel_uncore_forcewake_put(engine->uncore, FORCEWAKE_ALL);
+
+        intel_engine_signal_breadcrumbs(engine);
 }
 
-static void reset_finish(struct drm_i915_private *i915)
+static void reset_finish(struct drm_i915_private *i915,
+                         intel_engine_mask_t awake)
 {
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
 
         for_each_engine(engine, i915, id) {
                 reset_finish_engine(engine);
-                intel_engine_signal_breadcrumbs(engine);
+                if (awake & engine->mask)
+                        intel_engine_pm_put(engine);
         }
-        intel_gt_pm_put(i915);
 }
 
 static void nop_submit_request(struct i915_request *request)
@@ -798,6 +804,7 @@ static void __i915_gem_set_wedged(struct drm_i915_private *i915)
 {
         struct i915_gpu_error *error = &i915->gpu_error;
         struct intel_engine_cs *engine;
+        intel_engine_mask_t awake;
         enum intel_engine_id id;
 
         if (test_bit(I915_WEDGED, &error->flags))
@@ -817,7 +824,7 @@ static void __i915_gem_set_wedged(struct drm_i915_private *i915)
          * rolling the global seqno forward (since this would complete requests
          * for which we haven't set the fence error to EIO yet).
          */
-        reset_prepare(i915);
+        awake = reset_prepare(i915);
 
         /* Even if the GPU reset fails, it should still stop the engines */
         if (!INTEL_INFO(i915)->gpu_reset_clobbers_display)
@@ -841,7 +848,7 @@ static void __i915_gem_set_wedged(struct drm_i915_private *i915)
         for_each_engine(engine, i915, id)
                 engine->cancel_requests(engine);
 
-        reset_finish(i915);
+        reset_finish(i915, awake);
 
         GEM_TRACE("end\n");
 }
@@ -951,6 +958,21 @@ static int do_reset(struct drm_i915_private *i915,
         return gt_reset(i915, stalled_mask);
 }
 
+static int resume(struct drm_i915_private *i915)
+{
+        struct intel_engine_cs *engine;
+        enum intel_engine_id id;
+        int ret;
+
+        for_each_engine(engine, i915, id) {
+                ret = engine->resume(engine);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+
 /**
  * i915_reset - reset chip after a hang
  * @i915: #drm_i915_private to reset
@@ -973,6 +995,7 @@ void i915_reset(struct drm_i915_private *i915,
                 const char *reason)
 {
         struct i915_gpu_error *error = &i915->gpu_error;
+        intel_engine_mask_t awake;
         int ret;
 
         GEM_TRACE("flags=%lx\n", error->flags);
@@ -989,7 +1012,7 @@ void i915_reset(struct drm_i915_private *i915,
                 dev_notice(i915->drm.dev, "Resetting chip for %s\n", reason);
         error->reset_count++;
 
-        reset_prepare(i915);
+        awake = reset_prepare(i915);
 
         if (!intel_has_gpu_reset(i915)) {
                 if (i915_modparams.reset)
@@ -1024,13 +1047,17 @@ void i915_reset(struct drm_i915_private *i915,
         if (ret) {
                 DRM_ERROR("Failed to initialise HW following reset (%d)\n",
                           ret);
-                goto error;
+                goto taint;
         }
 
+        ret = resume(i915);
+        if (ret)
+                goto taint;
+
         i915_queue_hangcheck(i915);
 
 finish:
-        reset_finish(i915);
+        reset_finish(i915, awake);
 unlock:
         mutex_unlock(&error->wedge_mutex);
         return;
@@ -1081,7 +1108,7 @@ int i915_reset_engine(struct intel_engine_cs *engine, const char *msg)
         GEM_TRACE("%s flags=%lx\n", engine->name, error->flags);
         GEM_BUG_ON(!test_bit(I915_RESET_ENGINE + engine->id, &error->flags));
 
-        if (!intel_wakeref_active(&engine->wakeref))
+        if (!intel_engine_pm_get_if_awake(engine))
                 return 0;
 
         reset_prepare_engine(engine);
@@ -1116,12 +1143,11 @@ int i915_reset_engine(struct intel_engine_cs *engine, const char *msg)
          * process to program RING_MODE, HWSP and re-enable submission.
          */
         ret = engine->resume(engine);
-        if (ret)
-                goto out;
 
 out:
         intel_engine_cancel_stop_cs(engine);
         reset_finish_engine(engine);
+        intel_engine_pm_put(engine);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/gt/intel_ringbuffer.c b/drivers/gpu/drm/i915/gt/intel_ringbuffer.c
index c6023bc9452d..12010e798868 100644
--- a/drivers/gpu/drm/i915/gt/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/gt/intel_ringbuffer.c
@@ -1149,16 +1149,16 @@ i915_emit_bb_start(struct i915_request *rq,
 int intel_ring_pin(struct intel_ring *ring)
 {
         struct i915_vma *vma = ring->vma;
-        enum i915_map_type map = i915_coherent_map_type(vma->vm->i915);
         unsigned int flags;
         void *addr;
         int ret;
 
-        GEM_BUG_ON(ring->vaddr);
+        if (atomic_fetch_inc(&ring->pin_count))
+                return 0;
 
         ret = i915_timeline_pin(ring->timeline);
         if (ret)
-                return ret;
+                goto err_unpin;
 
         flags = PIN_GLOBAL;
 
@@ -1172,26 +1172,31 @@ int intel_ring_pin(struct intel_ring *ring)
 
         ret = i915_vma_pin(vma, 0, 0, flags);
         if (unlikely(ret))
-                goto unpin_timeline;
+                goto err_timeline;
 
         if (i915_vma_is_map_and_fenceable(vma))
                 addr = (void __force *)i915_vma_pin_iomap(vma);
         else
-                addr = i915_gem_object_pin_map(vma->obj, map);
+                addr = i915_gem_object_pin_map(vma->obj,
+                                               i915_coherent_map_type(vma->vm->i915));
         if (IS_ERR(addr)) {
                 ret = PTR_ERR(addr);
-                goto unpin_ring;
+                goto err_ring;
         }
 
         vma->obj->pin_global++;
 
+        GEM_BUG_ON(ring->vaddr);
         ring->vaddr = addr;
+
         return 0;
 
-unpin_ring:
+err_ring:
         i915_vma_unpin(vma);
-unpin_timeline:
+err_timeline:
         i915_timeline_unpin(ring->timeline);
+err_unpin:
+        atomic_dec(&ring->pin_count);
         return ret;
 }
 
@@ -1207,16 +1212,19 @@ void intel_ring_reset(struct intel_ring *ring, u32 tail)
 
 void intel_ring_unpin(struct intel_ring *ring)
 {
-        GEM_BUG_ON(!ring->vma);
-        GEM_BUG_ON(!ring->vaddr);
+        if (!atomic_dec_and_test(&ring->pin_count))
+                return;
 
         /* Discard any unused bytes beyond that submitted to hw. */
         intel_ring_reset(ring, ring->tail);
 
+        GEM_BUG_ON(!ring->vma);
         if (i915_vma_is_map_and_fenceable(ring->vma))
                 i915_vma_unpin_iomap(ring->vma);
         else
                 i915_gem_object_unpin_map(ring->vma->obj);
+
+        GEM_BUG_ON(!ring->vaddr);
         ring->vaddr = NULL;
 
         ring->vma->obj->pin_global--;
@@ -2081,10 +2089,11 @@ static void ring_destroy(struct intel_engine_cs *engine)
         WARN_ON(INTEL_GEN(dev_priv) > 2 &&
                 (ENGINE_READ(engine, RING_MI_MODE) & MODE_IDLE) == 0);
 
+        intel_engine_cleanup_common(engine);
+
         intel_ring_unpin(engine->buffer);
         intel_ring_put(engine->buffer);
 
-        intel_engine_cleanup_common(engine);
         kfree(engine);
 }
 
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
index 15e90fd2cfdc..98dfb086320f 100644
--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
@@ -1098,10 +1098,25 @@ static void glk_whitelist_build(struct intel_engine_cs *engine)
 
 static void cfl_whitelist_build(struct intel_engine_cs *engine)
 {
+        struct i915_wa_list *w = &engine->whitelist;
+
         if (engine->class != RENDER_CLASS)
                 return;
 
-        gen9_whitelist_build(&engine->whitelist);
+        gen9_whitelist_build(w);
+
+        /*
+         * WaAllowPMDepthAndInvocationCountAccessFromUMD:cfl,whl,cml,aml
+         *
+         * This covers 4 register which are next to one another :
+         *   - PS_INVOCATION_COUNT
+         *   - PS_INVOCATION_COUNT_UDW
+         *   - PS_DEPTH_COUNT
+         *   - PS_DEPTH_COUNT_UDW
+         */
+        whitelist_reg_ext(w, PS_INVOCATION_COUNT,
+                          RING_FORCE_TO_NONPRIV_RD |
+                          RING_FORCE_TO_NONPRIV_RANGE_4);
 }
 
 static void cnl_whitelist_build(struct intel_engine_cs *engine)
@@ -1129,6 +1144,19 @@ static void icl_whitelist_build(struct intel_engine_cs *engine)
 
                 /* WaEnableStateCacheRedirectToCS:icl */
                 whitelist_reg(w, GEN9_SLICE_COMMON_ECO_CHICKEN1);
+
+                /*
+                 * WaAllowPMDepthAndInvocationCountAccessFromUMD:icl
+                 *
+                 * This covers 4 register which are next to one another :
+                 *   - PS_INVOCATION_COUNT
+                 *   - PS_INVOCATION_COUNT_UDW
+                 *   - PS_DEPTH_COUNT
+                 *   - PS_DEPTH_COUNT_UDW
+                 */
+                whitelist_reg_ext(w, PS_INVOCATION_COUNT,
+                                  RING_FORCE_TO_NONPRIV_RD |
+                                  RING_FORCE_TO_NONPRIV_RANGE_4);
                 break;
 
         case VIDEO_DECODE_CLASS:
@@ -1258,8 +1286,12 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
                 if (IS_ICL_REVID(i915, ICL_REVID_A0, ICL_REVID_B0))
                         wa_write_or(wal,
                                     GEN7_SARCHKMD,
-                                    GEN7_DISABLE_DEMAND_PREFETCH |
-                                    GEN7_DISABLE_SAMPLER_PREFETCH);
+                                    GEN7_DISABLE_DEMAND_PREFETCH);
+
+                /* Wa_1606682166:icl */
+                wa_write_or(wal,
+                            GEN7_SARCHKMD,
+                            GEN7_DISABLE_SAMPLER_PREFETCH);
         }
 
         if (IS_GEN_RANGE(i915, 9, 11)) {
diff --git a/drivers/gpu/drm/i915/gt/mock_engine.c b/drivers/gpu/drm/i915/gt/mock_engine.c
index 086801b51441..486c6953dcb1 100644
--- a/drivers/gpu/drm/i915/gt/mock_engine.c
+++ b/drivers/gpu/drm/i915/gt/mock_engine.c
@@ -66,6 +66,7 @@ static struct intel_ring *mock_ring(struct intel_engine_cs *engine)
         ring->base.effective_size = sz;
         ring->base.vaddr = (void *)(ring + 1);
         ring->base.timeline = &ring->timeline;
+        atomic_set(&ring->base.pin_count, 1);
 
         INIT_LIST_HEAD(&ring->base.request_list);
         intel_ring_update_space(&ring->base);
diff --git a/drivers/gpu/drm/i915/gt/selftest_reset.c b/drivers/gpu/drm/i915/gt/selftest_reset.c
index 89da9e7cc1ba..b5c590c9ccba 100644
--- a/drivers/gpu/drm/i915/gt/selftest_reset.c
+++ b/drivers/gpu/drm/i915/gt/selftest_reset.c
@@ -71,13 +71,16 @@ static int igt_atomic_reset(void *arg)
                 goto unlock;
 
         for (p = igt_atomic_phases; p->name; p++) {
+                intel_engine_mask_t awake;
+
                 GEM_TRACE("intel_gpu_reset under %s\n", p->name);
 
+                awake = reset_prepare(i915);
                 p->critical_section_begin();
                 reset_prepare(i915);
                 err = intel_gpu_reset(i915, ALL_ENGINES);
-                reset_finish(i915);
                 p->critical_section_end();
+                reset_finish(i915, awake);
 
                 if (err) {
                         pr_err("intel_gpu_reset failed under %s\n", p->name);
diff --git a/drivers/gpu/drm/i915/gt/selftest_workarounds.c b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
index 9eaf030affd0..44becd9538be 100644
--- a/drivers/gpu/drm/i915/gt/selftest_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/selftest_workarounds.c
@@ -925,7 +925,12 @@ check_whitelisted_registers(struct intel_engine_cs *engine,
 
         err = 0;
         for (i = 0; i < engine->whitelist.count; i++) {
-                if (!fn(engine, a[i], b[i], engine->whitelist.list[i].reg))
+                const struct i915_wa *wa = &engine->whitelist.list[i];
+
+                if (i915_mmio_reg_offset(wa->reg) & RING_FORCE_TO_NONPRIV_RD)
+                        continue;
+
+                if (!fn(engine, a[i], b[i], wa->reg))
                         err = -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 6ea88270c818..b09dc315e2da 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -2674,11 +2674,6 @@ static int scan_workload(struct intel_vgpu_workload *workload)
                 gma_head == gma_tail)
                 return 0;
 
-        if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
         ret = ip_gma_set(&s, gma_head);
         if (ret)
                 goto out;
@@ -2724,11 +2719,6 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         s.workload = workload;
         s.is_ctx_wa = true;
 
-        if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
         ret = ip_gma_set(&s, gma_head);
         if (ret)
                 goto out;
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
index 65e847392aea..8bb292b01271 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
@@ -245,7 +245,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
         plane->hw_format = fmt;
 
         plane->base = vgpu_vreg_t(vgpu, DSPSURF(pipe)) & I915_GTT_PAGE_MASK;
-        if (!intel_gvt_ggtt_validate_range(vgpu, plane->base, 0))
+        if (!vgpu_gmadr_is_valid(vgpu, plane->base))
                 return  -EINVAL;
 
         plane->base_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm, plane->base);
@@ -368,7 +368,7 @@ int intel_vgpu_decode_cursor_plane(struct intel_vgpu *vgpu,
                         alpha_plane, alpha_force);
 
         plane->base = vgpu_vreg_t(vgpu, CURBASE(pipe)) & I915_GTT_PAGE_MASK;
-        if (!intel_gvt_ggtt_validate_range(vgpu, plane->base, 0))
+        if (!vgpu_gmadr_is_valid(vgpu, plane->base))
                 return  -EINVAL;
 
         plane->base_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm, plane->base);
@@ -472,7 +472,7 @@ int intel_vgpu_decode_sprite_plane(struct intel_vgpu *vgpu,
         plane->drm_format = drm_format;
 
         plane->base = vgpu_vreg_t(vgpu, SPRSURF(pipe)) & I915_GTT_PAGE_MASK;
-        if (!intel_gvt_ggtt_validate_range(vgpu, plane->base, 0))
+        if (!vgpu_gmadr_is_valid(vgpu, plane->base))
                 return  -EINVAL;
 
         plane->base_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm, plane->base);
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 53115bdae12b..4b04af569c05 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -2141,11 +2141,20 @@ static int emulate_ggtt_mmio_read(struct intel_vgpu *vgpu,
         struct intel_vgpu_mm *ggtt_mm = vgpu->gtt.ggtt_mm;
         const struct intel_gvt_device_info *info = &vgpu->gvt->device_info;
         unsigned long index = off >> info->gtt_entry_size_shift;
+        unsigned long gma;
         struct intel_gvt_gtt_entry e;
 
         if (bytes != 4 && bytes != 8)
                 return -EINVAL;
 
+        gma = index << I915_GTT_PAGE_SHIFT;
+        if (!intel_gvt_ggtt_validate_range(vgpu,
+                                           gma, 1 << I915_GTT_PAGE_SHIFT)) {
+                gvt_dbg_mm("read invalid ggtt at 0x%lx\n", gma);
+                memset(p_data, 0, bytes);
+                return 0;
+        }
+
         ggtt_get_guest_entry(ggtt_mm, &e, index);
         memcpy(p_data, (void *)&e.val64 + (off & (info->gtt_entry_size - 1)),
                         bytes);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 144301b778df..23aa3e50cbf8 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1911,6 +1911,18 @@ static int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn,
                 ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
                 if (ret)
                         goto err_unmap;
+        } else if (entry->size != size) {
+                /* the same gfn with different size: unmap and re-map */
+                gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size);
+                __gvt_cache_remove_entry(vgpu, entry);
+
+                ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
+                if (ret)
+                        goto err_unlock;
+
+                ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
+                if (ret)
+                        goto err_unmap;
         } else {
                 kref_get(&entry->ref);
                 *dma_addr = entry->dma_addr;
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 2144fb46d0e1..9f3fd7d96a69 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -364,16 +364,13 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         wa_ctx->indirect_ctx.shadow_va = NULL;
 }
 
-static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
-                                         struct i915_gem_context *ctx)
+static void set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
+                                          struct i915_gem_context *ctx)
 {
         struct intel_vgpu_mm *mm = workload->shadow_mm;
         struct i915_ppgtt *ppgtt = i915_vm_to_ppgtt(ctx->vm);
         int i = 0;
 
-        if (mm->type != INTEL_GVT_MM_PPGTT || !mm->ppgtt_mm.shadowed)
-                return -EINVAL;
-
         if (mm->ppgtt_mm.root_entry_type == GTT_TYPE_PPGTT_ROOT_L4_ENTRY) {
                 px_dma(ppgtt->pd) = mm->ppgtt_mm.shadow_pdps[0];
         } else {
@@ -384,8 +381,6 @@ static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
                         px_dma(pd) = mm->ppgtt_mm.shadow_pdps[i];
                 }
         }
-
-        return 0;
 }
 
 static int
@@ -614,6 +609,8 @@ static void release_shadow_batch_buffer(struct intel_vgpu_workload *workload)
 static int prepare_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
+        struct intel_vgpu_submission *s = &vgpu->submission;
+        int ring = workload->ring_id;
         int ret = 0;
 
         ret = intel_vgpu_pin_mm(workload->shadow_mm);
@@ -622,8 +619,16 @@ static int prepare_workload(struct intel_vgpu_workload *workload)
                 return ret;
         }
 
+        if (workload->shadow_mm->type != INTEL_GVT_MM_PPGTT ||
+            !workload->shadow_mm->ppgtt_mm.shadowed) {
+                gvt_vgpu_err("workload shadow ppgtt isn't ready\n");
+                return -EINVAL;
+        }
+
         update_shadow_pdps(workload);
 
+        set_context_ppgtt_from_shadow(workload, s->shadow[ring]->gem_context);
+
         ret = intel_vgpu_sync_oos_pages(workload->vgpu);
         if (ret) {
                 gvt_vgpu_err("fail to vgpu sync oos pages\n");
@@ -674,7 +679,6 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
-        struct intel_vgpu_submission *s = &vgpu->submission;
         struct i915_request *rq;
         int ring_id = workload->ring_id;
         int ret;
@@ -685,13 +689,6 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         mutex_lock(&vgpu->vgpu_lock);
         mutex_lock(&dev_priv->drm.struct_mutex);
 
-        ret = set_context_ppgtt_from_shadow(workload,
-                                            s->shadow[ring_id]->gem_context);
-        if (ret < 0) {
-                gvt_vgpu_err("workload shadow ppgtt isn't ready\n");
-                goto err_req;
-        }
-
         ret = intel_gvt_workload_req_alloc(workload);
         if (ret)
                 goto err_req;
@@ -990,6 +987,7 @@ static int workload_thread(void *priv)
         int ret;
         bool need_force_wake = (INTEL_GEN(gvt->dev_priv) >= 9);
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
+        struct intel_runtime_pm *rpm = &gvt->dev_priv->runtime_pm;
 
         kfree(p);
 
@@ -1013,6 +1011,8 @@ static int workload_thread(void *priv)
                                 workload->ring_id, workload,
                                 workload->vgpu->id);
 
+                intel_runtime_pm_get(rpm);
+
                 gvt_dbg_sched("ring id %d will dispatch workload %p\n",
                                 workload->ring_id, workload);
 
@@ -1042,6 +1042,7 @@ complete:
                         intel_uncore_forcewake_put(&gvt->dev_priv->uncore,
                                         FORCEWAKE_ALL);
 
+                intel_runtime_pm_put_unchecked(rpm);
                 if (ret && (vgpu_is_vm_unhealthy(ret)))
                         enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
         }
@@ -1492,6 +1493,12 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
         intel_gvt_hypervisor_read_gpa(vgpu, ring_context_gpa +
                         RING_CTX_OFF(ctx_ctrl.val), &ctx_ctl, 4);
 
+        if (!intel_gvt_ggtt_validate_range(vgpu, start,
+                                _RING_CTL_BUF_SIZE(ctl))) {
+                gvt_vgpu_err("context contain invalid rb at: 0x%x\n", start);
+                return ERR_PTR(-EINVAL);
+        }
+
         workload = alloc_workload(vgpu);
         if (IS_ERR(workload))
                 return workload;
@@ -1516,9 +1523,31 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                 workload->wa_ctx.indirect_ctx.size =
                         (indirect_ctx & INDIRECT_CTX_SIZE_MASK) *
                         CACHELINE_BYTES;
+
+                if (workload->wa_ctx.indirect_ctx.size != 0) {
+                        if (!intel_gvt_ggtt_validate_range(vgpu,
+                                workload->wa_ctx.indirect_ctx.guest_gma,
+                                workload->wa_ctx.indirect_ctx.size)) {
+                                kmem_cache_free(s->workloads, workload);
+                                gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n",
+                                    workload->wa_ctx.indirect_ctx.guest_gma);
+                                return ERR_PTR(-EINVAL);
+                        }
+                }
+
                 workload->wa_ctx.per_ctx.guest_gma =
                         per_ctx & PER_CTX_ADDR_MASK;
                 workload->wa_ctx.per_ctx.valid = per_ctx & 1;
+                if (workload->wa_ctx.per_ctx.valid) {
+                        if (!intel_gvt_ggtt_validate_range(vgpu,
+                                workload->wa_ctx.per_ctx.guest_gma,
+                                CACHELINE_BYTES)) {
+                                kmem_cache_free(s->workloads, workload);
+                                gvt_vgpu_err("invalid per_ctx at: 0x%lx\n",
+                                        workload->wa_ctx.per_ctx.guest_gma);
+                                return ERR_PTR(-EINVAL);
+                        }
+                }
         }
 
         gvt_dbg_el("workload %p ring id %d head %x tail %x start %x ctl %x\n",
diff --git a/drivers/gpu/drm/i915/gvt/trace_points.c b/drivers/gpu/drm/i915/gvt/trace_points.c
index a3deed692b9c..fe552e877e09 100644
--- a/drivers/gpu/drm/i915/gvt/trace_points.c
+++ b/drivers/gpu/drm/i915/gvt/trace_points.c
@@ -28,8 +28,6 @@
  *
  */
 
-#include "trace.h"
-
 #ifndef __CHECKER__
 #define CREATE_TRACE_POINTS
 #include "trace.h"
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index bc909ec5d9c3..fe7a6ec2c199 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1674,8 +1674,9 @@ struct drm_i915_private {
         } dram_info;
 
         struct intel_bw_info {
-                int num_planes;
-                int deratedbw[3];
+                unsigned int deratedbw[3]; /* for each QGV point */
+                u8 num_qgv_points;
+                u8 num_planes;
         } max_bw[6];
 
         struct drm_private_obj bw_obj;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 190ad54fb072..8a659d3d7435 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -46,7 +46,6 @@
 #include "gem/i915_gem_ioctls.h"
 #include "gem/i915_gem_pm.h"
 #include "gem/i915_gemfs.h"
-#include "gt/intel_engine_pm.h"
 #include "gt/intel_gt_pm.h"
 #include "gt/intel_mocs.h"
 #include "gt/intel_reset.h"
@@ -1307,21 +1306,13 @@ int i915_gem_init_hw(struct drm_i915_private *dev_priv)
 
         intel_mocs_init_l3cc_table(dev_priv);
 
-        /* Only when the HW is re-initialised, can we replay the requests */
-        ret = intel_engines_resume(dev_priv);
-        if (ret)
-                goto cleanup_uc;
-
         intel_uncore_forcewake_put(&dev_priv->uncore, FORCEWAKE_ALL);
 
         intel_engines_set_scheduler_caps(dev_priv);
         return 0;
 
-cleanup_uc:
-        intel_uc_fini_hw(dev_priv);
 out:
         intel_uncore_forcewake_put(&dev_priv->uncore, FORCEWAKE_ALL);
-
         return ret;
 }
 
@@ -1580,6 +1571,11 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
         if (ret)
                 goto err_uc_init;
 
+        /* Only when the HW is re-initialised, can we replay the requests */
+        ret = intel_gt_resume(dev_priv);
+        if (ret)
+                goto err_init_hw;
+
         /*
          * Despite its name intel_init_clock_gating applies both display
          * clock gating workarounds; GT mmio workarounds and the occasional
@@ -1593,20 +1589,20 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
 
         ret = intel_engines_verify_workarounds(dev_priv);
         if (ret)
-                goto err_init_hw;
+                goto err_gt;
 
         ret = __intel_engines_record_defaults(dev_priv);
         if (ret)
-                goto err_init_hw;
+                goto err_gt;
 
         if (i915_inject_load_failure()) {
                 ret = -ENODEV;
-                goto err_init_hw;
+                goto err_gt;
         }
 
         if (i915_inject_load_failure()) {
                 ret = -EIO;
-                goto err_init_hw;
+                goto err_gt;
         }
 
         intel_uncore_forcewake_put(&dev_priv->uncore, FORCEWAKE_ALL);
@@ -1620,7 +1616,7 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
          * HW as irrevisibly wedged, but keep enough state around that the
          * driver doesn't explode during runtime.
          */
-err_init_hw:
+err_gt:
         mutex_unlock(&dev_priv->drm.struct_mutex);
 
         i915_gem_set_wedged(dev_priv);
@@ -1630,6 +1626,7 @@ err_init_hw:
         i915_gem_drain_workqueue(dev_priv);
 
         mutex_lock(&dev_priv->drm.struct_mutex);
+err_init_hw:
         intel_uc_fini_hw(dev_priv);
 err_uc_init:
         intel_uc_fini(dev_priv);
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 8ab820145ea6..7015a97b1097 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1444,9 +1444,11 @@ unwind_pd:
         spin_lock(&pdp->lock);
         if (atomic_dec_and_test(&pd->used)) {
                 gen8_ppgtt_set_pdpe(pdp, vm->scratch_pd, pdpe);
+                pdp->entry[pdpe] = vm->scratch_pd;
                 GEM_BUG_ON(!atomic_read(&pdp->used));
                 atomic_dec(&pdp->used);
-                free_pd(vm, pd);
+                GEM_BUG_ON(alloc);
+                alloc = pd; /* defer the free to after the lock */
         }
         spin_unlock(&pdp->lock);
 unwind:
@@ -1515,7 +1517,9 @@ unwind_pdp:
         spin_lock(&pml4->lock);
         if (atomic_dec_and_test(&pdp->used)) {
                 gen8_ppgtt_set_pml4e(pml4, vm->scratch_pdp, pml4e);
-                free_pd(vm, pdp);
+                pml4->entry[pml4e] = vm->scratch_pdp;
+                GEM_BUG_ON(alloc);
+                alloc = pdp; /* defer the free until after the lock */
         }
         spin_unlock(&pml4->lock);
 unwind:
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index b7e9fddef270..8bc76fcff70d 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1194,6 +1194,7 @@ static void error_record_engine_registers(struct i915_gpu_state *error,
                         switch (engine->id) {
                         default:
                                 MISSING_CASE(engine->id);
+                                /* fall through */
                         case RCS0:
                                 mmio = RENDER_HWS_PGA_GEN7;
                                 break;
@@ -1417,6 +1418,7 @@ static void gem_record_rings(struct i915_gpu_state *error)
                 struct intel_engine_cs *engine = i915->engine[i];
                 struct drm_i915_error_engine *ee = &error->engine[i];
                 struct i915_request *request;
+                unsigned long flags;
 
                 ee->engine_id = -1;
 
@@ -1428,10 +1430,11 @@ static void gem_record_rings(struct i915_gpu_state *error)
                 error_record_engine_registers(error, engine, ee);
                 error_record_engine_execlists(engine, ee);
 
+                spin_lock_irqsave(&engine->active.lock, flags);
                 request = intel_engine_find_active_request(engine);
                 if (request) {
                         struct i915_gem_context *ctx = request->gem_context;
-                        struct intel_ring *ring;
+                        struct intel_ring *ring = request->ring;
 
                         ee->vm = ctx->vm ?: &ggtt->vm;
 
@@ -1461,7 +1464,6 @@ static void gem_record_rings(struct i915_gpu_state *error)
                         ee->rq_post = request->postfix;
                         ee->rq_tail = request->tail;
 
-                        ring = request->ring;
                         ee->cpu_ring_head = ring->head;
                         ee->cpu_ring_tail = ring->tail;
                         ee->ringbuffer =
@@ -1469,6 +1471,7 @@ static void gem_record_rings(struct i915_gpu_state *error)
 
                         engine_record_requests(engine, request, ee);
                 }
+                spin_unlock_irqrestore(&engine->active.lock, flags);
 
                 ee->hws_page =
                         i915_error_object_create(i915,
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index a700c5c3d167..5140017f9a39 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1567,28 +1567,10 @@ static void config_oa_regs(struct drm_i915_private *dev_priv,
         }
 }
 
-static int hsw_enable_metric_set(struct i915_perf_stream *stream)
+static void delay_after_mux(void)
 {
-        struct drm_i915_private *dev_priv = stream->dev_priv;
-        const struct i915_oa_config *oa_config = stream->oa_config;
-
-        /* PRM:
-         *
-         * OA unit is using “crclk” for its functionality. When trunk
-         * level clock gating takes place, OA clock would be gated,
-         * unable to count the events from non-render clock domain.
-         * Render clock gating must be disabled when OA is enabled to
-         * count the events from non-render domain. Unit level clock
-         * gating for RCS should also be disabled.
-         */
-        I915_WRITE(GEN7_MISCCPCTL, (I915_READ(GEN7_MISCCPCTL) &
-                                    ~GEN7_DOP_CLOCK_GATE_ENABLE));
-        I915_WRITE(GEN6_UCGCTL1, (I915_READ(GEN6_UCGCTL1) |
-                                  GEN6_CSUNIT_CLOCK_GATE_DISABLE));
-
-        config_oa_regs(dev_priv, oa_config->mux_regs, oa_config->mux_regs_len);
-
-        /* It apparently takes a fairly long time for a new MUX
+        /*
+         * It apparently takes a fairly long time for a new MUX
          * configuration to be be applied after these register writes.
          * This delay duration was derived empirically based on the
          * render_basic config but hopefully it covers the maximum
@@ -1610,6 +1592,30 @@ static int hsw_enable_metric_set(struct i915_perf_stream *stream)
          * a delay at this location would mitigate any invalid reports.
          */
         usleep_range(15000, 20000);
+}
+
+static int hsw_enable_metric_set(struct i915_perf_stream *stream)
+{
+        struct drm_i915_private *dev_priv = stream->dev_priv;
+        const struct i915_oa_config *oa_config = stream->oa_config;
+
+        /*
+         * PRM:
+         *
+         * OA unit is using “crclk” for its functionality. When trunk
+         * level clock gating takes place, OA clock would be gated,
+         * unable to count the events from non-render clock domain.
+         * Render clock gating must be disabled when OA is enabled to
+         * count the events from non-render domain. Unit level clock
+         * gating for RCS should also be disabled.
+         */
+        I915_WRITE(GEN7_MISCCPCTL, (I915_READ(GEN7_MISCCPCTL) &
+                                    ~GEN7_DOP_CLOCK_GATE_ENABLE));
+        I915_WRITE(GEN6_UCGCTL1, (I915_READ(GEN6_UCGCTL1) |
+                                  GEN6_CSUNIT_CLOCK_GATE_DISABLE));
+
+        config_oa_regs(dev_priv, oa_config->mux_regs, oa_config->mux_regs_len);
+        delay_after_mux();
 
         config_oa_regs(dev_priv, oa_config->b_counter_regs,
                        oa_config->b_counter_regs_len);
@@ -1835,6 +1841,7 @@ static int gen8_enable_metric_set(struct i915_perf_stream *stream)
                 return ret;
 
         config_oa_regs(dev_priv, oa_config->mux_regs, oa_config->mux_regs_len);
+        delay_after_mux();
 
         config_oa_regs(dev_priv, oa_config->b_counter_regs,
                        oa_config->b_counter_regs_len);
@@ -2515,6 +2522,9 @@ static int i915_perf_release(struct inode *inode, struct file *file)
         i915_perf_destroy_locked(stream);
         mutex_unlock(&dev_priv->perf.lock);
 
+        /* Release the reference the perf stream kept on the driver. */
+        drm_dev_put(&dev_priv->drm);
+
         return 0;
 }
 
@@ -2650,6 +2660,11 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
         if (!(param->flags & I915_PERF_FLAG_DISABLED))
                 i915_perf_enable_locked(stream);
 
+        /* Take a reference on the driver that will be kept with stream_fd
+         * until its release.
+         */
+        drm_dev_get(&dev_priv->drm);
+
         return stream_fd;
 
 err_open:
@@ -3477,9 +3492,13 @@ void i915_perf_init(struct drm_i915_private *dev_priv)
                         dev_priv->perf.oa.ops.enable_metric_set = gen8_enable_metric_set;
                         dev_priv->perf.oa.ops.disable_metric_set = gen10_disable_metric_set;
 
-                        dev_priv->perf.oa.ctx_oactxctrl_offset = 0x128;
-                        dev_priv->perf.oa.ctx_flexeu0_offset = 0x3de;
-
+                        if (IS_GEN(dev_priv, 10)) {
+                                dev_priv->perf.oa.ctx_oactxctrl_offset = 0x128;
+                                dev_priv->perf.oa.ctx_flexeu0_offset = 0x3de;
+                        } else {
+                                dev_priv->perf.oa.ctx_oactxctrl_offset = 0x124;
+                                dev_priv->perf.oa.ctx_flexeu0_offset = 0x78e;
+                        }
                         dev_priv->perf.oa.gen8_valid_ctx_bit = (1<<16);
                 }
         }
diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
index f4ce643b3bc3..cce426b23a24 100644
--- a/drivers/gpu/drm/i915/i915_trace.h
+++ b/drivers/gpu/drm/i915/i915_trace.h
@@ -21,24 +21,22 @@
 /* watermark/fifo updates */
 
 TRACE_EVENT(intel_pipe_enable,
-            TP_PROTO(struct drm_i915_private *dev_priv, enum pipe pipe),
-            TP_ARGS(dev_priv, pipe),
+            TP_PROTO(struct intel_crtc *crtc),
+            TP_ARGS(crtc),
 
             TP_STRUCT__entry(
                              __array(u32, frame, 3)
                              __array(u32, scanline, 3)
                              __field(enum pipe, pipe)
                              ),
-
             TP_fast_assign(
-                           enum pipe _pipe;
-                           for_each_pipe(dev_priv, _pipe) {
-                                   __entry->frame[_pipe] =
-                                           dev_priv->drm.driver->get_vblank_counter(&dev_priv->drm, _pipe);
-                                   __entry->scanline[_pipe] =
-                                           intel_get_crtc_scanline(intel_get_crtc_for_pipe(dev_priv, _pipe));
+                           struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+                           struct intel_crtc *it__;
+                           for_each_intel_crtc(&dev_priv->drm, it__) {
+                                   __entry->frame[it__->pipe] = intel_crtc_get_vblank_counter(it__);
+                                   __entry->scanline[it__->pipe] = intel_get_crtc_scanline(it__);
                            }
-                           __entry->pipe = pipe;
+                           __entry->pipe = crtc->pipe;
                            ),
 
             TP_printk("pipe %c enable, pipe A: frame=%u, scanline=%u, pipe B: frame=%u, scanline=%u, pipe C: frame=%u, scanline=%u",
@@ -49,8 +47,8 @@ TRACE_EVENT(intel_pipe_enable,
 );
 
 TRACE_EVENT(intel_pipe_disable,
-            TP_PROTO(struct drm_i915_private *dev_priv, enum pipe pipe),
-            TP_ARGS(dev_priv, pipe),
+            TP_PROTO(struct intel_crtc *crtc),
+            TP_ARGS(crtc),
 
             TP_STRUCT__entry(
                              __array(u32, frame, 3)
@@ -59,14 +57,13 @@ TRACE_EVENT(intel_pipe_disable,
                              ),
 
             TP_fast_assign(
-                           enum pipe _pipe;
-                           for_each_pipe(dev_priv, _pipe) {
-                                   __entry->frame[_pipe] =
-                                           dev_priv->drm.driver->get_vblank_counter(&dev_priv->drm, _pipe);
-                                   __entry->scanline[_pipe] =
-                                           intel_get_crtc_scanline(intel_get_crtc_for_pipe(dev_priv, _pipe));
+                           struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+                           struct intel_crtc *it__;
+                           for_each_intel_crtc(&dev_priv->drm, it__) {
+                                   __entry->frame[it__->pipe] = intel_crtc_get_vblank_counter(it__);
+                                   __entry->scanline[it__->pipe] = intel_get_crtc_scanline(it__);
                            }
-                           __entry->pipe = pipe;
+                           __entry->pipe = crtc->pipe;
                            ),
 
             TP_printk("pipe %c disable, pipe A: frame=%u, scanline=%u, pipe B: frame=%u, scanline=%u, pipe C: frame=%u, scanline=%u",
@@ -89,8 +86,7 @@ TRACE_EVENT(intel_pipe_crc,
 
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            memcpy(__entry->crcs, crcs, sizeof(__entry->crcs));
                            ),
@@ -112,9 +108,10 @@ TRACE_EVENT(intel_cpu_fifo_underrun,
                              ),
 
             TP_fast_assign(
+                            struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
                            __entry->pipe = pipe;
-                           __entry->frame = dev_priv->drm.driver->get_vblank_counter(&dev_priv->drm, pipe);
-                           __entry->scanline = intel_get_crtc_scanline(intel_get_crtc_for_pipe(dev_priv, pipe));
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
+                           __entry->scanline = intel_get_crtc_scanline(crtc);
                            ),
 
             TP_printk("pipe %c, frame=%u, scanline=%u",
@@ -134,9 +131,10 @@ TRACE_EVENT(intel_pch_fifo_underrun,
 
             TP_fast_assign(
                            enum pipe pipe = pch_transcoder;
+                           struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
                            __entry->pipe = pipe;
-                           __entry->frame = dev_priv->drm.driver->get_vblank_counter(&dev_priv->drm, pipe);
-                           __entry->scanline = intel_get_crtc_scanline(intel_get_crtc_for_pipe(dev_priv, pipe));
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
+                           __entry->scanline = intel_get_crtc_scanline(crtc);
                            ),
 
             TP_printk("pch transcoder %c, frame=%u, scanline=%u",
@@ -156,12 +154,10 @@ TRACE_EVENT(intel_memory_cxsr,
                              ),
 
             TP_fast_assign(
-                           enum pipe pipe;
-                           for_each_pipe(dev_priv, pipe) {
-                                   __entry->frame[pipe] =
-                                           dev_priv->drm.driver->get_vblank_counter(&dev_priv->drm, pipe);
-                                   __entry->scanline[pipe] =
-                                           intel_get_crtc_scanline(intel_get_crtc_for_pipe(dev_priv, pipe));
+                           struct intel_crtc *crtc;
+                           for_each_intel_crtc(&dev_priv->drm, crtc) {
+                                   __entry->frame[crtc->pipe] = intel_crtc_get_vblank_counter(crtc);
+                                   __entry->scanline[crtc->pipe] = intel_get_crtc_scanline(crtc);
                            }
                            __entry->old = old;
                            __entry->new = new;
@@ -198,8 +194,7 @@ TRACE_EVENT(g4x_wm,
 
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            __entry->primary = wm->pipe[crtc->pipe].plane[PLANE_PRIMARY];
                            __entry->sprite = wm->pipe[crtc->pipe].plane[PLANE_SPRITE0];
@@ -243,8 +238,7 @@ TRACE_EVENT(vlv_wm,
 
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            __entry->level = wm->level;
                            __entry->cxsr = wm->cxsr;
@@ -278,8 +272,7 @@ TRACE_EVENT(vlv_fifo_size,
 
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            __entry->sprite0_start = sprite0_start;
                            __entry->sprite1_start = sprite1_start;
@@ -310,8 +303,7 @@ TRACE_EVENT(intel_update_plane,
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
                            __entry->name = plane->name;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            memcpy(__entry->src, &plane->state->src, sizeof(__entry->src));
                            memcpy(__entry->dst, &plane->state->dst, sizeof(__entry->dst));
@@ -338,8 +330,7 @@ TRACE_EVENT(intel_disable_plane,
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
                            __entry->name = plane->name;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            ),
 
@@ -364,8 +355,7 @@ TRACE_EVENT(i915_pipe_update_start,
 
             TP_fast_assign(
                            __entry->pipe = crtc->pipe;
-                           __entry->frame = crtc->base.dev->driver->get_vblank_counter(crtc->base.dev,
-                                                                                       crtc->pipe);
+                           __entry->frame = intel_crtc_get_vblank_counter(crtc);
                            __entry->scanline = intel_get_crtc_scanline(crtc);
                            __entry->min = crtc->debug.min_vbl;
                            __entry->max = crtc->debug.max_vbl;
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 502c54428570..8d1aebc3e857 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -221,13 +221,11 @@ __untrack_all_wakerefs(struct intel_runtime_pm_debug *debug,
 static void
 dump_and_free_wakeref_tracking(struct intel_runtime_pm_debug *debug)
 {
-        struct drm_printer p;
+        if (debug->count) {
+                struct drm_printer p = drm_debug_printer("i915");
 
-        if (!debug->count)
-                return;
-
-        p = drm_debug_printer("i915");
-        __print_intel_runtime_pm_wakeref(&p, debug);
+                __print_intel_runtime_pm_wakeref(&p, debug);
+        }
 
         kfree(debug->owners);
 }
diff --git a/drivers/gpu/drm/i915/intel_wakeref.h b/drivers/gpu/drm/i915/intel_wakeref.h
index 9cbb2ebf575b..38275310b196 100644
--- a/drivers/gpu/drm/i915/intel_wakeref.h
+++ b/drivers/gpu/drm/i915/intel_wakeref.h
@@ -66,6 +66,21 @@ intel_wakeref_get(struct intel_runtime_pm *rpm,
 }
 
 /**
+ * intel_wakeref_get_if_in_use: Acquire the wakeref
+ * @wf: the wakeref
+ *
+ * Acquire a hold on the wakeref, but only if the wakeref is already
+ * active.
+ *
+ * Returns: true if the wakeref was acquired, false otherwise.
+ */
+static inline bool
+intel_wakeref_get_if_active(struct intel_wakeref *wf)
+{
+        return atomic_inc_not_zero(&wf->count);
+}
+
+/**
  * intel_wakeref_put: Release the wakeref
  * @i915: the drm_i915_private device
  * @wf: the wakeref
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 1671db47aa57..e9c55d1d6c04 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -59,6 +59,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit
                 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
                         if (priv->lastctx == ctx)
                                 break;
+                        /* fall-thru */
                 case MSM_SUBMIT_CMD_BUF:
                         /* copy commands into RB: */
                         obj = submit->bos[submit->cmd[i].idx].obj;
@@ -149,6 +150,7 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
                 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
                         if (priv->lastctx == ctx)
                                 break;
+                        /* fall-thru */
                 case MSM_SUBMIT_CMD_BUF:
                         OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
                         OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index be39cf01e51e..dc8ec2c94301 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -115,6 +115,7 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
                 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
                         if (priv->lastctx == ctx)
                                 break;
+                        /* fall-thru */
                 case MSM_SUBMIT_CMD_BUF:
                         OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
                         OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 9acbbc0f3232..048c8be426f3 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -428,6 +428,7 @@ void adreno_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
                         /* ignore if there has not been a ctx switch: */
                         if (priv->lastctx == ctx)
                                 break;
+                        /* fall-thru */
                 case MSM_SUBMIT_CMD_BUF:
                         OUT_PKT3(ring, adreno_is_a430(adreno_gpu) ?
                                 CP_INDIRECT_BUFFER_PFE : CP_INDIRECT_BUFFER_PFD, 2);
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 0e2f74163a16..0aa8a12c9952 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -2221,8 +2221,6 @@ int dpu_encoder_setup(struct drm_device *dev, struct drm_encoder *enc,
         if (ret)
                 goto fail;
 
-        spin_lock_init(&dpu_enc->enc_spinlock);
-
         atomic_set(&dpu_enc->frame_done_timeout_ms, 0);
         timer_setup(&dpu_enc->frame_done_timer,
                         dpu_encoder_frame_done_timeout, 0);
@@ -2276,6 +2274,7 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
 
         drm_encoder_helper_add(&dpu_enc->base, &dpu_encoder_helper_funcs);
 
+        spin_lock_init(&dpu_enc->enc_spinlock);
         dpu_enc->enabled = false;
 
         return &dpu_enc->base;
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index ff14555372d0..78d5fa230c16 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -439,6 +439,18 @@ static void mdp5_crtc_atomic_disable(struct drm_crtc *crtc,
         mdp5_crtc->enabled = false;
 }
 
+static void mdp5_crtc_vblank_on(struct drm_crtc *crtc)
+{
+        struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+        struct mdp5_interface *intf = mdp5_cstate->pipeline.intf;
+        u32 count;
+
+        count = intf->mode == MDP5_INTF_DSI_MODE_COMMAND ? 0 : 0xffffffff;
+        drm_crtc_set_max_vblank_count(crtc, count);
+
+        drm_crtc_vblank_on(crtc);
+}
+
 static void mdp5_crtc_atomic_enable(struct drm_crtc *crtc,
                                     struct drm_crtc_state *old_state)
 {
@@ -475,7 +487,7 @@ static void mdp5_crtc_atomic_enable(struct drm_crtc *crtc,
         }
 
         /* Restore vblank irq handling after power is enabled */
-        drm_crtc_vblank_on(crtc);
+        mdp5_crtc_vblank_on(crtc);
 
         mdp5_crtc_mode_set_nofb(crtc);
 
@@ -1028,6 +1040,8 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc)
                 mdp5_crtc_destroy_state(crtc, crtc->state);
 
         __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
+
+        drm_crtc_vblank_reset(crtc);
 }
 
 static const struct drm_crtc_funcs mdp5_crtc_funcs = {
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
index 4a60f5fca6b0..fec6ef1ae3b9 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
@@ -740,7 +740,7 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev)
         dev->driver->get_vblank_timestamp = drm_calc_vbltimestamp_from_scanoutpos;
         dev->driver->get_scanout_position = mdp5_get_scanoutpos;
         dev->driver->get_vblank_counter = mdp5_get_vblank_counter;
-        dev->max_vblank_count = 0xffffffff;
+        dev->max_vblank_count = 0; /* max_vblank_count is set on each CRTC */
         dev->vblank_disable_immediate = true;
 
         return kms;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index ab64ab470de7..c356f5ccf253 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -619,7 +619,7 @@ static int context_init(struct drm_device *dev, struct drm_file *file)
 
         msm_submitqueue_init(dev, ctx);
 
-        ctx->aspace = priv->gpu->aspace;
+        ctx->aspace = priv->gpu ? priv->gpu->aspace : NULL;
         file->driver_priv = ctx;
 
         return 0;
@@ -1279,7 +1279,8 @@ static int add_gpu_components(struct device *dev,
         if (!np)
                 return 0;
 
-        drm_of_component_match_add(dev, matchptr, compare_of, np);
+        if (of_device_is_available(np))
+                drm_of_component_match_add(dev, matchptr, compare_of, np);
 
         of_node_put(np);
 
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 8b78554cfde3..8cf6362e64bf 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -32,6 +32,46 @@ static bool use_pages(struct drm_gem_object *obj)
         return !msm_obj->vram_node;
 }
 
+/*
+ * Cache sync.. this is a bit over-complicated, to fit dma-mapping
+ * API.  Really GPU cache is out of scope here (handled on cmdstream)
+ * and all we need to do is invalidate newly allocated pages before
+ * mapping to CPU as uncached/writecombine.
+ *
+ * On top of this, we have the added headache, that depending on
+ * display generation, the display's iommu may be wired up to either
+ * the toplevel drm device (mdss), or to the mdp sub-node, meaning
+ * that here we either have dma-direct or iommu ops.
+ *
+ * Let this be a cautionary tail of abstraction gone wrong.
+ */
+
+static void sync_for_device(struct msm_gem_object *msm_obj)
+{
+        struct device *dev = msm_obj->base.dev->dev;
+
+        if (get_dma_ops(dev)) {
+                dma_sync_sg_for_device(dev, msm_obj->sgt->sgl,
+                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+        } else {
+                dma_map_sg(dev, msm_obj->sgt->sgl,
+                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+        }
+}
+
+static void sync_for_cpu(struct msm_gem_object *msm_obj)
+{
+        struct device *dev = msm_obj->base.dev->dev;
+
+        if (get_dma_ops(dev)) {
+                dma_sync_sg_for_cpu(dev, msm_obj->sgt->sgl,
+                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+        } else {
+                dma_unmap_sg(dev, msm_obj->sgt->sgl,
+                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+        }
+}
+
 /* allocate pages from VRAM carveout, used when no IOMMU: */
 static struct page **get_pages_vram(struct drm_gem_object *obj, int npages)
 {
@@ -97,8 +137,7 @@ static struct page **get_pages(struct drm_gem_object *obj)
                  * because display controller, GPU, etc. are not coherent:
                  */
                 if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
-                        dma_map_sg(dev->dev, msm_obj->sgt->sgl,
-                                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+                        sync_for_device(msm_obj);
         }
 
         return msm_obj->pages;
@@ -127,9 +166,7 @@ static void put_pages(struct drm_gem_object *obj)
                          * GPU, etc. are not coherent:
                          */
                         if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
-                                dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
-                                             msm_obj->sgt->nents,
-                                             DMA_BIDIRECTIONAL);
+                                sync_for_cpu(msm_obj);
 
                         sg_free_table(msm_obj->sgt);
                         kfree(msm_obj->sgt);
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 8497768f1b41..126703816794 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -780,7 +780,7 @@ nv50_msto_atomic_check(struct drm_encoder *encoder,
                         drm_dp_calc_pbn_mode(crtc_state->adjusted_mode.clock,
                                              connector->display_info.bpc * 3);
 
-        if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+        if (crtc_state->mode_changed) {
                 slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr,
                                                       mstc->port,
                                                       asyh->dp.pbn);
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 8c92374afcf2..a835cebb6d90 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -475,6 +475,47 @@ nouveau_svm_fault_cache(struct nouveau_svm *svm,
                 fault->inst, fault->addr, fault->access);
 }
 
+static inline bool
+nouveau_range_done(struct hmm_range *range)
+{
+        bool ret = hmm_range_valid(range);
+
+        hmm_range_unregister(range);
+        return ret;
+}
+
+static int
+nouveau_range_fault(struct hmm_mirror *mirror, struct hmm_range *range)
+{
+        long ret;
+
+        range->default_flags = 0;
+        range->pfn_flags_mask = -1UL;
+
+        ret = hmm_range_register(range, mirror,
+                                 range->start, range->end,
+                                 PAGE_SHIFT);
+        if (ret) {
+                up_read(&range->vma->vm_mm->mmap_sem);
+                return (int)ret;
+        }
+
+        if (!hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT)) {
+                up_read(&range->vma->vm_mm->mmap_sem);
+                return -EAGAIN;
+        }
+
+        ret = hmm_range_fault(range, true);
+        if (ret <= 0) {
+                if (ret == 0)
+                        ret = -EBUSY;
+                up_read(&range->vma->vm_mm->mmap_sem);
+                hmm_range_unregister(range);
+                return ret;
+        }
+        return 0;
+}
+
 static int
 nouveau_svm_fault(struct nvif_notify *notify)
 {
@@ -649,10 +690,10 @@ nouveau_svm_fault(struct nvif_notify *notify)
                 range.values = nouveau_svm_pfn_values;
                 range.pfn_shift = NVIF_VMM_PFNMAP_V0_ADDR_SHIFT;
 again:
-                ret = hmm_vma_fault(&svmm->mirror, &range, true);
+                ret = nouveau_range_fault(&svmm->mirror, &range);
                 if (ret == 0) {
                         mutex_lock(&svmm->mutex);
-                        if (!hmm_vma_range_done(&range)) {
+                        if (!nouveau_range_done(&range)) {
                                 mutex_unlock(&svmm->mutex);
                                 goto again;
                         }
@@ -666,8 +707,8 @@ again:
                                                 NULL);
                         svmm->vmm->vmm.object.client->super = false;
                         mutex_unlock(&svmm->mutex);
+                        up_read(&svmm->mm->mmap_sem);
                 }
-                up_read(&svmm->mm->mmap_sem);
 
                 /* Cancel any faults in the window whose pages didn't manage
                  * to keep their valid bit, or stay writeable when required.
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index d594f7520b7b..7d78e6deac89 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -285,9 +285,13 @@ static int ttm_set_pages_caching(struct dma_pool *pool,
 
 static void __ttm_dma_free_page(struct dma_pool *pool, struct dma_page *d_page)
 {
+        unsigned long attrs = 0;
         dma_addr_t dma = d_page->dma;
         d_page->vaddr &= ~VADDR_FLAG_HUGE_POOL;
-        dma_free_coherent(pool->dev, pool->size, (void *)d_page->vaddr, dma);
+        if (pool->type & IS_HUGE)
+                attrs = DMA_ATTR_NO_WARN;
+
+        dma_free_attrs(pool->dev, pool->size, (void *)d_page->vaddr, dma, attrs);
 
         kfree(d_page);
         d_page = NULL;
diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 98bf694626f7..3a8c4a5971f7 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -23,12 +23,36 @@
 #define A4_2WHEEL_MOUSE_HACK_7  0x01
 #define A4_2WHEEL_MOUSE_HACK_B8 0x02
 
+#define A4_WHEEL_ORIENTATION    (HID_UP_GENDESK | 0x000000b8)
+
 struct a4tech_sc {
         unsigned long quirks;
         unsigned int hw_wheel;
         __s32 delayed_value;
 };
 
+static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+                            struct hid_field *field, struct hid_usage *usage,
+                            unsigned long **bit, int *max)
+{
+        struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+
+        if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
+            usage->hid == A4_WHEEL_ORIENTATION) {
+                /*
+                 * We do not want to have this usage mapped to anything as it's
+                 * nonstandard and doesn't really behave like an HID report.
+                 * It's only selecting the orientation (vertical/horizontal) of
+                 * the previous mouse wheel report. The input_events will be
+                 * generated once both reports are recorded in a4_event().
+                 */
+                return -1;
+        }
+
+        return 0;
+
+}
+
 static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
         struct a4tech_sc *a4 = hid_get_drvdata(hdev);
         struct input_dev *input;
 
-        if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
-                        !usage->type)
+        if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
                 return 0;
 
         input = field->hidinput->input;
@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
                         return 1;
                 }
 
-                if (usage->hid == 0x000100b8) {
+                if (usage->hid == A4_WHEEL_ORIENTATION) {
                         input_event(input, EV_REL, value ? REL_HWHEEL :
                                         REL_WHEEL, a4->delayed_value);
                         input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
 static struct hid_driver a4_driver = {
         .name = "a4tech",
         .id_table = a4_devices,
+        .input_mapping = a4_input_mapping,
         .input_mapped = a4_input_mapped,
         .event = a4_event,
         .probe = a4_probe,
diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index b3d502421b79..0a38e8e9bc78 100644
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -123,9 +123,14 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
 
         /* Locate the boot interface, to receive the LED change events */
         struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0);
+        struct hid_device *boot_hid;
+        struct hid_input *boot_hid_input;
 
-        struct hid_device *boot_hid = usb_get_intfdata(boot_interface);
-        struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs,
+        if (unlikely(boot_interface == NULL))
+                return -ENODEV;
+
+        boot_hid = usb_get_intfdata(boot_interface);
+        boot_hid_input = list_first_entry(&boot_hid->inputs,
                 struct hid_input, list);
 
         return boot_hid_input->input->event(boot_hid_input->input, type, code,
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 0d695f8e1b2c..0a00be19f7a0 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -568,6 +568,7 @@
 #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A   0x0b4a
 #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE          0x134a
 #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A     0x094a
+#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641     0x0641
 
 #define USB_VENDOR_ID_HUION             0x256c
 #define USB_DEVICE_ID_HUION_TABLET      0x006e
@@ -768,7 +769,8 @@
 #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER            0xc52f
 #define USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2      0xc532
 #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2          0xc534
-#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_GAMING     0xc539
+#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED 0xc539
+#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY  0xc53a
 #define USB_DEVICE_ID_SPACETRAVELLER    0xc623
 #define USB_DEVICE_ID_SPACENAVIGATOR    0xc626
 #define USB_DEVICE_ID_DINOVO_DESKTOP    0xc704
@@ -989,6 +991,7 @@
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_RAT9       0x0cfa
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
+#define USB_DEVICE_ID_SAITEK_X52        0x075c
 
 #define USB_VENDOR_ID_SAMSUNG           0x0419
 #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 6196217a7d93..cc47f948c1d0 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1125,7 +1125,7 @@ static int logi_dj_recv_query_hidpp_devices(struct dj_receiver_dev *djrcv_dev)
                                     HID_REQ_SET_REPORT);
 
         kfree(hidpp_report);
-        return retval;
+        return (retval < 0) ? retval : 0;
 }
 
 static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
@@ -1832,13 +1832,17 @@ static const struct hid_device_id logi_dj_receivers[] = {
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                          USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2),
          .driver_data = recvr_type_hidpp},
-        { /* Logitech gaming receiver (0xc539) */
+        { /* Logitech lightspeed receiver (0xc539) */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
-                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_GAMING),
+                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED),
          .driver_data = recvr_type_gaming_hidpp},
         { /* Logitech 27 MHz HID++ 1.0 receiver (0xc513) */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER),
          .driver_data = recvr_type_27mhz},
+        { /* Logitech powerplay receiver (0xc53a) */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
+                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY),
+         .driver_data = recvr_type_gaming_hidpp},
         { /* Logitech 27 MHz HID++ 1.0 receiver (0xc517) */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                 USB_DEVICE_ID_S510_RECEIVER_2),
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index e3b6245bf4b2..21268c9fa71a 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3749,15 +3749,45 @@ static const struct hid_device_id hidpp_devices[] = {
 
         { L27MHZ_DEVICE(HID_ANY_ID) },
 
-        { /* Logitech G403 Gaming Mouse over USB */
+        { /* Logitech G203/Prodigy Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
+        { /* Logitech G302 Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
+        { /* Logitech G303 Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
+        { /* Logitech G400 Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
+        { /* Logitech G403 Wireless Gaming Mouse over USB */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
+        { /* Logitech G403 Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
+        { /* Logitech G403 Hero Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
+        { /* Logitech G502 Proteus Core Gaming Mouse */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
+        { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
+        { /* Logitech G502 Hero Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
         { /* Logitech G700 Gaming Mouse over USB */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
+        { /* Logitech G700s Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
+        { /* Logitech G703 Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
+        { /* Logitech G703 Hero Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC090) },
         { /* Logitech G900 Gaming Mouse over USB */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC081) },
+        { /* Logitech G903 Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
+        { /* Logitech G903 Hero Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
         { /* Logitech G920 Wheel over USB */
           HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
                 .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
+        { /* Logitech G Pro Gaming Mouse over USB */
+          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) },
 
         { /* MX5000 keyboard over Bluetooth */
           HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305),
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 185a577c46f6..166f41f3173b 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -92,6 +92,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
         { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
@@ -141,6 +142,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
         { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
         { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 93942063b51b..49dd2d905c7f 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -585,10 +585,14 @@ static void sony_set_leds(struct sony_sc *sc);
 static inline void sony_schedule_work(struct sony_sc *sc,
                                       enum sony_worker which)
 {
+        unsigned long flags;
+
         switch (which) {
         case SONY_WORKER_STATE:
-                if (!sc->defer_initialization)
+                spin_lock_irqsave(&sc->lock, flags);
+                if (!sc->defer_initialization && sc->state_worker_initialized)
                         schedule_work(&sc->state_worker);
+                spin_unlock_irqrestore(&sc->lock, flags);
                 break;
         case SONY_WORKER_HOTPLUG:
                 if (sc->hotplug_worker_initialized)
@@ -2558,13 +2562,18 @@ static inline void sony_init_output_report(struct sony_sc *sc,
 
 static inline void sony_cancel_work_sync(struct sony_sc *sc)
 {
+        unsigned long flags;
+
         if (sc->hotplug_worker_initialized)
                 cancel_work_sync(&sc->hotplug_worker);
-        if (sc->state_worker_initialized)
+        if (sc->state_worker_initialized) {
+                spin_lock_irqsave(&sc->lock, flags);
+                sc->state_worker_initialized = 0;
+                spin_unlock_irqrestore(&sc->lock, flags);
                 cancel_work_sync(&sc->state_worker);
+        }
 }
 
-
 static int sony_input_configured(struct hid_device *hdev,
                                         struct hid_input *hidinput)
 {
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index e12f2588ddeb..bdfc5ff3b2c5 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -22,6 +22,8 @@
 
 #include "hid-ids.h"
 
+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT        0xb320
+
 static const signed short ff_rumble[] = {
         FF_RUMBLE,
         -1
@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data,
         struct hid_field *ff_field = tmff->ff_field;
         int x, y;
         int left, right;        /* Rumbling */
+        int motor_swap;
 
         switch (effect->type) {
         case FF_CONSTANT:
@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data,
                                         ff_field->logical_minimum,
                                         ff_field->logical_maximum);
 
+                /* 2-in-1 strong motor is left */
+                if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
+                        motor_swap = left;
+                        left = right;
+                        right = motor_swap;
+                }
+
                 dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
                 ff_field->value[0] = left;
                 ff_field->value[1] = right;
@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = {
                 .driver_data = (unsigned long)ff_rumble },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304),   /* FireStorm Dual Power 2 (and 3) */
                 .driver_data = (unsigned long)ff_rumble },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT),   /* Dual Trigger 2-in-1 */
+                .driver_data = (unsigned long)ff_rumble },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323),   /* Dual Trigger 3-in-1 (PC Mode) */
                 .driver_data = (unsigned long)ff_rumble },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324),   /* Dual Trigger 3-in-1 (PS3 Mode) */
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 55b72573066b..4e11cc6fc34b 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -284,6 +284,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
         spin_unlock_irq(&list->hiddev->list_lock);
 
         mutex_lock(&hiddev->existancelock);
+        /*
+         * recheck exist with existance lock held to
+         * avoid opening a disconnected device
+         */
+        if (!list->hiddev->exist) {
+                res = -ENODEV;
+                goto bail_unlock;
+        }
         if (!list->hiddev->open++)
                 if (list->hiddev->exist) {
                         struct hid_device *hid = hiddev->hid;
@@ -300,6 +308,10 @@ bail_normal_power:
         hid_hw_power(hid, PM_HINT_NORMAL);
 bail_unlock:
         mutex_unlock(&hiddev->existancelock);
+
+        spin_lock_irq(&list->hiddev->list_lock);
+        list_del(&list->node);
+        spin_unlock_irq(&list->hiddev->list_lock);
 bail:
         file->private_data = NULL;
         vfree(list);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8fc36a28081b..7a8ddc999a8e 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -533,14 +533,14 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                  */
                 buttons = (data[4] << 1) | (data[3] & 0x01);
         } else if (features->type == CINTIQ_COMPANION_2) {
-                /* d-pad right  -> data[4] & 0x10
-                 * d-pad up     -> data[4] & 0x20
-                 * d-pad left   -> data[4] & 0x40
-                 * d-pad down   -> data[4] & 0x80
-                 * d-pad center -> data[3] & 0x01
+                /* d-pad right  -> data[2] & 0x10
+                 * d-pad up     -> data[2] & 0x20
+                 * d-pad left   -> data[2] & 0x40
+                 * d-pad down   -> data[2] & 0x80
+                 * d-pad center -> data[1] & 0x01
                  */
                 buttons = ((data[2] >> 4) << 7) |
-                          ((data[1] & 0x04) << 6) |
+                          ((data[1] & 0x04) << 4) |
                           ((data[2] & 0x0F) << 2) |
                           (data[1] & 0x03);
         } else if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index e7dff5febe16..d42bc0883a32 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -852,7 +852,7 @@ static const u16 NCT6106_REG_TARGET[] = { 0x111, 0x121, 0x131 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_SEL[] = { 0x168, 0x178, 0x188 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_STEP[] = { 0x169, 0x179, 0x189 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL[] = { 0x16a, 0x17a, 0x18a };
-static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x17c };
+static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x18b };
 static const u16 NCT6106_REG_WEIGHT_TEMP_BASE[] = { 0x16c, 0x17c, 0x18c };
 static const u16 NCT6106_REG_WEIGHT_DUTY_BASE[] = { 0x16d, 0x17d, 0x18d };
 
@@ -3764,6 +3764,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_FAN_TIME[0] = NCT6106_REG_FAN_STOP_TIME;
                 data->REG_FAN_TIME[1] = NCT6106_REG_FAN_STEP_UP_TIME;
                 data->REG_FAN_TIME[2] = NCT6106_REG_FAN_STEP_DOWN_TIME;
+                data->REG_TOLERANCE_H = NCT6106_REG_TOLERANCE_H;
                 data->REG_PWM[0] = NCT6106_REG_PWM;
                 data->REG_PWM[1] = NCT6106_REG_FAN_START_OUTPUT;
                 data->REG_PWM[2] = NCT6106_REG_FAN_STOP_OUTPUT;
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index a7d2b16dd702..30e18eb60da7 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -408,8 +408,10 @@ static ssize_t occ_show_power_1(struct device *dev,
 
 static u64 occ_get_powr_avg(u64 *accum, u32 *samples)
 {
-        return div64_u64(get_unaligned_be64(accum) * 1000000ULL,
-                         get_unaligned_be32(samples));
+        u64 divisor = get_unaligned_be32(samples);
+
+        return (divisor == 0) ? 0 :
+                div64_u64(get_unaligned_be64(accum) * 1000000ULL, divisor);
 }
 
 static ssize_t occ_show_power_2(struct device *dev,
diff --git a/drivers/i2c/busses/i2c-at91-core.c b/drivers/i2c/busses/i2c-at91-core.c
index 8d55cdd69ff4..435c7d7377a3 100644
--- a/drivers/i2c/busses/i2c-at91-core.c
+++ b/drivers/i2c/busses/i2c-at91-core.c
@@ -142,7 +142,7 @@ static struct at91_twi_pdata sama5d4_config = {
 
 static struct at91_twi_pdata sama5d2_config = {
         .clk_max_div = 7,
-        .clk_offset = 4,
+        .clk_offset = 3,
         .has_unre_flag = true,
         .has_alt_cmd = true,
         .has_hold_field = true,
diff --git a/drivers/i2c/busses/i2c-at91-master.c b/drivers/i2c/busses/i2c-at91-master.c
index e87232f2e708..a3fcc35ffd3b 100644
--- a/drivers/i2c/busses/i2c-at91-master.c
+++ b/drivers/i2c/busses/i2c-at91-master.c
@@ -122,9 +122,11 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
         writeb_relaxed(*dev->buf, dev->base + AT91_TWI_THR);
 
         /* send stop when last byte has been written */
-        if (--dev->buf_len == 0)
+        if (--dev->buf_len == 0) {
                 if (!dev->use_alt_cmd)
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
+                at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_TXRDY);
+        }
 
         dev_dbg(dev->dev, "wrote 0x%x, to go %zu\n", *dev->buf, dev->buf_len);
 
@@ -542,9 +544,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 } else {
                         at91_twi_write_next_byte(dev);
                         at91_twi_write(dev, AT91_TWI_IER,
-                                       AT91_TWI_TXCOMP |
-                                       AT91_TWI_NACK |
-                                       AT91_TWI_TXRDY);
+                                       AT91_TWI_TXCOMP | AT91_TWI_NACK |
+                                       (dev->buf_len ? AT91_TWI_TXRDY : 0));
                 }
         }
 
diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
index 2c7f145a036e..d7fd76baec92 100644
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -392,16 +392,18 @@ static bool bcm_iproc_i2c_slave_isr(struct bcm_iproc_i2c_dev *iproc_i2c,
 static void bcm_iproc_i2c_read_valid_bytes(struct bcm_iproc_i2c_dev *iproc_i2c)
 {
         struct i2c_msg *msg = iproc_i2c->msg;
+        uint32_t val;
 
         /* Read valid data from RX FIFO */
         while (iproc_i2c->rx_bytes < msg->len) {
-                if (!((iproc_i2c_rd_reg(iproc_i2c, M_FIFO_CTRL_OFFSET) >> M_FIFO_RX_CNT_SHIFT)
-                      & M_FIFO_RX_CNT_MASK))
+                val = iproc_i2c_rd_reg(iproc_i2c, M_RX_OFFSET);
+
+                /* rx fifo empty */
+                if (!((val >> M_RX_STATUS_SHIFT) & M_RX_STATUS_MASK))
                         break;
 
                 msg->buf[iproc_i2c->rx_bytes] =
-                        (iproc_i2c_rd_reg(iproc_i2c, M_RX_OFFSET) >>
-                        M_RX_DATA_SHIFT) & M_RX_DATA_MASK;
+                        (val >> M_RX_DATA_SHIFT) & M_RX_DATA_MASK;
                 iproc_i2c->rx_bytes++;
         }
 }
diff --git a/drivers/i2c/busses/i2c-nvidia-gpu.c b/drivers/i2c/busses/i2c-nvidia-gpu.c
index cfc76b5de726..5a1235fd86bb 100644
--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -364,7 +364,7 @@ static void gpu_i2c_remove(struct pci_dev *pdev)
 /*
  * We need gpu_i2c_suspend() even if it is stub, for runtime pm to work
  * correctly. Without it, lspci shows runtime pm status as "D0" for the card.
- * Documentation/power/pci.txt also insists for driver to provide this.
+ * Documentation/power/pci.rst also insists for driver to provide this.
  */
 static __maybe_unused int gpu_i2c_suspend(struct device *dev)
 {
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index d97fb857b0ea..c98ef4c4a0c9 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -435,6 +435,7 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
                  * fall through to the write state, as we will need to
                  * send a byte as well
                  */
+                /* Fall through */
 
         case STATE_WRITE:
                 /*
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 888d89ce81df..beee7b7e0d9a 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -302,7 +302,9 @@ static inline struct ib_qp *_ib_create_qp(struct ib_device *dev,
                                           struct ib_udata *udata,
                                           struct ib_uobject *uobj)
 {
+        enum ib_qp_type qp_type = attr->qp_type;
         struct ib_qp *qp;
+        bool is_xrc;
 
         if (!dev->ops.create_qp)
                 return ERR_PTR(-EOPNOTSUPP);
@@ -320,7 +322,8 @@ static inline struct ib_qp *_ib_create_qp(struct ib_device *dev,
          * and more importantly they are created internaly by driver,
          * see mlx5 create_dev_resources() as an example.
          */
-        if (attr->qp_type < IB_QPT_XRC_INI) {
+        is_xrc = qp_type == IB_QPT_XRC_INI || qp_type == IB_QPT_XRC_TGT;
+        if ((qp_type < IB_QPT_MAX && !is_xrc) || qp_type == IB_QPT_DRIVER) {
                 qp->res.type = RDMA_RESTRACK_QP;
                 if (uobj)
                         rdma_restrack_uadd(&qp->res);
diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index 01faef7bc061..45d5164e9574 100644
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -393,6 +393,9 @@ u64 rdma_counter_get_hwstat_value(struct ib_device *dev, u8 port, u32 index)
         u64 sum;
 
         port_counter = &dev->port_data[port].port_counter;
+        if (!port_counter->hstats)
+                return 0;
+
         sum = get_running_counters_hwstat_sum(dev, port, index);
         sum += port_counter->hstats->value[index];
 
@@ -594,7 +597,7 @@ void rdma_counter_init(struct ib_device *dev)
         struct rdma_port_counter *port_counter;
         u32 port;
 
-        if (!dev->ops.alloc_hw_stats || !dev->port_data)
+        if (!dev->port_data)
                 return;
 
         rdma_for_each_port(dev, port) {
@@ -602,6 +605,9 @@ void rdma_counter_init(struct ib_device *dev)
                 port_counter->mode.mode = RDMA_COUNTER_MODE_NONE;
                 mutex_init(&port_counter->lock);
 
+                if (!dev->ops.alloc_hw_stats)
+                        continue;
+
                 port_counter->hstats = dev->ops.alloc_hw_stats(dev, port);
                 if (!port_counter->hstats)
                         goto fail;
@@ -624,9 +630,6 @@ void rdma_counter_release(struct ib_device *dev)
         struct rdma_port_counter *port_counter;
         u32 port;
 
-        if (!dev->ops.alloc_hw_stats)
-                return;
-
         rdma_for_each_port(dev, port) {
                 port_counter = &dev->port_data[port].port_counter;
                 kfree(port_counter->hstats);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 9773145dee09..ea8661a00651 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -94,11 +94,17 @@ static DEFINE_XARRAY_FLAGS(devices, XA_FLAGS_ALLOC);
 static DECLARE_RWSEM(devices_rwsem);
 #define DEVICE_REGISTERED XA_MARK_1
 
-static LIST_HEAD(client_list);
+static u32 highest_client_id;
 #define CLIENT_REGISTERED XA_MARK_1
 static DEFINE_XARRAY_FLAGS(clients, XA_FLAGS_ALLOC);
 static DECLARE_RWSEM(clients_rwsem);
 
+static void ib_client_put(struct ib_client *client)
+{
+        if (refcount_dec_and_test(&client->uses))
+                complete(&client->uses_zero);
+}
+
 /*
  * If client_data is registered then the corresponding client must also still
  * be registered.
@@ -661,6 +667,14 @@ static int add_client_context(struct ib_device *device,
 
         down_write(&device->client_data_rwsem);
         /*
+         * So long as the client is registered hold both the client and device
+         * unregistration locks.
+         */
+        if (!refcount_inc_not_zero(&client->uses))
+                goto out_unlock;
+        refcount_inc(&device->refcount);
+
+        /*
          * Another caller to add_client_context got here first and has already
          * completely initialized context.
          */
@@ -683,6 +697,9 @@ static int add_client_context(struct ib_device *device,
         return 0;
 
 out:
+        ib_device_put(device);
+        ib_client_put(client);
+out_unlock:
         up_write(&device->client_data_rwsem);
         return ret;
 }
@@ -702,7 +719,7 @@ static void remove_client_context(struct ib_device *device,
         client_data = xa_load(&device->client_data, client_id);
         xa_clear_mark(&device->client_data, client_id, CLIENT_DATA_REGISTERED);
         client = xa_load(&clients, client_id);
-        downgrade_write(&device->client_data_rwsem);
+        up_write(&device->client_data_rwsem);
 
         /*
          * Notice we cannot be holding any exclusive locks when calling the
@@ -712,17 +729,13 @@ static void remove_client_context(struct ib_device *device,
          *
          * For this reason clients and drivers should not call the
          * unregistration functions will holdling any locks.
-         *
-         * It tempting to drop the client_data_rwsem too, but this is required
-         * to ensure that unregister_client does not return until all clients
-         * are completely unregistered, which is required to avoid module
-         * unloading races.
          */
         if (client->remove)
                 client->remove(device, client_data);
 
         xa_erase(&device->client_data, client_id);
-        up_read(&device->client_data_rwsem);
+        ib_device_put(device);
+        ib_client_put(client);
 }
 
 static int alloc_port_data(struct ib_device *device)
@@ -1224,7 +1237,7 @@ static int setup_device(struct ib_device *device)
 
 static void disable_device(struct ib_device *device)
 {
-        struct ib_client *client;
+        u32 cid;
 
         WARN_ON(!refcount_read(&device->refcount));
 
@@ -1232,10 +1245,19 @@ static void disable_device(struct ib_device *device)
         xa_clear_mark(&devices, device->index, DEVICE_REGISTERED);
         up_write(&devices_rwsem);
 
+        /*
+         * Remove clients in LIFO order, see assign_client_id. This could be
+         * more efficient if xarray learns to reverse iterate. Since no new
+         * clients can be added to this ib_device past this point we only need
+         * the maximum possible client_id value here.
+         */
         down_read(&clients_rwsem);
-        list_for_each_entry_reverse(client, &client_list, list)
-                remove_client_context(device, client->client_id);
+        cid = highest_client_id;
         up_read(&clients_rwsem);
+        while (cid) {
+                cid--;
+                remove_client_context(device, cid);
+        }
 
         /* Pairs with refcount_set in enable_device */
         ib_device_put(device);
@@ -1662,30 +1684,31 @@ static int assign_client_id(struct ib_client *client)
         /*
          * The add/remove callbacks must be called in FIFO/LIFO order. To
          * achieve this we assign client_ids so they are sorted in
-         * registration order, and retain a linked list we can reverse iterate
-         * to get the LIFO order. The extra linked list can go away if xarray
-         * learns to reverse iterate.
+         * registration order.
          */
-        if (list_empty(&client_list)) {
-                client->client_id = 0;
-        } else {
-                struct ib_client *last;
-
-                last = list_last_entry(&client_list, struct ib_client, list);
-                client->client_id = last->client_id + 1;
-        }
+        client->client_id = highest_client_id;
         ret = xa_insert(&clients, client->client_id, client, GFP_KERNEL);
         if (ret)
                 goto out;
 
+        highest_client_id++;
         xa_set_mark(&clients, client->client_id, CLIENT_REGISTERED);
-        list_add_tail(&client->list, &client_list);
 
 out:
         up_write(&clients_rwsem);
         return ret;
 }
 
+static void remove_client_id(struct ib_client *client)
+{
+        down_write(&clients_rwsem);
+        xa_erase(&clients, client->client_id);
+        for (; highest_client_id; highest_client_id--)
+                if (xa_load(&clients, highest_client_id - 1))
+                        break;
+        up_write(&clients_rwsem);
+}
+
 /**
  * ib_register_client - Register an IB client
  * @client:Client to register
@@ -1705,6 +1728,8 @@ int ib_register_client(struct ib_client *client)
         unsigned long index;
         int ret;
 
+        refcount_set(&client->uses, 1);
+        init_completion(&client->uses_zero);
         ret = assign_client_id(client);
         if (ret)
                 return ret;
@@ -1740,21 +1765,30 @@ void ib_unregister_client(struct ib_client *client)
         unsigned long index;
 
         down_write(&clients_rwsem);
+        ib_client_put(client);
         xa_clear_mark(&clients, client->client_id, CLIENT_REGISTERED);
         up_write(&clients_rwsem);
-        /*
-         * Every device still known must be serialized to make sure we are
-         * done with the client callbacks before we return.
-         */
-        down_read(&devices_rwsem);
-        xa_for_each (&devices, index, device)
+
+        /* We do not want to have locks while calling client->remove() */
+        rcu_read_lock();
+        xa_for_each (&devices, index, device) {
+                if (!ib_device_try_get(device))
+                        continue;
+                rcu_read_unlock();
+
                 remove_client_context(device, client->client_id);
-        up_read(&devices_rwsem);
 
-        down_write(&clients_rwsem);
-        list_del(&client->list);
-        xa_erase(&clients, client->client_id);
-        up_write(&clients_rwsem);
+                ib_device_put(device);
+                rcu_read_lock();
+        }
+        rcu_read_unlock();
+
+        /*
+         * remove_client_context() is not a fence, it can return even though a
+         * removal is ongoing. Wait until all removals are completed.
+         */
+        wait_for_completion(&client->uses_zero);
+        remove_client_id(client);
 }
 EXPORT_SYMBOL(ib_unregister_client);
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index cc99479b2c09..9947d16edef2 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -3224,18 +3224,18 @@ static int ib_mad_port_open(struct ib_device *device,
         if (has_smi)
                 cq_size *= 2;
 
+        port_priv->pd = ib_alloc_pd(device, 0);
+        if (IS_ERR(port_priv->pd)) {
+                dev_err(&device->dev, "Couldn't create ib_mad PD\n");
+                ret = PTR_ERR(port_priv->pd);
+                goto error3;
+        }
+
         port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
                         IB_POLL_UNBOUND_WORKQUEUE);
         if (IS_ERR(port_priv->cq)) {
                 dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
                 ret = PTR_ERR(port_priv->cq);
-                goto error3;
-        }
-
-        port_priv->pd = ib_alloc_pd(device, 0);
-        if (IS_ERR(port_priv->pd)) {
-                dev_err(&device->dev, "Couldn't create ib_mad PD\n");
-                ret = PTR_ERR(port_priv->pd);
                 goto error4;
         }
 
@@ -3278,11 +3278,11 @@ error8:
 error7:
         destroy_mad_qp(&port_priv->qp_info[0]);
 error6:
-        ib_dealloc_pd(port_priv->pd);
-error4:
         ib_free_cq(port_priv->cq);
         cleanup_recv_queue(&port_priv->qp_info[1]);
         cleanup_recv_queue(&port_priv->qp_info[0]);
+error4:
+        ib_dealloc_pd(port_priv->pd);
 error3:
         kfree(port_priv);
 
@@ -3312,8 +3312,8 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
         destroy_workqueue(port_priv->wq);
         destroy_mad_qp(&port_priv->qp_info[1]);
         destroy_mad_qp(&port_priv->qp_info[0]);
-        ib_dealloc_pd(port_priv->pd);
         ib_free_cq(port_priv->cq);
+        ib_dealloc_pd(port_priv->pd);
         cleanup_recv_queue(&port_priv->qp_info[1]);
         cleanup_recv_queue(&port_priv->qp_info[0]);
         /* XXX: Handle deallocation of MAD registration tables */
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 9f8a48016b41..ffdeaf6e0b68 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -49,6 +49,7 @@
 #include <linux/sched.h>
 #include <linux/semaphore.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 
@@ -884,11 +885,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
 
         if (get_user(id, arg))
                 return -EFAULT;
+        if (id >= IB_UMAD_MAX_AGENTS)
+                return -EINVAL;
 
         mutex_lock(&file->port->file_mutex);
         mutex_lock(&file->mutex);
 
-        if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
+        id = array_index_nospec(id, IB_UMAD_MAX_AGENTS);
+        if (!__get_agent(file, id)) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index a91653aabf38..098ab883733e 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -308,6 +308,7 @@ int bnxt_re_del_gid(const struct ib_gid_attr *attr, void **context)
         struct bnxt_re_dev *rdev = to_bnxt_re_dev(attr->device, ibdev);
         struct bnxt_qplib_sgid_tbl *sgid_tbl = &rdev->qplib_res.sgid_tbl;
         struct bnxt_qplib_gid *gid_to_del;
+        u16 vlan_id = 0xFFFF;
 
         /* Delete the entry from the hardware */
         ctx = *context;
@@ -317,7 +318,8 @@ int bnxt_re_del_gid(const struct ib_gid_attr *attr, void **context)
         if (sgid_tbl && sgid_tbl->active) {
                 if (ctx->idx >= sgid_tbl->max)
                         return -EINVAL;
-                gid_to_del = &sgid_tbl->tbl[ctx->idx];
+                gid_to_del = &sgid_tbl->tbl[ctx->idx].gid;
+                vlan_id = sgid_tbl->tbl[ctx->idx].vlan_id;
                 /* DEL_GID is called in WQ context(netdevice_event_work_handler)
                  * or via the ib_unregister_device path. In the former case QP1
                  * may not be destroyed yet, in which case just return as FW
@@ -335,7 +337,8 @@ int bnxt_re_del_gid(const struct ib_gid_attr *attr, void **context)
                 }
                 ctx->refcnt--;
                 if (!ctx->refcnt) {
-                        rc = bnxt_qplib_del_sgid(sgid_tbl, gid_to_del, true);
+                        rc = bnxt_qplib_del_sgid(sgid_tbl, gid_to_del,
+                                                 vlan_id,  true);
                         if (rc) {
                                 dev_err(rdev_to_dev(rdev),
                                         "Failed to remove GID: %#x", rc);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 37928b1111df..bdbde8e22420 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -488,7 +488,7 @@ static int bnxt_qplib_alloc_sgid_tbl(struct bnxt_qplib_res *res,
                                      struct bnxt_qplib_sgid_tbl *sgid_tbl,
                                      u16 max)
 {
-        sgid_tbl->tbl = kcalloc(max, sizeof(struct bnxt_qplib_gid), GFP_KERNEL);
+        sgid_tbl->tbl = kcalloc(max, sizeof(*sgid_tbl->tbl), GFP_KERNEL);
         if (!sgid_tbl->tbl)
                 return -ENOMEM;
 
@@ -526,9 +526,10 @@ static void bnxt_qplib_cleanup_sgid_tbl(struct bnxt_qplib_res *res,
         for (i = 0; i < sgid_tbl->max; i++) {
                 if (memcmp(&sgid_tbl->tbl[i], &bnxt_qplib_gid_zero,
                            sizeof(bnxt_qplib_gid_zero)))
-                        bnxt_qplib_del_sgid(sgid_tbl, &sgid_tbl->tbl[i], true);
+                        bnxt_qplib_del_sgid(sgid_tbl, &sgid_tbl->tbl[i].gid,
+                                            sgid_tbl->tbl[i].vlan_id, true);
         }
-        memset(sgid_tbl->tbl, 0, sizeof(struct bnxt_qplib_gid) * sgid_tbl->max);
+        memset(sgid_tbl->tbl, 0, sizeof(*sgid_tbl->tbl) * sgid_tbl->max);
         memset(sgid_tbl->hw_id, -1, sizeof(u16) * sgid_tbl->max);
         memset(sgid_tbl->vlan, 0, sizeof(u8) * sgid_tbl->max);
         sgid_tbl->active = 0;
@@ -537,7 +538,11 @@ static void bnxt_qplib_cleanup_sgid_tbl(struct bnxt_qplib_res *res,
 static void bnxt_qplib_init_sgid_tbl(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                                      struct net_device *netdev)
 {
-        memset(sgid_tbl->tbl, 0, sizeof(struct bnxt_qplib_gid) * sgid_tbl->max);
+        u32 i;
+
+        for (i = 0; i < sgid_tbl->max; i++)
+                sgid_tbl->tbl[i].vlan_id = 0xffff;
+
         memset(sgid_tbl->hw_id, -1, sizeof(u16) * sgid_tbl->max);
 }
 
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
index 30c42c92fac7..fbda11a7ab1a 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
@@ -111,7 +111,7 @@ struct bnxt_qplib_pd_tbl {
 };
 
 struct bnxt_qplib_sgid_tbl {
-        struct bnxt_qplib_gid           *tbl;
+        struct bnxt_qplib_gid_info      *tbl;
         u16                             *hw_id;
         u16                             max;
         u16                             active;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 48793d3512ac..40296b97d21e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -213,12 +213,12 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
                         index, sgid_tbl->max);
                 return -EINVAL;
         }
-        memcpy(gid, &sgid_tbl->tbl[index], sizeof(*gid));
+        memcpy(gid, &sgid_tbl->tbl[index].gid, sizeof(*gid));
         return 0;
 }
 
 int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
-                        struct bnxt_qplib_gid *gid, bool update)
+                        struct bnxt_qplib_gid *gid, u16 vlan_id, bool update)
 {
         struct bnxt_qplib_res *res = to_bnxt_qplib(sgid_tbl,
                                                    struct bnxt_qplib_res,
@@ -236,7 +236,8 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                 return -ENOMEM;
         }
         for (index = 0; index < sgid_tbl->max; index++) {
-                if (!memcmp(&sgid_tbl->tbl[index], gid, sizeof(*gid)))
+                if (!memcmp(&sgid_tbl->tbl[index].gid, gid, sizeof(*gid)) &&
+                    vlan_id == sgid_tbl->tbl[index].vlan_id)
                         break;
         }
         if (index == sgid_tbl->max) {
@@ -262,8 +263,9 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                 if (rc)
                         return rc;
         }
-        memcpy(&sgid_tbl->tbl[index], &bnxt_qplib_gid_zero,
+        memcpy(&sgid_tbl->tbl[index].gid, &bnxt_qplib_gid_zero,
                sizeof(bnxt_qplib_gid_zero));
+        sgid_tbl->tbl[index].vlan_id = 0xFFFF;
         sgid_tbl->vlan[index] = 0;
         sgid_tbl->active--;
         dev_dbg(&res->pdev->dev,
@@ -296,7 +298,8 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         }
         free_idx = sgid_tbl->max;
         for (i = 0; i < sgid_tbl->max; i++) {
-                if (!memcmp(&sgid_tbl->tbl[i], gid, sizeof(*gid))) {
+                if (!memcmp(&sgid_tbl->tbl[i], gid, sizeof(*gid)) &&
+                    sgid_tbl->tbl[i].vlan_id == vlan_id) {
                         dev_dbg(&res->pdev->dev,
                                 "SGID entry already exist in entry %d!\n", i);
                         *index = i;
@@ -351,6 +354,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         }
         /* Add GID to the sgid_tbl */
         memcpy(&sgid_tbl->tbl[free_idx], gid, sizeof(*gid));
+        sgid_tbl->tbl[free_idx].vlan_id = vlan_id;
         sgid_tbl->active++;
         if (vlan_id != 0xFFFF)
                 sgid_tbl->vlan[free_idx] = 1;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index 0ec3b12b0bcd..13d9432d5ce2 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -84,6 +84,11 @@ struct bnxt_qplib_gid {
         u8                              data[16];
 };
 
+struct bnxt_qplib_gid_info {
+        struct bnxt_qplib_gid gid;
+        u16 vlan_id;
+};
+
 struct bnxt_qplib_ah {
         struct bnxt_qplib_gid           dgid;
         struct bnxt_qplib_pd            *pd;
@@ -221,7 +226,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
                         struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
                         struct bnxt_qplib_gid *gid);
 int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
-                        struct bnxt_qplib_gid *gid, bool update);
+                        struct bnxt_qplib_gid *gid, u16 vlan_id, bool update);
 int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                         struct bnxt_qplib_gid *gid, u8 *mac, u16 vlan_id,
                         bool update, u32 *index);
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index d5b643a1d9fd..67052dc3100c 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -14452,7 +14452,7 @@ void hfi1_deinit_vnic_rsm(struct hfi1_devdata *dd)
                 clear_rcvctrl(dd, RCV_CTRL_RCV_RSM_ENABLE_SMASK);
 }
 
-static void init_rxe(struct hfi1_devdata *dd)
+static int init_rxe(struct hfi1_devdata *dd)
 {
         struct rsm_map_table *rmt;
         u64 val;
@@ -14461,6 +14461,9 @@ static void init_rxe(struct hfi1_devdata *dd)
         write_csr(dd, RCV_ERR_MASK, ~0ull);
 
         rmt = alloc_rsm_map_table(dd);
+        if (!rmt)
+                return -ENOMEM;
+
         /* set up QOS, including the QPN map table */
         init_qos(dd, rmt);
         init_fecn_handling(dd, rmt);
@@ -14487,6 +14490,7 @@ static void init_rxe(struct hfi1_devdata *dd)
         val |= ((4ull & RCV_BYPASS_HDR_SIZE_MASK) <<
                 RCV_BYPASS_HDR_SIZE_SHIFT);
         write_csr(dd, RCV_BYPASS, val);
+        return 0;
 }
 
 static void init_other(struct hfi1_devdata *dd)
@@ -15024,7 +15028,10 @@ int hfi1_init_dd(struct hfi1_devdata *dd)
                 goto bail_cleanup;
 
         /* set initial RXE CSRs */
-        init_rxe(dd);
+        ret = init_rxe(dd);
+        if (ret)
+                goto bail_cleanup;
+
         /* set initial TXE CSRs */
         init_txe(dd);
         /* set initial non-RXE, non-TXE CSRs */
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 0477c14633ab..024a7c2b6124 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -1835,7 +1835,6 @@ void hfi1_rc_send_complete(struct rvt_qp *qp, struct hfi1_opa_header *opah)
                     cmp_psn(qp->s_sending_psn, qp->s_sending_hpsn) <= 0)
                         break;
                 trdma_clean_swqe(qp, wqe);
-                rvt_qp_wqe_unreserve(qp, wqe);
                 trace_hfi1_qp_send_completion(qp, wqe, qp->s_last);
                 rvt_qp_complete_swqe(qp,
                                      wqe,
@@ -1882,7 +1881,6 @@ struct rvt_swqe *do_rc_completion(struct rvt_qp *qp,
         if (cmp_psn(wqe->lpsn, qp->s_sending_psn) < 0 ||
             cmp_psn(qp->s_sending_psn, qp->s_sending_hpsn) > 0) {
                 trdma_clean_swqe(qp, wqe);
-                rvt_qp_wqe_unreserve(qp, wqe);
                 trace_hfi1_qp_send_completion(qp, wqe, qp->s_last);
                 rvt_qp_complete_swqe(qp,
                                      wqe,
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
index 92acccaaaa86..996fc298207e 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -1620,6 +1620,7 @@ static int hfi1_kern_exp_rcv_alloc_flows(struct tid_rdma_request *req,
                 flows[i].req = req;
                 flows[i].npagesets = 0;
                 flows[i].pagesets[0].mapped =  0;
+                flows[i].resync_npkts = 0;
         }
         req->flows = flows;
         return 0;
@@ -1673,34 +1674,6 @@ static struct tid_rdma_flow *find_flow_ib(struct tid_rdma_request *req,
         return NULL;
 }
 
-static struct tid_rdma_flow *
-__find_flow_ranged(struct tid_rdma_request *req, u16 head, u16 tail,
-                   u32 psn, u16 *fidx)
-{
-        for ( ; CIRC_CNT(head, tail, MAX_FLOWS);
-              tail = CIRC_NEXT(tail, MAX_FLOWS)) {
-                struct tid_rdma_flow *flow = &req->flows[tail];
-                u32 spsn, lpsn;
-
-                spsn = full_flow_psn(flow, flow->flow_state.spsn);
-                lpsn = full_flow_psn(flow, flow->flow_state.lpsn);
-
-                if (cmp_psn(psn, spsn) >= 0 && cmp_psn(psn, lpsn) <= 0) {
-                        if (fidx)
-                                *fidx = tail;
-                        return flow;
-                }
-        }
-        return NULL;
-}
-
-static struct tid_rdma_flow *find_flow(struct tid_rdma_request *req,
-                                       u32 psn, u16 *fidx)
-{
-        return __find_flow_ranged(req, req->setup_head, req->clear_tail, psn,
-                                  fidx);
-}
-
 /* TID RDMA READ functions */
 u32 hfi1_build_tid_rdma_read_packet(struct rvt_swqe *wqe,
                                     struct ib_other_headers *ohdr, u32 *bth1,
@@ -2788,19 +2761,7 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
                          * to prevent continuous Flow Sequence errors for any
                          * packets that could be still in the fabric.
                          */
-                        flow = find_flow(req, psn, NULL);
-                        if (!flow) {
-                                /*
-                                 * We can't find the IB PSN matching the
-                                 * received KDETH PSN. The only thing we can
-                                 * do at this point is report the error to
-                                 * the QP.
-                                 */
-                                hfi1_kern_read_tid_flow_free(qp);
-                                spin_unlock(&qp->s_lock);
-                                rvt_rc_error(qp, IB_WC_LOC_QP_OP_ERR);
-                                return ret;
-                        }
+                        flow = &req->flows[req->clear_tail];
                         if (priv->s_flags & HFI1_R_TID_SW_PSN) {
                                 diff = cmp_psn(psn,
                                                flow->flow_state.r_next_psn);
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index c4b243f50c76..646f61545ed6 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -54,6 +54,7 @@
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
 #include <rdma/opa_addr.h>
+#include <linux/nospec.h>
 
 #include "hfi.h"
 #include "common.h"
@@ -1536,6 +1537,7 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct rdma_ah_attr *ah_attr)
         sl = rdma_ah_get_sl(ah_attr);
         if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
                 return -EINVAL;
+        sl = array_index_nospec(sl, ARRAY_SIZE(ibp->sl_to_sc));
 
         sc5 = ibp->sl_to_sc[sl];
         if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
diff --git a/drivers/infiniband/hw/hns/Kconfig b/drivers/infiniband/hw/hns/Kconfig
index 8bf847bcd8d3..54782197c717 100644
--- a/drivers/infiniband/hw/hns/Kconfig
+++ b/drivers/infiniband/hw/hns/Kconfig
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config INFINIBAND_HNS
-        tristate "HNS RoCE Driver"
+        bool "HNS RoCE Driver"
         depends on NET_VENDOR_HISILICON
         depends on ARM64 || (COMPILE_TEST && 64BIT)
         ---help---
@@ -11,7 +11,7 @@ config INFINIBAND_HNS
           To compile HIP06 or HIP08 driver as module, choose M here.
 
 config INFINIBAND_HNS_HIP06
-        bool "Hisilicon Hip06 Family RoCE support"
+        tristate "Hisilicon Hip06 Family RoCE support"
         depends on INFINIBAND_HNS && HNS && HNS_DSAF && HNS_ENET
         ---help---
           RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip06 and
@@ -21,7 +21,7 @@ config INFINIBAND_HNS_HIP06
           module will be called hns-roce-hw-v1
 
 config INFINIBAND_HNS_HIP08
-        bool "Hisilicon Hip08 Family RoCE support"
+        tristate "Hisilicon Hip08 Family RoCE support"
         depends on INFINIBAND_HNS && PCI && HNS3
         ---help---
           RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC.
diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile
index e105945b94a1..449a2d81319d 100644
--- a/drivers/infiniband/hw/hns/Makefile
+++ b/drivers/infiniband/hw/hns/Makefile
@@ -9,12 +9,8 @@ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \
         hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \
         hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o
 
-ifdef CONFIG_INFINIBAND_HNS_HIP06
 hns-roce-hw-v1-objs := hns_roce_hw_v1.o $(hns-roce-objs)
-obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v1.o
-endif
+obj-$(CONFIG_INFINIBAND_HNS_HIP06) += hns-roce-hw-v1.o
 
-ifdef CONFIG_INFINIBAND_HNS_HIP08
 hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs)
-obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o
-endif
+obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o
diff --git a/drivers/infiniband/hw/hns/hns_roce_db.c b/drivers/infiniband/hw/hns/hns_roce_db.c
index 627aa46ef683..c00714c2f16a 100644
--- a/drivers/infiniband/hw/hns/hns_roce_db.c
+++ b/drivers/infiniband/hw/hns/hns_roce_db.c
@@ -12,13 +12,15 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
                          struct ib_udata *udata, unsigned long virt,
                          struct hns_roce_db *db)
 {
+        unsigned long page_addr = virt & PAGE_MASK;
         struct hns_roce_user_db_page *page;
+        unsigned int offset;
         int ret = 0;
 
         mutex_lock(&context->page_mutex);
 
         list_for_each_entry(page, &context->page_list, list)
-                if (page->user_virt == (virt & PAGE_MASK))
+                if (page->user_virt == page_addr)
                         goto found;
 
         page = kmalloc(sizeof(*page), GFP_KERNEL);
@@ -28,8 +30,8 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
         }
 
         refcount_set(&page->refcount, 1);
-        page->user_virt = (virt & PAGE_MASK);
-        page->umem = ib_umem_get(udata, virt & PAGE_MASK, PAGE_SIZE, 0, 0);
+        page->user_virt = page_addr;
+        page->umem = ib_umem_get(udata, page_addr, PAGE_SIZE, 0, 0);
         if (IS_ERR(page->umem)) {
                 ret = PTR_ERR(page->umem);
                 kfree(page);
@@ -39,10 +41,9 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
         list_add(&page->list, &context->page_list);
 
 found:
-        db->dma = sg_dma_address(page->umem->sg_head.sgl) +
-                  (virt & ~PAGE_MASK);
-        page->umem->sg_head.sgl->offset = virt & ~PAGE_MASK;
-        db->virt_addr = sg_virt(page->umem->sg_head.sgl);
+        offset = virt - page_addr;
+        db->dma = sg_dma_address(page->umem->sg_head.sgl) + offset;
+        db->virt_addr = sg_virt(page->umem->sg_head.sgl) + offset;
         db->u.user_page = page;
         refcount_inc(&page->refcount);
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 81e6dedb1e02..c07e387a07a3 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -750,8 +750,10 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
         atomic_set(&free_mr->mr_free_cq->ib_cq.usecnt, 0);
 
         pd = rdma_zalloc_drv_obj(ibdev, ib_pd);
-        if (!pd)
+        if (!pd) {
+                ret = -ENOMEM;
                 goto alloc_mem_failed;
+        }
 
         pd->device  = ibdev;
         ret = hns_roce_alloc_pd(pd, NULL);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index c2a5780cb394..e12a4404096b 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -5802,13 +5802,12 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
                 return;
         }
 
-        if (mpi->mdev_events.notifier_call)
-                mlx5_notifier_unregister(mpi->mdev, &mpi->mdev_events);
-        mpi->mdev_events.notifier_call = NULL;
-
         mpi->ibdev = NULL;
 
         spin_unlock(&port->mp.mpi_lock);
+        if (mpi->mdev_events.notifier_call)
+                mlx5_notifier_unregister(mpi->mdev, &mpi->mdev_events);
+        mpi->mdev_events.notifier_call = NULL;
         mlx5_remove_netdev_notifier(ibdev, port_num);
         spin_lock(&port->mp.mpi_lock);
 
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index c482f19958b3..f6a53455bf8b 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -481,6 +481,7 @@ struct mlx5_umr_wr {
         u64                             length;
         int                             access_flags;
         u32                             mkey;
+        u8                              ignore_free_state:1;
 };
 
 static inline const struct mlx5_umr_wr *umr_wr(const struct ib_send_wr *wr)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 20ece6e0b2fc..b74fad08412f 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -51,22 +51,12 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
-static bool umr_can_modify_entity_size(struct mlx5_ib_dev *dev)
-{
-        return !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled);
-}
 
 static bool umr_can_use_indirect_mkey(struct mlx5_ib_dev *dev)
 {
         return !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled);
 }
 
-static bool use_umr(struct mlx5_ib_dev *dev, int order)
-{
-        return order <= mr_cache_max_order(dev) &&
-                umr_can_modify_entity_size(dev);
-}
-
 static int destroy_mkey(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
         int err = mlx5_core_destroy_mkey(dev->mdev, &mr->mmkey);
@@ -545,13 +535,16 @@ void mlx5_mr_cache_free(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                 return;
 
         c = order2idx(dev, mr->order);
-        if (c < 0 || c >= MAX_MR_CACHE_ENTRIES) {
-                mlx5_ib_warn(dev, "order %d, cache index %d\n", mr->order, c);
-                return;
-        }
+        WARN_ON(c < 0 || c >= MAX_MR_CACHE_ENTRIES);
 
-        if (unreg_umr(dev, mr))
+        if (unreg_umr(dev, mr)) {
+                mr->allocated_from_cache = false;
+                destroy_mkey(dev, mr);
+                ent = &cache->ent[c];
+                if (ent->cur < ent->limit)
+                        queue_work(cache->wq, &ent->work);
                 return;
+        }
 
         ent = &cache->ent[c];
         spin_lock_irq(&ent->lock);
@@ -1268,7 +1261,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 {
         struct mlx5_ib_dev *dev = to_mdev(pd->device);
         struct mlx5_ib_mr *mr = NULL;
-        bool populate_mtts = false;
+        bool use_umr;
         struct ib_umem *umem;
         int page_shift;
         int npages;
@@ -1300,29 +1293,30 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
         if (err < 0)
                 return ERR_PTR(err);
 
-        if (use_umr(dev, order)) {
+        use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
+                  (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
+                   !MLX5_CAP_GEN(dev->mdev, atomic));
+
+        if (order <= mr_cache_max_order(dev) && use_umr) {
                 mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
                                          page_shift, order, access_flags);
                 if (PTR_ERR(mr) == -EAGAIN) {
                         mlx5_ib_dbg(dev, "cache empty for order %d\n", order);
                         mr = NULL;
                 }
-                populate_mtts = false;
         } else if (!MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset)) {
                 if (access_flags & IB_ACCESS_ON_DEMAND) {
                         err = -EINVAL;
                         pr_err("Got MR registration for ODP MR > 512MB, not supported for Connect-IB\n");
                         goto error;
                 }
-                populate_mtts = true;
+                use_umr = false;
         }
 
         if (!mr) {
-                if (!umr_can_modify_entity_size(dev))
-                        populate_mtts = true;
                 mutex_lock(&dev->slow_path_mutex);
                 mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
-                                page_shift, access_flags, populate_mtts);
+                                page_shift, access_flags, !use_umr);
                 mutex_unlock(&dev->slow_path_mutex);
         }
 
@@ -1338,7 +1332,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
         update_odp_mr(mr);
 
-        if (!populate_mtts) {
+        if (use_umr) {
                 int update_xlt_flags = MLX5_IB_UPD_XLT_ENABLE;
 
                 if (access_flags & IB_ACCESS_ON_DEMAND)
@@ -1373,9 +1367,11 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                 return 0;
 
         umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR |
-                              MLX5_IB_SEND_UMR_FAIL_IF_FREE;
+                              MLX5_IB_SEND_UMR_UPDATE_PD_ACCESS;
         umrwr.wr.opcode = MLX5_IB_WR_UMR;
+        umrwr.pd = dev->umrc.pd;
         umrwr.mkey = mr->mmkey.key;
+        umrwr.ignore_free_state = 1;
 
         return mlx5_ib_post_send_wait(dev, &umrwr);
 }
@@ -1577,10 +1573,10 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                 mr->sig = NULL;
         }
 
-        mlx5_free_priv_descs(mr);
-
-        if (!allocated_from_cache)
+        if (!allocated_from_cache) {
                 destroy_mkey(dev, mr);
+                mlx5_free_priv_descs(mr);
+        }
 }
 
 static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 5b642d81e617..81da82050d05 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -246,7 +246,7 @@ void mlx5_ib_invalidate_range(struct ib_umem_odp *umem_odp, unsigned long start,
          * overwrite the same MTTs.  Concurent invalidations might race us,
          * but they will write 0s as well, so no difference in the end result.
          */
-
+        mutex_lock(&umem_odp->umem_mutex);
         for (addr = start; addr < end; addr += BIT(umem_odp->page_shift)) {
                 idx = (addr - ib_umem_start(umem_odp)) >> umem_odp->page_shift;
                 /*
@@ -278,6 +278,7 @@ void mlx5_ib_invalidate_range(struct ib_umem_odp *umem_odp, unsigned long start,
                                    idx - blk_start_idx + 1, 0,
                                    MLX5_IB_UPD_XLT_ZAP |
                                    MLX5_IB_UPD_XLT_ATOMIC);
+        mutex_unlock(&umem_odp->umem_mutex);
         /*
          * We are now sure that the device will not access the
          * memory. We can safely unmap it, and mark it as dirty if
@@ -1771,7 +1772,7 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
 
         num_pending_prefetch_dec(to_mdev(w->pd->device), w->sg_list,
                                  w->num_sge, 0);
-        kfree(w);
+        kvfree(w);
 }
 
 int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
@@ -1813,7 +1814,7 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
         if (valid_req)
                 queue_work(system_unbound_wq, &work->work);
         else
-                kfree(work);
+                kvfree(work);
 
         srcu_read_unlock(&dev->mr_srcu, srcu_key);
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 2a97619ed603..379328b2598f 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1713,7 +1713,6 @@ static int create_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                 }
 
                 MLX5_SET(tirc, tirc, rx_hash_fn, MLX5_RX_HASH_FN_TOEPLITZ);
-                MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
                 memcpy(rss_key, ucmd.rx_hash_key, len);
                 break;
         }
@@ -4295,10 +4294,14 @@ static int set_reg_umr_segment(struct mlx5_ib_dev *dev,
 
         memset(umr, 0, sizeof(*umr));
 
-        if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
-                umr->flags = MLX5_UMR_CHECK_FREE; /* fail if free */
-        else
-                umr->flags = MLX5_UMR_CHECK_NOT_FREE; /* fail if not free */
+        if (!umrwr->ignore_free_state) {
+                if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
+                         /* fail if free */
+                        umr->flags = MLX5_UMR_CHECK_FREE;
+                else
+                        /* fail if not free */
+                        umr->flags = MLX5_UMR_CHECK_NOT_FREE;
+        }
 
         umr->xlt_octowords = cpu_to_be16(get_xlt_octo(umrwr->xlt_size));
         if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_XLT) {
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index 533157a2a3be..f97b3d65b30c 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -125,14 +125,20 @@ static ssize_t hw_rev_show(struct device *device, struct device_attribute *attr,
         struct qedr_dev *dev =
                 rdma_device_to_drv_device(device, struct qedr_dev, ibdev);
 
-        return scnprintf(buf, PAGE_SIZE, "0x%x\n", dev->pdev->vendor);
+        return scnprintf(buf, PAGE_SIZE, "0x%x\n", dev->attr.hw_ver);
 }
 static DEVICE_ATTR_RO(hw_rev);
 
 static ssize_t hca_type_show(struct device *device,
                              struct device_attribute *attr, char *buf)
 {
-        return scnprintf(buf, PAGE_SIZE, "%s\n", "HCA_TYPE_TO_SET");
+        struct qedr_dev *dev =
+                rdma_device_to_drv_device(device, struct qedr_dev, ibdev);
+
+        return scnprintf(buf, PAGE_SIZE, "FastLinQ QL%x %s\n",
+                         dev->pdev->device,
+                         rdma_protocol_iwarp(&dev->ibdev, 1) ?
+                         "iWARP" : "RoCE");
 }
 static DEVICE_ATTR_RO(hca_type);
 
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index a7cde98e73e8..9ce8a1b925d2 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -220,13 +220,12 @@ static void siw_put_work(struct siw_cm_work *work)
 static void siw_cep_set_inuse(struct siw_cep *cep)
 {
         unsigned long flags;
-        int rv;
 retry:
         spin_lock_irqsave(&cep->lock, flags);
 
         if (cep->in_use) {
                 spin_unlock_irqrestore(&cep->lock, flags);
-                rv = wait_event_interruptible(cep->waitq, !cep->in_use);
+                wait_event_interruptible(cep->waitq, !cep->in_use);
                 if (signal_pending(current))
                         flush_signals(current);
                 goto retry;
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index f55c4e80aea4..d0f140daf659 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -612,6 +612,7 @@ static __init int siw_init_module(void)
 
         if (!siw_create_tx_threads()) {
                 pr_info("siw: Could not start any TX thread\n");
+                rv = -ENOMEM;
                 goto out_error;
         }
         /*
diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
index 11383d9f95ef..e27bd5b35b96 100644
--- a/drivers/infiniband/sw/siw/siw_qp.c
+++ b/drivers/infiniband/sw/siw/siw_qp.c
@@ -220,12 +220,14 @@ static int siw_qp_enable_crc(struct siw_qp *qp)
 {
         struct siw_rx_stream *c_rx = &qp->rx_stream;
         struct siw_iwarp_tx *c_tx = &qp->tx_ctx;
-        int size = crypto_shash_descsize(siw_crypto_shash) +
-                        sizeof(struct shash_desc);
+        int size;
 
         if (siw_crypto_shash == NULL)
                 return -ENOENT;
 
+        size = crypto_shash_descsize(siw_crypto_shash) +
+                sizeof(struct shash_desc);
+
         c_tx->mpa_crc_hd = kzalloc(size, GFP_KERNEL);
         c_rx->mpa_crc_hd = kzalloc(size, GFP_KERNEL);
         if (!c_tx->mpa_crc_hd || !c_rx->mpa_crc_hd) {
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index eb104c719629..4413aa67000e 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -23,6 +23,8 @@
 #include <linux/mem_encrypt.h>
 #include <asm/pci-direct.h>
 #include <asm/iommu.h>
+#include <asm/apic.h>
+#include <asm/msidef.h>
 #include <asm/gart.h>
 #include <asm/x86_init.h>
 #include <asm/iommu_table.h>
@@ -1920,6 +1922,90 @@ static int iommu_setup_msi(struct amd_iommu *iommu)
         return 0;
 }
 
+#define XT_INT_DEST_MODE(x)     (((x) & 0x1ULL) << 2)
+#define XT_INT_DEST_LO(x)       (((x) & 0xFFFFFFULL) << 8)
+#define XT_INT_VEC(x)           (((x) & 0xFFULL) << 32)
+#define XT_INT_DEST_HI(x)       ((((x) >> 24) & 0xFFULL) << 56)
+
+/**
+ * Setup the IntCapXT registers with interrupt routing information
+ * based on the PCI MSI capability block registers, accessed via
+ * MMIO MSI address low/hi and MSI data registers.
+ */
+static void iommu_update_intcapxt(struct amd_iommu *iommu)
+{
+        u64 val;
+        u32 addr_lo = readl(iommu->mmio_base + MMIO_MSI_ADDR_LO_OFFSET);
+        u32 addr_hi = readl(iommu->mmio_base + MMIO_MSI_ADDR_HI_OFFSET);
+        u32 data    = readl(iommu->mmio_base + MMIO_MSI_DATA_OFFSET);
+        bool dm     = (addr_lo >> MSI_ADDR_DEST_MODE_SHIFT) & 0x1;
+        u32 dest    = ((addr_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xFF);
+
+        if (x2apic_enabled())
+                dest |= MSI_ADDR_EXT_DEST_ID(addr_hi);
+
+        val = XT_INT_VEC(data & 0xFF) |
+              XT_INT_DEST_MODE(dm) |
+              XT_INT_DEST_LO(dest) |
+              XT_INT_DEST_HI(dest);
+
+        /**
+         * Current IOMMU implemtation uses the same IRQ for all
+         * 3 IOMMU interrupts.
+         */
+        writeq(val, iommu->mmio_base + MMIO_INTCAPXT_EVT_OFFSET);
+        writeq(val, iommu->mmio_base + MMIO_INTCAPXT_PPR_OFFSET);
+        writeq(val, iommu->mmio_base + MMIO_INTCAPXT_GALOG_OFFSET);
+}
+
+static void _irq_notifier_notify(struct irq_affinity_notify *notify,
+                                 const cpumask_t *mask)
+{
+        struct amd_iommu *iommu;
+
+        for_each_iommu(iommu) {
+                if (iommu->dev->irq == notify->irq) {
+                        iommu_update_intcapxt(iommu);
+                        break;
+                }
+        }
+}
+
+static void _irq_notifier_release(struct kref *ref)
+{
+}
+
+static int iommu_init_intcapxt(struct amd_iommu *iommu)
+{
+        int ret;
+        struct irq_affinity_notify *notify = &iommu->intcapxt_notify;
+
+        /**
+         * IntCapXT requires XTSup=1, which can be inferred
+         * amd_iommu_xt_mode.
+         */
+        if (amd_iommu_xt_mode != IRQ_REMAP_X2APIC_MODE)
+                return 0;
+
+        /**
+         * Also, we need to setup notifier to update the IntCapXT registers
+         * whenever the irq affinity is changed from user-space.
+         */
+        notify->irq = iommu->dev->irq;
+        notify->notify = _irq_notifier_notify,
+        notify->release = _irq_notifier_release,
+        ret = irq_set_affinity_notifier(iommu->dev->irq, notify);
+        if (ret) {
+                pr_err("Failed to register irq affinity notifier (devid=%#x, irq %d)\n",
+                       iommu->devid, iommu->dev->irq);
+                return ret;
+        }
+
+        iommu_update_intcapxt(iommu);
+        iommu_feature_enable(iommu, CONTROL_INTCAPXT_EN);
+        return ret;
+}
+
 static int iommu_init_msi(struct amd_iommu *iommu)
 {
         int ret;
@@ -1936,6 +2022,10 @@ static int iommu_init_msi(struct amd_iommu *iommu)
                 return ret;
 
 enable_faults:
+        ret = iommu_init_intcapxt(iommu);
+        if (ret)
+                return ret;
+
         iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
 
         if (iommu->ppr_log != NULL)
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 52c35d557fad..64edd5a9694c 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -60,6 +60,12 @@
 #define MMIO_PPR_LOG_OFFSET     0x0038
 #define MMIO_GA_LOG_BASE_OFFSET 0x00e0
 #define MMIO_GA_LOG_TAIL_OFFSET 0x00e8
+#define MMIO_MSI_ADDR_LO_OFFSET 0x015C
+#define MMIO_MSI_ADDR_HI_OFFSET 0x0160
+#define MMIO_MSI_DATA_OFFSET    0x0164
+#define MMIO_INTCAPXT_EVT_OFFSET        0x0170
+#define MMIO_INTCAPXT_PPR_OFFSET        0x0178
+#define MMIO_INTCAPXT_GALOG_OFFSET      0x0180
 #define MMIO_CMD_HEAD_OFFSET    0x2000
 #define MMIO_CMD_TAIL_OFFSET    0x2008
 #define MMIO_EVT_HEAD_OFFSET    0x2010
@@ -150,6 +156,7 @@
 #define CONTROL_GALOG_EN        0x1CULL
 #define CONTROL_GAINT_EN        0x1DULL
 #define CONTROL_XT_EN           0x32ULL
+#define CONTROL_INTCAPXT_EN     0x33ULL
 
 #define CTRL_INV_TO_MASK        (7 << CONTROL_INV_TIMEOUT)
 #define CTRL_INV_TO_NONE        0
@@ -592,6 +599,8 @@ struct amd_iommu {
         /* DebugFS Info */
         struct dentry *debugfs;
 #endif
+        /* IRQ notifier for IntCapXT interrupt */
+        struct irq_affinity_notify intcapxt_notify;
 };
 
 static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
diff --git a/drivers/iommu/intel-iommu-debugfs.c b/drivers/iommu/intel-iommu-debugfs.c
index 73a552914455..2b25d9c59336 100644
--- a/drivers/iommu/intel-iommu-debugfs.c
+++ b/drivers/iommu/intel-iommu-debugfs.c
@@ -162,9 +162,9 @@ static inline void print_tbl_walk(struct seq_file *m)
                            (u64)0, (u64)0, (u64)0);
         else
                 seq_printf(m, "%-6d\t0x%016llx:0x%016llx:0x%016llx\n",
-                           tbl_wlk->pasid, tbl_wlk->pasid_tbl_entry->val[0],
+                           tbl_wlk->pasid, tbl_wlk->pasid_tbl_entry->val[2],
                            tbl_wlk->pasid_tbl_entry->val[1],
-                           tbl_wlk->pasid_tbl_entry->val[2]);
+                           tbl_wlk->pasid_tbl_entry->val[0]);
 }
 
 static void pasid_tbl_walk(struct seq_file *m, struct pasid_entry *tbl_entry,
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index ac4172c02244..bdaed2da8a55 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -339,8 +339,6 @@ static void domain_exit(struct dmar_domain *domain);
 static void domain_remove_dev_info(struct dmar_domain *domain);
 static void dmar_remove_one_dev_info(struct device *dev);
 static void __dmar_remove_one_dev_info(struct device_domain_info *info);
-static void domain_context_clear(struct intel_iommu *iommu,
-                                 struct device *dev);
 static int domain_detach_iommu(struct dmar_domain *domain,
                                struct intel_iommu *iommu);
 static bool device_is_rmrr_locked(struct device *dev);
@@ -1833,9 +1831,65 @@ static inline int guestwidth_to_adjustwidth(int gaw)
         return agaw;
 }
 
+static int domain_init(struct dmar_domain *domain, struct intel_iommu *iommu,
+                       int guest_width)
+{
+        int adjust_width, agaw;
+        unsigned long sagaw;
+        int err;
+
+        init_iova_domain(&domain->iovad, VTD_PAGE_SIZE, IOVA_START_PFN);
+
+        err = init_iova_flush_queue(&domain->iovad,
+                                    iommu_flush_iova, iova_entry_free);
+        if (err)
+                return err;
+
+        domain_reserve_special_ranges(domain);
+
+        /* calculate AGAW */
+        if (guest_width > cap_mgaw(iommu->cap))
+                guest_width = cap_mgaw(iommu->cap);
+        domain->gaw = guest_width;
+        adjust_width = guestwidth_to_adjustwidth(guest_width);
+        agaw = width_to_agaw(adjust_width);
+        sagaw = cap_sagaw(iommu->cap);
+        if (!test_bit(agaw, &sagaw)) {
+                /* hardware doesn't support it, choose a bigger one */
+                pr_debug("Hardware doesn't support agaw %d\n", agaw);
+                agaw = find_next_bit(&sagaw, 5, agaw);
+                if (agaw >= 5)
+                        return -ENODEV;
+        }
+        domain->agaw = agaw;
+
+        if (ecap_coherent(iommu->ecap))
+                domain->iommu_coherency = 1;
+        else
+                domain->iommu_coherency = 0;
+
+        if (ecap_sc_support(iommu->ecap))
+                domain->iommu_snooping = 1;
+        else
+                domain->iommu_snooping = 0;
+
+        if (intel_iommu_superpage)
+                domain->iommu_superpage = fls(cap_super_page_val(iommu->cap));
+        else
+                domain->iommu_superpage = 0;
+
+        domain->nid = iommu->node;
+
+        /* always allocate the top pgd */
+        domain->pgd = (struct dma_pte *)alloc_pgtable_page(domain->nid);
+        if (!domain->pgd)
+                return -ENOMEM;
+        __iommu_flush_cache(iommu, domain->pgd, PAGE_SIZE);
+        return 0;
+}
+
 static void domain_exit(struct dmar_domain *domain)
 {
-        struct page *freelist;
 
         /* Remove associated devices and clear attached or cached domains */
         domain_remove_dev_info(domain);
@@ -1843,9 +1897,12 @@ static void domain_exit(struct dmar_domain *domain)
         /* destroy iovas */
         put_iova_domain(&domain->iovad);
 
-        freelist = domain_unmap(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
+        if (domain->pgd) {
+                struct page *freelist;
 
-        dma_free_pagelist(freelist);
+                freelist = domain_unmap(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
+                dma_free_pagelist(freelist);
+        }
 
         free_domain_mem(domain);
 }
@@ -2048,26 +2105,9 @@ out_unlock:
         return ret;
 }
 
-struct domain_context_mapping_data {
-        struct dmar_domain *domain;
-        struct intel_iommu *iommu;
-        struct pasid_table *table;
-};
-
-static int domain_context_mapping_cb(struct pci_dev *pdev,
-                                     u16 alias, void *opaque)
-{
-        struct domain_context_mapping_data *data = opaque;
-
-        return domain_context_mapping_one(data->domain, data->iommu,
-                                          data->table, PCI_BUS_NUM(alias),
-                                          alias & 0xff);
-}
-
 static int
 domain_context_mapping(struct dmar_domain *domain, struct device *dev)
 {
-        struct domain_context_mapping_data data;
         struct pasid_table *table;
         struct intel_iommu *iommu;
         u8 bus, devfn;
@@ -2077,17 +2117,7 @@ domain_context_mapping(struct dmar_domain *domain, struct device *dev)
                 return -ENODEV;
 
         table = intel_pasid_get_table(dev);
-
-        if (!dev_is_pci(dev))
-                return domain_context_mapping_one(domain, iommu, table,
-                                                  bus, devfn);
-
-        data.domain = domain;
-        data.iommu = iommu;
-        data.table = table;
-
-        return pci_for_each_dma_alias(to_pci_dev(dev),
-                                      &domain_context_mapping_cb, &data);
+        return domain_context_mapping_one(domain, iommu, table, bus, devfn);
 }
 
 static int domain_context_mapped_cb(struct pci_dev *pdev,
@@ -2513,31 +2543,6 @@ static int get_last_alias(struct pci_dev *pdev, u16 alias, void *opaque)
         return 0;
 }
 
-static int domain_init(struct dmar_domain *domain, int guest_width)
-{
-        int adjust_width;
-
-        init_iova_domain(&domain->iovad, VTD_PAGE_SIZE, IOVA_START_PFN);
-        domain_reserve_special_ranges(domain);
-
-        /* calculate AGAW */
-        domain->gaw = guest_width;
-        adjust_width = guestwidth_to_adjustwidth(guest_width);
-        domain->agaw = width_to_agaw(adjust_width);
-
-        domain->iommu_coherency = 0;
-        domain->iommu_snooping = 0;
-        domain->iommu_superpage = 0;
-        domain->max_addr = 0;
-
-        /* always allocate the top pgd */
-        domain->pgd = (struct dma_pte *)alloc_pgtable_page(domain->nid);
-        if (!domain->pgd)
-                return -ENOMEM;
-        domain_flush_cache(domain, domain->pgd, PAGE_SIZE);
-        return 0;
-}
-
 static struct dmar_domain *find_or_alloc_domain(struct device *dev, int gaw)
 {
         struct device_domain_info *info;
@@ -2575,19 +2580,11 @@ static struct dmar_domain *find_or_alloc_domain(struct device *dev, int gaw)
         domain = alloc_domain(0);
         if (!domain)
                 return NULL;
-
-        if (domain_init(domain, gaw)) {
+        if (domain_init(domain, iommu, gaw)) {
                 domain_exit(domain);
                 return NULL;
         }
 
-        if (init_iova_flush_queue(&domain->iovad,
-                                  iommu_flush_iova,
-                                  iova_entry_free)) {
-                pr_warn("iova flush queue initialization failed\n");
-                intel_iommu_strict = 1;
-        }
-
 out:
         return domain;
 }
@@ -2692,6 +2689,8 @@ static int domain_prepare_identity_map(struct device *dev,
         return iommu_domain_identity_map(domain, start, end);
 }
 
+static int md_domain_init(struct dmar_domain *domain, int guest_width);
+
 static int __init si_domain_init(int hw)
 {
         struct dmar_rmrr_unit *rmrr;
@@ -2702,7 +2701,7 @@ static int __init si_domain_init(int hw)
         if (!si_domain)
                 return -EFAULT;
 
-        if (domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+        if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
                 domain_exit(si_domain);
                 return -EFAULT;
         }
@@ -3564,7 +3563,8 @@ static void intel_unmap(struct device *dev, dma_addr_t dev_addr, size_t size)
 
         freelist = domain_unmap(domain, start_pfn, last_pfn);
 
-        if (intel_iommu_strict || (pdev && pdev->untrusted)) {
+        if (intel_iommu_strict || (pdev && pdev->untrusted) ||
+                        !has_iova_flush_queue(&domain->iovad)) {
                 iommu_flush_iotlb_psi(iommu, domain, start_pfn,
                                       nrpages, !freelist, 0);
                 /* free iova */
@@ -4758,28 +4758,6 @@ out_free_dmar:
         return ret;
 }
 
-static int domain_context_clear_one_cb(struct pci_dev *pdev, u16 alias, void *opaque)
-{
-        struct intel_iommu *iommu = opaque;
-
-        domain_context_clear_one(iommu, PCI_BUS_NUM(alias), alias & 0xff);
-        return 0;
-}
-
-/*
- * NB - intel-iommu lacks any sort of reference counting for the users of
- * dependent devices.  If multiple endpoints have intersecting dependent
- * devices, unbinding the driver from any one of them will possibly leave
- * the others unable to operate.
- */
-static void domain_context_clear(struct intel_iommu *iommu, struct device *dev)
-{
-        if (!iommu || !dev || !dev_is_pci(dev))
-                return;
-
-        pci_for_each_dma_alias(to_pci_dev(dev), &domain_context_clear_one_cb, iommu);
-}
-
 static void __dmar_remove_one_dev_info(struct device_domain_info *info)
 {
         struct dmar_domain *domain;
@@ -4800,7 +4778,7 @@ static void __dmar_remove_one_dev_info(struct device_domain_info *info)
                                         PASID_RID2PASID);
 
                 iommu_disable_dev_iotlb(info);
-                domain_context_clear(iommu, info->dev);
+                domain_context_clear_one(iommu, info->bus, info->devfn);
                 intel_pasid_free_table(info->dev);
         }
 
@@ -4829,6 +4807,31 @@ static void dmar_remove_one_dev_info(struct device *dev)
         spin_unlock_irqrestore(&device_domain_lock, flags);
 }
 
+static int md_domain_init(struct dmar_domain *domain, int guest_width)
+{
+        int adjust_width;
+
+        init_iova_domain(&domain->iovad, VTD_PAGE_SIZE, IOVA_START_PFN);
+        domain_reserve_special_ranges(domain);
+
+        /* calculate AGAW */
+        domain->gaw = guest_width;
+        adjust_width = guestwidth_to_adjustwidth(guest_width);
+        domain->agaw = width_to_agaw(adjust_width);
+
+        domain->iommu_coherency = 0;
+        domain->iommu_snooping = 0;
+        domain->iommu_superpage = 0;
+        domain->max_addr = 0;
+
+        /* always allocate the top pgd */
+        domain->pgd = (struct dma_pte *)alloc_pgtable_page(domain->nid);
+        if (!domain->pgd)
+                return -ENOMEM;
+        domain_flush_cache(domain, domain->pgd, PAGE_SIZE);
+        return 0;
+}
+
 static struct iommu_domain *intel_iommu_domain_alloc(unsigned type)
 {
         struct dmar_domain *dmar_domain;
@@ -4843,7 +4846,7 @@ static struct iommu_domain *intel_iommu_domain_alloc(unsigned type)
                         pr_err("Can't allocate dmar_domain\n");
                         return NULL;
                 }
-                if (domain_init(dmar_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+                if (md_domain_init(dmar_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
                         pr_err("Domain initialization failed\n");
                         domain_exit(dmar_domain);
                         return NULL;
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index d499b2621239..3e1a8a675572 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -54,9 +54,14 @@ init_iova_domain(struct iova_domain *iovad, unsigned long granule,
 }
 EXPORT_SYMBOL_GPL(init_iova_domain);
 
+bool has_iova_flush_queue(struct iova_domain *iovad)
+{
+        return !!iovad->fq;
+}
+
 static void free_iova_flush_queue(struct iova_domain *iovad)
 {
-        if (!iovad->fq)
+        if (!has_iova_flush_queue(iovad))
                 return;
 
         if (timer_pending(&iovad->fq_timer))
@@ -74,13 +79,14 @@ static void free_iova_flush_queue(struct iova_domain *iovad)
 int init_iova_flush_queue(struct iova_domain *iovad,
                           iova_flush_cb flush_cb, iova_entry_dtor entry_dtor)
 {
+        struct iova_fq __percpu *queue;
         int cpu;
 
         atomic64_set(&iovad->fq_flush_start_cnt,  0);
         atomic64_set(&iovad->fq_flush_finish_cnt, 0);
 
-        iovad->fq = alloc_percpu(struct iova_fq);
-        if (!iovad->fq)
+        queue = alloc_percpu(struct iova_fq);
+        if (!queue)
                 return -ENOMEM;
 
         iovad->flush_cb   = flush_cb;
@@ -89,13 +95,17 @@ int init_iova_flush_queue(struct iova_domain *iovad,
         for_each_possible_cpu(cpu) {
                 struct iova_fq *fq;
 
-                fq = per_cpu_ptr(iovad->fq, cpu);
+                fq = per_cpu_ptr(queue, cpu);
                 fq->head = 0;
                 fq->tail = 0;
 
                 spin_lock_init(&fq->lock);
         }
 
+        smp_wmb();
+
+        iovad->fq = queue;
+
         timer_setup(&iovad->fq_timer, fq_flush_timeout, 0);
         atomic_set(&iovad->fq_timer_on, 0);
 
@@ -127,8 +137,9 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
         struct iova *cached_iova;
 
         cached_iova = rb_entry(iovad->cached32_node, struct iova, node);
-        if (free->pfn_hi < iovad->dma_32bit_pfn &&
-            free->pfn_lo >= cached_iova->pfn_lo) {
+        if (free == cached_iova ||
+            (free->pfn_hi < iovad->dma_32bit_pfn &&
+             free->pfn_lo >= cached_iova->pfn_lo)) {
                 iovad->cached32_node = rb_next(&free->node);
                 iovad->max32_alloc_size = iovad->dma_32bit_pfn;
         }
diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 433f4d2ee956..80a740df0737 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -2,7 +2,7 @@
 /*
  * Virtio driver for the paravirtualized IOMMU
  *
- * Copyright (C) 2018 Arm Limited
+ * Copyright (C) 2019 Arm Limited
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -47,7 +47,10 @@ struct viommu_dev {
         /* Device configuration */
         struct iommu_domain_geometry    geometry;
         u64                             pgsize_bitmap;
-        u8                              domain_bits;
+        u32                             first_domain;
+        u32                             last_domain;
+        /* Supported MAP flags */
+        u32                             map_flags;
         u32                             probe_size;
 };
 
@@ -62,6 +65,7 @@ struct viommu_domain {
         struct viommu_dev               *viommu;
         struct mutex                    mutex; /* protects viommu pointer */
         unsigned int                    id;
+        u32                             map_flags;
 
         spinlock_t                      mappings_lock;
         struct rb_root_cached           mappings;
@@ -113,6 +117,8 @@ static int viommu_get_req_errno(void *buf, size_t len)
                 return -ENOENT;
         case VIRTIO_IOMMU_S_FAULT:
                 return -EFAULT;
+        case VIRTIO_IOMMU_S_NOMEM:
+                return -ENOMEM;
         case VIRTIO_IOMMU_S_IOERR:
         case VIRTIO_IOMMU_S_DEVERR:
         default:
@@ -607,15 +613,15 @@ static int viommu_domain_finalise(struct viommu_dev *viommu,
 {
         int ret;
         struct viommu_domain *vdomain = to_viommu_domain(domain);
-        unsigned int max_domain = viommu->domain_bits > 31 ? ~0 :
-                                  (1U << viommu->domain_bits) - 1;
 
         vdomain->viommu         = viommu;
+        vdomain->map_flags      = viommu->map_flags;
 
         domain->pgsize_bitmap   = viommu->pgsize_bitmap;
         domain->geometry        = viommu->geometry;
 
-        ret = ida_alloc_max(&viommu->domain_ids, max_domain, GFP_KERNEL);
+        ret = ida_alloc_range(&viommu->domain_ids, viommu->first_domain,
+                              viommu->last_domain, GFP_KERNEL);
         if (ret >= 0)
                 vdomain->id = (unsigned int)ret;
 
@@ -710,7 +716,7 @@ static int viommu_map(struct iommu_domain *domain, unsigned long iova,
                       phys_addr_t paddr, size_t size, int prot)
 {
         int ret;
-        int flags;
+        u32 flags;
         struct virtio_iommu_req_map map;
         struct viommu_domain *vdomain = to_viommu_domain(domain);
 
@@ -718,6 +724,9 @@ static int viommu_map(struct iommu_domain *domain, unsigned long iova,
                 (prot & IOMMU_WRITE ? VIRTIO_IOMMU_MAP_F_WRITE : 0) |
                 (prot & IOMMU_MMIO ? VIRTIO_IOMMU_MAP_F_MMIO : 0);
 
+        if (flags & ~vdomain->map_flags)
+                return -EINVAL;
+
         ret = viommu_add_mapping(vdomain, iova, paddr, size, flags);
         if (ret)
                 return ret;
@@ -1027,7 +1036,8 @@ static int viommu_probe(struct virtio_device *vdev)
                 goto err_free_vqs;
         }
 
-        viommu->domain_bits = 32;
+        viommu->map_flags = VIRTIO_IOMMU_MAP_F_READ | VIRTIO_IOMMU_MAP_F_WRITE;
+        viommu->last_domain = ~0U;
 
         /* Optional features */
         virtio_cread_feature(vdev, VIRTIO_IOMMU_F_INPUT_RANGE,
@@ -1038,9 +1048,13 @@ static int viommu_probe(struct virtio_device *vdev)
                              struct virtio_iommu_config, input_range.end,
                              &input_end);
 
-        virtio_cread_feature(vdev, VIRTIO_IOMMU_F_DOMAIN_BITS,
-                             struct virtio_iommu_config, domain_bits,
-                             &viommu->domain_bits);
+        virtio_cread_feature(vdev, VIRTIO_IOMMU_F_DOMAIN_RANGE,
+                             struct virtio_iommu_config, domain_range.start,
+                             &viommu->first_domain);
+
+        virtio_cread_feature(vdev, VIRTIO_IOMMU_F_DOMAIN_RANGE,
+                             struct virtio_iommu_config, domain_range.end,
+                             &viommu->last_domain);
 
         virtio_cread_feature(vdev, VIRTIO_IOMMU_F_PROBE,
                              struct virtio_iommu_config, probe_size,
@@ -1052,6 +1066,9 @@ static int viommu_probe(struct virtio_device *vdev)
                 .force_aperture = true,
         };
 
+        if (virtio_has_feature(vdev, VIRTIO_IOMMU_F_MMIO))
+                viommu->map_flags |= VIRTIO_IOMMU_MAP_F_MMIO;
+
         viommu_ops.pgsize_bitmap = viommu->pgsize_bitmap;
 
         virtio_device_ready(vdev);
@@ -1130,9 +1147,10 @@ static void viommu_config_changed(struct virtio_device *vdev)
 
 static unsigned int features[] = {
         VIRTIO_IOMMU_F_MAP_UNMAP,
-        VIRTIO_IOMMU_F_DOMAIN_BITS,
         VIRTIO_IOMMU_F_INPUT_RANGE,
+        VIRTIO_IOMMU_F_DOMAIN_RANGE,
         VIRTIO_IOMMU_F_PROBE,
+        VIRTIO_IOMMU_F_MMIO,
 };
 
 static struct virtio_device_id id_table[] = {
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 730fbe0e2a9d..1b5c3672aea2 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3010,7 +3010,7 @@ static int its_vpe_init(struct its_vpe *vpe)
 
         if (!its_alloc_vpe_table(vpe_id)) {
                 its_vpe_id_free(vpe_id);
-                its_free_pending_table(vpe->vpt_page);
+                its_free_pending_table(vpt_page);
                 return -ENOMEM;
         }
 
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 9bca4896fa6f..96d927f0f91a 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -771,8 +771,10 @@ static void gic_cpu_sys_reg_init(void)
                 case 7:
                         write_gicreg(0, ICC_AP0R3_EL1);
                         write_gicreg(0, ICC_AP0R2_EL1);
+                /* Fall through */
                 case 6:
                         write_gicreg(0, ICC_AP0R1_EL1);
+                /* Fall through */
                 case 5:
                 case 4:
                         write_gicreg(0, ICC_AP0R0_EL1);
@@ -786,8 +788,10 @@ static void gic_cpu_sys_reg_init(void)
         case 7:
                 write_gicreg(0, ICC_AP1R3_EL1);
                 write_gicreg(0, ICC_AP1R2_EL1);
+                /* Fall through */
         case 6:
                 write_gicreg(0, ICC_AP1R1_EL1);
+                /* Fall through */
         case 5:
         case 4:
                 write_gicreg(0, ICC_AP1R0_EL1);
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index bf2237ac5d09..4f74c15c4755 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -131,6 +131,7 @@ static struct irq_chip gpcv2_irqchip_data_chip = {
         .irq_unmask             = imx_gpcv2_irq_unmask,
         .irq_set_wake           = imx_gpcv2_irq_set_wake,
         .irq_retrigger          = irq_chip_retrigger_hierarchy,
+        .irq_set_type           = irq_chip_set_type_parent,
 #ifdef CONFIG_SMP
         .irq_set_affinity       = irq_chip_set_affinity_parent,
 #endif
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index 3dd28382d5f5..3f09f658e8e2 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -241,12 +241,15 @@ static int mbigen_of_create_domain(struct platform_device *pdev,
 
                 parent = platform_bus_type.dev_root;
                 child = of_platform_device_create(np, NULL, parent);
-                if (!child)
+                if (!child) {
+                        of_node_put(np);
                         return -ENOMEM;
+                }
 
                 if (of_property_read_u32(child->dev.of_node, "num-pins",
                                          &num_pins) < 0) {
                         dev_err(&pdev->dev, "No num-pins property\n");
+                        of_node_put(np);
                         return -EINVAL;
                 }
 
@@ -254,8 +257,10 @@ static int mbigen_of_create_domain(struct platform_device *pdev,
                                                            mbigen_write_msg,
                                                            &mbigen_domain_ops,
                                                            mgn_chip);
-                if (!domain)
+                if (!domain) {
+                        of_node_put(np);
                         return -ENOMEM;
+                }
         }
 
         return 0;
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 0e224232f746..008a74a1ed44 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1394,6 +1394,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
                                 printk(KERN_DEBUG
                                        "%s: %s: alloc urb for fifo %i failed",
                                        hw->name, __func__, fifo->fifonum);
+                                continue;
                         }
                         fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
                         fifo->iso[i].indx = i;
@@ -1692,13 +1693,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
 static int
 setup_hfcsusb(struct hfcsusb *hw)
 {
+        void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
         u_char b;
+        int ret;
 
         if (debug & DBG_HFC_CALL_TRACE)
                 printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
 
+        if (!dmabuf)
+                return -ENOMEM;
+
+        ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
+
+        memcpy(&b, dmabuf, sizeof(u_char));
+        kfree(dmabuf);
+
         /* check the chip id */
-        if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
+        if (ret != 1) {
                 printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
                        hw->name, __func__);
                 return 1;
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 276065c888bc..23f1f41c8602 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -852,6 +852,7 @@ int smu_queue_i2c(struct smu_i2c_cmd *cmd)
                 break;
         case SMU_I2C_TRANSFER_COMBINED:
                 cmd->info.devaddr &= 0xfe;
+                /* fall through */
         case SMU_I2C_TRANSFER_STDSUB:
                 if (cmd->info.sublen > 3)
                         return -EINVAL;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 26e374fbf57c..20ed838e9413 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -931,6 +931,9 @@ int bch_cached_dev_run(struct cached_dev *dc)
         if (dc->io_disable) {
                 pr_err("I/O disabled on cached dev %s",
                        dc->backing_dev_name);
+                kfree(env[1]);
+                kfree(env[2]);
+                kfree(buf);
                 return -EIO;
         }
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index caaee8032afe..7b6c3ee9e755 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -882,23 +882,23 @@ EXPORT_SYMBOL_GPL(dm_table_set_type);
 
 /* validate the dax capability of the target device span */
 int device_supports_dax(struct dm_target *ti, struct dm_dev *dev,
-                                       sector_t start, sector_t len, void *data)
+                        sector_t start, sector_t len, void *data)
 {
         int blocksize = *(int *) data;
 
         return generic_fsdax_supported(dev->dax_dev, dev->bdev, blocksize,
-                        start, len);
+                                       start, len);
 }
 
 /* Check devices support synchronous DAX */
-static int device_synchronous(struct dm_target *ti, struct dm_dev *dev,
-                                       sector_t start, sector_t len, void *data)
+static int device_dax_synchronous(struct dm_target *ti, struct dm_dev *dev,
+                                  sector_t start, sector_t len, void *data)
 {
-        return dax_synchronous(dev->dax_dev);
+        return dev->dax_dev && dax_synchronous(dev->dax_dev);
 }
 
 bool dm_table_supports_dax(struct dm_table *t,
-                          iterate_devices_callout_fn iterate_fn, int *blocksize)
+                           iterate_devices_callout_fn iterate_fn, int *blocksize)
 {
         struct dm_target *ti;
         unsigned i;
@@ -911,7 +911,7 @@ bool dm_table_supports_dax(struct dm_table *t,
                         return false;
 
                 if (!ti->type->iterate_devices ||
-                        !ti->type->iterate_devices(ti, iterate_fn, blocksize))
+                    !ti->type->iterate_devices(ti, iterate_fn, blocksize))
                         return false;
         }
 
@@ -1921,7 +1921,7 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
 
         if (dm_table_supports_dax(t, device_supports_dax, &page_size)) {
                 blk_queue_flag_set(QUEUE_FLAG_DAX, q);
-                if (dm_table_supports_dax(t, device_synchronous, NULL))
+                if (dm_table_supports_dax(t, device_dax_synchronous, NULL))
                         set_dax_synchronous(t->md->dax_dev);
         }
         else
diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
index f88094719552..f2abe27010ef 100644
--- a/drivers/misc/eeprom/Kconfig
+++ b/drivers/misc/eeprom/Kconfig
@@ -5,6 +5,7 @@ config EEPROM_AT24
         tristate "I2C EEPROMs / RAMs / ROMs from most vendors"
         depends on I2C && SYSFS
         select NVMEM
+        select NVMEM_SYSFS
         select REGMAP_I2C
         help
           Enable this driver to get read/write support to most I2C EEPROMs
@@ -34,6 +35,7 @@ config EEPROM_AT25
         tristate "SPI EEPROMs from most vendors"
         depends on SPI && SYSFS
         select NVMEM
+        select NVMEM_SYSFS
         help
           Enable this driver to get read/write support to most SPI EEPROMs,
           after you configure the board init code to know about each eeprom
@@ -80,6 +82,7 @@ config EEPROM_93XX46
         depends on SPI && SYSFS
         select REGMAP
         select NVMEM
+        select NVMEM_SYSFS
         help
           Driver for the microwire EEPROM chipsets 93xx46x. The driver
           supports both read and write commands and also the command to
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 35bf2477693d..518945b2f737 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -685,7 +685,7 @@ static int at24_probe(struct i2c_client *client)
         nvmem_config.name = dev_name(dev);
         nvmem_config.dev = dev;
         nvmem_config.read_only = !writable;
-        nvmem_config.root_only = true;
+        nvmem_config.root_only = !(flags & AT24_FLAG_IRUGO);
         nvmem_config.owner = THIS_MODULE;
         nvmem_config.compat = true;
         nvmem_config.base_dev = dev;
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 75294ec65257..1a2c062a57d4 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -695,8 +695,8 @@ static int goya_sw_init(struct hl_device *hdev)
                 goto free_dma_pool;
         }
 
-        dev_dbg(hdev->dev, "cpu accessible memory at bus address 0x%llx\n",
-                hdev->cpu_accessible_dma_address);
+        dev_dbg(hdev->dev, "cpu accessible memory at bus address %pad\n",
+                &hdev->cpu_accessible_dma_address);
 
         hdev->cpu_accessible_dma_pool = gen_pool_create(ilog2(32), -1);
         if (!hdev->cpu_accessible_dma_pool) {
@@ -4449,7 +4449,6 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
         case GOYA_ASYNC_EVENT_ID_AXI_ECC:
         case GOYA_ASYNC_EVENT_ID_L2_RAM_ECC:
         case GOYA_ASYNC_EVENT_ID_PSOC_GPIO_05_SW_RESET:
-        case GOYA_ASYNC_EVENT_ID_PSOC_GPIO_10_VRHOT_ICRIT:
                 goya_print_irq_info(hdev, event_type, false);
                 hl_device_reset(hdev, true, false);
                 break;
@@ -4485,6 +4484,7 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
                 goya_unmask_irq(hdev, event_type);
                 break;
 
+        case GOYA_ASYNC_EVENT_ID_PSOC_GPIO_10_VRHOT_ICRIT:
         case GOYA_ASYNC_EVENT_ID_TPC0_BMON_SPMU:
         case GOYA_ASYNC_EVENT_ID_TPC1_BMON_SPMU:
         case GOYA_ASYNC_EVENT_ID_TPC2_BMON_SPMU:
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index d74b182e19f3..6c0173772162 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -81,6 +81,9 @@
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
 
+#define MEI_DEV_ID_MCC        0x4B70  /* Mule Creek Canyon (EHL) */
+#define MEI_DEV_ID_MCC_4      0x4B75  /* Mule Creek Canyon 4 (EHL) */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 7a2b3545a7f9..57cb68f5cc64 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,6 +98,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index e327f80ebe70..7102e2ebc614 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -10,6 +10,7 @@
 #include <linux/kthread.h>
 #include <linux/scatterlist.h>
 #include <linux/dma-mapping.h>
+#include <linux/backing-dev.h>
 
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>
@@ -427,6 +428,10 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card)
                 goto free_tag_set;
         }
 
+        if (mmc_host_is_spi(host) && host->use_spi_crc)
+                mq->queue->backing_dev_info->capabilities |=
+                        BDI_CAP_STABLE_WRITES;
+
         mq->queue->queuedata = mq;
         blk_queue_rq_timeout(mq->queue, 60 * HZ);
 
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index faaaf52a46d2..eea52e2c5a0c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2012,8 +2012,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
                                  * delayed. Allowing the transfer to take place
                                  * avoids races and keeps things simple.
                                  */
-                                if ((err != -ETIMEDOUT) &&
-                                    (cmd->opcode == MMC_SEND_TUNING_BLOCK)) {
+                                if (err != -ETIMEDOUT) {
                                         state = STATE_SENDING_DATA;
                                         continue;
                                 }
diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
index 2d736e416775..ba9a63db73da 100644
--- a/drivers/mmc/host/meson-mx-sdio.c
+++ b/drivers/mmc/host/meson-mx-sdio.c
@@ -73,7 +73,7 @@
         #define MESON_MX_SDIO_IRQC_IF_CONFIG_MASK               GENMASK(7, 6)
         #define MESON_MX_SDIO_IRQC_FORCE_DATA_CLK               BIT(8)
         #define MESON_MX_SDIO_IRQC_FORCE_DATA_CMD               BIT(9)
-        #define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK          GENMASK(10, 13)
+        #define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK          GENMASK(13, 10)
         #define MESON_MX_SDIO_IRQC_SOFT_RESET                   BIT(15)
         #define MESON_MX_SDIO_IRQC_FORCE_HALT                   BIT(30)
         #define MESON_MX_SDIO_IRQC_HALT_HOLE                    BIT(31)
diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index 6ee340a3fb3a..603a5d9f045a 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -624,6 +624,7 @@ err_cleanup_host:
         sdhci_cleanup_host(host);
 
 pm_runtime_disable:
+        pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
         pm_runtime_set_suspended(&pdev->dev);
 
diff --git a/drivers/mtd/hyperbus/Kconfig b/drivers/mtd/hyperbus/Kconfig
index cff6bbd226f5..b4e3caf7d799 100644
--- a/drivers/mtd/hyperbus/Kconfig
+++ b/drivers/mtd/hyperbus/Kconfig
@@ -14,8 +14,9 @@ if MTD_HYPERBUS
 
 config HBMC_AM654
         tristate "HyperBus controller driver for AM65x SoC"
+        depends on ARM64 || COMPILE_TEST
         select MULTIPLEXER
-        select MUX_MMIO
+        imply MUX_MMIO
         help
          This is the driver for HyperBus controller on TI's AM65x and
          other SoCs
diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c
index a1f8fe1abb10..e082d632fb74 100644
--- a/drivers/mtd/nand/onenand/onenand_base.c
+++ b/drivers/mtd/nand/onenand/onenand_base.c
@@ -3259,6 +3259,7 @@ static void onenand_check_features(struct mtd_info *mtd)
         switch (density) {
         case ONENAND_DEVICE_DENSITY_8Gb:
                 this->options |= ONENAND_HAS_NOP_1;
+                /* fall through */
         case ONENAND_DEVICE_DENSITY_4Gb:
                 if (ONENAND_IS_DDP(this))
                         this->options |= ONENAND_HAS_2PLANE;
diff --git a/drivers/mtd/nand/raw/nand_micron.c b/drivers/mtd/nand/raw/nand_micron.c
index 1622d3145587..8ca9fad6e6ad 100644
--- a/drivers/mtd/nand/raw/nand_micron.c
+++ b/drivers/mtd/nand/raw/nand_micron.c
@@ -390,6 +390,14 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
             (chip->id.data[4] & MICRON_ID_INTERNAL_ECC_MASK) != 0x2)
                 return MICRON_ON_DIE_UNSUPPORTED;
 
+        /*
+         * It seems that there are devices which do not support ECC officially.
+         * At least the MT29F2G08ABAGA / MT29F2G08ABBGA devices supports
+         * enabling the ECC feature but don't reflect that to the READ_ID table.
+         * So we have to guarantee that we disable the ECC feature directly
+         * after we did the READ_ID table command. Later we can evaluate the
+         * ECC_ENABLE support.
+         */
         ret = micron_nand_on_die_ecc_setup(chip, true);
         if (ret)
                 return MICRON_ON_DIE_UNSUPPORTED;
@@ -398,13 +406,13 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
         if (ret)
                 return MICRON_ON_DIE_UNSUPPORTED;
 
-        if (!(id[4] & MICRON_ID_ECC_ENABLED))
-                return MICRON_ON_DIE_UNSUPPORTED;
-
         ret = micron_nand_on_die_ecc_setup(chip, false);
         if (ret)
                 return MICRON_ON_DIE_UNSUPPORTED;
 
+        if (!(id[4] & MICRON_ID_ECC_ENABLED))
+                return MICRON_ON_DIE_UNSUPPORTED;
+
         ret = nand_readid_op(chip, 0, id, sizeof(id));
         if (ret)
                 return MICRON_ON_DIE_UNSUPPORTED;
diff --git a/drivers/net/arcnet/arc-rimi.c b/drivers/net/arcnet/arc-rimi.c
index 11c5bad95226..14a5fb378145 100644
--- a/drivers/net/arcnet/arc-rimi.c
+++ b/drivers/net/arcnet/arc-rimi.c
@@ -363,10 +363,13 @@ static int __init arcrimi_setup(char *s)
         switch (ints[0]) {
         default:                /* ERROR */
                 pr_err("Too many arguments\n");
+                /* Fall through */
         case 3:         /* Node ID */
                 node = ints[3];
+                /* Fall through */
         case 2:         /* IRQ */
                 irq = ints[2];
+                /* Fall through */
         case 1:         /* IO address */
                 io = ints[1];
         }
diff --git a/drivers/net/arcnet/com20020-isa.c b/drivers/net/arcnet/com20020-isa.c
index 28510e33924f..cd27fdc1059b 100644
--- a/drivers/net/arcnet/com20020-isa.c
+++ b/drivers/net/arcnet/com20020-isa.c
@@ -197,16 +197,22 @@ static int __init com20020isa_setup(char *s)
         switch (ints[0]) {
         default:                /* ERROR */
                 pr_info("Too many arguments\n");
+                /* Fall through */
         case 6:         /* Timeout */
                 timeout = ints[6];
+                /* Fall through */
         case 5:         /* CKP value */
                 clockp = ints[5];
+                /* Fall through */
         case 4:         /* Backplane flag */
                 backplane = ints[4];
+                /* Fall through */
         case 3:         /* Node ID */
                 node = ints[3];
+                /* Fall through */
         case 2:         /* IRQ */
                 irq = ints[2];
+                /* Fall through */
         case 1:         /* IO address */
                 io = ints[1];
         }
diff --git a/drivers/net/arcnet/com90io.c b/drivers/net/arcnet/com90io.c
index 2c546013a980..186bbf87bc84 100644
--- a/drivers/net/arcnet/com90io.c
+++ b/drivers/net/arcnet/com90io.c
@@ -363,8 +363,10 @@ static int __init com90io_setup(char *s)
         switch (ints[0]) {
         default:                /* ERROR */
                 pr_err("Too many arguments\n");
+                /* Fall through */
         case 2:         /* IRQ */
                 irq = ints[2];
+                /* Fall through */
         case 1:         /* IO address */
                 io = ints[1];
         }
diff --git a/drivers/net/arcnet/com90xx.c b/drivers/net/arcnet/com90xx.c
index ca4a57c30bf8..bd75d06ad7df 100644
--- a/drivers/net/arcnet/com90xx.c
+++ b/drivers/net/arcnet/com90xx.c
@@ -693,10 +693,13 @@ static int __init com90xx_setup(char *s)
         switch (ints[0]) {
         default:                /* ERROR */
                 pr_err("Too many arguments\n");
+                /* Fall through */
         case 3:         /* Mem address */
                 shmem = ints[3];
+                /* Fall through */
         case 2:         /* IRQ */
                 irq = ints[2];
+                /* Fall through */
         case 1:         /* IO address */
                 io = ints[1];
         }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9b7016abca2f..02fd7822c14a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2196,6 +2196,15 @@ static void bond_miimon_commit(struct bonding *bond)
         bond_for_each_slave(bond, slave, iter) {
                 switch (slave->new_link) {
                 case BOND_LINK_NOCHANGE:
+                        /* For 802.3ad mode, check current slave speed and
+                         * duplex again in case its port was disabled after
+                         * invalid speed/duplex reporting but recovered before
+                         * link monitoring could make a decision on the actual
+                         * link status
+                         */
+                        if (BOND_MODE(bond) == BOND_MODE_8023AD &&
+                            slave->link == BOND_LINK_UP)
+                                bond_3ad_adapter_speed_duplex_changed(slave);
                         continue;
 
                 case BOND_LINK_UP:
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index b6b93a2d93a5..483d270664cc 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1249,6 +1249,8 @@ int register_candev(struct net_device *dev)
                 return -EINVAL;
 
         dev->rtnl_link_ops = &can_link_ops;
+        netif_carrier_off(dev);
+
         return register_netdev(dev);
 }
 EXPORT_SYMBOL_GPL(register_candev);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 09d8e623dcf6..dc5695dffc2e 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -404,9 +404,10 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable)
         priv->write(reg_mcr, &regs->mcr);
 }
 
-static inline void flexcan_enter_stop_mode(struct flexcan_priv *priv)
+static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->regs;
+        unsigned int ackval;
         u32 reg_mcr;
 
         reg_mcr = priv->read(&regs->mcr);
@@ -416,20 +417,37 @@ static inline void flexcan_enter_stop_mode(struct flexcan_priv *priv)
         /* enable stop request */
         regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,
                            1 << priv->stm.req_bit, 1 << priv->stm.req_bit);
+
+        /* get stop acknowledgment */
+        if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr,
+                                     ackval, ackval & (1 << priv->stm.ack_bit),
+                                     0, FLEXCAN_TIMEOUT_US))
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
-static inline void flexcan_exit_stop_mode(struct flexcan_priv *priv)
+static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->regs;
+        unsigned int ackval;
         u32 reg_mcr;
 
         /* remove stop request */
         regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,
                            1 << priv->stm.req_bit, 0);
 
+        /* get stop acknowledgment */
+        if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr,
+                                     ackval, !(ackval & (1 << priv->stm.ack_bit)),
+                                     0, FLEXCAN_TIMEOUT_US))
+                return -ETIMEDOUT;
+
         reg_mcr = priv->read(&regs->mcr);
         reg_mcr &= ~FLEXCAN_MCR_SLF_WAK;
         priv->write(reg_mcr, &regs->mcr);
+
+        return 0;
 }
 
 static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv)
@@ -1455,10 +1473,10 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
 
         priv = netdev_priv(dev);
         priv->stm.gpr = syscon_node_to_regmap(gpr_np);
-        of_node_put(gpr_np);
         if (IS_ERR(priv->stm.gpr)) {
                 dev_dbg(&pdev->dev, "could not find gpr regmap\n");
-                return PTR_ERR(priv->stm.gpr);
+                ret = PTR_ERR(priv->stm.gpr);
+                goto out_put_node;
         }
 
         priv->stm.req_gpr = out_val[1];
@@ -1477,6 +1495,10 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
                 device_set_wakeup_enable(&pdev->dev, true);
 
         return 0;
+
+out_put_node:
+        of_node_put(gpr_np);
+        return ret;
 }
 
 static const struct of_device_id flexcan_of_match[] = {
@@ -1644,7 +1666,9 @@ static int __maybe_unused flexcan_suspend(struct device *device)
                  */
                 if (device_may_wakeup(device)) {
                         enable_irq_wake(dev->irq);
-                        flexcan_enter_stop_mode(priv);
+                        err = flexcan_enter_stop_mode(priv);
+                        if (err)
+                                return err;
                 } else {
                         err = flexcan_chip_disable(priv);
                         if (err)
@@ -1717,10 +1741,13 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
         if (netif_running(dev) && device_may_wakeup(device)) {
                 flexcan_enable_wakeup_irq(priv, false);
-                flexcan_exit_stop_mode(priv);
+                err = flexcan_exit_stop_mode(priv);
+                if (err)
+                        return err;
         }
 
         return 0;
diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
index 51eecc7cdcdd..edaa1ca972c1 100644
--- a/drivers/net/can/rcar/rcar_canfd.c
+++ b/drivers/net/can/rcar/rcar_canfd.c
@@ -1508,10 +1508,11 @@ static int rcar_canfd_rx_poll(struct napi_struct *napi, int quota)
 
         /* All packets processed */
         if (num_pkts < quota) {
-                napi_complete_done(napi, num_pkts);
-                /* Enable Rx FIFO interrupts */
-                rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
-                                   RCANFD_RFCC_RFIE);
+                if (napi_complete_done(napi, num_pkts)) {
+                        /* Enable Rx FIFO interrupts */
+                        rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
+                                           RCANFD_RFCC_RFIE);
+                }
         }
         return num_pkts;
 }
diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
index 185c7f7d38a4..5e0d5e8101c8 100644
--- a/drivers/net/can/sja1000/peak_pcmcia.c
+++ b/drivers/net/can/sja1000/peak_pcmcia.c
@@ -479,7 +479,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
                 if (!netdev)
                         continue;
 
-                strncpy(name, netdev->name, IFNAMSIZ);
+                strlcpy(name, netdev->name, IFNAMSIZ);
 
                 unregister_sja1000dev(netdev);
 
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index 234cf1042df6..12358f06d194 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -664,17 +664,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable)
                 return regulator_disable(reg);
 }
 
-static void mcp251x_open_clean(struct net_device *net)
-{
-        struct mcp251x_priv *priv = netdev_priv(net);
-        struct spi_device *spi = priv->spi;
-
-        free_irq(spi->irq, priv);
-        mcp251x_hw_sleep(spi);
-        mcp251x_power_enable(priv->transceiver, 0);
-        close_candev(net);
-}
-
 static int mcp251x_stop(struct net_device *net)
 {
         struct mcp251x_priv *priv = netdev_priv(net);
@@ -941,37 +930,43 @@ static int mcp251x_open(struct net_device *net)
                                    flags | IRQF_ONESHOT, DEVICE_NAME, priv);
         if (ret) {
                 dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
-                mcp251x_power_enable(priv->transceiver, 0);
-                close_candev(net);
-                goto open_unlock;
+                goto out_close;
         }
 
         priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
                                    0);
+        if (!priv->wq) {
+                ret = -ENOMEM;
+                goto out_clean;
+        }
         INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler);
         INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler);
 
         ret = mcp251x_hw_reset(spi);
-        if (ret) {
-                mcp251x_open_clean(net);
-                goto open_unlock;
-        }
+        if (ret)
+                goto out_free_wq;
         ret = mcp251x_setup(net, spi);
-        if (ret) {
-                mcp251x_open_clean(net);
-                goto open_unlock;
-        }
+        if (ret)
+                goto out_free_wq;
         ret = mcp251x_set_normal_mode(spi);
-        if (ret) {
-                mcp251x_open_clean(net);
-                goto open_unlock;
-        }
+        if (ret)
+                goto out_free_wq;
 
         can_led_event(net, CAN_LED_EVENT_OPEN);
 
         netif_wake_queue(net);
+        mutex_unlock(&priv->mcp_lock);
 
-open_unlock:
+        return 0;
+
+out_free_wq:
+        destroy_workqueue(priv->wq);
+out_clean:
+        free_irq(spi->irq, priv);
+        mcp251x_hw_sleep(spi);
+out_close:
+        mcp251x_power_enable(priv->transceiver, 0);
+        close_candev(net);
         mutex_unlock(&priv->mcp_lock);
         return ret;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 458154c9b482..65dce642b86b 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -568,16 +568,16 @@ static int peak_usb_ndo_stop(struct net_device *netdev)
         dev->state &= ~PCAN_USB_STATE_STARTED;
         netif_stop_queue(netdev);
 
+        close_candev(netdev);
+
+        dev->can.state = CAN_STATE_STOPPED;
+
         /* unlink all pending urbs and free used memory */
         peak_usb_unlink_all_urbs(dev);
 
         if (dev->adapter->dev_stop)
                 dev->adapter->dev_stop(dev);
 
-        close_candev(netdev);
-
-        dev->can.state = CAN_STATE_STOPPED;
-
         /* can set bus off now */
         if (dev->adapter->dev_set_bus) {
                 int err = dev->adapter->dev_set_bus(dev, 0);
@@ -855,7 +855,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
 
                 dev_prev_siblings = dev->prev_siblings;
                 dev->state &= ~PCAN_USB_STATE_CONNECTED;
-                strncpy(name, netdev->name, IFNAMSIZ);
+                strlcpy(name, netdev->name, IFNAMSIZ);
 
                 unregister_netdev(netdev);
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 34761c3a6286..47cc1ff5b88e 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -841,7 +841,7 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
                         goto err_out;
 
                 /* allocate command buffer once for all for the interface */
-                pdev->cmd_buffer_addr = kmalloc(PCAN_UFD_CMD_BUFFER_SIZE,
+                pdev->cmd_buffer_addr = kzalloc(PCAN_UFD_CMD_BUFFER_SIZE,
                                                 GFP_KERNEL);
                 if (!pdev->cmd_buffer_addr)
                         goto err_out_1;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 178bb7cff0c1..53cb2f72bdd0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -494,7 +494,7 @@ static int pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded)
         u8 *buffer;
         int err;
 
-        buffer = kmalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
+        buffer = kzalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
         if (!buffer)
                 return -ENOMEM;
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 467e61ced82c..d3804ffd3d2a 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -27,7 +27,6 @@
 #include <linux/platform_data/mv88e6xxx.h>
 #include <linux/netdevice.h>
 #include <linux/gpio/consumer.h>
-#include <linux/phy.h>
 #include <linux/phylink.h>
 #include <net/dsa.h>
 
@@ -430,7 +429,7 @@ int mv88e6xxx_port_setup_mac(struct mv88e6xxx_chip *chip, int port, int link,
                 return 0;
 
         /* Port's MAC control must not be changed unless the link is down */
-        err = chip->info->ops->port_set_link(chip, port, 0);
+        err = chip->info->ops->port_set_link(chip, port, LINK_FORCED_DOWN);
         if (err)
                 return err;
 
@@ -482,30 +481,6 @@ static int mv88e6xxx_phy_is_internal(struct dsa_switch *ds, int port)
         return port < chip->info->num_internal_phys;
 }
 
-/* We expect the switch to perform auto negotiation if there is a real
- * phy. However, in the case of a fixed link phy, we force the port
- * settings from the fixed link settings.
- */
-static void mv88e6xxx_adjust_link(struct dsa_switch *ds, int port,
-                                  struct phy_device *phydev)
-{
-        struct mv88e6xxx_chip *chip = ds->priv;
-        int err;
-
-        if (!phy_is_pseudo_fixed_link(phydev) &&
-            mv88e6xxx_phy_is_internal(ds, port))
-                return;
-
-        mv88e6xxx_reg_lock(chip);
-        err = mv88e6xxx_port_setup_mac(chip, port, phydev->link, phydev->speed,
-                                       phydev->duplex, phydev->pause,
-                                       phydev->interface);
-        mv88e6xxx_reg_unlock(chip);
-
-        if (err && err != -EOPNOTSUPP)
-                dev_err(ds->dev, "p%d: failed to configure MAC\n", port);
-}
-
 static void mv88e6065_phylink_validate(struct mv88e6xxx_chip *chip, int port,
                                        unsigned long *mask,
                                        struct phylink_link_state *state)
@@ -2747,6 +2722,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
                         err = mv88e6xxx_mdio_register(chip, child, true);
                         if (err) {
                                 mv88e6xxx_mdios_unregister(chip);
+                                of_node_put(child);
                                 return err;
                         }
                 }
@@ -4720,7 +4696,6 @@ static int mv88e6xxx_port_egress_floods(struct dsa_switch *ds, int port,
 static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
         .get_tag_protocol       = mv88e6xxx_get_tag_protocol,
         .setup                  = mv88e6xxx_setup,
-        .adjust_link            = mv88e6xxx_adjust_link,
         .phylink_validate       = mv88e6xxx_validate,
         .phylink_mac_link_state = mv88e6xxx_link_state,
         .phylink_mac_config     = mv88e6xxx_mac_config,
diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
index 232e8cc96f6d..16f15c93a102 100644
--- a/drivers/net/dsa/qca8k.c
+++ b/drivers/net/dsa/qca8k.c
@@ -2,7 +2,7 @@
 /*
  * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
  * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
- * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015, 2019, The Linux Foundation. All rights reserved.
  * Copyright (c) 2016 John Crispin <john@phrozen.org>
  */
 
@@ -583,8 +583,11 @@ qca8k_setup_mdio_bus(struct qca8k_priv *priv)
 
         for_each_available_child_of_node(ports, port) {
                 err = of_property_read_u32(port, "reg", &reg);
-                if (err)
+                if (err) {
+                        of_node_put(port);
+                        of_node_put(ports);
                         return err;
+                }
 
                 if (!dsa_is_user_port(priv->ds, reg))
                         continue;
@@ -595,6 +598,7 @@ qca8k_setup_mdio_bus(struct qca8k_priv *priv)
                         internal_mdio_mask |= BIT(reg);
         }
 
+        of_node_put(ports);
         if (!external_mdio_mask && !internal_mdio_mask) {
                 dev_err(priv->dev, "no PHYs are defined.\n");
                 return -EINVAL;
@@ -935,6 +939,8 @@ qca8k_port_enable(struct dsa_switch *ds, int port,
         qca8k_port_set_status(priv, port, 1);
         priv->port_sts[port].enabled = 1;
 
+        phy_support_asym_pause(phy);
+
         return 0;
 }
 
diff --git a/drivers/net/dsa/sja1105/sja1105_dynamic_config.c b/drivers/net/dsa/sja1105/sja1105_dynamic_config.c
index 6bfb1696a6f2..9988c9d18567 100644
--- a/drivers/net/dsa/sja1105/sja1105_dynamic_config.c
+++ b/drivers/net/dsa/sja1105/sja1105_dynamic_config.c
@@ -277,6 +277,18 @@ sja1105et_l2_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd,
                         SJA1105ET_SIZE_L2_LOOKUP_ENTRY, op);
 }
 
+static size_t sja1105et_dyn_l2_lookup_entry_packing(void *buf, void *entry_ptr,
+                                                    enum packing_op op)
+{
+        struct sja1105_l2_lookup_entry *entry = entry_ptr;
+        u8 *cmd = buf + SJA1105ET_SIZE_L2_LOOKUP_ENTRY;
+        const int size = SJA1105_SIZE_DYN_CMD;
+
+        sja1105_packing(cmd, &entry->lockeds, 28, 28, size, op);
+
+        return sja1105et_l2_lookup_entry_packing(buf, entry_ptr, op);
+}
+
 static void
 sja1105et_mgmt_route_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd,
                                  enum packing_op op)
@@ -477,7 +489,7 @@ sja1105et_general_params_entry_packing(void *buf, void *entry_ptr,
 /* SJA1105E/T: First generation */
 struct sja1105_dynamic_table_ops sja1105et_dyn_ops[BLK_IDX_MAX_DYN] = {
         [BLK_IDX_L2_LOOKUP] = {
-                .entry_packing = sja1105et_l2_lookup_entry_packing,
+                .entry_packing = sja1105et_dyn_l2_lookup_entry_packing,
                 .cmd_packing = sja1105et_l2_lookup_cmd_packing,
                 .access = (OP_READ | OP_WRITE | OP_DEL),
                 .max_entry_count = SJA1105_MAX_L2_LOOKUP_COUNT,
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 32bf3a7cc3b6..d073baffc20b 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -218,7 +218,7 @@ static int sja1105_init_l2_lookup_params(struct sja1105_private *priv)
                 /* This selects between Independent VLAN Learning (IVL) and
                  * Shared VLAN Learning (SVL)
                  */
-                .shared_learn = false,
+                .shared_learn = true,
                 /* Don't discard management traffic based on ENFPORT -
                  * we don't perform SMAC port enforcement anyway, so
                  * what we are setting here doesn't matter.
@@ -625,6 +625,7 @@ static int sja1105_parse_ports_node(struct sja1105_private *priv,
                 if (of_property_read_u32(child, "reg", &index) < 0) {
                         dev_err(dev, "Port number not defined in device tree "
                                 "(property \"reg\")\n");
+                        of_node_put(child);
                         return -ENODEV;
                 }
 
@@ -634,6 +635,7 @@ static int sja1105_parse_ports_node(struct sja1105_private *priv,
                         dev_err(dev, "Failed to read phy-mode or "
                                 "phy-interface-type property for port %d\n",
                                 index);
+                        of_node_put(child);
                         return -ENODEV;
                 }
                 ports[index].phy_mode = phy_mode;
@@ -643,6 +645,7 @@ static int sja1105_parse_ports_node(struct sja1105_private *priv,
                         if (!of_phy_is_fixed_link(child)) {
                                 dev_err(dev, "phy-handle or fixed-link "
                                         "properties missing!\n");
+                                of_node_put(child);
                                 return -ENODEV;
                         }
                         /* phy-handle is missing, but fixed-link isn't.
@@ -1089,8 +1092,13 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
         l2_lookup.vlanid = vid;
         l2_lookup.iotag = SJA1105_S_TAG;
         l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
-        l2_lookup.mask_vlanid = VLAN_VID_MASK;
-        l2_lookup.mask_iotag = BIT(0);
+        if (dsa_port_is_vlan_filtering(&ds->ports[port])) {
+                l2_lookup.mask_vlanid = VLAN_VID_MASK;
+                l2_lookup.mask_iotag = BIT(0);
+        } else {
+                l2_lookup.mask_vlanid = 0;
+                l2_lookup.mask_iotag = 0;
+        }
         l2_lookup.destports = BIT(port);
 
         rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
@@ -1147,8 +1155,13 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port,
         l2_lookup.vlanid = vid;
         l2_lookup.iotag = SJA1105_S_TAG;
         l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
-        l2_lookup.mask_vlanid = VLAN_VID_MASK;
-        l2_lookup.mask_iotag = BIT(0);
+        if (dsa_port_is_vlan_filtering(&ds->ports[port])) {
+                l2_lookup.mask_vlanid = VLAN_VID_MASK;
+                l2_lookup.mask_iotag = BIT(0);
+        } else {
+                l2_lookup.mask_vlanid = 0;
+                l2_lookup.mask_iotag = 0;
+        }
         l2_lookup.destports = BIT(port);
 
         rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
@@ -1178,60 +1191,31 @@ static int sja1105_fdb_add(struct dsa_switch *ds, int port,
                            const unsigned char *addr, u16 vid)
 {
         struct sja1105_private *priv = ds->priv;
-        u16 rx_vid, tx_vid;
-        int rc, i;
 
-        if (dsa_port_is_vlan_filtering(&ds->ports[port]))
-                return priv->info->fdb_add_cmd(ds, port, addr, vid);
-
-        /* Since we make use of VLANs even when the bridge core doesn't tell us
-         * to, translate these FDB entries into the correct dsa_8021q ones.
-         * The basic idea (also repeats for removal below) is:
-         * - Each of the other front-panel ports needs to be able to forward a
-         *   pvid-tagged (aka tagged with their rx_vid) frame that matches this
-         *   DMAC.
-         * - The CPU port (aka the tx_vid of this port) needs to be able to
-         *   send a frame matching this DMAC to the specified port.
-         * For a better picture see net/dsa/tag_8021q.c.
+        /* dsa_8021q is in effect when the bridge's vlan_filtering isn't,
+         * so the switch still does some VLAN processing internally.
+         * But Shared VLAN Learning (SVL) is also active, and it will take
+         * care of autonomous forwarding between the unique pvid's of each
+         * port.  Here we just make sure that users can't add duplicate FDB
+         * entries when in this mode - the actual VID doesn't matter except
+         * for what gets printed in 'bridge fdb show'.  In the case of zero,
+         * no VID gets printed at all.
          */
-        for (i = 0; i < SJA1105_NUM_PORTS; i++) {
-                if (i == port)
-                        continue;
-                if (i == dsa_upstream_port(priv->ds, port))
-                        continue;
+        if (!dsa_port_is_vlan_filtering(&ds->ports[port]))
+                vid = 0;
 
-                rx_vid = dsa_8021q_rx_vid(ds, i);
-                rc = priv->info->fdb_add_cmd(ds, port, addr, rx_vid);
-                if (rc < 0)
-                        return rc;
-        }
-        tx_vid = dsa_8021q_tx_vid(ds, port);
-        return priv->info->fdb_add_cmd(ds, port, addr, tx_vid);
+        return priv->info->fdb_add_cmd(ds, port, addr, vid);
 }
 
 static int sja1105_fdb_del(struct dsa_switch *ds, int port,
                            const unsigned char *addr, u16 vid)
 {
         struct sja1105_private *priv = ds->priv;
-        u16 rx_vid, tx_vid;
-        int rc, i;
-
-        if (dsa_port_is_vlan_filtering(&ds->ports[port]))
-                return priv->info->fdb_del_cmd(ds, port, addr, vid);
 
-        for (i = 0; i < SJA1105_NUM_PORTS; i++) {
-                if (i == port)
-                        continue;
-                if (i == dsa_upstream_port(priv->ds, port))
-                        continue;
+        if (!dsa_port_is_vlan_filtering(&ds->ports[port]))
+                vid = 0;
 
-                rx_vid = dsa_8021q_rx_vid(ds, i);
-                rc = priv->info->fdb_del_cmd(ds, port, addr, rx_vid);
-                if (rc < 0)
-                        return rc;
-        }
-        tx_vid = dsa_8021q_tx_vid(ds, port);
-        return priv->info->fdb_del_cmd(ds, port, addr, tx_vid);
+        return priv->info->fdb_del_cmd(ds, port, addr, vid);
 }
 
 static int sja1105_fdb_dump(struct dsa_switch *ds, int port,
@@ -1270,39 +1254,9 @@ static int sja1105_fdb_dump(struct dsa_switch *ds, int port,
                         continue;
                 u64_to_ether_addr(l2_lookup.macaddr, macaddr);
 
-                /* On SJA1105 E/T, the switch doesn't implement the LOCKEDS
-                 * bit, so it doesn't tell us whether a FDB entry is static
-                 * or not.
-                 * But, of course, we can find out - we're the ones who added
-                 * it in the first place.
-                 */
-                if (priv->info->device_id == SJA1105E_DEVICE_ID ||
-                    priv->info->device_id == SJA1105T_DEVICE_ID) {
-                        int match;
-
-                        match = sja1105_find_static_fdb_entry(priv, port,
-                                                              &l2_lookup);
-                        l2_lookup.lockeds = (match >= 0);
-                }
-
-                /* We need to hide the dsa_8021q VLANs from the user. This
-                 * basically means hiding the duplicates and only showing
-                 * the pvid that is supposed to be active in standalone and
-                 * non-vlan_filtering modes (aka 1).
-                 * - For statically added FDB entries (bridge fdb add), we
-                 *   can convert the TX VID (coming from the CPU port) into the
-                 *   pvid and ignore the RX VIDs of the other ports.
-                 * - For dynamically learned FDB entries, a single entry with
-                 *   no duplicates is learned - that which has the real port's
-                 *   pvid, aka RX VID.
-                 */
-                if (!dsa_port_is_vlan_filtering(&ds->ports[port])) {
-                        if (l2_lookup.vlanid == tx_vid ||
-                            l2_lookup.vlanid == rx_vid)
-                                l2_lookup.vlanid = 1;
-                        else
-                                continue;
-                }
+                /* We need to hide the dsa_8021q VLANs from the user. */
+                if (!dsa_port_is_vlan_filtering(&ds->ports[port]))
+                        l2_lookup.vlanid = 0;
                 cb(macaddr, l2_lookup.vlanid, l2_lookup.lockeds, data);
         }
         return 0;
@@ -1594,6 +1548,7 @@ static int sja1105_vlan_prepare(struct dsa_switch *ds, int port,
  */
 static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled)
 {
+        struct sja1105_l2_lookup_params_entry *l2_lookup_params;
         struct sja1105_general_params_entry *general_params;
         struct sja1105_private *priv = ds->priv;
         struct sja1105_table *table;
@@ -1622,6 +1577,28 @@ static int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled)
         general_params->incl_srcpt1 = enabled;
         general_params->incl_srcpt0 = enabled;
 
+        /* VLAN filtering => independent VLAN learning.
+         * No VLAN filtering => shared VLAN learning.
+         *
+         * In shared VLAN learning mode, untagged traffic still gets
+         * pvid-tagged, and the FDB table gets populated with entries
+         * containing the "real" (pvid or from VLAN tag) VLAN ID.
+         * However the switch performs a masked L2 lookup in the FDB,
+         * effectively only looking up a frame's DMAC (and not VID) for the
+         * forwarding decision.
+         *
+         * This is extremely convenient for us, because in modes with
+         * vlan_filtering=0, dsa_8021q actually installs unique pvid's into
+         * each front panel port. This is good for identification but breaks
+         * learning badly - the VID of the learnt FDB entry is unique, aka
+         * no frames coming from any other port are going to have it. So
+         * for forwarding purposes, this is as though learning was broken
+         * (all frames get flooded).
+         */
+        table = &priv->static_config.tables[BLK_IDX_L2_LOOKUP_PARAMS];
+        l2_lookup_params = table->entries;
+        l2_lookup_params->shared_learn = !enabled;
+
         rc = sja1105_static_config_reload(priv);
         if (rc)
                 dev_err(ds->dev, "Failed to change VLAN Ethertype\n");
@@ -1751,6 +1728,8 @@ static void sja1105_teardown(struct dsa_switch *ds)
 
         cancel_work_sync(&priv->tagger_data.rxtstamp_work);
         skb_queue_purge(&priv->tagger_data.skb_rxtstamp_queue);
+        sja1105_ptp_clock_unregister(priv);
+        sja1105_static_config_free(&priv->static_config);
 }
 
 static int sja1105_mgmt_xmit(struct dsa_switch *ds, int port, int slot,
@@ -2208,9 +2187,7 @@ static int sja1105_remove(struct spi_device *spi)
 {
         struct sja1105_private *priv = spi_get_drvdata(spi);
 
-        sja1105_ptp_clock_unregister(priv);
         dsa_unregister_switch(priv->ds);
-        sja1105_static_config_free(&priv->static_config);
         return 0;
 }
 
diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
index d19cfdf681af..d8e8dd59f3d1 100644
--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
+++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
@@ -369,16 +369,15 @@ int sja1105_ptp_clock_register(struct sja1105_private *priv)
                 .mult = SJA1105_CC_MULT,
         };
         mutex_init(&priv->ptp_lock);
-        INIT_DELAYED_WORK(&priv->refresh_work, sja1105_ptp_overflow_check);
-
-        schedule_delayed_work(&priv->refresh_work, SJA1105_REFRESH_INTERVAL);
-
         priv->ptp_caps = sja1105_ptp_caps;
 
         priv->clock = ptp_clock_register(&priv->ptp_caps, ds->dev);
         if (IS_ERR_OR_NULL(priv->clock))
                 return PTR_ERR(priv->clock);
 
+        INIT_DELAYED_WORK(&priv->refresh_work, sja1105_ptp_overflow_check);
+        schedule_delayed_work(&priv->refresh_work, SJA1105_REFRESH_INTERVAL);
+
         return sja1105_ptp_reset(priv);
 }
 
diff --git a/drivers/net/ethernet/8390/Kconfig b/drivers/net/ethernet/8390/Kconfig
index 2a3e2450968e..a9478577b495 100644
--- a/drivers/net/ethernet/8390/Kconfig
+++ b/drivers/net/ethernet/8390/Kconfig
@@ -12,8 +12,8 @@ config NET_VENDOR_8390
 
           Note that the answer to this question doesn't directly affect the
           kernel: saying N will just cause the configurator to skip all
-          the questions about Western Digital cards. If you say Y, you will be
-          asked for your specific card in the following questions.
+          the questions about National Semiconductor 8390 cards. If you say Y,
+          you will be asked for your specific card in the following questions.
 
 if NET_VENDOR_8390
 
diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c
index e43d922f043e..174344c450af 100644
--- a/drivers/net/ethernet/agere/et131x.c
+++ b/drivers/net/ethernet/agere/et131x.c
@@ -2362,7 +2362,7 @@ static int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter)
 
         /* Allocate memory for the TCB's (Transmit Control Block) */
         tx_ring->tcb_ring = kcalloc(NUM_TCB, sizeof(struct tcb),
-                                    GFP_ATOMIC | GFP_DMA);
+                                    GFP_KERNEL | GFP_DMA);
         if (!tx_ring->tcb_ring)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 3434730a7699..0537df06a9b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -860,7 +860,9 @@ static int emac_probe(struct platform_device *pdev)
                 goto out_clk_disable_unprepare;
         }
 
-        db->phy_node = of_parse_phandle(np, "phy", 0);
+        db->phy_node = of_parse_phandle(np, "phy-handle", 0);
+        if (!db->phy_node)
+                db->phy_node = of_parse_phandle(np, "phy", 0);
         if (!db->phy_node) {
                 dev_err(&pdev->dev, "no associated PHY\n");
                 ret = -ENODEV;
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index de4950d2022e..9f965cdfff5c 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -14,7 +14,7 @@ config NET_VENDOR_AMD
           say Y.
 
           Note that the answer to this question does not directly affect
-          the kernel: saying N will just case the configurator to skip all
+          the kernel: saying N will just cause the configurator to skip all
           the questions regarding AMD chipsets. If you say Y, you will be asked
           for your specific chipset/driver in the following questions.
 
diff --git a/drivers/net/ethernet/apple/Kconfig b/drivers/net/ethernet/apple/Kconfig
index fde7ae33e302..f78b9c841296 100644
--- a/drivers/net/ethernet/apple/Kconfig
+++ b/drivers/net/ethernet/apple/Kconfig
@@ -11,8 +11,8 @@ config NET_VENDOR_APPLE
           If you have a network (Ethernet) card belonging to this class, say Y.
 
           Note that the answer to this question doesn't directly affect the
-          kernel: saying N will just cause the configurator to skip all
-          the questions about IBM devices. If you say Y, you will be asked for
+          kernel: saying N will just cause the configurator to skip all the
+          questions about Apple devices. If you say Y, you will be asked for
           your specific card in the following questions.
 
 if NET_VENDOR_APPLE
diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
index 40a8717f51b1..7548247455d7 100644
--- a/drivers/net/ethernet/atheros/ag71xx.c
+++ b/drivers/net/ethernet/atheros/ag71xx.c
@@ -1141,7 +1141,7 @@ static int ag71xx_rings_init(struct ag71xx *ag)
 
         tx->descs_cpu = dma_alloc_coherent(&ag->pdev->dev,
                                            ring_size * AG71XX_DESC_SIZE,
-                                           &tx->descs_dma, GFP_ATOMIC);
+                                           &tx->descs_dma, GFP_KERNEL);
         if (!tx->descs_cpu) {
                 kfree(tx->buf);
                 tx->buf = NULL;
diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
index e9017caf024d..e24f5d2b6afe 100644
--- a/drivers/net/ethernet/broadcom/Kconfig
+++ b/drivers/net/ethernet/broadcom/Kconfig
@@ -14,9 +14,9 @@ config NET_VENDOR_BROADCOM
           say Y.
 
           Note that the answer to this question does not directly affect
-          the kernel: saying N will just case the configurator to skip all
-          the questions regarding AMD chipsets. If you say Y, you will be asked
-          for your specific chipset/driver in the following questions.
+          the kernel: saying N will just cause the configurator to skip all
+          the questions regarding Broadcom chipsets. If you say Y, you will
+          be asked for your specific chipset/driver in the following questions.
 
 if NET_VENDOR_BROADCOM
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index b9c5cea8db16..9483553ce444 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -992,7 +992,7 @@ static int bcm_sysport_poll(struct napi_struct *napi, int budget)
 {
         struct bcm_sysport_priv *priv =
                 container_of(napi, struct bcm_sysport_priv, napi);
-        struct dim_sample dim_sample;
+        struct dim_sample dim_sample = {};
         unsigned int work_done = 0;
 
         work_done = bcm_sysport_desc_rx(priv, budget);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e2be5a685130..e47ea92e2ae3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1934,8 +1934,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return netdev_pick_tx(dev, skb, NULL) %
-               (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
+        return netdev_pick_tx(dev, skb, NULL) % (BNX2X_NUM_ETH_QUEUES(bp));
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index c23fbb34f0e9..94be97b7952c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2267,7 +2267,7 @@ static int bnxt_poll(struct napi_struct *napi, int budget)
                 }
         }
         if (bp->flags & BNXT_FLAG_DIM) {
-                struct dim_sample dim_sample;
+                struct dim_sample dim_sample = {};
 
                 dim_update_sample(cpr->event_ctr,
                                   cpr->rx_packets,
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index a2b57807453b..d3a0b614dbfa 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1895,7 +1895,7 @@ static int bcmgenet_rx_poll(struct napi_struct *napi, int budget)
 {
         struct bcmgenet_rx_ring *ring = container_of(napi,
                         struct bcmgenet_rx_ring, napi);
-        struct dim_sample dim_sample;
+        struct dim_sample dim_sample = {};
         unsigned int work_done;
 
         work_done = bcmgenet_desc_rx(ring, budget);
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index ad22554857bf..acb016834f04 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -1381,24 +1381,18 @@ static int acpi_get_mac_address(struct device *dev, struct acpi_device *adev,
                                 u8 *dst)
 {
         u8 mac[ETH_ALEN];
-        int ret;
+        u8 *addr;
 
-        ret = fwnode_property_read_u8_array(acpi_fwnode_handle(adev),
-                                            "mac-address", mac, ETH_ALEN);
-        if (ret)
-                goto out;
-
-        if (!is_valid_ether_addr(mac)) {
+        addr = fwnode_get_mac_address(acpi_fwnode_handle(adev), mac, ETH_ALEN);
+        if (!addr) {
                 dev_err(dev, "MAC address invalid: %pM\n", mac);
-                ret = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
 
         dev_info(dev, "MAC address set to: %pM\n", mac);
 
-        memcpy(dst, mac, ETH_ALEN);
-out:
-        return ret;
+        ether_addr_copy(dst, mac);
+        return 0;
 }
 
 /* Currently only sets the MAC address. */
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 1e82b9efe447..58f89f6a040f 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -3269,7 +3269,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!adapter->regs) {
                 dev_err(&pdev->dev, "cannot map device registers\n");
                 err = -ENOMEM;
-                goto out_free_adapter;
+                goto out_free_adapter_nofail;
         }
 
         adapter->pdev = pdev;
@@ -3397,6 +3397,9 @@ out_free_dev:
                 if (adapter->port[i])
                         free_netdev(adapter->port[i]);
 
+out_free_adapter_nofail:
+        kfree_skb(adapter->nofail_skb);
+
 out_free_adapter:
         kfree(adapter);
 
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index ef5d61d57597..323976c811e9 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -550,7 +550,7 @@ int be_process_mcc(struct be_adapter *adapter)
         int num = 0, status = 0;
         struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
 
-        spin_lock(&adapter->mcc_cq_lock);
+        spin_lock_bh(&adapter->mcc_cq_lock);
 
         while ((compl = be_mcc_compl_get(adapter))) {
                 if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
@@ -566,7 +566,7 @@ int be_process_mcc(struct be_adapter *adapter)
         if (num)
                 be_cq_notify(adapter, mcc_obj->cq.id, mcc_obj->rearm_cq, num);
 
-        spin_unlock(&adapter->mcc_cq_lock);
+        spin_unlock_bh(&adapter->mcc_cq_lock);
         return status;
 }
 
@@ -581,9 +581,7 @@ static int be_mcc_wait_compl(struct be_adapter *adapter)
                 if (be_check_error(adapter, BE_ERROR_ANY))
                         return -EIO;
 
-                local_bh_disable();
                 status = be_process_mcc(adapter);
-                local_bh_enable();
 
                 if (atomic_read(&mcc_obj->q.used) == 0)
                         break;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 1c9883019767..314e9868b861 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5630,9 +5630,7 @@ static void be_worker(struct work_struct *work)
          * mcc completions
          */
         if (!netif_running(adapter->netdev)) {
-                local_bh_disable();
                 be_process_mcc(adapter);
-                local_bh_enable();
                 goto reschedule;
         }
 
diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig
index 9c530f75134f..c219587bd334 100644
--- a/drivers/net/ethernet/freescale/enetc/Kconfig
+++ b/drivers/net/ethernet/freescale/enetc/Kconfig
@@ -2,6 +2,7 @@
 config FSL_ENETC
         tristate "ENETC PF driver"
         depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
+        select PHYLIB
         help
           This driver supports NXP ENETC gigabit ethernet controller PCIe
           physical function (PF) devices, managing ENETC Ports at a privileged
@@ -12,6 +13,7 @@ config FSL_ENETC
 config FSL_ENETC_VF
         tristate "ENETC VF driver"
         depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
+        select PHYLIB
         help
           This driver supports NXP ENETC gigabit ethernet controller PCIe
           virtual function (VF) devices enabled by the ENETC PF driver.
diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index e80fedb27cee..210749bf1eac 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -2439,9 +2439,6 @@ MODULE_PARM_DESC(fsl_fm_rx_extra_headroom, "Extra headroom for Rx buffers");
  * buffers when not using jumbo frames.
  * Must be large enough to accommodate the network MTU, but small enough
  * to avoid wasting skb memory.
- *
- * Could be overridden once, at boot-time, via the
- * fm_set_max_frm() callback.
  */
 static int fsl_fm_max_frm = FSL_FM_MAX_FRAME_SIZE;
 module_param(fsl_fm_max_frm, int, 0);
diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h
index 92372dc43be8..ebc37e256922 100644
--- a/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -31,9 +31,6 @@
 struct gve_rx_desc_queue {
         struct gve_rx_desc *desc_ring; /* the descriptor ring */
         dma_addr_t bus; /* the bus for the desc_ring */
-        u32 cnt; /* free-running total number of completed packets */
-        u32 fill_cnt; /* free-running total number of descriptors posted */
-        u32 mask; /* masks the cnt to the size of the ring */
         u8 seqno; /* the next expected seqno for this desc*/
 };
 
@@ -60,8 +57,6 @@ struct gve_rx_data_queue {
         dma_addr_t data_bus; /* dma mapping of the slots */
         struct gve_rx_slot_page_info *page_info; /* page info of the buffers */
         struct gve_queue_page_list *qpl; /* qpl assigned to this queue */
-        u32 mask; /* masks the cnt to the size of the ring */
-        u32 cnt; /* free-running total number of completed packets */
 };
 
 struct gve_priv;
@@ -73,6 +68,9 @@ struct gve_rx_ring {
         struct gve_rx_data_queue data;
         u64 rbytes; /* free-running bytes received */
         u64 rpackets; /* free-running packets received */
+        u32 cnt; /* free-running total number of completed packets */
+        u32 fill_cnt; /* free-running total number of descs and buffs posted */
+        u32 mask; /* masks the cnt and fill_cnt to the size of the ring */
         u32 q_num; /* queue index */
         u32 ntfy_id; /* notification block index */
         struct gve_queue_resources *q_resources; /* head and tail pointer idx */
diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
index 26540b856541..d8fa816f4473 100644
--- a/drivers/net/ethernet/google/gve/gve_ethtool.c
+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
@@ -138,8 +138,8 @@ gve_get_ethtool_stats(struct net_device *netdev,
                 for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) {
                         struct gve_rx_ring *rx = &priv->rx[ring];
 
-                        data[i++] = rx->desc.cnt;
-                        data[i++] = rx->desc.fill_cnt;
+                        data[i++] = rx->cnt;
+                        data[i++] = rx->fill_cnt;
                 }
         } else {
                 i += priv->rx_cfg.num_queues * NUM_GVE_RX_CNTS;
diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c
index 1914b8350da7..59564ac99d2a 100644
--- a/drivers/net/ethernet/google/gve/gve_rx.c
+++ b/drivers/net/ethernet/google/gve/gve_rx.c
@@ -37,7 +37,7 @@ static void gve_rx_free_ring(struct gve_priv *priv, int idx)
         rx->data.qpl = NULL;
         kvfree(rx->data.page_info);
 
-        slots = rx->data.mask + 1;
+        slots = rx->mask + 1;
         bytes = sizeof(*rx->data.data_ring) * slots;
         dma_free_coherent(dev, bytes, rx->data.data_ring,
                           rx->data.data_bus);
@@ -64,7 +64,7 @@ static int gve_prefill_rx_pages(struct gve_rx_ring *rx)
         /* Allocate one page per Rx queue slot. Each page is split into two
          * packet buffers, when possible we "page flip" between the two.
          */
-        slots = rx->data.mask + 1;
+        slots = rx->mask + 1;
 
         rx->data.page_info = kvzalloc(slots *
                                       sizeof(*rx->data.page_info), GFP_KERNEL);
@@ -111,7 +111,7 @@ static int gve_rx_alloc_ring(struct gve_priv *priv, int idx)
         rx->q_num = idx;
 
         slots = priv->rx_pages_per_qpl;
-        rx->data.mask = slots - 1;
+        rx->mask = slots - 1;
 
         /* alloc rx data ring */
         bytes = sizeof(*rx->data.data_ring) * slots;
@@ -125,7 +125,7 @@ static int gve_rx_alloc_ring(struct gve_priv *priv, int idx)
                 err = -ENOMEM;
                 goto abort_with_slots;
         }
-        rx->desc.fill_cnt = filled_pages;
+        rx->fill_cnt = filled_pages;
         /* Ensure data ring slots (packet buffers) are visible. */
         dma_wmb();
 
@@ -156,8 +156,8 @@ static int gve_rx_alloc_ring(struct gve_priv *priv, int idx)
                 err = -ENOMEM;
                 goto abort_with_q_resources;
         }
-        rx->desc.mask = slots - 1;
-        rx->desc.cnt = 0;
+        rx->mask = slots - 1;
+        rx->cnt = 0;
         rx->desc.seqno = 1;
         gve_rx_add_to_block(priv, idx);
 
@@ -213,7 +213,7 @@ void gve_rx_write_doorbell(struct gve_priv *priv, struct gve_rx_ring *rx)
 {
         u32 db_idx = be32_to_cpu(rx->q_resources->db_index);
 
-        iowrite32be(rx->desc.fill_cnt, &priv->db_bar2[db_idx]);
+        iowrite32be(rx->fill_cnt, &priv->db_bar2[db_idx]);
 }
 
 static enum pkt_hash_types gve_rss_type(__be16 pkt_flags)
@@ -273,7 +273,7 @@ static void gve_rx_flip_buff(struct gve_rx_slot_page_info *page_info,
 }
 
 static bool gve_rx(struct gve_rx_ring *rx, struct gve_rx_desc *rx_desc,
-                   netdev_features_t feat)
+                   netdev_features_t feat, u32 idx)
 {
         struct gve_rx_slot_page_info *page_info;
         struct gve_priv *priv = rx->gve;
@@ -282,14 +282,12 @@ static bool gve_rx(struct gve_rx_ring *rx, struct gve_rx_desc *rx_desc,
         struct sk_buff *skb;
         int pagecount;
         u16 len;
-        u32 idx;
 
         /* drop this packet */
         if (unlikely(rx_desc->flags_seq & GVE_RXF_ERR))
                 return true;
 
         len = be16_to_cpu(rx_desc->len) - GVE_RX_PAD;
-        idx = rx->data.cnt & rx->data.mask;
         page_info = &rx->data.page_info[idx];
 
         /* gvnic can only receive into registered segments. If the buffer
@@ -340,8 +338,6 @@ have_skb:
         if (!skb)
                 return true;
 
-        rx->data.cnt++;
-
         if (likely(feat & NETIF_F_RXCSUM)) {
                 /* NIC passes up the partial sum */
                 if (rx_desc->csum)
@@ -370,7 +366,7 @@ static bool gve_rx_work_pending(struct gve_rx_ring *rx)
         __be16 flags_seq;
         u32 next_idx;
 
-        next_idx = rx->desc.cnt & rx->desc.mask;
+        next_idx = rx->cnt & rx->mask;
         desc = rx->desc.desc_ring + next_idx;
 
         flags_seq = desc->flags_seq;
@@ -385,8 +381,8 @@ bool gve_clean_rx_done(struct gve_rx_ring *rx, int budget,
 {
         struct gve_priv *priv = rx->gve;
         struct gve_rx_desc *desc;
-        u32 cnt = rx->desc.cnt;
-        u32 idx = cnt & rx->desc.mask;
+        u32 cnt = rx->cnt;
+        u32 idx = cnt & rx->mask;
         u32 work_done = 0;
         u64 bytes = 0;
 
@@ -401,10 +397,10 @@ bool gve_clean_rx_done(struct gve_rx_ring *rx, int budget,
                            rx->q_num, GVE_SEQNO(desc->flags_seq),
                            rx->desc.seqno);
                 bytes += be16_to_cpu(desc->len) - GVE_RX_PAD;
-                if (!gve_rx(rx, desc, feat))
+                if (!gve_rx(rx, desc, feat, idx))
                         gve_schedule_reset(priv);
                 cnt++;
-                idx = cnt & rx->desc.mask;
+                idx = cnt & rx->mask;
                 desc = rx->desc.desc_ring + idx;
                 rx->desc.seqno = gve_next_seqno(rx->desc.seqno);
                 work_done++;
@@ -417,8 +413,8 @@ bool gve_clean_rx_done(struct gve_rx_ring *rx, int budget,
         rx->rpackets += work_done;
         rx->rbytes += bytes;
         u64_stats_update_end(&rx->statss);
-        rx->desc.cnt = cnt;
-        rx->desc.fill_cnt += work_done;
+        rx->cnt = cnt;
+        rx->fill_cnt += work_done;
 
         /* restock desc ring slots */
         dma_wmb();      /* Ensure descs are visible before ringing doorbell */
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index d60452845539..c84167447abe 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -220,6 +220,7 @@ struct hip04_priv {
         unsigned int reg_inten;
 
         struct napi_struct napi;
+        struct device *dev;
         struct net_device *ndev;
 
         struct tx_desc *tx_desc;
@@ -248,7 +249,7 @@ struct hip04_priv {
 
 static inline unsigned int tx_count(unsigned int head, unsigned int tail)
 {
-        return (head - tail) % (TX_DESC_NUM - 1);
+        return (head - tail) % TX_DESC_NUM;
 }
 
 static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
@@ -465,7 +466,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force)
                 }
 
                 if (priv->tx_phys[tx_tail]) {
-                        dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
+                        dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
                                          priv->tx_skb[tx_tail]->len,
                                          DMA_TO_DEVICE);
                         priv->tx_phys[tx_tail] = 0;
@@ -516,8 +517,8 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 return NETDEV_TX_BUSY;
         }
 
-        phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
-        if (dma_mapping_error(&ndev->dev, phys)) {
+        phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
+        if (dma_mapping_error(priv->dev, phys)) {
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
@@ -585,6 +586,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
         u16 len;
         u32 err;
 
+        /* clean up tx descriptors */
+        tx_remaining = hip04_tx_reclaim(ndev, false);
+
         while (cnt && !last) {
                 buf = priv->rx_buf[priv->rx_head];
                 skb = build_skb(buf, priv->rx_buf_size);
@@ -593,7 +597,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
                         goto refill;
                 }
 
-                dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
+                dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
                                  RX_BUF_SIZE, DMA_FROM_DEVICE);
                 priv->rx_phys[priv->rx_head] = 0;
 
@@ -622,9 +626,9 @@ refill:
                 buf = netdev_alloc_frag(priv->rx_buf_size);
                 if (!buf)
                         goto done;
-                phys = dma_map_single(&ndev->dev, buf,
+                phys = dma_map_single(priv->dev, buf,
                                       RX_BUF_SIZE, DMA_FROM_DEVICE);
-                if (dma_mapping_error(&ndev->dev, phys))
+                if (dma_mapping_error(priv->dev, phys))
                         goto done;
                 priv->rx_buf[priv->rx_head] = buf;
                 priv->rx_phys[priv->rx_head] = phys;
@@ -645,8 +649,7 @@ refill:
         }
         napi_complete_done(napi, rx);
 done:
-        /* clean up tx descriptors and start a new timer if necessary */
-        tx_remaining = hip04_tx_reclaim(ndev, false);
+        /* start a new timer if necessary */
         if (rx < budget && tx_remaining)
                 hip04_start_tx_timer(priv);
 
@@ -728,9 +731,9 @@ static int hip04_mac_open(struct net_device *ndev)
         for (i = 0; i < RX_DESC_NUM; i++) {
                 dma_addr_t phys;
 
-                phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
+                phys = dma_map_single(priv->dev, priv->rx_buf[i],
                                       RX_BUF_SIZE, DMA_FROM_DEVICE);
-                if (dma_mapping_error(&ndev->dev, phys))
+                if (dma_mapping_error(priv->dev, phys))
                         return -EIO;
 
                 priv->rx_phys[i] = phys;
@@ -764,7 +767,7 @@ static int hip04_mac_stop(struct net_device *ndev)
 
         for (i = 0; i < RX_DESC_NUM; i++) {
                 if (priv->rx_phys[i]) {
-                        dma_unmap_single(&ndev->dev, priv->rx_phys[i],
+                        dma_unmap_single(priv->dev, priv->rx_phys[i],
                                          RX_BUF_SIZE, DMA_FROM_DEVICE);
                         priv->rx_phys[i] = 0;
                 }
@@ -907,6 +910,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         priv = netdev_priv(ndev);
+        priv->dev = d;
         priv->ndev = ndev;
         platform_set_drvdata(pdev, ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 4138a8480347..cca71ba7a74a 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3251,7 +3251,7 @@ static int ehea_mem_notifier(struct notifier_block *nb,
         switch (action) {
         case MEM_CANCEL_OFFLINE:
                 pr_info("memory offlining canceled");
-                /* Fall through: re-add canceled memory block */
+                /* Fall through - re-add canceled memory block */
 
         case MEM_ONLINE:
                 pr_info("memory is going online");
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index f660cc2b8258..0b9e851f3da4 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -319,20 +319,33 @@ static int orion_mdio_probe(struct platform_device *pdev)
 
         init_waitqueue_head(&dev->smi_busy_wait);
 
-        for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
-                dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
-                if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
+        if (pdev->dev.of_node) {
+                for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+                        dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
+                        if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
+                                ret = -EPROBE_DEFER;
+                                goto out_clk;
+                        }
+                        if (IS_ERR(dev->clk[i]))
+                                break;
+                        clk_prepare_enable(dev->clk[i]);
+                }
+
+                if (!IS_ERR(of_clk_get(pdev->dev.of_node,
+                                       ARRAY_SIZE(dev->clk))))
+                        dev_warn(&pdev->dev,
+                                 "unsupported number of clocks, limiting to the first "
+                                 __stringify(ARRAY_SIZE(dev->clk)) "\n");
+        } else {
+                dev->clk[0] = clk_get(&pdev->dev, NULL);
+                if (PTR_ERR(dev->clk[0]) == -EPROBE_DEFER) {
                         ret = -EPROBE_DEFER;
                         goto out_clk;
                 }
-                if (IS_ERR(dev->clk[i]))
-                        break;
-                clk_prepare_enable(dev->clk[i]);
+                if (!IS_ERR(dev->clk[0]))
+                        clk_prepare_enable(dev->clk[0]);
         }
 
-        if (!IS_ERR(of_clk_get(pdev->dev.of_node, ARRAY_SIZE(dev->clk))))
-                dev_warn(&pdev->dev, "unsupported number of clocks, limiting to the first "
-                         __stringify(ARRAY_SIZE(dev->clk)) "\n");
 
         dev->err_interrupt = platform_get_irq(pdev, 0);
         if (dev->err_interrupt > 0 &&
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index e9d8ffe897e9..74fd9e171865 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -811,6 +811,26 @@ static int mvpp2_swf_bm_pool_init(struct mvpp2_port *port)
         return 0;
 }
 
+static void mvpp2_set_hw_csum(struct mvpp2_port *port,
+                              enum mvpp2_bm_pool_log_num new_long_pool)
+{
+        const netdev_features_t csums = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+
+        /* Update L4 checksum when jumbo enable/disable on port.
+         * Only port 0 supports hardware checksum offload due to
+         * the Tx FIFO size limitation.
+         * Also, don't set NETIF_F_HW_CSUM because L3_offset in TX descriptor
+         * has 7 bits, so the maximum L3 offset is 128.
+         */
+        if (new_long_pool == MVPP2_BM_JUMBO && port->id != 0) {
+                port->dev->features &= ~csums;
+                port->dev->hw_features &= ~csums;
+        } else {
+                port->dev->features |= csums;
+                port->dev->hw_features |= csums;
+        }
+}
+
 static int mvpp2_bm_update_mtu(struct net_device *dev, int mtu)
 {
         struct mvpp2_port *port = netdev_priv(dev);
@@ -843,15 +863,7 @@ static int mvpp2_bm_update_mtu(struct net_device *dev, int mtu)
                 /* Add port to new short & long pool */
                 mvpp2_swf_bm_pool_init(port);
 
-                /* Update L4 checksum when jumbo enable/disable on port */
-                if (new_long_pool == MVPP2_BM_JUMBO && port->id != 0) {
-                        dev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-                        dev->hw_features &= ~(NETIF_F_IP_CSUM |
-                                              NETIF_F_IPV6_CSUM);
-                } else {
-                        dev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                        dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                }
+                mvpp2_set_hw_csum(port, new_long_pool);
         }
 
         dev->mtu = mtu;
@@ -3701,6 +3713,7 @@ static int mvpp2_set_mac_address(struct net_device *dev, void *p)
 static int mvpp2_change_mtu(struct net_device *dev, int mtu)
 {
         struct mvpp2_port *port = netdev_priv(dev);
+        bool running = netif_running(dev);
         int err;
 
         if (!IS_ALIGNED(MVPP2_RX_PKT_SIZE(mtu), 8)) {
@@ -3709,40 +3722,24 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
                 mtu = ALIGN(MVPP2_RX_PKT_SIZE(mtu), 8);
         }
 
-        if (!netif_running(dev)) {
-                err = mvpp2_bm_update_mtu(dev, mtu);
-                if (!err) {
-                        port->pkt_size =  MVPP2_RX_PKT_SIZE(mtu);
-                        return 0;
-                }
-
-                /* Reconfigure BM to the original MTU */
-                err = mvpp2_bm_update_mtu(dev, dev->mtu);
-                if (err)
-                        goto log_error;
-        }
-
-        mvpp2_stop_dev(port);
+        if (running)
+                mvpp2_stop_dev(port);
 
         err = mvpp2_bm_update_mtu(dev, mtu);
-        if (!err) {
+        if (err) {
+                netdev_err(dev, "failed to change MTU\n");
+                /* Reconfigure BM to the original MTU */
+                mvpp2_bm_update_mtu(dev, dev->mtu);
+        } else {
                 port->pkt_size =  MVPP2_RX_PKT_SIZE(mtu);
-                goto out_start;
         }
 
-        /* Reconfigure BM to the original MTU */
-        err = mvpp2_bm_update_mtu(dev, dev->mtu);
-        if (err)
-                goto log_error;
-
-out_start:
-        mvpp2_start_dev(port);
-        mvpp2_egress_enable(port);
-        mvpp2_ingress_enable(port);
+        if (running) {
+                mvpp2_start_dev(port);
+                mvpp2_egress_enable(port);
+                mvpp2_ingress_enable(port);
+        }
 
-        return 0;
-log_error:
-        netdev_err(dev, "failed to change MTU\n");
         return err;
 }
 
@@ -4740,9 +4737,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode,
         else
                 ctrl0 &= ~MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN;
 
-        ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC;
-        ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC |
-                 MVPP22_XLG_CTRL4_EN_IDLE_CHECK;
+        ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC |
+                   MVPP22_XLG_CTRL4_EN_IDLE_CHECK);
+        ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC;
 
         if (old_ctrl0 != ctrl0)
                 writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG);
@@ -5207,10 +5204,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
                 dev->features |= NETIF_F_NTUPLE;
         }
 
-        if (port->pool_long->id == MVPP2_BM_JUMBO && port->id != 0) {
-                dev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-                dev->hw_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-        }
+        mvpp2_set_hw_csum(port, port->pool_long->id);
 
         dev->vlan_features |= features;
         dev->gso_max_segs = MVPP2_MAX_TSO_SEGS;
@@ -5756,9 +5750,6 @@ static int mvpp2_remove(struct platform_device *pdev)
 
         mvpp2_dbgfs_cleanup(priv);
 
-        flush_workqueue(priv->stats_queue);
-        destroy_workqueue(priv->stats_queue);
-
         fwnode_for_each_available_child_node(fwnode, port_fwnode) {
                 if (priv->port_list[i]) {
                         mutex_destroy(&priv->port_list[i]->gather_stats_lock);
@@ -5767,6 +5758,8 @@ static int mvpp2_remove(struct platform_device *pdev)
                 i++;
         }
 
+        destroy_workqueue(priv->stats_queue);
+
         for (i = 0; i < MVPP2_BM_POOLS_NUM; i++) {
                 struct mvpp2_bm_pool *bm_pool = &priv->bm_pools[i];
 
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index 762fe0821923..c2e00bb587cd 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -4924,6 +4924,13 @@ static const struct dmi_system_id msi_blacklist[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "P5W DH Deluxe"),
                 },
         },
+        {
+                .ident = "ASUS P6T",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "P6T"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/net/ethernet/mediatek/Kconfig b/drivers/net/ethernet/mediatek/Kconfig
index 263cd0909fe0..1f7fff81f24d 100644
--- a/drivers/net/ethernet/mediatek/Kconfig
+++ b/drivers/net/ethernet/mediatek/Kconfig
@@ -9,7 +9,6 @@ if NET_VENDOR_MEDIATEK
 
 config NET_MEDIATEK_SOC
         tristate "MediaTek SoC Gigabit Ethernet support"
-        depends on NET_VENDOR_MEDIATEK
         select PHYLIB
         ---help---
           This driver supports the gigabit ethernet MACs in the
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index 5bb6a26ea267..50862275544e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -213,7 +213,7 @@ void mlx5_unregister_device(struct mlx5_core_dev *dev)
         struct mlx5_interface *intf;
 
         mutex_lock(&mlx5_intf_mutex);
-        list_for_each_entry(intf, &intf_list, list)
+        list_for_each_entry_reverse(intf, &intf_list, list)
                 mlx5_remove_device(intf, priv);
         list_del(&priv->dev_list);
         mutex_unlock(&mlx5_intf_mutex);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 30f13f81c965..0807992090b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -159,7 +159,7 @@ do {                                                            \
 enum mlx5e_rq_group {
         MLX5E_RQ_GROUP_REGULAR,
         MLX5E_RQ_GROUP_XSK,
-        MLX5E_NUM_RQ_GROUPS /* Keep last. */
+#define MLX5E_NUM_RQ_GROUPS(g) (1 + MLX5E_RQ_GROUP_##g)
 };
 
 static inline u16 mlx5_min_rx_wqes(int wq_type, u32 wq_size)
@@ -182,14 +182,6 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
                 min_t(int, mlx5_comp_vectors_count(mdev), MLX5E_MAX_NUM_CHANNELS);
 }
 
-/* Use this function to get max num channels after netdev was created */
-static inline int mlx5e_get_netdev_max_channels(struct net_device *netdev)
-{
-        return min_t(unsigned int,
-                     netdev->num_rx_queues / MLX5E_NUM_RQ_GROUPS,
-                     netdev->num_tx_queues);
-}
-
 struct mlx5e_tx_wqe {
         struct mlx5_wqe_ctrl_seg ctrl;
         struct mlx5_wqe_eth_seg  eth;
@@ -829,6 +821,7 @@ struct mlx5e_priv {
         struct net_device         *netdev;
         struct mlx5e_stats         stats;
         struct mlx5e_channel_stats channel_stats[MLX5E_MAX_NUM_CHANNELS];
+        u16                        max_nch;
         u8                         max_opened_tc;
         struct hwtstamp_config     tstamp;
         u16                        q_counter;
@@ -870,6 +863,7 @@ struct mlx5e_profile {
                 mlx5e_fp_handle_rx_cqe handle_rx_cqe_mpwqe;
         } rx_handlers;
         int     max_tc;
+        u8      rq_groups;
 };
 
 void mlx5e_build_ptys2ethtool_map(void);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h
index bd882b5ee9a7..3a615d663d84 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h
@@ -66,9 +66,10 @@ static inline void mlx5e_qid_get_ch_and_group(struct mlx5e_params *params,
         *group = qid / nch;
 }
 
-static inline bool mlx5e_qid_validate(struct mlx5e_params *params, u64 qid)
+static inline bool mlx5e_qid_validate(const struct mlx5e_profile *profile,
+                                      struct mlx5e_params *params, u64 qid)
 {
-        return qid < params->num_channels * MLX5E_NUM_RQ_GROUPS;
+        return qid < params->num_channels * profile->rq_groups;
 }
 
 /* Parameter calculations */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index d5e5afbdca6d..f777994f3005 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -78,9 +78,10 @@ static const u32 mlx5e_ext_link_speed[MLX5E_EXT_LINK_MODES_NUMBER] = {
 };
 
 static void mlx5e_port_get_speed_arr(struct mlx5_core_dev *mdev,
-                                     const u32 **arr, u32 *size)
+                                     const u32 **arr, u32 *size,
+                                     bool force_legacy)
 {
-        bool ext = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
+        bool ext = force_legacy ? false : MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
 
         *size = ext ? ARRAY_SIZE(mlx5e_ext_link_speed) :
                       ARRAY_SIZE(mlx5e_link_speed);
@@ -152,7 +153,8 @@ int mlx5_port_set_eth_ptys(struct mlx5_core_dev *dev, bool an_disable,
                             sizeof(out), MLX5_REG_PTYS, 0, 1);
 }
 
-u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper)
+u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper,
+                          bool force_legacy)
 {
         unsigned long temp = eth_proto_oper;
         const u32 *table;
@@ -160,7 +162,7 @@ u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper)
         u32 max_size;
         int i;
 
-        mlx5e_port_get_speed_arr(mdev, &table, &max_size);
+        mlx5e_port_get_speed_arr(mdev, &table, &max_size, force_legacy);
         i = find_first_bit(&temp, max_size);
         if (i < max_size)
                 speed = table[i];
@@ -170,6 +172,7 @@ u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper)
 int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
 {
         struct mlx5e_port_eth_proto eproto;
+        bool force_legacy = false;
         bool ext;
         int err;
 
@@ -177,8 +180,13 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
         err = mlx5_port_query_eth_proto(mdev, 1, ext, &eproto);
         if (err)
                 goto out;
-
-        *speed = mlx5e_port_ptys2speed(mdev, eproto.oper);
+        if (ext && !eproto.admin) {
+                force_legacy = true;
+                err = mlx5_port_query_eth_proto(mdev, 1, false, &eproto);
+                if (err)
+                        goto out;
+        }
+        *speed = mlx5e_port_ptys2speed(mdev, eproto.oper, force_legacy);
         if (!(*speed))
                 err = -EINVAL;
 
@@ -201,7 +209,7 @@ int mlx5e_port_max_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
         if (err)
                 return err;
 
-        mlx5e_port_get_speed_arr(mdev, &table, &max_size);
+        mlx5e_port_get_speed_arr(mdev, &table, &max_size, false);
         for (i = 0; i < max_size; ++i)
                 if (eproto.cap & MLX5E_PROT_MASK(i))
                         max_speed = max(max_speed, table[i]);
@@ -210,14 +218,15 @@ int mlx5e_port_max_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
         return 0;
 }
 
-u32 mlx5e_port_speed2linkmodes(struct mlx5_core_dev *mdev, u32 speed)
+u32 mlx5e_port_speed2linkmodes(struct mlx5_core_dev *mdev, u32 speed,
+                               bool force_legacy)
 {
         u32 link_modes = 0;
         const u32 *table;
         u32 max_size;
         int i;
 
-        mlx5e_port_get_speed_arr(mdev, &table, &max_size);
+        mlx5e_port_get_speed_arr(mdev, &table, &max_size, force_legacy);
         for (i = 0; i < max_size; ++i) {
                 if (table[i] == speed)
                         link_modes |= MLX5E_PROT_MASK(i);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
index 70f536ec51c4..4a7f4497692b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
@@ -48,10 +48,12 @@ void mlx5_port_query_eth_autoneg(struct mlx5_core_dev *dev, u8 *an_status,
                                  u8 *an_disable_cap, u8 *an_disable_admin);
 int mlx5_port_set_eth_ptys(struct mlx5_core_dev *dev, bool an_disable,
                            u32 proto_admin, bool ext);
-u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper);
+u32 mlx5e_port_ptys2speed(struct mlx5_core_dev *mdev, u32 eth_proto_oper,
+                          bool force_legacy);
 int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed);
 int mlx5e_port_max_linkspeed(struct mlx5_core_dev *mdev, u32 *speed);
-u32 mlx5e_port_speed2linkmodes(struct mlx5_core_dev *mdev, u32 speed);
+u32 mlx5e_port_speed2linkmodes(struct mlx5_core_dev *mdev, u32 speed,
+                               bool force_legacy);
 
 int mlx5e_port_query_pbmc(struct mlx5_core_dev *mdev, void *out);
 int mlx5e_port_set_pbmc(struct mlx5_core_dev *mdev, void *in);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
index ea032f54197e..3766545ce259 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
@@ -412,7 +412,7 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
                 goto out;
 
         tls_ctx = tls_get_ctx(skb->sk);
-        if (unlikely(tls_ctx->netdev != netdev))
+        if (unlikely(WARN_ON_ONCE(tls_ctx->netdev != netdev)))
                 goto err_out;
 
         priv_tx = mlx5e_get_ktls_tx_priv_ctx(tls_ctx);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index a6b0eda0bd1a..02530b50609c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -391,7 +391,7 @@ void mlx5e_ethtool_get_channels(struct mlx5e_priv *priv,
 {
         mutex_lock(&priv->state_lock);
 
-        ch->max_combined   = mlx5e_get_netdev_max_channels(priv->netdev);
+        ch->max_combined   = priv->max_nch;
         ch->combined_count = priv->channels.params.num_channels;
         if (priv->xsk.refcnt) {
                 /* The upper half are XSK queues. */
@@ -785,7 +785,7 @@ static void ptys2ethtool_supported_advertised_port(struct ethtool_link_ksettings
 }
 
 static void get_speed_duplex(struct net_device *netdev,
-                             u32 eth_proto_oper,
+                             u32 eth_proto_oper, bool force_legacy,
                              struct ethtool_link_ksettings *link_ksettings)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -795,7 +795,7 @@ static void get_speed_duplex(struct net_device *netdev,
         if (!netif_carrier_ok(netdev))
                 goto out;
 
-        speed = mlx5e_port_ptys2speed(priv->mdev, eth_proto_oper);
+        speed = mlx5e_port_ptys2speed(priv->mdev, eth_proto_oper, force_legacy);
         if (!speed) {
                 speed = SPEED_UNKNOWN;
                 goto out;
@@ -914,8 +914,8 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         /* Fields: eth_proto_admin and ext_eth_proto_admin  are
          * mutually exclusive. Hence try reading legacy advertising
          * when extended advertising is zero.
-         * admin_ext indicates how eth_proto_admin should be
-         * interpreted
+         * admin_ext indicates which proto_admin (ext vs. legacy)
+         * should be read and interpreted
          */
         admin_ext = ext;
         if (ext && !eth_proto_admin) {
@@ -924,7 +924,7 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
                 admin_ext = false;
         }
 
-        eth_proto_oper   = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
+        eth_proto_oper   = MLX5_GET_ETH_PROTO(ptys_reg, out, admin_ext,
                                               eth_proto_oper);
         eth_proto_lp        = MLX5_GET(ptys_reg, out, eth_proto_lp_advertise);
         an_disable_admin    = MLX5_GET(ptys_reg, out, an_disable_admin);
@@ -939,7 +939,8 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         get_supported(mdev, eth_proto_cap, link_ksettings);
         get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings,
                         admin_ext);
-        get_speed_duplex(priv->netdev, eth_proto_oper, link_ksettings);
+        get_speed_duplex(priv->netdev, eth_proto_oper, !admin_ext,
+                         link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
 
@@ -1016,45 +1017,69 @@ static u32 mlx5e_ethtool2ptys_ext_adver_link(const unsigned long *link_modes)
         return ptys_modes;
 }
 
+static bool ext_link_mode_requested(const unsigned long *adver)
+{
+#define MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT ETHTOOL_LINK_MODE_50000baseKR_Full_BIT
+        int size = __ETHTOOL_LINK_MODE_MASK_NBITS - MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT;
+        __ETHTOOL_DECLARE_LINK_MODE_MASK(modes);
+
+        bitmap_set(modes, MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT, size);
+        return bitmap_intersects(modes, adver, __ETHTOOL_LINK_MODE_MASK_NBITS);
+}
+
+static bool ext_speed_requested(u32 speed)
+{
+#define MLX5E_MAX_PTYS_LEGACY_SPEED 100000
+        return !!(speed > MLX5E_MAX_PTYS_LEGACY_SPEED);
+}
+
+static bool ext_requested(u8 autoneg, const unsigned long *adver, u32 speed)
+{
+        bool ext_link_mode = ext_link_mode_requested(adver);
+        bool ext_speed = ext_speed_requested(speed);
+
+        return  autoneg == AUTONEG_ENABLE ? ext_link_mode : ext_speed;
+}
+
 int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
                                      const struct ethtool_link_ksettings *link_ksettings)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
         struct mlx5e_port_eth_proto eproto;
+        const unsigned long *adver;
         bool an_changes = false;
         u8 an_disable_admin;
         bool ext_supported;
-        bool ext_requested;
         u8 an_disable_cap;
         bool an_disable;
         u32 link_modes;
         u8 an_status;
+        u8 autoneg;
         u32 speed;
+        bool ext;
         int err;
 
         u32 (*ethtool2ptys_adver_func)(const unsigned long *adver);
 
-#define MLX5E_PTYS_EXT ((1ULL << ETHTOOL_LINK_MODE_50000baseKR_Full_BIT) - 1)
+        adver = link_ksettings->link_modes.advertising;
+        autoneg = link_ksettings->base.autoneg;
+        speed = link_ksettings->base.speed;
 
-        ext_requested = !!(link_ksettings->link_modes.advertising[0] >
-                        MLX5E_PTYS_EXT ||
-                        link_ksettings->link_modes.advertising[1]);
+        ext = ext_requested(autoneg, adver, speed),
         ext_supported = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
-        ext_requested &= ext_supported;
+        if (!ext_supported && ext)
+                return -EOPNOTSUPP;
 
-        speed = link_ksettings->base.speed;
-        ethtool2ptys_adver_func = ext_requested ?
-                                  mlx5e_ethtool2ptys_ext_adver_link :
+        ethtool2ptys_adver_func = ext ? mlx5e_ethtool2ptys_ext_adver_link :
                                   mlx5e_ethtool2ptys_adver_link;
-        err = mlx5_port_query_eth_proto(mdev, 1, ext_requested, &eproto);
+        err = mlx5_port_query_eth_proto(mdev, 1, ext, &eproto);
         if (err) {
                 netdev_err(priv->netdev, "%s: query port eth proto failed: %d\n",
                            __func__, err);
                 goto out;
         }
-        link_modes = link_ksettings->base.autoneg == AUTONEG_ENABLE ?
-                ethtool2ptys_adver_func(link_ksettings->link_modes.advertising) :
-                mlx5e_port_speed2linkmodes(mdev, speed);
+        link_modes = autoneg == AUTONEG_ENABLE ? ethtool2ptys_adver_func(adver) :
+                mlx5e_port_speed2linkmodes(mdev, speed, !ext);
 
         link_modes = link_modes & eproto.cap;
         if (!link_modes) {
@@ -1067,14 +1092,14 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
         mlx5_port_query_eth_autoneg(mdev, &an_status, &an_disable_cap,
                                     &an_disable_admin);
 
-        an_disable = link_ksettings->base.autoneg == AUTONEG_DISABLE;
+        an_disable = autoneg == AUTONEG_DISABLE;
         an_changes = ((!an_disable && an_disable_admin) ||
                       (an_disable && !an_disable_admin));
 
         if (!an_changes && link_modes == eproto.admin)
                 goto out;
 
-        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_requested);
+        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext);
         mlx5_toggle_port_link(mdev);
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index a66589816e21..eed7101e8bb7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -611,7 +611,8 @@ static int validate_flow(struct mlx5e_priv *priv,
                 return -ENOSPC;
 
         if (fs->ring_cookie != RX_CLS_FLOW_DISC)
-                if (!mlx5e_qid_validate(&priv->channels.params, fs->ring_cookie))
+                if (!mlx5e_qid_validate(priv->profile, &priv->channels.params,
+                                        fs->ring_cookie))
                         return -EINVAL;
 
         switch (fs->flow_type & ~(FLOW_EXT | FLOW_MAC_EXT)) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 4db595a7eb03..9a2fcef6e7f0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -331,12 +331,11 @@ static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 
 static void mlx5e_init_frags_partition(struct mlx5e_rq *rq)
 {
-        struct mlx5e_wqe_frag_info next_frag, *prev;
+        struct mlx5e_wqe_frag_info next_frag = {};
+        struct mlx5e_wqe_frag_info *prev = NULL;
         int i;
 
         next_frag.di = &rq->wqe.di[0];
-        next_frag.offset = 0;
-        prev = NULL;
 
         for (i = 0; i < mlx5_wq_cyc_get_size(&rq->wqe.wq); i++) {
                 struct mlx5e_rq_frag_info *frag_info = &rq->wqe.info.arr[0];
@@ -1679,10 +1678,10 @@ static int mlx5e_open_sqs(struct mlx5e_channel *c,
                           struct mlx5e_channel_param *cparam)
 {
         struct mlx5e_priv *priv = c->priv;
-        int err, tc, max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
+        int err, tc;
 
         for (tc = 0; tc < params->num_tc; tc++) {
-                int txq_ix = c->ix + tc * max_nch;
+                int txq_ix = c->ix + tc * priv->max_nch;
 
                 err = mlx5e_open_txqsq(c, c->priv->tisn[tc], txq_ix,
                                        params, &cparam->sq, &c->sq[tc], tc);
@@ -2440,11 +2439,10 @@ int mlx5e_create_indirect_rqt(struct mlx5e_priv *priv)
 
 int mlx5e_create_direct_rqts(struct mlx5e_priv *priv, struct mlx5e_tir *tirs)
 {
-        const int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         int err;
         int ix;
 
-        for (ix = 0; ix < max_nch; ix++) {
+        for (ix = 0; ix < priv->max_nch; ix++) {
                 err = mlx5e_create_rqt(priv, 1 /*size */, &tirs[ix].rqt);
                 if (unlikely(err))
                         goto err_destroy_rqts;
@@ -2462,10 +2460,9 @@ err_destroy_rqts:
 
 void mlx5e_destroy_direct_rqts(struct mlx5e_priv *priv, struct mlx5e_tir *tirs)
 {
-        const int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         int i;
 
-        for (i = 0; i < max_nch; i++)
+        for (i = 0; i < priv->max_nch; i++)
                 mlx5e_destroy_rqt(priv, &tirs[i].rqt);
 }
 
@@ -2559,7 +2556,7 @@ static void mlx5e_redirect_rqts(struct mlx5e_priv *priv,
                 mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, rrp);
         }
 
-        for (ix = 0; ix < mlx5e_get_netdev_max_channels(priv->netdev); ix++) {
+        for (ix = 0; ix < priv->max_nch; ix++) {
                 struct mlx5e_redirect_rqt_param direct_rrp = {
                         .is_rss = false,
                         {
@@ -2760,7 +2757,7 @@ static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
                         goto free_in;
         }
 
-        for (ix = 0; ix < mlx5e_get_netdev_max_channels(priv->netdev); ix++) {
+        for (ix = 0; ix < priv->max_nch; ix++) {
                 err = mlx5_core_modify_tir(mdev, priv->direct_tir[ix].tirn,
                                            in, inlen);
                 if (err)
@@ -2860,12 +2857,11 @@ static void mlx5e_netdev_set_tcs(struct net_device *netdev)
 
 static void mlx5e_build_tc2txq_maps(struct mlx5e_priv *priv)
 {
-        int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         int i, tc;
 
-        for (i = 0; i < max_nch; i++)
+        for (i = 0; i < priv->max_nch; i++)
                 for (tc = 0; tc < priv->profile->max_tc; tc++)
-                        priv->channel_tc2txq[i][tc] = i + tc * max_nch;
+                        priv->channel_tc2txq[i][tc] = i + tc * priv->max_nch;
 }
 
 static void mlx5e_build_tx2sq_maps(struct mlx5e_priv *priv)
@@ -2886,7 +2882,7 @@ static void mlx5e_build_tx2sq_maps(struct mlx5e_priv *priv)
 void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
 {
         int num_txqs = priv->channels.num * priv->channels.params.num_tc;
-        int num_rxqs = priv->channels.num * MLX5E_NUM_RQ_GROUPS;
+        int num_rxqs = priv->channels.num * priv->profile->rq_groups;
         struct net_device *netdev = priv->netdev;
 
         mlx5e_netdev_set_tcs(netdev);
@@ -3308,7 +3304,6 @@ err_destroy_inner_tirs:
 
 int mlx5e_create_direct_tirs(struct mlx5e_priv *priv, struct mlx5e_tir *tirs)
 {
-        const int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         struct mlx5e_tir *tir;
         void *tirc;
         int inlen;
@@ -3321,7 +3316,7 @@ int mlx5e_create_direct_tirs(struct mlx5e_priv *priv, struct mlx5e_tir *tirs)
         if (!in)
                 return -ENOMEM;
 
-        for (ix = 0; ix < max_nch; ix++) {
+        for (ix = 0; ix < priv->max_nch; ix++) {
                 memset(in, 0, inlen);
                 tir = &tirs[ix];
                 tirc = MLX5_ADDR_OF(create_tir_in, in, ctx);
@@ -3360,10 +3355,9 @@ void mlx5e_destroy_indirect_tirs(struct mlx5e_priv *priv, bool inner_ttc)
 
 void mlx5e_destroy_direct_tirs(struct mlx5e_priv *priv, struct mlx5e_tir *tirs)
 {
-        const int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         int i;
 
-        for (i = 0; i < max_nch; i++)
+        for (i = 0; i < priv->max_nch; i++)
                 mlx5e_destroy_tir(priv->mdev, &tirs[i]);
 }
 
@@ -3489,7 +3483,7 @@ void mlx5e_fold_sw_stats64(struct mlx5e_priv *priv, struct rtnl_link_stats64 *s)
 {
         int i;
 
-        for (i = 0; i < mlx5e_get_netdev_max_channels(priv->netdev); i++) {
+        for (i = 0; i < priv->max_nch; i++) {
                 struct mlx5e_channel_stats *channel_stats = &priv->channel_stats[i];
                 struct mlx5e_rq_stats *xskrq_stats = &channel_stats->xskrq;
                 struct mlx5e_rq_stats *rq_stats = &channel_stats->rq;
@@ -4964,8 +4958,7 @@ static int mlx5e_nic_init(struct mlx5_core_dev *mdev,
                 return err;
 
         mlx5e_build_nic_params(mdev, &priv->xsk, rss, &priv->channels.params,
-                               mlx5e_get_netdev_max_channels(netdev),
-                               netdev->mtu);
+                               priv->max_nch, netdev->mtu);
 
         mlx5e_timestamp_init(priv);
 
@@ -5168,6 +5161,7 @@ static const struct mlx5e_profile mlx5e_nic_profile = {
         .rx_handlers.handle_rx_cqe       = mlx5e_handle_rx_cqe,
         .rx_handlers.handle_rx_cqe_mpwqe = mlx5e_handle_rx_cqe_mpwrq,
         .max_tc            = MLX5E_MAX_NUM_TC,
+        .rq_groups         = MLX5E_NUM_RQ_GROUPS(XSK),
 };
 
 /* mlx5e generic netdev management API (move to en_common.c) */
@@ -5185,6 +5179,7 @@ int mlx5e_netdev_init(struct net_device *netdev,
         priv->profile     = profile;
         priv->ppriv       = ppriv;
         priv->msglevel    = MLX5E_MSG_LEVEL;
+        priv->max_nch     = netdev->num_rx_queues / max_t(u8, profile->rq_groups, 1);
         priv->max_opened_tc = 1;
 
         mutex_init(&priv->state_lock);
@@ -5222,7 +5217,7 @@ struct net_device *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
 
         netdev = alloc_etherdev_mqs(sizeof(struct mlx5e_priv),
                                     nch * profile->max_tc,
-                                    nch * MLX5E_NUM_RQ_GROUPS);
+                                    nch * profile->rq_groups);
         if (!netdev) {
                 mlx5_core_err(mdev, "alloc_etherdev_mqs() failed\n");
                 return NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index bf6f4835457e..fbb9de633578 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -1718,6 +1718,7 @@ static const struct mlx5e_profile mlx5e_rep_profile = {
         .rx_handlers.handle_rx_cqe       = mlx5e_handle_rx_cqe_rep,
         .rx_handlers.handle_rx_cqe_mpwqe = mlx5e_handle_rx_cqe_mpwrq,
         .max_tc                 = 1,
+        .rq_groups              = MLX5E_NUM_RQ_GROUPS(REGULAR),
 };
 
 static const struct mlx5e_profile mlx5e_uplink_rep_profile = {
@@ -1735,6 +1736,7 @@ static const struct mlx5e_profile mlx5e_uplink_rep_profile = {
         .rx_handlers.handle_rx_cqe       = mlx5e_handle_rx_cqe_rep,
         .rx_handlers.handle_rx_cqe_mpwqe = mlx5e_handle_rx_cqe_mpwrq,
         .max_tc                 = MLX5E_MAX_NUM_TC,
+        .rq_groups              = MLX5E_NUM_RQ_GROUPS(REGULAR),
 };
 
 static bool
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 6eee3c7d4b06..94a32c76c182 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -174,7 +174,7 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
 
         memset(s, 0, sizeof(*s));
 
-        for (i = 0; i < mlx5e_get_netdev_max_channels(priv->netdev); i++) {
+        for (i = 0; i < priv->max_nch; i++) {
                 struct mlx5e_channel_stats *channel_stats =
                         &priv->channel_stats[i];
                 struct mlx5e_xdpsq_stats *xdpsq_red_stats = &channel_stats->xdpsq;
@@ -1401,7 +1401,7 @@ static const struct counter_desc ch_stats_desc[] = {
 
 static int mlx5e_grp_channels_get_num_stats(struct mlx5e_priv *priv)
 {
-        int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
+        int max_nch = priv->max_nch;
 
         return (NUM_RQ_STATS * max_nch) +
                (NUM_CH_STATS * max_nch) +
@@ -1415,8 +1415,8 @@ static int mlx5e_grp_channels_get_num_stats(struct mlx5e_priv *priv)
 static int mlx5e_grp_channels_fill_strings(struct mlx5e_priv *priv, u8 *data,
                                            int idx)
 {
-        int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         bool is_xsk = priv->xsk.ever_used;
+        int max_nch = priv->max_nch;
         int i, j, tc;
 
         for (i = 0; i < max_nch; i++)
@@ -1458,8 +1458,8 @@ static int mlx5e_grp_channels_fill_strings(struct mlx5e_priv *priv, u8 *data,
 static int mlx5e_grp_channels_fill_stats(struct mlx5e_priv *priv, u64 *data,
                                          int idx)
 {
-        int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         bool is_xsk = priv->xsk.ever_used;
+        int max_nch = priv->max_nch;
         int i, j, tc;
 
         for (i = 0; i < max_nch; i++)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index c5d75e2ecf54..4d97cc47835f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1320,13 +1320,13 @@ static struct mlx5_fc *mlx5e_tc_get_counter(struct mlx5e_tc_flow *flow)
 void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
 {
         struct mlx5e_neigh *m_neigh = &nhe->m_neigh;
-        u64 bytes, packets, lastuse = 0;
         struct mlx5e_tc_flow *flow;
         struct mlx5e_encap_entry *e;
         struct mlx5_fc *counter;
         struct neigh_table *tbl;
         bool neigh_used = false;
         struct neighbour *n;
+        u64 lastuse;
 
         if (m_neigh->family == AF_INET)
                 tbl = &arp_tbl;
@@ -1349,7 +1349,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
 
                         if (mlx5e_is_offloaded_flow(flow)) {
                                 counter = mlx5e_tc_get_counter(flow);
-                                mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
+                                lastuse = mlx5_fc_query_lastuse(counter);
                                 if (time_after((unsigned long)lastuse, nhe->reported_lastuse)) {
                                         mlx5e_flow_put(netdev_priv(e->out_dev), flow);
                                         neigh_used = true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index c50b6f0769c8..49b06b256c92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -49,7 +49,7 @@ static inline bool mlx5e_channel_no_affinity_change(struct mlx5e_channel *c)
 static void mlx5e_handle_tx_dim(struct mlx5e_txqsq *sq)
 {
         struct mlx5e_sq_stats *stats = sq->stats;
-        struct dim_sample dim_sample;
+        struct dim_sample dim_sample = {};
 
         if (unlikely(!test_bit(MLX5E_SQ_STATE_AM, &sq->state)))
                 return;
@@ -61,7 +61,7 @@ static void mlx5e_handle_tx_dim(struct mlx5e_txqsq *sq)
 static void mlx5e_handle_rx_dim(struct mlx5e_rq *rq)
 {
         struct mlx5e_rq_stats *stats = rq->stats;
-        struct dim_sample dim_sample;
+        struct dim_sample dim_sample = {};
 
         if (unlikely(!test_bit(MLX5E_RQ_STATE_AM, &rq->state)))
                 return;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index c48c382f926f..c1252d6be0ef 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -68,7 +68,7 @@ enum fs_flow_table_type {
         FS_FT_SNIFFER_RX        = 0X5,
         FS_FT_SNIFFER_TX        = 0X6,
         FS_FT_RDMA_RX           = 0X7,
-        FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
+        FS_FT_MAX_TYPE = FS_FT_RDMA_RX,
 };
 
 enum fs_flow_table_op_mod {
@@ -275,7 +275,8 @@ void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
         (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
         (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
         (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
-        (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+        (type == FS_FT_RDMA_RX) ? MLX5_CAP_FLOWTABLE_RDMA_RX(mdev, cap) :               \
+        (BUILD_BUG_ON_ZERO(FS_FT_RDMA_RX != FS_FT_MAX_TYPE))\
         )
 
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index 51f1736c455d..1804cf3c3814 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -426,6 +426,11 @@ int mlx5_fc_query(struct mlx5_core_dev *dev, struct mlx5_fc *counter,
 }
 EXPORT_SYMBOL(mlx5_fc_query);
 
+u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter)
+{
+        return counter->cache.lastuse;
+}
+
 void mlx5_fc_query_cached(struct mlx5_fc *counter,
                           u64 *bytes, u64 *packets, u64 *lastuse)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 6bfaaab362dc..1a2560e3bf7c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -88,8 +88,7 @@ int mlx5i_init(struct mlx5_core_dev *mdev,
         netdev->mtu = netdev->max_mtu;
 
         mlx5e_build_nic_params(mdev, NULL, &priv->rss_params, &priv->channels.params,
-                               mlx5e_get_netdev_max_channels(netdev),
-                               netdev->mtu);
+                               priv->max_nch, netdev->mtu);
         mlx5i_build_nic_params(mdev, &priv->channels.params);
 
         mlx5e_timestamp_init(priv);
@@ -118,11 +117,10 @@ void mlx5i_cleanup(struct mlx5e_priv *priv)
 
 static void mlx5i_grp_sw_update_stats(struct mlx5e_priv *priv)
 {
-        int max_nch = mlx5e_get_netdev_max_channels(priv->netdev);
         struct mlx5e_sw_stats s = { 0 };
         int i, j;
 
-        for (i = 0; i < max_nch; i++) {
+        for (i = 0; i < priv->max_nch; i++) {
                 struct mlx5e_channel_stats *channel_stats;
                 struct mlx5e_rq_stats *rq_stats;
 
@@ -436,6 +434,7 @@ static const struct mlx5e_profile mlx5i_nic_profile = {
         .rx_handlers.handle_rx_cqe       = mlx5i_handle_rx_cqe,
         .rx_handlers.handle_rx_cqe_mpwqe = NULL, /* Not supported */
         .max_tc            = MLX5I_MAX_NUM_TC,
+        .rq_groups         = MLX5E_NUM_RQ_GROUPS(REGULAR),
 };
 
 /* mlx5i netdev NDos */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c
index 6e56fa769d2e..c5a491e22e55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c
@@ -355,6 +355,7 @@ static const struct mlx5e_profile mlx5i_pkey_nic_profile = {
         .rx_handlers.handle_rx_cqe       = mlx5i_handle_rx_cqe,
         .rx_handlers.handle_rx_cqe_mpwqe = NULL, /* Not supported */
         .max_tc            = MLX5I_MAX_NUM_TC,
+        .rq_groups         = MLX5E_NUM_RQ_GROUPS(REGULAR),
 };
 
 const struct mlx5e_profile *mlx5i_pkey_get_profile(void)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 9277b3f125e8..5a8e94c0a95a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -6350,7 +6350,7 @@ static int __init mlxsw_sp_module_init(void)
         return 0;
 
 err_sp2_pci_driver_register:
-        mlxsw_pci_driver_unregister(&mlxsw_sp2_pci_driver);
+        mlxsw_pci_driver_unregister(&mlxsw_sp1_pci_driver);
 err_sp1_pci_driver_register:
         mlxsw_core_driver_unregister(&mlxsw_sp2_driver);
 err_sp2_core_driver_register:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index c78d93afbb9d..db17ba35ec84 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -954,4 +954,8 @@ void mlxsw_sp_port_nve_fini(struct mlxsw_sp_port *mlxsw_sp_port);
 int mlxsw_sp_nve_init(struct mlxsw_sp *mlxsw_sp);
 void mlxsw_sp_nve_fini(struct mlxsw_sp *mlxsw_sp);
 
+/* spectrum_nve_vxlan.c */
+int mlxsw_sp_nve_inc_parsing_depth_get(struct mlxsw_sp *mlxsw_sp);
+void mlxsw_sp_nve_inc_parsing_depth_put(struct mlxsw_sp *mlxsw_sp);
+
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 1537f70bc26d..888ba4300bcc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -437,8 +437,8 @@ static const struct mlxsw_sp_sb_pr mlxsw_sp1_sb_prs[] = {
                            MLXSW_SP1_SB_PR_CPU_SIZE, true, false),
 };
 
-#define MLXSW_SP2_SB_PR_INGRESS_SIZE    38128752
-#define MLXSW_SP2_SB_PR_EGRESS_SIZE     38128752
+#define MLXSW_SP2_SB_PR_INGRESS_SIZE    35297568
+#define MLXSW_SP2_SB_PR_EGRESS_SIZE     35297568
 #define MLXSW_SP2_SB_PR_CPU_SIZE        (256 * 1000)
 
 /* Order according to mlxsw_sp2_sb_pool_dess */
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
index 1df164a4b06d..17f334b46c40 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
@@ -775,6 +775,7 @@ static void mlxsw_sp_nve_tunnel_fini(struct mlxsw_sp *mlxsw_sp)
                 ops->fini(nve);
                 mlxsw_sp_kvdl_free(mlxsw_sp, MLXSW_SP_KVDL_ENTRY_TYPE_ADJ, 1,
                                    nve->tunnel_index);
+                memset(&nve->config, 0, sizeof(nve->config));
         }
         nve->num_nve_tunnels--;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.h
index 0035640156a1..12f664f42f21 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.h
@@ -29,6 +29,7 @@ struct mlxsw_sp_nve {
         unsigned int num_max_mc_entries[MLXSW_SP_L3_PROTO_MAX];
         u32 tunnel_index;
         u16 ul_rif_index;       /* Reserved for Spectrum */
+        unsigned int inc_parsing_depth_refs;
 };
 
 struct mlxsw_sp_nve_ops {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
index 93ccd9fc2266..05517c7feaa5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
@@ -103,9 +103,9 @@ static void mlxsw_sp_nve_vxlan_config(const struct mlxsw_sp_nve *nve,
         config->udp_dport = cfg->dst_port;
 }
 
-static int mlxsw_sp_nve_parsing_set(struct mlxsw_sp *mlxsw_sp,
-                                    unsigned int parsing_depth,
-                                    __be16 udp_dport)
+static int __mlxsw_sp_nve_parsing_set(struct mlxsw_sp *mlxsw_sp,
+                                      unsigned int parsing_depth,
+                                      __be16 udp_dport)
 {
         char mprs_pl[MLXSW_REG_MPRS_LEN];
 
@@ -113,6 +113,56 @@ static int mlxsw_sp_nve_parsing_set(struct mlxsw_sp *mlxsw_sp,
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mprs), mprs_pl);
 }
 
+static int mlxsw_sp_nve_parsing_set(struct mlxsw_sp *mlxsw_sp,
+                                    __be16 udp_dport)
+{
+        int parsing_depth = mlxsw_sp->nve->inc_parsing_depth_refs ?
+                                MLXSW_SP_NVE_VXLAN_PARSING_DEPTH :
+                                MLXSW_SP_NVE_DEFAULT_PARSING_DEPTH;
+
+        return __mlxsw_sp_nve_parsing_set(mlxsw_sp, parsing_depth, udp_dport);
+}
+
+static int
+__mlxsw_sp_nve_inc_parsing_depth_get(struct mlxsw_sp *mlxsw_sp,
+                                     __be16 udp_dport)
+{
+        int err;
+
+        mlxsw_sp->nve->inc_parsing_depth_refs++;
+
+        err = mlxsw_sp_nve_parsing_set(mlxsw_sp, udp_dport);
+        if (err)
+                goto err_nve_parsing_set;
+        return 0;
+
+err_nve_parsing_set:
+        mlxsw_sp->nve->inc_parsing_depth_refs--;
+        return err;
+}
+
+static void
+__mlxsw_sp_nve_inc_parsing_depth_put(struct mlxsw_sp *mlxsw_sp,
+                                     __be16 udp_dport)
+{
+        mlxsw_sp->nve->inc_parsing_depth_refs--;
+        mlxsw_sp_nve_parsing_set(mlxsw_sp, udp_dport);
+}
+
+int mlxsw_sp_nve_inc_parsing_depth_get(struct mlxsw_sp *mlxsw_sp)
+{
+        __be16 udp_dport = mlxsw_sp->nve->config.udp_dport;
+
+        return __mlxsw_sp_nve_inc_parsing_depth_get(mlxsw_sp, udp_dport);
+}
+
+void mlxsw_sp_nve_inc_parsing_depth_put(struct mlxsw_sp *mlxsw_sp)
+{
+        __be16 udp_dport = mlxsw_sp->nve->config.udp_dport;
+
+        __mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp, udp_dport);
+}
+
 static void
 mlxsw_sp_nve_vxlan_config_prepare(char *tngcr_pl,
                                   const struct mlxsw_sp_nve_config *config)
@@ -176,9 +226,7 @@ static int mlxsw_sp1_nve_vxlan_init(struct mlxsw_sp_nve *nve,
         struct mlxsw_sp *mlxsw_sp = nve->mlxsw_sp;
         int err;
 
-        err = mlxsw_sp_nve_parsing_set(mlxsw_sp,
-                                       MLXSW_SP_NVE_VXLAN_PARSING_DEPTH,
-                                       config->udp_dport);
+        err = __mlxsw_sp_nve_inc_parsing_depth_get(mlxsw_sp, config->udp_dport);
         if (err)
                 return err;
 
@@ -203,8 +251,7 @@ err_promote_decap:
 err_rtdp_set:
         mlxsw_sp1_nve_vxlan_config_clear(mlxsw_sp);
 err_config_set:
-        mlxsw_sp_nve_parsing_set(mlxsw_sp, MLXSW_SP_NVE_DEFAULT_PARSING_DEPTH,
-                                 config->udp_dport);
+        __mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp, 0);
         return err;
 }
 
@@ -216,8 +263,7 @@ static void mlxsw_sp1_nve_vxlan_fini(struct mlxsw_sp_nve *nve)
         mlxsw_sp_router_nve_demote_decap(mlxsw_sp, config->ul_tb_id,
                                          config->ul_proto, &config->ul_sip);
         mlxsw_sp1_nve_vxlan_config_clear(mlxsw_sp);
-        mlxsw_sp_nve_parsing_set(mlxsw_sp, MLXSW_SP_NVE_DEFAULT_PARSING_DEPTH,
-                                 config->udp_dport);
+        __mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp, 0);
 }
 
 static int
@@ -320,9 +366,7 @@ static int mlxsw_sp2_nve_vxlan_init(struct mlxsw_sp_nve *nve,
         struct mlxsw_sp *mlxsw_sp = nve->mlxsw_sp;
         int err;
 
-        err = mlxsw_sp_nve_parsing_set(mlxsw_sp,
-                                       MLXSW_SP_NVE_VXLAN_PARSING_DEPTH,
-                                       config->udp_dport);
+        err = __mlxsw_sp_nve_inc_parsing_depth_get(mlxsw_sp, config->udp_dport);
         if (err)
                 return err;
 
@@ -348,8 +392,7 @@ err_promote_decap:
 err_rtdp_set:
         mlxsw_sp2_nve_vxlan_config_clear(mlxsw_sp);
 err_config_set:
-        mlxsw_sp_nve_parsing_set(mlxsw_sp, MLXSW_SP_NVE_DEFAULT_PARSING_DEPTH,
-                                 config->udp_dport);
+        __mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp, 0);
         return err;
 }
 
@@ -361,8 +404,7 @@ static void mlxsw_sp2_nve_vxlan_fini(struct mlxsw_sp_nve *nve)
         mlxsw_sp_router_nve_demote_decap(mlxsw_sp, config->ul_tb_id,
                                          config->ul_proto, &config->ul_sip);
         mlxsw_sp2_nve_vxlan_config_clear(mlxsw_sp);
-        mlxsw_sp_nve_parsing_set(mlxsw_sp, MLXSW_SP_NVE_DEFAULT_PARSING_DEPTH,
-                                 config->udp_dport);
+        __mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp, 0);
 }
 
 const struct mlxsw_sp_nve_ops mlxsw_sp2_nve_vxlan_ops = {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
index bd9c2bc2d5d6..63b07edd9d81 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
@@ -979,6 +979,9 @@ static int mlxsw_sp1_ptp_mtpppc_update(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_port *tmp;
+        u16 orig_ing_types = 0;
+        u16 orig_egr_types = 0;
+        int err;
         int i;
 
         /* MTPPPC configures timestamping globally, not per port. Find the
@@ -986,12 +989,26 @@ static int mlxsw_sp1_ptp_mtpppc_update(struct mlxsw_sp_port *mlxsw_sp_port,
          */
         for (i = 1; i < mlxsw_core_max_ports(mlxsw_sp->core); i++) {
                 tmp = mlxsw_sp->ports[i];
+                if (tmp) {
+                        orig_ing_types |= tmp->ptp.ing_types;
+                        orig_egr_types |= tmp->ptp.egr_types;
+                }
                 if (tmp && tmp != mlxsw_sp_port) {
                         ing_types |= tmp->ptp.ing_types;
                         egr_types |= tmp->ptp.egr_types;
                 }
         }
 
+        if ((ing_types || egr_types) && !(orig_ing_types || orig_egr_types)) {
+                err = mlxsw_sp_nve_inc_parsing_depth_get(mlxsw_sp);
+                if (err) {
+                        netdev_err(mlxsw_sp_port->dev, "Failed to increase parsing depth");
+                        return err;
+                }
+        }
+        if (!(ing_types || egr_types) && (orig_ing_types || orig_egr_types))
+                mlxsw_sp_nve_inc_parsing_depth_put(mlxsw_sp);
+
         return mlxsw_sp1_ptp_mtpppc_set(mlxsw_sp_port->mlxsw_sp,
                                        ing_types, egr_types);
 }
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index b71e4ecbe469..6932e615d4b0 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -1818,6 +1818,7 @@ EXPORT_SYMBOL(ocelot_init);
 
 void ocelot_deinit(struct ocelot *ocelot)
 {
+        cancel_delayed_work(&ocelot->stats_work);
         destroy_workqueue(ocelot->stats_queue);
         mutex_destroy(&ocelot->stats_lock);
         ocelot_ace_deinit();
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index d9cbe84ac6ad..1b840ee47339 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -444,12 +444,12 @@ static u8 *nfp_vnic_get_sw_stats_strings(struct net_device *netdev, u8 *data)
         data = nfp_pr_et(data, "hw_rx_csum_complete");
         data = nfp_pr_et(data, "hw_rx_csum_err");
         data = nfp_pr_et(data, "rx_replace_buf_alloc_fail");
-        data = nfp_pr_et(data, "rx_tls_decrypted");
+        data = nfp_pr_et(data, "rx_tls_decrypted_packets");
         data = nfp_pr_et(data, "hw_tx_csum");
         data = nfp_pr_et(data, "hw_tx_inner_csum");
         data = nfp_pr_et(data, "tx_gather");
         data = nfp_pr_et(data, "tx_lso");
-        data = nfp_pr_et(data, "tx_tls_encrypted");
+        data = nfp_pr_et(data, "tx_tls_encrypted_packets");
         data = nfp_pr_et(data, "tx_tls_ooo");
         data = nfp_pr_et(data, "tx_tls_drop_no_sync_data");
 
diff --git a/drivers/net/ethernet/ni/Kconfig b/drivers/net/ethernet/ni/Kconfig
index 70b1a03c0953..01229190132d 100644
--- a/drivers/net/ethernet/ni/Kconfig
+++ b/drivers/net/ethernet/ni/Kconfig
@@ -11,7 +11,7 @@ config NET_VENDOR_NI
 
           Note that the answer to this question doesn't directly affect the
           kernel: saying N will just cause the configurator to skip all
-          the questions about National Instrument devices.
+          the questions about National Instruments devices.
           If you say Y, you will be asked for your specific device in the
           following questions.
 
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index 8161e308e64b..ead3750b4489 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -1,10 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
-# Packet engine device configuration
+# Packet Engines device configuration
 #
 
 config NET_VENDOR_PACKET_ENGINES
-        bool "Packet Engine devices"
+        bool "Packet Engines devices"
         default y
         depends on PCI
         ---help---
@@ -12,7 +12,7 @@ config NET_VENDOR_PACKET_ENGINES
 
           Note that the answer to this question doesn't directly affect the
           kernel: saying N will just cause the configurator to skip all
-          the questions about packet engine devices. If you say Y, you will
+          the questions about Packet Engines devices. If you say Y, you will
           be asked for your specific card in the following questions.
 
 if NET_VENDOR_PACKET_ENGINES
diff --git a/drivers/net/ethernet/packetengines/Makefile b/drivers/net/ethernet/packetengines/Makefile
index 1553c9cfc254..cf054b796d11 100644
--- a/drivers/net/ethernet/packetengines/Makefile
+++ b/drivers/net/ethernet/packetengines/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
-# Makefile for the Packet Engine network device drivers.
+# Makefile for the Packet Engines network device drivers.
 #
 
 obj-$(CONFIG_HAMACHI) += hamachi.o
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index 4e8118a08654..9f5113639eaf 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -1093,7 +1093,7 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
                                                 snprintf(bit_name, 30,
                                                          p_aeu->bit_name, num);
                                         else
-                                                strncpy(bit_name,
+                                                strlcpy(bit_name,
                                                         p_aeu->bit_name, 30);
 
                                         /* We now need to pass bitmask in its
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 17c64e43d6c3..158ac0738911 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn,
         /* Vendor specific information */
         dev->vendor_id = cdev->vendor_id;
         dev->vendor_part_id = cdev->device_id;
-        dev->hw_ver = 0;
+        dev->hw_ver = cdev->chip_rev;
         dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) |
                       (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 60189923737a..21d38167f961 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -206,9 +206,9 @@ rmnet_map_ipv4_ul_csum_header(void *iphdr,
         ul_header->csum_insert_offset = skb->csum_offset;
         ul_header->csum_enabled = 1;
         if (ip4h->protocol == IPPROTO_UDP)
-                ul_header->udp_ip4_ind = 1;
+                ul_header->udp_ind = 1;
         else
-                ul_header->udp_ip4_ind = 0;
+                ul_header->udp_ind = 0;
 
         /* Changing remaining fields to network order */
         hdr++;
@@ -239,6 +239,7 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
                               struct rmnet_map_ul_csum_header *ul_header,
                               struct sk_buff *skb)
 {
+        struct ipv6hdr *ip6h = (struct ipv6hdr *)ip6hdr;
         __be16 *hdr = (__be16 *)ul_header, offset;
 
         offset = htons((__force u16)(skb_transport_header(skb) -
@@ -246,7 +247,11 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
         ul_header->csum_start_offset = offset;
         ul_header->csum_insert_offset = skb->csum_offset;
         ul_header->csum_enabled = 1;
-        ul_header->udp_ip4_ind = 0;
+
+        if (ip6h->nexthdr == IPPROTO_UDP)
+                ul_header->udp_ind = 1;
+        else
+                ul_header->udp_ind = 0;
 
         /* Changing remaining fields to network order */
         hdr++;
@@ -419,7 +424,7 @@ sw_csum:
         ul_header->csum_start_offset = 0;
         ul_header->csum_insert_offset = 0;
         ul_header->csum_enabled = 0;
-        ul_header->udp_ip4_ind = 0;
+        ul_header->udp_ind = 0;
 
         priv->stats.csum_sw++;
 }
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index a10ff9e1efec..fa6eae2e7ed8 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -6098,10 +6098,7 @@ static int r8169_phy_connect(struct rtl8169_private *tp)
         if (ret)
                 return ret;
 
-        if (tp->supports_gmii)
-                phy_remove_link_mode(phydev,
-                                     ETHTOOL_LINK_MODE_1000baseT_Half_BIT);
-        else
+        if (!tp->supports_gmii)
                 phy_set_max_speed(phydev, SPEED_100);
 
         phy_support_asym_pause(phydev);
@@ -6552,13 +6549,18 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
 {
         unsigned int flags;
 
-        if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
                 rtl_unlock_config_regs(tp);
                 RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
                 rtl_lock_config_regs(tp);
+                /* fall through */
+        case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24:
                 flags = PCI_IRQ_LEGACY;
-        } else {
+                break;
+        default:
                 flags = PCI_IRQ_ALL_TYPES;
+                break;
         }
 
         return pci_alloc_irq_vectors(tp->pci_dev, 1, 1, flags);
diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index 079f459c73a5..2c5d3f5b84dd 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -2208,10 +2208,12 @@ static int rocker_router_fib_event(struct notifier_block *nb,
 
                         if (fen_info->fi->fib_nh_is_v6) {
                                 NL_SET_ERR_MSG_MOD(info->extack, "IPv6 gateway with IPv4 route is not supported");
+                                kfree(fib_work);
                                 return notifier_from_errno(-EINVAL);
                         }
                         if (fen_info->fi->nh) {
                                 NL_SET_ERR_MSG_MOD(info->extack, "IPv4 route with nexthop objects is not supported");
+                                kfree(fib_work);
                                 return notifier_from_errno(-EINVAL);
                         }
                 }
diff --git a/drivers/net/ethernet/samsung/Kconfig b/drivers/net/ethernet/samsung/Kconfig
index 027938017579..e92a178a76df 100644
--- a/drivers/net/ethernet/samsung/Kconfig
+++ b/drivers/net/ethernet/samsung/Kconfig
@@ -11,7 +11,7 @@ config NET_VENDOR_SAMSUNG
           say Y.
 
           Note that the answer to this question does not directly affect
-          the kernel: saying N will just case the configurator to skip all
+          the kernel: saying N will just cause the configurator to skip all
           the questions about Samsung chipsets. If you say Y, you will be asked
           for your specific chipset/driver in the following questions.
 
diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
index bd14803545de..8d88e4083456 100644
--- a/drivers/net/ethernet/smsc/smc911x.c
+++ b/drivers/net/ethernet/smsc/smc911x.c
@@ -712,6 +712,7 @@ static void smc911x_phy_detect(struct net_device *dev)
                                         /* Found an external PHY */
                                         break;
                         }
+                        /* Else, fall through */
                 default:
                         /* Internal media only */
                         SMC_GET_PHY_ID1(lp, 1, id1);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 01c2e2d83e76..fc9954e4a772 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -85,6 +85,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
         u32 value;
 
         base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
+        if (queue >= 4)
+                queue -= 4;
 
         value = readl(ioaddr + base_register);
 
@@ -102,6 +104,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
         u32 value;
 
         base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
+        if (queue >= 4)
+                queue -= 4;
 
         value = readl(ioaddr + base_register);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 7f86dffb264d..3174b701aa90 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -44,11 +44,13 @@
 #define XGMAC_CORE_INIT_RX              0
 #define XGMAC_PACKET_FILTER             0x00000008
 #define XGMAC_FILTER_RA                 BIT(31)
+#define XGMAC_FILTER_HPF                BIT(10)
 #define XGMAC_FILTER_PCF                BIT(7)
 #define XGMAC_FILTER_PM                 BIT(4)
 #define XGMAC_FILTER_HMC                BIT(2)
 #define XGMAC_FILTER_PR                 BIT(0)
 #define XGMAC_HASH_TABLE(x)             (0x00000010 + (x) * 4)
+#define XGMAC_MAX_HASH_TABLE            8
 #define XGMAC_RXQ_CTRL0                 0x000000a0
 #define XGMAC_RXQEN(x)                  GENMASK((x) * 2 + 1, (x) * 2)
 #define XGMAC_RXQEN_SHIFT(x)            ((x) * 2)
@@ -99,11 +101,12 @@
 #define XGMAC_MDIO_ADDR                 0x00000200
 #define XGMAC_MDIO_DATA                 0x00000204
 #define XGMAC_MDIO_C22P                 0x00000220
-#define XGMAC_ADDR0_HIGH                0x00000300
+#define XGMAC_ADDRx_HIGH(x)             (0x00000300 + (x) * 0x8)
+#define XGMAC_ADDR_MAX                  32
 #define XGMAC_AE                        BIT(31)
 #define XGMAC_DCS                       GENMASK(19, 16)
 #define XGMAC_DCS_SHIFT                 16
-#define XGMAC_ADDR0_LOW                 0x00000304
+#define XGMAC_ADDRx_LOW(x)              (0x00000304 + (x) * 0x8)
 #define XGMAC_ARP_ADDR                  0x00000c10
 #define XGMAC_TIMESTAMP_STATUS          0x00000d20
 #define XGMAC_TXTSC                     BIT(15)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index 0a32c96a7854..85c68b7ee8c6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -4,6 +4,8 @@
  * stmmac XGMAC support.
  */
 
+#include <linux/bitrev.h>
+#include <linux/crc32.h>
 #include "stmmac.h"
 #include "dwxgmac2.h"
 
@@ -106,6 +108,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio,
         u32 value, reg;
 
         reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
+        if (queue >= 4)
+                queue -= 4;
 
         value = readl(ioaddr + reg);
         value &= ~XGMAC_PSRQ(queue);
@@ -169,6 +173,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
         u32 value, reg;
 
         reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
+        if (queue >= 4)
+                queue -= 4;
 
         value = readl(ioaddr + reg);
         value &= ~XGMAC_QxMDMACH(queue);
@@ -278,10 +284,10 @@ static void dwxgmac2_set_umac_addr(struct mac_device_info *hw,
         u32 value;
 
         value = (addr[5] << 8) | addr[4];
-        writel(value | XGMAC_AE, ioaddr + XGMAC_ADDR0_HIGH);
+        writel(value | XGMAC_AE, ioaddr + XGMAC_ADDRx_HIGH(reg_n));
 
         value = (addr[3] << 24) | (addr[2] << 16) | (addr[1] << 8) | addr[0];
-        writel(value, ioaddr + XGMAC_ADDR0_LOW);
+        writel(value, ioaddr + XGMAC_ADDRx_LOW(reg_n));
 }
 
 static void dwxgmac2_get_umac_addr(struct mac_device_info *hw,
@@ -291,8 +297,8 @@ static void dwxgmac2_get_umac_addr(struct mac_device_info *hw,
         u32 hi_addr, lo_addr;
 
         /* Read the MAC address from the hardware */
-        hi_addr = readl(ioaddr + XGMAC_ADDR0_HIGH);
-        lo_addr = readl(ioaddr + XGMAC_ADDR0_LOW);
+        hi_addr = readl(ioaddr + XGMAC_ADDRx_HIGH(reg_n));
+        lo_addr = readl(ioaddr + XGMAC_ADDRx_LOW(reg_n));
 
         /* Extract the MAC address from the high and low words */
         addr[0] = lo_addr & 0xff;
@@ -303,19 +309,82 @@ static void dwxgmac2_get_umac_addr(struct mac_device_info *hw,
         addr[5] = (hi_addr >> 8) & 0xff;
 }
 
+static void dwxgmac2_set_mchash(void __iomem *ioaddr, u32 *mcfilterbits,
+                                int mcbitslog2)
+{
+        int numhashregs, regs;
+
+        switch (mcbitslog2) {
+        case 6:
+                numhashregs = 2;
+                break;
+        case 7:
+                numhashregs = 4;
+                break;
+        case 8:
+                numhashregs = 8;
+                break;
+        default:
+                return;
+        }
+
+        for (regs = 0; regs < numhashregs; regs++)
+                writel(mcfilterbits[regs], ioaddr + XGMAC_HASH_TABLE(regs));
+}
+
 static void dwxgmac2_set_filter(struct mac_device_info *hw,
                                 struct net_device *dev)
 {
         void __iomem *ioaddr = (void __iomem *)dev->base_addr;
-        u32 value = XGMAC_FILTER_RA;
+        u32 value = readl(ioaddr + XGMAC_PACKET_FILTER);
+        int mcbitslog2 = hw->mcast_bits_log2;
+        u32 mc_filter[8];
+        int i;
+
+        value &= ~(XGMAC_FILTER_PR | XGMAC_FILTER_HMC | XGMAC_FILTER_PM);
+        value |= XGMAC_FILTER_HPF;
+
+        memset(mc_filter, 0, sizeof(mc_filter));
 
         if (dev->flags & IFF_PROMISC) {
-                value |= XGMAC_FILTER_PR | XGMAC_FILTER_PCF;
+                value |= XGMAC_FILTER_PR;
+                value |= XGMAC_FILTER_PCF;
         } else if ((dev->flags & IFF_ALLMULTI) ||
-                   (netdev_mc_count(dev) > HASH_TABLE_SIZE)) {
+                   (netdev_mc_count(dev) > hw->multicast_filter_bins)) {
                 value |= XGMAC_FILTER_PM;
-                writel(~0x0, ioaddr + XGMAC_HASH_TABLE(0));
-                writel(~0x0, ioaddr + XGMAC_HASH_TABLE(1));
+
+                for (i = 0; i < XGMAC_MAX_HASH_TABLE; i++)
+                        writel(~0x0, ioaddr + XGMAC_HASH_TABLE(i));
+        } else if (!netdev_mc_empty(dev)) {
+                struct netdev_hw_addr *ha;
+
+                value |= XGMAC_FILTER_HMC;
+
+                netdev_for_each_mc_addr(ha, dev) {
+                        int nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
+                                        (32 - mcbitslog2));
+                        mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
+                }
+        }
+
+        dwxgmac2_set_mchash(ioaddr, mc_filter, mcbitslog2);
+
+        /* Handle multiple unicast addresses */
+        if (netdev_uc_count(dev) > XGMAC_ADDR_MAX) {
+                value |= XGMAC_FILTER_PR;
+        } else {
+                struct netdev_hw_addr *ha;
+                int reg = 1;
+
+                netdev_for_each_uc_addr(ha, dev) {
+                        dwxgmac2_set_umac_addr(hw, ha->addr, reg);
+                        reg++;
+                }
+
+                for ( ; reg < XGMAC_ADDR_MAX; reg++) {
+                        writel(0, ioaddr + XGMAC_ADDRx_HIGH(reg));
+                        writel(0, ioaddr + XGMAC_ADDRx_LOW(reg));
+                }
         }
 
         writel(value, ioaddr + XGMAC_PACKET_FILTER);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index c7c9e5f162e6..fd54c7c87485 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -814,20 +814,15 @@ static void stmmac_validate(struct phylink_config *config,
         phylink_set(mac_supported, 10baseT_Full);
         phylink_set(mac_supported, 100baseT_Half);
         phylink_set(mac_supported, 100baseT_Full);
+        phylink_set(mac_supported, 1000baseT_Half);
+        phylink_set(mac_supported, 1000baseT_Full);
+        phylink_set(mac_supported, 1000baseKX_Full);
 
         phylink_set(mac_supported, Autoneg);
         phylink_set(mac_supported, Pause);
         phylink_set(mac_supported, Asym_Pause);
         phylink_set_port_modes(mac_supported);
 
-        if (priv->plat->has_gmac ||
-            priv->plat->has_gmac4 ||
-            priv->plat->has_xgmac) {
-                phylink_set(mac_supported, 1000baseT_Half);
-                phylink_set(mac_supported, 1000baseT_Full);
-                phylink_set(mac_supported, 1000baseKX_Full);
-        }
-
         /* Cut down 1G if asked to */
         if ((max_speed > 0) && (max_speed < 1000)) {
                 phylink_set(mask, 1000baseT_Full);
@@ -1295,6 +1290,8 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
                           "(%s) dma_rx_phy=0x%08x\n", __func__,
                           (u32)rx_q->dma_rx_phy);
 
+                stmmac_clear_rx_descriptors(priv, queue);
+
                 for (i = 0; i < DMA_RX_SIZE; i++) {
                         struct dma_desc *p;
 
@@ -1312,8 +1309,6 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
                 rx_q->cur_rx = 0;
                 rx_q->dirty_rx = (unsigned int)(i - DMA_RX_SIZE);
 
-                stmmac_clear_rx_descriptors(priv, queue);
-
                 /* Setup the chained descriptor addresses */
                 if (priv->mode == STMMAC_CHAIN_MODE) {
                         if (priv->extend_desc)
@@ -1555,9 +1550,8 @@ static int alloc_dma_rx_desc_resources(struct stmmac_priv *priv)
                         goto err_dma;
                 }
 
-                rx_q->buf_pool = kmalloc_array(DMA_RX_SIZE,
-                                               sizeof(*rx_q->buf_pool),
-                                               GFP_KERNEL);
+                rx_q->buf_pool = kcalloc(DMA_RX_SIZE, sizeof(*rx_q->buf_pool),
+                                         GFP_KERNEL);
                 if (!rx_q->buf_pool)
                         goto err_dma;
 
@@ -1608,15 +1602,15 @@ static int alloc_dma_tx_desc_resources(struct stmmac_priv *priv)
                 tx_q->queue_index = queue;
                 tx_q->priv_data = priv;
 
-                tx_q->tx_skbuff_dma = kmalloc_array(DMA_TX_SIZE,
-                                                    sizeof(*tx_q->tx_skbuff_dma),
-                                                    GFP_KERNEL);
+                tx_q->tx_skbuff_dma = kcalloc(DMA_TX_SIZE,
+                                              sizeof(*tx_q->tx_skbuff_dma),
+                                              GFP_KERNEL);
                 if (!tx_q->tx_skbuff_dma)
                         goto err_dma;
 
-                tx_q->tx_skbuff = kmalloc_array(DMA_TX_SIZE,
-                                                sizeof(struct sk_buff *),
-                                                GFP_KERNEL);
+                tx_q->tx_skbuff = kcalloc(DMA_TX_SIZE,
+                                          sizeof(struct sk_buff *),
+                                          GFP_KERNEL);
                 if (!tx_q->tx_skbuff)
                         goto err_dma;
 
@@ -3277,9 +3271,11 @@ static inline int stmmac_rx_threshold_count(struct stmmac_rx_queue *rx_q)
 static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
 {
         struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
-        int dirty = stmmac_rx_dirty(priv, queue);
+        int len, dirty = stmmac_rx_dirty(priv, queue);
         unsigned int entry = rx_q->dirty_rx;
 
+        len = DIV_ROUND_UP(priv->dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
+
         while (dirty-- > 0) {
                 struct stmmac_rx_buffer *buf = &rx_q->buf_pool[entry];
                 struct dma_desc *p;
@@ -3297,6 +3293,13 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
                 }
 
                 buf->addr = page_pool_get_dma_addr(buf->page);
+
+                /* Sync whole allocation to device. This will invalidate old
+                 * data.
+                 */
+                dma_sync_single_for_device(priv->device, buf->addr, len,
+                                           DMA_FROM_DEVICE);
+
                 stmmac_set_desc_addr(priv, p, buf->addr);
                 stmmac_refill_desc3(priv, rx_q, p);
 
@@ -3431,8 +3434,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         skb_copy_to_linear_data(skb, page_address(buf->page),
                                                 frame_len);
                         skb_put(skb, frame_len);
-                        dma_sync_single_for_device(priv->device, buf->addr,
-                                                   frame_len, DMA_FROM_DEVICE);
 
                         if (netif_msg_pktdata(priv)) {
                                 netdev_dbg(priv->dev, "frame received (%dbytes)",
@@ -4319,8 +4320,9 @@ int stmmac_dvr_probe(struct device *device,
                                        NAPI_POLL_WEIGHT);
                 }
                 if (queue < priv->plat->tx_queues_to_use) {
-                        netif_napi_add(ndev, &ch->tx_napi, stmmac_napi_poll_tx,
-                                       NAPI_POLL_WEIGHT);
+                        netif_tx_napi_add(ndev, &ch->tx_napi,
+                                          stmmac_napi_poll_tx,
+                                          NAPI_POLL_WEIGHT);
                 }
         }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 0f3e6ce7f6ec..eaf8f08f2e91 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -376,6 +376,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                 return ERR_PTR(-ENOMEM);
 
         *mac = of_get_mac_address(np);
+        if (IS_ERR(*mac)) {
+                if (PTR_ERR(*mac) == -EPROBE_DEFER)
+                        return ERR_CAST(*mac);
+
+                *mac = NULL;
+        }
+
         plat->interface = of_get_phy_mode(np);
 
         /* Some wrapper drivers still rely on phy_node. Let's save it while
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 58ea18af9813..37c0bc699cd9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv,
                 entry = &priv->tc_entries[i];
                 if (!entry->in_use && !first && free)
                         first = entry;
-                if (entry->handle == loc && !free)
+                if ((entry->handle == loc) && !free && !entry->is_frag)
                         dup = entry;
         }
 
diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
index 5b196ebfed49..0f346761a2b2 100644
--- a/drivers/net/ethernet/toshiba/spider_net.c
+++ b/drivers/net/ethernet/toshiba/spider_net.c
@@ -788,6 +788,7 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
                         /* fallthrough, if we release the descriptors
                          * brutally (then we don't care about
                          * SPIDER_NET_DESCR_CARDOWNED) */
+                        /* Fall through */
 
                 case SPIDER_NET_DESCR_RESPONSE_ERROR:
                 case SPIDER_NET_DESCR_PROTECTION_ERROR:
diff --git a/drivers/net/ethernet/xscale/Kconfig b/drivers/net/ethernet/xscale/Kconfig
index 2f354ba029a6..cd0a8f46e7c6 100644
--- a/drivers/net/ethernet/xscale/Kconfig
+++ b/drivers/net/ethernet/xscale/Kconfig
@@ -13,7 +13,7 @@ config NET_VENDOR_XSCALE
 
           Note that the answer to this question does not directly affect the
           kernel: saying N will just cause the configurator to skip all
-          the questions about XSacle IXP devices. If you say Y, you will be
+          the questions about XScale IXP devices. If you say Y, you will be
           asked for your specific card in the following questions.
 
 if NET_VENDOR_XSCALE
diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
index daab2c07d891..9303aeb2595f 100644
--- a/drivers/net/hamradio/baycom_epp.c
+++ b/drivers/net/hamradio/baycom_epp.c
@@ -500,8 +500,9 @@ static int transmit(struct baycom_state *bc, int cnt, unsigned char stat)
                                 }
                                 break;
                         }
+                        /* fall through */
 
-                default:  /* fall through */
+                default:
                         if (bc->hdlctx.calibrate <= 0)
                                 return 0;
                         i = min_t(int, cnt, bc->hdlctx.calibrate);
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 3ffe46df249e..7c5265fd2b94 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -216,8 +216,10 @@ static struct gpio_desc *fixed_phy_get_gpiod(struct device_node *np)
         if (IS_ERR(gpiod)) {
                 if (PTR_ERR(gpiod) == -EPROBE_DEFER)
                         return gpiod;
-                pr_err("error getting GPIO for fixed link %pOF, proceed without\n",
-                       fixed_link_node);
+
+                if (PTR_ERR(gpiod) != -ENOENT)
+                        pr_err("error getting GPIO for fixed link %pOF, proceed without\n",
+                               fixed_link_node);
                 gpiod = NULL;
         }
 
diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
index 28676af97b42..645d354ffb48 100644
--- a/drivers/net/phy/mscc.c
+++ b/drivers/net/phy/mscc.c
@@ -2226,8 +2226,8 @@ static int vsc8514_probe(struct phy_device *phydev)
         vsc8531->supp_led_modes = VSC85XX_SUPP_LED_MODES;
         vsc8531->hw_stats = vsc85xx_hw_stats;
         vsc8531->nstats = ARRAY_SIZE(vsc85xx_hw_stats);
-        vsc8531->stats = devm_kmalloc_array(&phydev->mdio.dev, vsc8531->nstats,
-                                            sizeof(u64), GFP_KERNEL);
+        vsc8531->stats = devm_kcalloc(&phydev->mdio.dev, vsc8531->nstats,
+                                      sizeof(u64), GFP_KERNEL);
         if (!vsc8531->stats)
                 return -ENOMEM;
 
@@ -2251,8 +2251,8 @@ static int vsc8574_probe(struct phy_device *phydev)
         vsc8531->supp_led_modes = VSC8584_SUPP_LED_MODES;
         vsc8531->hw_stats = vsc8584_hw_stats;
         vsc8531->nstats = ARRAY_SIZE(vsc8584_hw_stats);
-        vsc8531->stats = devm_kmalloc_array(&phydev->mdio.dev, vsc8531->nstats,
-                                            sizeof(u64), GFP_KERNEL);
+        vsc8531->stats = devm_kcalloc(&phydev->mdio.dev, vsc8531->nstats,
+                                      sizeof(u64), GFP_KERNEL);
         if (!vsc8531->stats)
                 return -ENOMEM;
 
@@ -2281,8 +2281,8 @@ static int vsc8584_probe(struct phy_device *phydev)
         vsc8531->supp_led_modes = VSC8584_SUPP_LED_MODES;
         vsc8531->hw_stats = vsc8584_hw_stats;
         vsc8531->nstats = ARRAY_SIZE(vsc8584_hw_stats);
-        vsc8531->stats = devm_kmalloc_array(&phydev->mdio.dev, vsc8531->nstats,
-                                            sizeof(u64), GFP_KERNEL);
+        vsc8531->stats = devm_kcalloc(&phydev->mdio.dev, vsc8531->nstats,
+                                      sizeof(u64), GFP_KERNEL);
         if (!vsc8531->stats)
                 return -ENOMEM;
 
@@ -2311,8 +2311,8 @@ static int vsc85xx_probe(struct phy_device *phydev)
         vsc8531->supp_led_modes = VSC85XX_SUPP_LED_MODES;
         vsc8531->hw_stats = vsc85xx_hw_stats;
         vsc8531->nstats = ARRAY_SIZE(vsc85xx_hw_stats);
-        vsc8531->stats = devm_kmalloc_array(&phydev->mdio.dev, vsc8531->nstats,
-                                            sizeof(u64), GFP_KERNEL);
+        vsc8531->stats = devm_kcalloc(&phydev->mdio.dev, vsc8531->nstats,
+                                      sizeof(u64), GFP_KERNEL);
         if (!vsc8531->stats)
                 return -ENOMEM;
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 6b5cb87f3866..7ddd91df99e3 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1774,6 +1774,12 @@ done:
         phydev->link = status & BMSR_LSTATUS ? 1 : 0;
         phydev->autoneg_complete = status & BMSR_ANEGCOMPLETE ? 1 : 0;
 
+        /* Consider the case that autoneg was started and "aneg complete"
+         * bit has been reset, but "link up" bit not yet.
+         */
+        if (phydev->autoneg == AUTONEG_ENABLE && !phydev->autoneg_complete)
+                phydev->link = 0;
+
         return 0;
 }
 EXPORT_SYMBOL(genphy_update_link);
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index b86a4b2116f8..59a94e07e7c5 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c
@@ -48,8 +48,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy)
                 if (!phy->last_triggered)
                         led_trigger_event(&phy->led_link_trigger->trigger,
                                           LED_FULL);
+                else
+                        led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
 
-                led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
                 led_trigger_event(&plt->trigger, LED_FULL);
                 phy->last_triggered = plt;
         }
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 5d0af041b8f9..a45c5de96ab1 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -216,6 +216,8 @@ static int phylink_parse_fixedlink(struct phylink *pl,
                                pl->supported, true);
         linkmode_zero(pl->supported);
         phylink_set(pl->supported, MII);
+        phylink_set(pl->supported, Pause);
+        phylink_set(pl->supported, Asym_Pause);
         if (s) {
                 __set_bit(s->bit, pl->supported);
         } else {
@@ -990,10 +992,10 @@ void phylink_start(struct phylink *pl)
         }
         if (pl->link_an_mode == MLO_AN_FIXED && pl->get_fixed_state)
                 mod_timer(&pl->link_poll, jiffies + HZ);
-        if (pl->sfp_bus)
-                sfp_upstream_start(pl->sfp_bus);
         if (pl->phydev)
                 phy_start(pl->phydev);
+        if (pl->sfp_bus)
+                sfp_upstream_start(pl->sfp_bus);
 }
 EXPORT_SYMBOL_GPL(phylink_start);
 
@@ -1010,10 +1012,10 @@ void phylink_stop(struct phylink *pl)
 {
         ASSERT_RTNL();
 
-        if (pl->phydev)
-                phy_stop(pl->phydev);
         if (pl->sfp_bus)
                 sfp_upstream_stop(pl->sfp_bus);
+        if (pl->phydev)
+                phy_stop(pl->phydev);
         del_timer_sync(&pl->link_poll);
         if (pl->link_irq) {
                 free_irq(pl->link_irq, pl);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1d902ecb4aa8..a44dd3c8af63 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -1115,6 +1115,9 @@ static const struct proto_ops pppoe_ops = {
         .recvmsg        = pppoe_recvmsg,
         .mmap           = sock_no_mmap,
         .ioctl          = pppox_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = pppox_compat_ioctl,
+#endif
 };
 
 static const struct pppox_proto pppoe_proto = {
diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c
index 5ef422a43d70..08364f10a43f 100644
--- a/drivers/net/ppp/pppox.c
+++ b/drivers/net/ppp/pppox.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/compat.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
 #include <linux/net.h>
@@ -98,6 +99,18 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
 EXPORT_SYMBOL(pppox_ioctl);
 
+#ifdef CONFIG_COMPAT
+int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == PPPOEIOCSFWD32)
+                cmd = PPPOEIOCSFWD;
+
+        return pppox_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
+}
+
+EXPORT_SYMBOL(pppox_compat_ioctl);
+#endif
+
 static int pppox_create(struct net *net, struct socket *sock, int protocol,
                         int kern)
 {
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index a8e52c8e4128..734de7de03f7 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -623,6 +623,9 @@ static const struct proto_ops pptp_ops = {
         .recvmsg    = sock_no_recvmsg,
         .mmap       = sock_no_mmap,
         .ioctl      = pppox_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = pppox_compat_ioctl,
+#endif
 };
 
 static const struct pppox_proto pppox_pptp_proto = {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3d443597bd04..db16d7a13e00 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1599,7 +1599,8 @@ static bool tun_can_build_skb(struct tun_struct *tun, struct tun_file *tfile,
         return true;
 }
 
-static struct sk_buff *__tun_build_skb(struct page_frag *alloc_frag, char *buf,
+static struct sk_buff *__tun_build_skb(struct tun_file *tfile,
+                                       struct page_frag *alloc_frag, char *buf,
                                        int buflen, int len, int pad)
 {
         struct sk_buff *skb = build_skb(buf, buflen);
@@ -1609,6 +1610,7 @@ static struct sk_buff *__tun_build_skb(struct page_frag *alloc_frag, char *buf,
 
         skb_reserve(skb, pad);
         skb_put(skb, len);
+        skb_set_owner_w(skb, tfile->socket.sk);
 
         get_page(alloc_frag->page);
         alloc_frag->offset += buflen;
@@ -1686,7 +1688,8 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
          */
         if (hdr->gso_type || !xdp_prog) {
                 *skb_xdp = 1;
-                return __tun_build_skb(alloc_frag, buf, buflen, len, pad);
+                return __tun_build_skb(tfile, alloc_frag, buf, buflen, len,
+                                       pad);
         }
 
         *skb_xdp = 0;
@@ -1723,7 +1726,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
         rcu_read_unlock();
         local_bh_enable();
 
-        return __tun_build_skb(alloc_frag, buf, buflen, len, pad);
+        return __tun_build_skb(tfile, alloc_frag, buf, buflen, len, pad);
 
 err_xdp:
         put_page(alloc_frag->page);
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 6d25dea5ad4b..f7d117d80cfb 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -282,7 +282,7 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
 static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
 {
         int i;
-        __u8 tmp;
+        __u8 tmp = 0;
         __le16 retdatai;
         int ret;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 69e0a2acfcb0..b6dc5d714b5e 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1295,6 +1295,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)},    /* D-Link DWM-222 A2 */
         {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
         {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
+        {QMI_FIXED_INTF(0x2020, 0x2060, 4)},    /* BroadMobi BM818 */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 39e0768d734d..0cc03a9ff545 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -50,7 +50,7 @@
 #define PLA_TEREDO_WAKE_BASE    0xc0c4
 #define PLA_MAR                 0xcd00
 #define PLA_BACKUP              0xd000
-#define PAL_BDC_CR              0xd1a0
+#define PLA_BDC_CR              0xd1a0
 #define PLA_TEREDO_TIMER        0xd2cc
 #define PLA_REALWOW_TIMER       0xd2e8
 #define PLA_SUSPEND_FLAG        0xd38a
@@ -274,7 +274,7 @@
 #define TEREDO_RS_EVENT_MASK    0x00fe
 #define OOB_TEREDO_EN           0x0001
 
-/* PAL_BDC_CR */
+/* PLA_BDC_CR */
 #define ALDPS_PROXY_MODE        0x0001
 
 /* PLA_EFUSE_CMD */
@@ -3191,9 +3191,9 @@ static void r8152b_enter_oob(struct r8152 *tp)
 
         rtl_rx_vlan_en(tp, true);
 
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PAL_BDC_CR);
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_BDC_CR);
         ocp_data |= ALDPS_PROXY_MODE;
-        ocp_write_word(tp, MCU_TYPE_PLA, PAL_BDC_CR, ocp_data);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_BDC_CR, ocp_data);
 
         ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
         ocp_data |= NOW_IS_OOB | DIS_MCU_CLROOB;
@@ -3577,9 +3577,9 @@ static void r8153_enter_oob(struct r8152 *tp)
 
         rtl_rx_vlan_en(tp, true);
 
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PAL_BDC_CR);
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_BDC_CR);
         ocp_data |= ALDPS_PROXY_MODE;
-        ocp_write_word(tp, MCU_TYPE_PLA, PAL_BDC_CR, ocp_data);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_BDC_CR, ocp_data);
 
         ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
         ocp_data |= NOW_IS_OOB | DIS_MCU_CLROOB;
diff --git a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
index a9ac3f37b904..e2e679a01b65 100644
--- a/drivers/net/wan/sdla.c
+++ b/drivers/net/wan/sdla.c
@@ -413,6 +413,7 @@ static void sdla_errors(struct net_device *dev, int cmd, int dlci, int ret, int
                 case SDLA_RET_NO_BUFS:
                         if (cmd == SDLA_INFORMATION_WRITE)
                                 break;
+                        /* Else, fall through */
 
                 default: 
                         netdev_dbg(dev, "Cmd 0x%02X generated return code 0x%02X\n",
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
index d55312ef58c9..9b0bb89599fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
@@ -776,7 +776,6 @@ struct iwl_rss_config_cmd {
         u8 indirection_table[IWL_RSS_INDIRECTION_TABLE_SIZE];
 } __packed; /* RSS_CONFIG_CMD_API_S_VER_1 */
 
-#define IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE 128
 #define IWL_MULTI_QUEUE_SYNC_SENDER_POS 0
 #define IWL_MULTI_QUEUE_SYNC_SENDER_MSK 0xf
 
@@ -812,10 +811,12 @@ struct iwl_rxq_sync_notification {
  *
  * @IWL_MVM_RXQ_EMPTY: empty sync notification
  * @IWL_MVM_RXQ_NOTIF_DEL_BA: notify RSS queues of delBA
+ * @IWL_MVM_RXQ_NSSN_SYNC: notify all the RSS queues with the new NSSN
  */
 enum iwl_mvm_rxq_notif_type {
         IWL_MVM_RXQ_EMPTY,
         IWL_MVM_RXQ_NOTIF_DEL_BA,
+        IWL_MVM_RXQ_NSSN_SYNC,
 };
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index e411ac98290d..4d81776f576d 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -2438,17 +2438,19 @@ static void iwl_fw_dbg_info_apply(struct iwl_fw_runtime *fwrt,
 {
         u32 img_name_len = le32_to_cpu(dbg_info->img_name_len);
         u32 dbg_cfg_name_len = le32_to_cpu(dbg_info->dbg_cfg_name_len);
-        const char err_str[] =
-                "WRT: ext=%d. Invalid %s name length %d, expected %d\n";
 
         if (img_name_len != IWL_FW_INI_MAX_IMG_NAME_LEN) {
-                IWL_WARN(fwrt, err_str, ext, "image", img_name_len,
+                IWL_WARN(fwrt,
+                         "WRT: ext=%d. Invalid image name length %d, expected %d\n",
+                         ext, img_name_len,
                          IWL_FW_INI_MAX_IMG_NAME_LEN);
                 return;
         }
 
         if (dbg_cfg_name_len != IWL_FW_INI_MAX_DBG_CFG_NAME_LEN) {
-                IWL_WARN(fwrt, err_str, ext, "debug cfg", dbg_cfg_name_len,
+                IWL_WARN(fwrt,
+                         "WRT: ext=%d. Invalid debug cfg name length %d, expected %d\n",
+                         ext, dbg_cfg_name_len,
                          IWL_FW_INI_MAX_DBG_CFG_NAME_LEN);
                 return;
         }
@@ -2775,8 +2777,6 @@ static void _iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                 struct iwl_ucode_tlv *tlv = iter;
                 void *ini_tlv = (void *)tlv->data;
                 u32 type = le32_to_cpu(tlv->type);
-                const char invalid_ap_str[] =
-                        "WRT: ext=%d. Invalid apply point %d for %s\n";
 
                 switch (type) {
                 case IWL_UCODE_TLV_TYPE_DEBUG_INFO:
@@ -2786,8 +2786,9 @@ static void _iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                         struct iwl_fw_ini_allocation_data *buf_alloc = ini_tlv;
 
                         if (pnt != IWL_FW_INI_APPLY_EARLY) {
-                                IWL_ERR(fwrt, invalid_ap_str, ext, pnt,
-                                        "buffer allocation");
+                                IWL_ERR(fwrt,
+                                        "WRT: ext=%d. Invalid apply point %d for buffer allocation\n",
+                                        ext, pnt);
                                 goto next;
                         }
 
@@ -2797,8 +2798,9 @@ static void _iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                 }
                 case IWL_UCODE_TLV_TYPE_HCMD:
                         if (pnt < IWL_FW_INI_APPLY_AFTER_ALIVE) {
-                                IWL_ERR(fwrt, invalid_ap_str, ext, pnt,
-                                        "host command");
+                                IWL_ERR(fwrt,
+                                        "WRT: ext=%d. Invalid apply point %d for host command\n",
+                                        ext, pnt);
                                 goto next;
                         }
                         iwl_fw_dbg_send_hcmd(fwrt, tlv, ext);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 57d09049e615..38672dd5aae9 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -1640,6 +1640,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
         init_completion(&drv->request_firmware_complete);
         INIT_LIST_HEAD(&drv->list);
 
+        iwl_load_fw_dbg_tlv(drv->trans->dev, drv->trans);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         /* Create the device debugfs entries. */
         drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
@@ -1660,8 +1662,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
 err_fw:
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         debugfs_remove_recursive(drv->dbgfs_drv);
-        iwl_fw_dbg_free(drv->trans);
 #endif
+        iwl_fw_dbg_free(drv->trans);
         kfree(drv);
 err:
         return ERR_PTR(ret);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 1d608e9e9101..5de54d1559dd 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -755,7 +755,7 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
 
         for (i = 0; i < n_profiles; i++) {
                 /* the tables start at element 3 */
-                static int pos = 3;
+                int pos = 3;
 
                 /* The EWRD profiles officially go from 2 to 4, but we
                  * save them in sar_profiles[1-3] (because we don't
@@ -880,6 +880,22 @@ int iwl_mvm_sar_select_profile(struct iwl_mvm *mvm, int prof_a, int prof_b)
         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
 }
 
+static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
+{
+        /*
+         * The GEO_TX_POWER_LIMIT command is not supported on earlier
+         * firmware versions.  Unfortunately, we don't have a TLV API
+         * flag to rely on, so rely on the major version which is in
+         * the first byte of ucode_ver.  This was implemented
+         * initially on version 38 and then backported to 36, 29 and
+         * 17.
+         */
+        return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
+               IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 ||
+               IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
+               IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
+}
+
 int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 {
         struct iwl_geo_tx_power_profiles_resp *resp;
@@ -909,6 +925,9 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
                 .data = { data },
         };
 
+        if (!iwl_mvm_sar_geo_support(mvm))
+                return -EOPNOTSUPP;
+
         ret = iwl_mvm_send_cmd(mvm, &cmd);
         if (ret) {
                 IWL_ERR(mvm, "Failed to get geographic profile info %d\n", ret);
@@ -934,13 +953,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
         int ret, i, j;
         u16 cmd_wide_id =  WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
 
-        /*
-         * This command is not supported on earlier firmware versions.
-         * Unfortunately, we don't have a TLV API flag to rely on, so
-         * rely on the major version which is in the first byte of
-         * ucode_ver.
-         */
-        if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
+        if (!iwl_mvm_sar_geo_support(mvm))
                 return 0;
 
         ret = iwl_mvm_sar_get_wgds_table(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index e63623251d61..b74bd58f3f45 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -207,11 +207,11 @@ static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
         },
 };
 
-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
-                               enum set_key_cmd cmd,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_sta *sta,
-                               struct ieee80211_key_conf *key);
+static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+                                 enum set_key_cmd cmd,
+                                 struct ieee80211_vif *vif,
+                                 struct ieee80211_sta *sta,
+                                 struct ieee80211_key_conf *key);
 
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 {
@@ -474,7 +474,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
         ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
         ieee80211_hw_set(hw, STA_MMPDU_TXQ);
-        ieee80211_hw_set(hw, TX_AMSDU);
+        /*
+         * On older devices, enabling TX A-MSDU occasionally leads to
+         * something getting messed up, the command read from the FIFO
+         * gets out of sync and isn't a TX command, so that we have an
+         * assert EDC.
+         *
+         * It's not clear where the bug is, but since we didn't used to
+         * support A-MSDU until moving the mac80211 iTXQs, just leave it
+         * for older devices. We also don't see this issue on any newer
+         * devices.
+         */
+        if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000)
+                ieee80211_hw_set(hw, TX_AMSDU);
         ieee80211_hw_set(hw, TX_FRAG_LIST);
 
         if (iwl_mvm_has_tlc_offload(mvm)) {
@@ -2726,7 +2738,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
 
                 mvmvif->ap_early_keys[i] = NULL;
 
-                ret = iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
+                ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
                 if (ret)
                         goto out_quota_failed;
         }
@@ -3494,11 +3506,11 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         return ret;
 }
 
-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
-                               enum set_key_cmd cmd,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_sta *sta,
-                               struct ieee80211_key_conf *key)
+static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+                                 enum set_key_cmd cmd,
+                                 struct ieee80211_vif *vif,
+                                 struct ieee80211_sta *sta,
+                                 struct ieee80211_key_conf *key)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
@@ -3553,8 +3565,6 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                         return -EOPNOTSUPP;
         }
 
-        mutex_lock(&mvm->mutex);
-
         switch (cmd) {
         case SET_KEY:
                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
@@ -3700,7 +3710,22 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                 ret = -EINVAL;
         }
 
+        return ret;
+}
+
+static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+                               enum set_key_cmd cmd,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct ieee80211_key_conf *key)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        int ret;
+
+        mutex_lock(&mvm->mutex);
+        ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
         mutex_unlock(&mvm->mutex);
+
         return ret;
 }
 
@@ -5042,7 +5067,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
         int ret;
 
-        lockdep_assert_held(&mvm->mutex);
 
         if (!iwl_mvm_has_new_rx_api(mvm))
                 return;
@@ -5053,13 +5077,15 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
                 atomic_set(&mvm->queue_sync_counter,
                            mvm->trans->num_rx_queues);
 
-        ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif, size);
+        ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
+                                      size, !notif->sync);
         if (ret) {
                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
                 goto out;
         }
 
         if (notif->sync) {
+                lockdep_assert_held(&mvm->mutex);
                 ret = wait_event_timeout(mvm->rx_sync_waitq,
                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
                                          iwl_mvm_is_radio_killed(mvm),
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 48c77af54e99..a263cc629d75 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1664,9 +1664,9 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
 void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
                               struct iwl_rx_cmd_buffer *rxb, int queue);
 int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
-                            const u8 *data, u32 count);
-void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
-                            int queue);
+                            const u8 *data, u32 count, bool async);
+void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
+                            struct iwl_rx_cmd_buffer *rxb, int queue);
 void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_mfu_assert_dump_notif(struct iwl_mvm *mvm,
                                    struct iwl_rx_cmd_buffer *rxb);
@@ -1813,7 +1813,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
 /* rate scaling */
-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync);
+int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq);
 void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
 int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate);
 void rs_update_last_rssi(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 719f793b3487..a9bb43a2f27b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -620,7 +620,7 @@ void iwl_mvm_rx_chub_update_mcc(struct iwl_mvm *mvm,
         enum iwl_mcc_source src;
         char mcc[3];
         struct ieee80211_regdomain *regd;
-        u32 wgds_tbl_idx;
+        int wgds_tbl_idx;
 
         lockdep_assert_held(&mvm->mutex);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index d7d6f3398f86..4888054dc3d8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1088,7 +1088,7 @@ static void iwl_mvm_rx_mq(struct iwl_op_mode *op_mode,
                 iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, 0);
         else if (unlikely(cmd == WIDE_ID(DATA_PATH_GROUP,
                                          RX_QUEUES_NOTIFICATION)))
-                iwl_mvm_rx_queue_notif(mvm, rxb, 0);
+                iwl_mvm_rx_queue_notif(mvm, napi, rxb, 0);
         else if (cmd == WIDE_ID(LEGACY_GROUP, FRAME_RELEASE))
                 iwl_mvm_rx_frame_release(mvm, napi, rxb, 0);
         else if (cmd == WIDE_ID(DATA_PATH_GROUP, RX_NO_DATA_NOTIF))
@@ -1812,7 +1812,7 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode,
                 iwl_mvm_rx_frame_release(mvm, napi, rxb, queue);
         else if (unlikely(cmd == WIDE_ID(DATA_PATH_GROUP,
                                          RX_QUEUES_NOTIFICATION)))
-                iwl_mvm_rx_queue_notif(mvm, rxb, queue);
+                iwl_mvm_rx_queue_notif(mvm, napi, rxb, queue);
         else if (likely(cmd == WIDE_ID(LEGACY_GROUP, REPLY_RX_MPDU_CMD)))
                 iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, queue);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 009e72abcd51..e4415e58fa78 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1197,239 +1197,6 @@ static u8 rs_get_tid(struct ieee80211_hdr *hdr)
         return tid;
 }
 
-void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          int tid, struct ieee80211_tx_info *info, bool ndp)
-{
-        int legacy_success;
-        int retries;
-        int i;
-        struct iwl_lq_cmd *table;
-        u32 lq_hwrate;
-        struct rs_rate lq_rate, tx_resp_rate;
-        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
-        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
-        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
-        u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
-        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta.rs_drv;
-
-        /* Treat uninitialized rate scaling data same as non-existing. */
-        if (!lq_sta) {
-                IWL_DEBUG_RATE(mvm, "Station rate scaling not created yet.\n");
-                return;
-        } else if (!lq_sta->pers.drv) {
-                IWL_DEBUG_RATE(mvm, "Rate scaling not initialized yet.\n");
-                return;
-        }
-
-        /* This packet was aggregated but doesn't carry status info */
-        if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
-            !(info->flags & IEEE80211_TX_STAT_AMPDU))
-                return;
-
-        if (rs_rate_from_ucode_rate(tx_resp_hwrate, info->band,
-                                    &tx_resp_rate)) {
-                WARN_ON_ONCE(1);
-                return;
-        }
-
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /* Disable last tx check if we are debugging with fixed rate but
-         * update tx stats */
-        if (lq_sta->pers.dbg_fixed_rate) {
-                int index = tx_resp_rate.index;
-                enum rs_column column;
-                int attempts, success;
-
-                column = rs_get_column_from_rate(&tx_resp_rate);
-                if (WARN_ONCE(column == RS_COLUMN_INVALID,
-                              "Can't map rate 0x%x to column",
-                              tx_resp_hwrate))
-                        return;
-
-                if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                        attempts = info->status.ampdu_len;
-                        success = info->status.ampdu_ack_len;
-                } else {
-                        attempts = info->status.rates[0].count;
-                        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
-                }
-
-                lq_sta->pers.tx_stats[column][index].total += attempts;
-                lq_sta->pers.tx_stats[column][index].success += success;
-
-                IWL_DEBUG_RATE(mvm, "Fixed rate 0x%x success %d attempts %d\n",
-                               tx_resp_hwrate, success, attempts);
-                return;
-        }
-#endif
-
-        if (time_after(jiffies,
-                       (unsigned long)(lq_sta->last_tx +
-                                       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
-                IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
-                iwl_mvm_rs_rate_init(mvm, sta, info->band, true);
-                return;
-        }
-        lq_sta->last_tx = jiffies;
-
-        /* Ignore this Tx frame response if its initial rate doesn't match
-         * that of latest Link Quality command.  There may be stragglers
-         * from a previous Link Quality command, but we're no longer interested
-         * in those; they're either from the "active" mode while we're trying
-         * to check "search" mode, or a prior "search" mode after we've moved
-         * to a new "search" mode (which might become the new "active" mode).
-         */
-        table = &lq_sta->lq;
-        lq_hwrate = le32_to_cpu(table->rs_table[0]);
-        if (rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate)) {
-                WARN_ON_ONCE(1);
-                return;
-        }
-
-        /* Here we actually compare this rate to the latest LQ command */
-        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
-                IWL_DEBUG_RATE(mvm,
-                               "tx resp color 0x%x does not match 0x%x\n",
-                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
-
-                /*
-                 * Since rates mis-match, the last LQ command may have failed.
-                 * After IWL_MISSED_RATE_MAX mis-matches, resync the uCode with
-                 * ... driver.
-                 */
-                lq_sta->missed_rate_counter++;
-                if (lq_sta->missed_rate_counter > IWL_MVM_RS_MISSED_RATE_MAX) {
-                        lq_sta->missed_rate_counter = 0;
-                        IWL_DEBUG_RATE(mvm,
-                                       "Too many rates mismatch. Send sync LQ. rs_state %d\n",
-                                       lq_sta->rs_state);
-                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
-                }
-                /* Regardless, ignore this status info for outdated rate */
-                return;
-        } else
-                /* Rate did match, so reset the missed_rate_counter */
-                lq_sta->missed_rate_counter = 0;
-
-        if (!lq_sta->search_better_tbl) {
-                curr_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                other_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
-        } else {
-                curr_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
-                other_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        }
-
-        if (WARN_ON_ONCE(!rs_rate_column_match(&lq_rate, &curr_tbl->rate))) {
-                IWL_DEBUG_RATE(mvm,
-                               "Neither active nor search matches tx rate\n");
-                tmp_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                rs_dump_rate(mvm, &tmp_tbl->rate, "ACTIVE");
-                tmp_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
-                rs_dump_rate(mvm, &tmp_tbl->rate, "SEARCH");
-                rs_dump_rate(mvm, &lq_rate, "ACTUAL");
-
-                /*
-                 * no matching table found, let's by-pass the data collection
-                 * and continue to perform rate scale to find the rate table
-                 */
-                rs_stay_in_table(lq_sta, true);
-                goto done;
-        }
-
-        /*
-         * Updating the frame history depends on whether packets were
-         * aggregated.
-         *
-         * For aggregation, all packets were transmitted at the same rate, the
-         * first index into rate scale table.
-         */
-        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
-                                    info->status.ampdu_len,
-                                    info->status.ampdu_ack_len,
-                                    reduced_txp);
-
-                /* ampdu_ack_len = 0 marks no BA was received. For TLC, treat
-                 * it as a single frame loss as we don't want the success ratio
-                 * to dip too quickly because a BA wasn't received.
-                 * For TPC, there's no need for this optimisation since we want
-                 * to recover very quickly from a bad power reduction and,
-                 * therefore we'd like the success ratio to get an immediate hit
-                 * when failing to get a BA, so we'd switch back to a lower or
-                 * zero power reduction. When FW transmits agg with a rate
-                 * different from the initial rate, it will not use reduced txp
-                 * and will send BA notification twice (one empty with reduced
-                 * txp equal to the value from LQ and one with reduced txp 0).
-                 * We need to update counters for each txp level accordingly.
-                 */
-                if (info->status.ampdu_ack_len == 0)
-                        info->status.ampdu_len = 1;
-
-                rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl, tx_resp_rate.index,
-                                    info->status.ampdu_len,
-                                    info->status.ampdu_ack_len);
-
-                /* Update success/fail counts if not searching for new mode */
-                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
-                        lq_sta->total_success += info->status.ampdu_ack_len;
-                        lq_sta->total_failed += (info->status.ampdu_len -
-                                        info->status.ampdu_ack_len);
-                }
-        } else {
-                /* For legacy, update frame history with for each Tx retry. */
-                retries = info->status.rates[0].count - 1;
-                /* HW doesn't send more than 15 retries */
-                retries = min(retries, 15);
-
-                /* The last transmission may have been successful */
-                legacy_success = !!(info->flags & IEEE80211_TX_STAT_ACK);
-                /* Collect data for each rate used during failed TX attempts */
-                for (i = 0; i <= retries; ++i) {
-                        lq_hwrate = le32_to_cpu(table->rs_table[i]);
-                        if (rs_rate_from_ucode_rate(lq_hwrate, info->band,
-                                                    &lq_rate)) {
-                                WARN_ON_ONCE(1);
-                                return;
-                        }
-
-                        /*
-                         * Only collect stats if retried rate is in the same RS
-                         * table as active/search.
-                         */
-                        if (rs_rate_column_match(&lq_rate, &curr_tbl->rate))
-                                tmp_tbl = curr_tbl;
-                        else if (rs_rate_column_match(&lq_rate,
-                                                      &other_tbl->rate))
-                                tmp_tbl = other_tbl;
-                        else
-                                continue;
-
-                        rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            tx_resp_rate.index, 1,
-                                            i < retries ? 0 : legacy_success,
-                                            reduced_txp);
-                        rs_collect_tlc_data(mvm, mvmsta, tid, tmp_tbl,
-                                            tx_resp_rate.index, 1,
-                                            i < retries ? 0 : legacy_success);
-                }
-
-                /* Update success/fail counts if not searching for new mode */
-                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
-                        lq_sta->total_success += legacy_success;
-                        lq_sta->total_failed += retries + (1 - legacy_success);
-                }
-        }
-        /* The last TX rate is cached in lq_sta; it's set in if/else above */
-        lq_sta->last_rate_n_flags = lq_hwrate;
-        IWL_DEBUG_RATE(mvm, "reduced txpower: %d\n", reduced_txp);
-done:
-        /* See if there's a better rate or modulation mode to try. */
-        if (sta->supp_rates[info->band])
-                rs_rate_scale_perform(mvm, sta, lq_sta, tid, ndp);
-}
-
 /*
  * mac80211 sends us Tx status
  */
@@ -1442,8 +1209,9 @@ static void rs_drv_mac80211_tx_status(void *mvm_r,
         struct iwl_op_mode *op_mode = mvm_r;
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
-        if (!iwl_mvm_sta_from_mac80211(sta)->vif)
+        if (!mvmsta->vif)
                 return;
 
         if (!ieee80211_is_data(hdr->frame_control) ||
@@ -1584,6 +1352,18 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         tbl->expected_tpt = rs_get_expected_tpt_table(lq_sta, column, rate->bw);
 }
 
+/* rs uses two tables, one is active and the second is for searching better
+ * configuration. This function, according to the index of the currently
+ * active table returns the search table, which is located at the
+ * index complementary to 1 according to the active table (active = 1,
+ * search = 0 or active = 0, search = 1).
+ * Since lq_info is an arary of size 2, make sure index cannot be out of bounds.
+ */
+static inline u8 rs_search_tbl(u8 active_tbl)
+{
+        return (active_tbl ^ 1) & 1;
+}
+
 static s32 rs_get_best_rate(struct iwl_mvm *mvm,
                             struct iwl_lq_sta *lq_sta,
                             struct iwl_scale_tbl_info *tbl,     /* "search" */
@@ -1794,7 +1574,7 @@ static void rs_update_rate_tbl(struct iwl_mvm *mvm,
                                struct iwl_scale_tbl_info *tbl)
 {
         rs_fill_lq_cmd(mvm, sta, lq_sta, &tbl->rate);
-        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
+        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
 }
 
 static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm,
@@ -1931,9 +1711,9 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                                struct ieee80211_sta *sta,
                                enum rs_column col_id)
 {
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+        struct iwl_scale_tbl_info *tbl = &lq_sta->lq_info[lq_sta->active_tbl];
         struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
+                &lq_sta->lq_info[rs_search_tbl(lq_sta->active_tbl)];
         struct rs_rate *rate = &search_tbl->rate;
         const struct rs_tx_column *column = &rs_tx_columns[col_id];
         const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
@@ -2341,7 +2121,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         if (!lq_sta->search_better_tbl)
                 active_tbl = lq_sta->active_tbl;
         else
-                active_tbl = 1 - lq_sta->active_tbl;
+                active_tbl = rs_search_tbl(lq_sta->active_tbl);
 
         tbl = &(lq_sta->lq_info[active_tbl]);
         rate = &tbl->rate;
@@ -2565,7 +2345,7 @@ lq_update:
                 /* If new "search" mode was selected, set up in uCode table */
                 if (lq_sta->search_better_tbl) {
                         /* Access the "search" table, clear its history. */
-                        tbl = &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
+                        tbl = &lq_sta->lq_info[rs_search_tbl(lq_sta->active_tbl)];
                         rs_rate_scale_clear_tbl_windows(mvm, tbl);
 
                         /* Use new "search" start rate */
@@ -2896,7 +2676,7 @@ void rs_update_last_rssi(struct iwl_mvm *mvm,
 static void rs_initialize_lq(struct iwl_mvm *mvm,
                              struct ieee80211_sta *sta,
                              struct iwl_lq_sta *lq_sta,
-                             enum nl80211_band band, bool update)
+                             enum nl80211_band band)
 {
         struct iwl_scale_tbl_info *tbl;
         struct rs_rate *rate;
@@ -2908,7 +2688,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
         if (!lq_sta->search_better_tbl)
                 active_tbl = lq_sta->active_tbl;
         else
-                active_tbl = 1 - lq_sta->active_tbl;
+                active_tbl = rs_search_tbl(lq_sta->active_tbl);
 
         tbl = &(lq_sta->lq_info[active_tbl]);
         rate = &tbl->rate;
@@ -2926,7 +2706,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
         /* TODO restore station should remember the lq cmd */
-        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, !update);
+        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
 }
 
 static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
@@ -3175,7 +2955,7 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
  * Called after adding a new station to initialize rate scaling
  */
 static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                             enum nl80211_band band, bool update)
+                             enum nl80211_band band)
 {
         int i, j;
         struct ieee80211_hw *hw = mvm->hw;
@@ -3186,6 +2966,8 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         struct ieee80211_supported_band *sband;
         unsigned long supp; /* must be unsigned long for for_each_set_bit */
 
+        lockdep_assert_held(&mvmsta->lq_sta.rs_drv.pers.lock);
+
         /* clear all non-persistent lq data */
         memset(lq_sta, 0, offsetof(typeof(*lq_sta), pers));
 
@@ -3255,7 +3037,7 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         iwl_mvm_reset_frame_stats(mvm);
 #endif
-        rs_initialize_lq(mvm, sta, lq_sta, band, update);
+        rs_initialize_lq(mvm, sta, lq_sta, band);
 }
 
 static void rs_drv_rate_update(void *mvm_r,
@@ -3278,6 +3060,258 @@ static void rs_drv_rate_update(void *mvm_r,
         iwl_mvm_rs_rate_init(mvm, sta, sband->band, true);
 }
 
+static void __iwl_mvm_rs_tx_status(struct iwl_mvm *mvm,
+                                   struct ieee80211_sta *sta,
+                                   int tid, struct ieee80211_tx_info *info,
+                                   bool ndp)
+{
+        int legacy_success;
+        int retries;
+        int i;
+        struct iwl_lq_cmd *table;
+        u32 lq_hwrate;
+        struct rs_rate lq_rate, tx_resp_rate;
+        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
+        u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta.rs_drv;
+
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (!lq_sta) {
+                IWL_DEBUG_RATE(mvm, "Station rate scaling not created yet.\n");
+                return;
+        } else if (!lq_sta->pers.drv) {
+                IWL_DEBUG_RATE(mvm, "Rate scaling not initialized yet.\n");
+                return;
+        }
+
+        /* This packet was aggregated but doesn't carry status info */
+        if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
+            !(info->flags & IEEE80211_TX_STAT_AMPDU))
+                return;
+
+        if (rs_rate_from_ucode_rate(tx_resp_hwrate, info->band,
+                                    &tx_resp_rate)) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* Disable last tx check if we are debugging with fixed rate but
+         * update tx stats
+         */
+        if (lq_sta->pers.dbg_fixed_rate) {
+                int index = tx_resp_rate.index;
+                enum rs_column column;
+                int attempts, success;
+
+                column = rs_get_column_from_rate(&tx_resp_rate);
+                if (WARN_ONCE(column == RS_COLUMN_INVALID,
+                              "Can't map rate 0x%x to column",
+                              tx_resp_hwrate))
+                        return;
+
+                if (info->flags & IEEE80211_TX_STAT_AMPDU) {
+                        attempts = info->status.ampdu_len;
+                        success = info->status.ampdu_ack_len;
+                } else {
+                        attempts = info->status.rates[0].count;
+                        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+                }
+
+                lq_sta->pers.tx_stats[column][index].total += attempts;
+                lq_sta->pers.tx_stats[column][index].success += success;
+
+                IWL_DEBUG_RATE(mvm, "Fixed rate 0x%x success %d attempts %d\n",
+                               tx_resp_hwrate, success, attempts);
+                return;
+        }
+#endif
+
+        if (time_after(jiffies,
+                       (unsigned long)(lq_sta->last_tx +
+                                       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
+                IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+                /* reach here only in case of driver RS, call directly
+                 * the unlocked version
+                 */
+                rs_drv_rate_init(mvm, sta, info->band);
+                return;
+        }
+        lq_sta->last_tx = jiffies;
+
+        /* Ignore this Tx frame response if its initial rate doesn't match
+         * that of latest Link Quality command.  There may be stragglers
+         * from a previous Link Quality command, but we're no longer interested
+         * in those; they're either from the "active" mode while we're trying
+         * to check "search" mode, or a prior "search" mode after we've moved
+         * to a new "search" mode (which might become the new "active" mode).
+         */
+        table = &lq_sta->lq;
+        lq_hwrate = le32_to_cpu(table->rs_table[0]);
+        if (rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate)) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        /* Here we actually compare this rate to the latest LQ command */
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
+                IWL_DEBUG_RATE(mvm,
+                               "tx resp color 0x%x does not match 0x%x\n",
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
+
+                /* Since rates mis-match, the last LQ command may have failed.
+                 * After IWL_MISSED_RATE_MAX mis-matches, resync the uCode with
+                 * ... driver.
+                 */
+                lq_sta->missed_rate_counter++;
+                if (lq_sta->missed_rate_counter > IWL_MVM_RS_MISSED_RATE_MAX) {
+                        lq_sta->missed_rate_counter = 0;
+                        IWL_DEBUG_RATE(mvm,
+                                       "Too many rates mismatch. Send sync LQ. rs_state %d\n",
+                                       lq_sta->rs_state);
+                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+                }
+                /* Regardless, ignore this status info for outdated rate */
+                return;
+        }
+
+        /* Rate did match, so reset the missed_rate_counter */
+        lq_sta->missed_rate_counter = 0;
+
+        if (!lq_sta->search_better_tbl) {
+                curr_tbl = &lq_sta->lq_info[lq_sta->active_tbl];
+                other_tbl = &lq_sta->lq_info[rs_search_tbl(lq_sta->active_tbl)];
+        } else {
+                curr_tbl = &lq_sta->lq_info[rs_search_tbl(lq_sta->active_tbl)];
+                other_tbl = &lq_sta->lq_info[lq_sta->active_tbl];
+        }
+
+        if (WARN_ON_ONCE(!rs_rate_column_match(&lq_rate, &curr_tbl->rate))) {
+                IWL_DEBUG_RATE(mvm,
+                               "Neither active nor search matches tx rate\n");
+                tmp_tbl = &lq_sta->lq_info[lq_sta->active_tbl];
+                rs_dump_rate(mvm, &tmp_tbl->rate, "ACTIVE");
+                tmp_tbl = &lq_sta->lq_info[rs_search_tbl(lq_sta->active_tbl)];
+                rs_dump_rate(mvm, &tmp_tbl->rate, "SEARCH");
+                rs_dump_rate(mvm, &lq_rate, "ACTUAL");
+
+                /* no matching table found, let's by-pass the data collection
+                 * and continue to perform rate scale to find the rate table
+                 */
+                rs_stay_in_table(lq_sta, true);
+                goto done;
+        }
+
+        /* Updating the frame history depends on whether packets were
+         * aggregated.
+         *
+         * For aggregation, all packets were transmitted at the same rate, the
+         * first index into rate scale table.
+         */
+        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
+                                    info->status.ampdu_len,
+                                    info->status.ampdu_ack_len,
+                                    reduced_txp);
+
+                /* ampdu_ack_len = 0 marks no BA was received. For TLC, treat
+                 * it as a single frame loss as we don't want the success ratio
+                 * to dip too quickly because a BA wasn't received.
+                 * For TPC, there's no need for this optimisation since we want
+                 * to recover very quickly from a bad power reduction and,
+                 * therefore we'd like the success ratio to get an immediate hit
+                 * when failing to get a BA, so we'd switch back to a lower or
+                 * zero power reduction. When FW transmits agg with a rate
+                 * different from the initial rate, it will not use reduced txp
+                 * and will send BA notification twice (one empty with reduced
+                 * txp equal to the value from LQ and one with reduced txp 0).
+                 * We need to update counters for each txp level accordingly.
+                 */
+                if (info->status.ampdu_ack_len == 0)
+                        info->status.ampdu_len = 1;
+
+                rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl,
+                                    tx_resp_rate.index,
+                                    info->status.ampdu_len,
+                                    info->status.ampdu_ack_len);
+
+                /* Update success/fail counts if not searching for new mode */
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
+                        lq_sta->total_success += info->status.ampdu_ack_len;
+                        lq_sta->total_failed += (info->status.ampdu_len -
+                                        info->status.ampdu_ack_len);
+                }
+        } else {
+                /* For legacy, update frame history with for each Tx retry. */
+                retries = info->status.rates[0].count - 1;
+                /* HW doesn't send more than 15 retries */
+                retries = min(retries, 15);
+
+                /* The last transmission may have been successful */
+                legacy_success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+                /* Collect data for each rate used during failed TX attempts */
+                for (i = 0; i <= retries; ++i) {
+                        lq_hwrate = le32_to_cpu(table->rs_table[i]);
+                        if (rs_rate_from_ucode_rate(lq_hwrate, info->band,
+                                                    &lq_rate)) {
+                                WARN_ON_ONCE(1);
+                                return;
+                        }
+
+                        /* Only collect stats if retried rate is in the same RS
+                         * table as active/search.
+                         */
+                        if (rs_rate_column_match(&lq_rate, &curr_tbl->rate))
+                                tmp_tbl = curr_tbl;
+                        else if (rs_rate_column_match(&lq_rate,
+                                                      &other_tbl->rate))
+                                tmp_tbl = other_tbl;
+                        else
+                                continue;
+
+                        rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
+                                            tx_resp_rate.index, 1,
+                                            i < retries ? 0 : legacy_success,
+                                            reduced_txp);
+                        rs_collect_tlc_data(mvm, mvmsta, tid, tmp_tbl,
+                                            tx_resp_rate.index, 1,
+                                            i < retries ? 0 : legacy_success);
+                }
+
+                /* Update success/fail counts if not searching for new mode */
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
+                        lq_sta->total_success += legacy_success;
+                        lq_sta->total_failed += retries + (1 - legacy_success);
+                }
+        }
+        /* The last TX rate is cached in lq_sta; it's set in if/else above */
+        lq_sta->last_rate_n_flags = lq_hwrate;
+        IWL_DEBUG_RATE(mvm, "reduced txpower: %d\n", reduced_txp);
+done:
+        /* See if there's a better rate or modulation mode to try. */
+        if (sta->supp_rates[info->band])
+                rs_rate_scale_perform(mvm, sta, lq_sta, tid, ndp);
+}
+
+void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                          int tid, struct ieee80211_tx_info *info, bool ndp)
+{
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
+        /* If it's locked we are in middle of init flow
+         * just wait for next tx status to update the lq_sta data
+         */
+        if (!spin_trylock(&mvmsta->lq_sta.rs_drv.pers.lock))
+                return;
+
+        __iwl_mvm_rs_tx_status(mvm, sta, tid, info, ndp);
+        spin_unlock(&mvmsta->lq_sta.rs_drv.pers.lock);
+}
+
 #ifdef CONFIG_MAC80211_DEBUGFS
 static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,
                                             struct iwl_lq_cmd *lq_cmd,
@@ -3569,7 +3603,7 @@ static void rs_set_lq_ss_params(struct iwl_mvm *mvm,
 
                 bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED;
                 bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params);
-                iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false);
+                iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd);
 
                 ss_params |= LQ_SS_BFER_ALLOWED;
                 IWL_DEBUG_RATE(mvm,
@@ -3735,7 +3769,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
 
         if (lq_sta->pers.dbg_fixed_rate) {
                 rs_fill_lq_cmd(mvm, NULL, lq_sta, NULL);
-                iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq, false);
+                iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq);
         }
 }
 
@@ -4127,10 +4161,15 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           enum nl80211_band band, bool update)
 {
-        if (iwl_mvm_has_tlc_offload(mvm))
+        if (iwl_mvm_has_tlc_offload(mvm)) {
                 rs_fw_rate_init(mvm, sta, band, update);
-        else
-                rs_drv_rate_init(mvm, sta, band, update);
+        } else {
+                struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
+                spin_lock(&mvmsta->lq_sta.rs_drv.pers.lock);
+                rs_drv_rate_init(mvm, sta, band);
+                spin_unlock(&mvmsta->lq_sta.rs_drv.pers.lock);
+        }
 }
 
 int iwl_mvm_rate_control_register(void)
@@ -4160,7 +4199,7 @@ static int rs_drv_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                         lq->flags &= ~LQ_FLAG_USE_RTS_MSK;
         }
 
-        return iwl_mvm_send_lq_cmd(mvm, lq, false);
+        return iwl_mvm_send_lq_cmd(mvm, lq);
 }
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index f7eb60dbaf20..428642e66658 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -4,7 +4,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * Contact Information:
  *  Intel Linux Wireless <linuxwifi@intel.com>
@@ -390,6 +390,7 @@ struct iwl_lq_sta {
                 s8 last_rssi;
                 struct rs_rate_stats tx_stats[RS_COLUMN_COUNT][IWL_RATE_COUNT];
                 struct iwl_mvm *drv;
+                spinlock_t lock; /* for races in reinit/update table */
         } pers;
 };
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 64f950501287..854edd7d7103 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -463,20 +463,22 @@ static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
 }
 
 int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
-                            const u8 *data, u32 count)
+                            const u8 *data, u32 count, bool async)
 {
-        struct iwl_rxq_sync_cmd *cmd;
+        u8 buf[sizeof(struct iwl_rxq_sync_cmd) +
+               sizeof(struct iwl_mvm_rss_sync_notif)];
+        struct iwl_rxq_sync_cmd *cmd = (void *)buf;
         u32 data_size = sizeof(*cmd) + count;
         int ret;
 
-        /* should be DWORD aligned */
-        if (WARN_ON(count & 3 || count > IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE))
+        /*
+         * size must be a multiple of DWORD
+         * Ensure we don't overflow buf
+         */
+        if (WARN_ON(count & 3 ||
+                    count > sizeof(struct iwl_mvm_rss_sync_notif)))
                 return -EINVAL;
 
-        cmd = kzalloc(data_size, GFP_KERNEL);
-        if (!cmd)
-                return -ENOMEM;
-
         cmd->rxq_mask = cpu_to_le32(rxq_mask);
         cmd->count =  cpu_to_le32(count);
         cmd->flags = 0;
@@ -485,9 +487,8 @@ int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
         ret = iwl_mvm_send_cmd_pdu(mvm,
                                    WIDE_ID(DATA_PATH_GROUP,
                                            TRIGGER_RX_QUEUES_NOTIF_CMD),
-                                   0, data_size, cmd);
+                                   async ? CMD_ASYNC : 0, data_size, cmd);
 
-        kfree(cmd);
         return ret;
 }
 
@@ -503,14 +504,31 @@ static bool iwl_mvm_is_sn_less(u16 sn1, u16 sn2, u16 buffer_size)
                !ieee80211_sn_less(sn1, sn2 - buffer_size);
 }
 
+static void iwl_mvm_sync_nssn(struct iwl_mvm *mvm, u8 baid, u16 nssn)
+{
+        struct iwl_mvm_rss_sync_notif notif = {
+                .metadata.type = IWL_MVM_RXQ_NSSN_SYNC,
+                .metadata.sync = 0,
+                .nssn_sync.baid = baid,
+                .nssn_sync.nssn = nssn,
+        };
+
+        iwl_mvm_sync_rx_queues_internal(mvm, (void *)&notif, sizeof(notif));
+}
+
 #define RX_REORDER_BUF_TIMEOUT_MQ (HZ / 10)
 
+enum iwl_mvm_release_flags {
+        IWL_MVM_RELEASE_SEND_RSS_SYNC = BIT(0),
+        IWL_MVM_RELEASE_FROM_RSS_SYNC = BIT(1),
+};
+
 static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
                                    struct ieee80211_sta *sta,
                                    struct napi_struct *napi,
                                    struct iwl_mvm_baid_data *baid_data,
                                    struct iwl_mvm_reorder_buffer *reorder_buf,
-                                   u16 nssn)
+                                   u16 nssn, u32 flags)
 {
         struct iwl_mvm_reorder_buf_entry *entries =
                 &baid_data->entries[reorder_buf->queue *
@@ -519,6 +537,18 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&reorder_buf->lock);
 
+        /*
+         * We keep the NSSN not too far behind, if we are sync'ing it and it
+         * is more than 2048 ahead of us, it must be behind us. Discard it.
+         * This can happen if the queue that hit the 0 / 2048 seqno was lagging
+         * behind and this queue already processed packets. The next if
+         * would have caught cases where this queue would have processed less
+         * than 64 packets, but it may have processed more than 64 packets.
+         */
+        if ((flags & IWL_MVM_RELEASE_FROM_RSS_SYNC) &&
+            ieee80211_sn_less(nssn, ssn))
+                goto set_timer;
+
         /* ignore nssn smaller than head sn - this can happen due to timeout */
         if (iwl_mvm_is_sn_less(nssn, ssn, reorder_buf->buf_size))
                 goto set_timer;
@@ -529,6 +559,9 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
                 struct sk_buff *skb;
 
                 ssn = ieee80211_sn_inc(ssn);
+                if ((flags & IWL_MVM_RELEASE_SEND_RSS_SYNC) &&
+                    (ssn == 2048 || ssn == 0))
+                        iwl_mvm_sync_nssn(mvm, baid_data->baid, ssn);
 
                 /*
                  * Empty the list. Will have more than one frame for A-MSDU.
@@ -615,7 +648,8 @@ void iwl_mvm_reorder_timer_expired(struct timer_list *t)
                              sta_id, sn);
                 iwl_mvm_event_frame_timeout_callback(buf->mvm, mvmsta->vif,
                                                      sta, baid_data->tid);
-                iwl_mvm_release_frames(buf->mvm, sta, NULL, baid_data, buf, sn);
+                iwl_mvm_release_frames(buf->mvm, sta, NULL, baid_data,
+                                       buf, sn, IWL_MVM_RELEASE_SEND_RSS_SYNC);
                 rcu_read_unlock();
         } else {
                 /*
@@ -657,7 +691,8 @@ static void iwl_mvm_del_ba(struct iwl_mvm *mvm, int queue,
         spin_lock_bh(&reorder_buf->lock);
         iwl_mvm_release_frames(mvm, sta, NULL, ba_data, reorder_buf,
                                ieee80211_sn_add(reorder_buf->head_sn,
-                                                reorder_buf->buf_size));
+                                                reorder_buf->buf_size),
+                               0);
         spin_unlock_bh(&reorder_buf->lock);
         del_timer_sync(&reorder_buf->reorder_timer);
 
@@ -665,8 +700,54 @@ out:
         rcu_read_unlock();
 }
 
-void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
-                            int queue)
+static void iwl_mvm_release_frames_from_notif(struct iwl_mvm *mvm,
+                                              struct napi_struct *napi,
+                                              u8 baid, u16 nssn, int queue,
+                                              u32 flags)
+{
+        struct ieee80211_sta *sta;
+        struct iwl_mvm_reorder_buffer *reorder_buf;
+        struct iwl_mvm_baid_data *ba_data;
+
+        IWL_DEBUG_HT(mvm, "Frame release notification for BAID %u, NSSN %d\n",
+                     baid, nssn);
+
+        if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
+                         baid >= ARRAY_SIZE(mvm->baid_map)))
+                return;
+
+        rcu_read_lock();
+
+        ba_data = rcu_dereference(mvm->baid_map[baid]);
+        if (WARN_ON_ONCE(!ba_data))
+                goto out;
+
+        sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
+        if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
+                goto out;
+
+        reorder_buf = &ba_data->reorder_buf[queue];
+
+        spin_lock_bh(&reorder_buf->lock);
+        iwl_mvm_release_frames(mvm, sta, napi, ba_data,
+                               reorder_buf, nssn, flags);
+        spin_unlock_bh(&reorder_buf->lock);
+
+out:
+        rcu_read_unlock();
+}
+
+static void iwl_mvm_nssn_sync(struct iwl_mvm *mvm,
+                              struct napi_struct *napi, int queue,
+                              const struct iwl_mvm_nssn_sync_data *data)
+{
+        iwl_mvm_release_frames_from_notif(mvm, napi, data->baid,
+                                          data->nssn, queue,
+                                          IWL_MVM_RELEASE_FROM_RSS_SYNC);
+}
+
+void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
+                            struct iwl_rx_cmd_buffer *rxb, int queue)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rxq_sync_notification *notif;
@@ -687,6 +768,10 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         case IWL_MVM_RXQ_NOTIF_DEL_BA:
                 iwl_mvm_del_ba(mvm, queue, (void *)internal_notif->data);
                 break;
+        case IWL_MVM_RXQ_NSSN_SYNC:
+                iwl_mvm_nssn_sync(mvm, napi, queue,
+                                  (void *)internal_notif->data);
+                break;
         default:
                 WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
         }
@@ -785,7 +870,8 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         }
 
         if (ieee80211_is_back_req(hdr->frame_control)) {
-                iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer, nssn);
+                iwl_mvm_release_frames(mvm, sta, napi, baid_data,
+                                       buffer, nssn, 0);
                 goto drop;
         }
 
@@ -794,7 +880,10 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * If the SN is smaller than the NSSN it might need to first go into
          * the reorder buffer, in which case we just release up to it and the
          * rest of the function will take care of storing it and releasing up to
-         * the nssn
+         * the nssn.
+         * This should not happen. This queue has been lagging and it should
+         * have been updated by a IWL_MVM_RXQ_NSSN_SYNC notification. Be nice
+         * and update the other queues.
          */
         if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
                                 buffer->buf_size) ||
@@ -802,7 +891,7 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
                 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
 
                 iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer,
-                                       min_sn);
+                                       min_sn, IWL_MVM_RELEASE_SEND_RSS_SYNC);
         }
 
         /* drop any oudated packets */
@@ -813,8 +902,23 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         if (!buffer->num_stored && ieee80211_sn_less(sn, nssn)) {
                 if (iwl_mvm_is_sn_less(buffer->head_sn, nssn,
                                        buffer->buf_size) &&
-                   (!amsdu || last_subframe))
+                   (!amsdu || last_subframe)) {
+                        /*
+                         * If we crossed the 2048 or 0 SN, notify all the
+                         * queues. This is done in order to avoid having a
+                         * head_sn that lags behind for too long. When that
+                         * happens, we can get to a situation where the head_sn
+                         * is within the interval [nssn - buf_size : nssn]
+                         * which will make us think that the nssn is a packet
+                         * that we already freed because of the reordering
+                         * buffer and we will ignore it. So maintain the
+                         * head_sn somewhat updated across all the queues:
+                         * when it crosses 0 and 2048.
+                         */
+                        if (sn == 2048 || sn == 0)
+                                iwl_mvm_sync_nssn(mvm, baid, sn);
                         buffer->head_sn = nssn;
+                }
                 /* No need to update AMSDU last SN - we are moving the head */
                 spin_unlock_bh(&buffer->lock);
                 return false;
@@ -829,8 +933,11 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * while technically there is no hole and we can move forward.
          */
         if (!buffer->num_stored && sn == buffer->head_sn) {
-                if (!amsdu || last_subframe)
+                if (!amsdu || last_subframe) {
+                        if (sn == 2048 || sn == 0)
+                                iwl_mvm_sync_nssn(mvm, baid, sn);
                         buffer->head_sn = ieee80211_sn_inc(buffer->head_sn);
+                }
                 /* No need to update AMSDU last SN - we are moving the head */
                 spin_unlock_bh(&buffer->lock);
                 return false;
@@ -875,7 +982,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * release notification with up to date NSSN.
          */
         if (!amsdu || last_subframe)
-                iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer, nssn);
+                iwl_mvm_release_frames(mvm, sta, napi, baid_data,
+                                       buffer, nssn,
+                                       IWL_MVM_RELEASE_SEND_RSS_SYNC);
 
         spin_unlock_bh(&buffer->lock);
         return true;
@@ -1840,40 +1949,14 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
 out:
         rcu_read_unlock();
 }
+
 void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
                               struct iwl_rx_cmd_buffer *rxb, int queue)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_frame_release *release = (void *)pkt->data;
-        struct ieee80211_sta *sta;
-        struct iwl_mvm_reorder_buffer *reorder_buf;
-        struct iwl_mvm_baid_data *ba_data;
-
-        int baid = release->baid;
-
-        IWL_DEBUG_HT(mvm, "Frame release notification for BAID %u, NSSN %d\n",
-                     release->baid, le16_to_cpu(release->nssn));
 
-        if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID))
-                return;
-
-        rcu_read_lock();
-
-        ba_data = rcu_dereference(mvm->baid_map[baid]);
-        if (WARN_ON_ONCE(!ba_data))
-                goto out;
-
-        sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
-        if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
-                goto out;
-
-        reorder_buf = &ba_data->reorder_buf[queue];
-
-        spin_lock_bh(&reorder_buf->lock);
-        iwl_mvm_release_frames(mvm, sta, napi, ba_data, reorder_buf,
-                               le16_to_cpu(release->nssn));
-        spin_unlock_bh(&reorder_buf->lock);
-
-out:
-        rcu_read_unlock();
+        iwl_mvm_release_frames_from_notif(mvm, napi, release->baid,
+                                          le16_to_cpu(release->nssn),
+                                          queue, 0);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f545a737a92d..10f18536dd0d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1684,6 +1684,8 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
          */
         if (iwl_mvm_has_tlc_offload(mvm))
                 iwl_mvm_rs_add_sta(mvm, mvm_sta);
+        else
+                spin_lock_init(&mvm_sta->lq_sta.rs_drv.pers.lock);
 
         iwl_mvm_toggle_tx_ant(mvm, &mvm_sta->tx_ant);
 
@@ -2421,7 +2423,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
 static void iwl_mvm_sync_rxq_del_ba(struct iwl_mvm *mvm, u8 baid)
 {
-        struct iwl_mvm_delba_notif notif = {
+        struct iwl_mvm_rss_sync_notif notif = {
                 .metadata.type = IWL_MVM_RXQ_NOTIF_DEL_BA,
                 .metadata.sync = 1,
                 .delba.baid = baid,
@@ -2972,7 +2974,7 @@ out:
         IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
                      sta->addr, tid);
 
-        return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq, false);
+        return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq);
 }
 
 static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 4487cc3e07c1..8d70093847cb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -343,9 +343,17 @@ struct iwl_mvm_delba_data {
         u32 baid;
 } __packed;
 
-struct iwl_mvm_delba_notif {
+struct iwl_mvm_nssn_sync_data {
+        u32 baid;
+        u32 nssn;
+} __packed;
+
+struct iwl_mvm_rss_sync_notif {
         struct iwl_mvm_internal_rxq_notif metadata;
-        struct iwl_mvm_delba_data delba;
+        union {
+                struct iwl_mvm_delba_data delba;
+                struct iwl_mvm_nssn_sync_data nssn_sync;
+        };
 } __packed;
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index a3e5d88f1c07..6ac114a393cc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -831,6 +831,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
         unsigned int tcp_payload_len;
         unsigned int mss = skb_shinfo(skb)->gso_size;
         bool ipv4 = (skb->protocol == htons(ETH_P_IP));
+        bool qos = ieee80211_is_data_qos(hdr->frame_control);
         u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0;
 
         skb_shinfo(skb)->gso_size = num_subframes * mss;
@@ -864,7 +865,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
                 if (tcp_payload_len > mss) {
                         skb_shinfo(tmp)->gso_size = mss;
                 } else {
-                        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                        if (qos) {
                                 u8 *qc;
 
                                 if (ipv4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index 9ecd5f09615a..b8e20a01c192 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -653,12 +653,12 @@ int iwl_mvm_reconfig_scd(struct iwl_mvm *mvm, int queue, int fifo, int sta_id,
  * this case to clear the state indicating that station creation is in
  * progress.
  */
-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync)
+int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq)
 {
         struct iwl_host_cmd cmd = {
                 .id = LQ_CMD,
                 .len = { sizeof(struct iwl_lq_cmd), },
-                .flags = sync ? 0 : CMD_ASYNC,
+                .flags = CMD_ASYNC,
                 .data = { lq, },
         };
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index ea2a03d4bf55..de711c1160d3 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -604,10 +604,13 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x6010, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x6014, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x8010, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xE010, iwl9260_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xE014, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index fa4245d0d4a8..2f0ba7ef53b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -435,6 +435,8 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
                                          DMA_TO_DEVICE);
         }
 
+        meta->tbs = 0;
+
         if (trans->cfg->use_tfh) {
                 struct iwl_tfh_tfd *tfd_fh = (void *)tfd;
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3aeff7a3c3d8..f86c2891310a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3619,10 +3619,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
-                if (!hdr)
+                if (hdr) {
+                        genl_dump_check_consistent(cb, hdr);
+                        genlmsg_end(skb, hdr);
+                } else {
                         res = -EMSGSIZE;
-                genl_dump_check_consistent(cb, hdr);
-                genlmsg_end(skb, hdr);
+                }
         }
 
 done:
diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
index 3e442c7f7882..095837fba300 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.h
+++ b/drivers/net/wireless/marvell/mwifiex/main.h
@@ -124,6 +124,7 @@ enum {
 
 #define MWIFIEX_MAX_TOTAL_SCAN_TIME     (MWIFIEX_TIMER_10S - MWIFIEX_TIMER_1S)
 
+#define WPA_GTK_OUI_OFFSET                              2
 #define RSN_GTK_OUI_OFFSET                              2
 
 #define MWIFIEX_OUI_NOT_PRESENT                 0
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 0d6d41727037..21dda385f6c6 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -181,7 +181,8 @@ mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
         u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 
         if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
-                iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
+                iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
+                                            WPA_GTK_OUI_OFFSET);
                 oui = &mwifiex_wpa_oui[cipher][0];
                 ret = mwifiex_search_oui_in_ie(iebody, oui);
                 if (ret)
diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
index e65d027b91fa..529be35ac178 100644
--- a/drivers/nfc/nfcmrvl/main.c
+++ b/drivers/nfc/nfcmrvl/main.c
@@ -244,7 +244,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
         /* Reset possible fault of previous session */
         clear_bit(NFCMRVL_PHY_ERROR, &priv->flags);
 
-        if (priv->config.reset_n_io) {
+        if (gpio_is_valid(priv->config.reset_n_io)) {
                 nfc_info(priv->dev, "reset the chip\n");
                 gpio_set_value(priv->config.reset_n_io, 0);
                 usleep_range(5000, 10000);
@@ -255,7 +255,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
 
 void nfcmrvl_chip_halt(struct nfcmrvl_private *priv)
 {
-        if (priv->config.reset_n_io)
+        if (gpio_is_valid(priv->config.reset_n_io))
                 gpio_set_value(priv->config.reset_n_io, 0);
 }
 
diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
index 9a22056e8d9e..e5a622ce4b95 100644
--- a/drivers/nfc/nfcmrvl/uart.c
+++ b/drivers/nfc/nfcmrvl/uart.c
@@ -26,7 +26,7 @@
 static unsigned int hci_muxed;
 static unsigned int flow_control;
 static unsigned int break_control;
-static unsigned int reset_n_io;
+static int reset_n_io = -EINVAL;
 
 /*
 ** NFCMRVL NCI OPS
@@ -231,5 +231,5 @@ MODULE_PARM_DESC(break_control, "Tell if UART driver must drive break signal.");
 module_param(hci_muxed, uint, 0);
 MODULE_PARM_DESC(hci_muxed, "Tell if transport is muxed in HCI one.");
 
-module_param(reset_n_io, uint, 0);
+module_param(reset_n_io, int, 0);
 MODULE_PARM_DESC(reset_n_io, "GPIO that is wired to RESET_N signal.");
diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index 945cc903d8f1..888e298f610b 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -305,6 +305,7 @@ static int nfcmrvl_probe(struct usb_interface *intf,
 
         /* No configuration for USB */
         memset(&config, 0, sizeof(config));
+        config.reset_n_io = -EINVAL;
 
         nfc_info(&udev->dev, "intf %p id %p\n", intf, id);
 
diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
index c3e10b6ab3a4..f25f1ec5f9e9 100644
--- a/drivers/nfc/st-nci/se.c
+++ b/drivers/nfc/st-nci/se.c
@@ -333,6 +333,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
 
                 transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
                                             skb->len - 2, GFP_KERNEL);
+                if (!transaction)
+                        return -ENOMEM;
 
                 transaction->aid_len = skb->data[1];
                 memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
index 06fc542fd198..6586378cacb0 100644
--- a/drivers/nfc/st21nfca/se.c
+++ b/drivers/nfc/st21nfca/se.c
@@ -317,6 +317,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
 
                 transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
                                                    skb->len - 2, GFP_KERNEL);
+                if (!transaction)
+                        return -ENOMEM;
 
                 transaction->aid_len = skb->data[1];
                 memcpy(transaction->aid, &skb->data[2],
diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
index 62d00fffa4af..3508a79110c7 100644
--- a/drivers/nvdimm/btt_devs.c
+++ b/drivers/nvdimm/btt_devs.c
@@ -62,14 +62,14 @@ static ssize_t sector_size_store(struct device *dev,
         struct nd_btt *nd_btt = to_nd_btt(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         rc = nd_size_select_store(dev, buf, &nd_btt->lbasize,
                         btt_lbasize_supported);
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -91,11 +91,11 @@ static ssize_t uuid_store(struct device *dev,
         struct nd_btt *nd_btt = to_nd_btt(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         rc = nd_uuid_store(dev, &nd_btt->uuid, buf, len);
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -120,13 +120,13 @@ static ssize_t namespace_store(struct device *dev,
         struct nd_btt *nd_btt = to_nd_btt(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         rc = nd_namespace_store(dev, &nd_btt->ndns, buf, len);
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -138,14 +138,14 @@ static ssize_t size_show(struct device *dev,
         struct nd_btt *nd_btt = to_nd_btt(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         if (dev->driver)
                 rc = sprintf(buf, "%llu\n", nd_btt->size);
         else {
                 /* no size to convey if the btt instance is disabled */
                 rc = -ENXIO;
         }
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 2dca3034fee0..798c5c4aea9c 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -26,7 +26,7 @@
 
 int nvdimm_major;
 static int nvdimm_bus_major;
-static struct class *nd_class;
+struct class *nd_class;
 static DEFINE_IDA(nd_ida);
 
 static int to_nd_device_type(struct device *dev)
@@ -73,7 +73,7 @@ static void nvdimm_bus_probe_end(struct nvdimm_bus *nvdimm_bus)
 {
         nvdimm_bus_lock(&nvdimm_bus->dev);
         if (--nvdimm_bus->probe_active == 0)
-                wake_up(&nvdimm_bus->probe_wait);
+                wake_up(&nvdimm_bus->wait);
         nvdimm_bus_unlock(&nvdimm_bus->dev);
 }
 
@@ -91,7 +91,10 @@ static int nvdimm_bus_probe(struct device *dev)
                         dev->driver->name, dev_name(dev));
 
         nvdimm_bus_probe_start(nvdimm_bus);
+        debug_nvdimm_lock(dev);
         rc = nd_drv->probe(dev);
+        debug_nvdimm_unlock(dev);
+
         if (rc == 0)
                 nd_region_probe_success(nvdimm_bus, dev);
         else
@@ -113,8 +116,11 @@ static int nvdimm_bus_remove(struct device *dev)
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
         int rc = 0;
 
-        if (nd_drv->remove)
+        if (nd_drv->remove) {
+                debug_nvdimm_lock(dev);
                 rc = nd_drv->remove(dev);
+                debug_nvdimm_unlock(dev);
+        }
         nd_region_disable(nvdimm_bus, dev);
 
         dev_dbg(&nvdimm_bus->dev, "%s.remove(%s) = %d\n", dev->driver->name,
@@ -140,7 +146,7 @@ static void nvdimm_bus_shutdown(struct device *dev)
 
 void nd_device_notify(struct device *dev, enum nvdimm_event event)
 {
-        device_lock(dev);
+        nd_device_lock(dev);
         if (dev->driver) {
                 struct nd_device_driver *nd_drv;
 
@@ -148,7 +154,7 @@ void nd_device_notify(struct device *dev, enum nvdimm_event event)
                 if (nd_drv->notify)
                         nd_drv->notify(dev, event);
         }
-        device_unlock(dev);
+        nd_device_unlock(dev);
 }
 EXPORT_SYMBOL(nd_device_notify);
 
@@ -296,7 +302,7 @@ static void nvdimm_bus_release(struct device *dev)
         kfree(nvdimm_bus);
 }
 
-static bool is_nvdimm_bus(struct device *dev)
+bool is_nvdimm_bus(struct device *dev)
 {
         return dev->release == nvdimm_bus_release;
 }
@@ -341,7 +347,7 @@ struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
                 return NULL;
         INIT_LIST_HEAD(&nvdimm_bus->list);
         INIT_LIST_HEAD(&nvdimm_bus->mapping_list);
-        init_waitqueue_head(&nvdimm_bus->probe_wait);
+        init_waitqueue_head(&nvdimm_bus->wait);
         nvdimm_bus->id = ida_simple_get(&nd_ida, 0, 0, GFP_KERNEL);
         if (nvdimm_bus->id < 0) {
                 kfree(nvdimm_bus);
@@ -426,6 +432,9 @@ static int nd_bus_remove(struct device *dev)
         list_del_init(&nvdimm_bus->list);
         mutex_unlock(&nvdimm_bus_list_mutex);
 
+        wait_event(nvdimm_bus->wait,
+                        atomic_read(&nvdimm_bus->ioctl_active) == 0);
+
         nd_synchronize();
         device_for_each_child(&nvdimm_bus->dev, NULL, child_unregister);
 
@@ -547,13 +556,38 @@ EXPORT_SYMBOL(nd_device_register);
 
 void nd_device_unregister(struct device *dev, enum nd_async_mode mode)
 {
+        bool killed;
+
         switch (mode) {
         case ND_ASYNC:
+                /*
+                 * In the async case this is being triggered with the
+                 * device lock held and the unregistration work needs to
+                 * be moved out of line iff this is thread has won the
+                 * race to schedule the deletion.
+                 */
+                if (!kill_device(dev))
+                        return;
+
                 get_device(dev);
                 async_schedule_domain(nd_async_device_unregister, dev,
                                 &nd_async_domain);
                 break;
         case ND_SYNC:
+                /*
+                 * In the sync case the device is being unregistered due
+                 * to a state change of the parent. Claim the kill state
+                 * to synchronize against other unregistration requests,
+                 * or otherwise let the async path handle it if the
+                 * unregistration was already queued.
+                 */
+                nd_device_lock(dev);
+                killed = kill_device(dev);
+                nd_device_unlock(dev);
+
+                if (!killed)
+                        return;
+
                 nd_synchronize();
                 device_unregister(dev);
                 break;
@@ -859,10 +893,12 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
         do {
                 if (nvdimm_bus->probe_active == 0)
                         break;
-                nvdimm_bus_unlock(&nvdimm_bus->dev);
-                wait_event(nvdimm_bus->probe_wait,
+                nvdimm_bus_unlock(dev);
+                nd_device_unlock(dev);
+                wait_event(nvdimm_bus->wait,
                                 nvdimm_bus->probe_active == 0);
-                nvdimm_bus_lock(&nvdimm_bus->dev);
+                nd_device_lock(dev);
+                nvdimm_bus_lock(dev);
         } while (true);
 }
 
@@ -945,20 +981,19 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 int read_only, unsigned int ioctl_cmd, unsigned long arg)
 {
         struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
-        static char out_env[ND_CMD_MAX_ENVELOPE];
-        static char in_env[ND_CMD_MAX_ENVELOPE];
         const struct nd_cmd_desc *desc = NULL;
         unsigned int cmd = _IOC_NR(ioctl_cmd);
         struct device *dev = &nvdimm_bus->dev;
         void __user *p = (void __user *) arg;
+        char *out_env = NULL, *in_env = NULL;
         const char *cmd_name, *dimm_name;
         u32 in_len = 0, out_len = 0;
         unsigned int func = cmd;
         unsigned long cmd_mask;
         struct nd_cmd_pkg pkg;
         int rc, i, cmd_rc;
+        void *buf = NULL;
         u64 buf_len = 0;
-        void *buf;
 
         if (nvdimm) {
                 desc = nd_cmd_dimm_desc(cmd);
@@ -989,7 +1024,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 case ND_CMD_ARS_START:
                 case ND_CMD_CLEAR_ERROR:
                 case ND_CMD_CALL:
-                        dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
+                        dev_dbg(dev, "'%s' command while read-only.\n",
                                         nvdimm ? nvdimm_cmd_name(cmd)
                                         : nvdimm_bus_cmd_name(cmd));
                         return -EPERM;
@@ -998,6 +1033,9 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 }
 
         /* process an input envelope */
+        in_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
+        if (!in_env)
+                return -ENOMEM;
         for (i = 0; i < desc->in_num; i++) {
                 u32 in_size, copy;
 
@@ -1005,14 +1043,17 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 if (in_size == UINT_MAX) {
                         dev_err(dev, "%s:%s unknown input size cmd: %s field: %d\n",
                                         __func__, dimm_name, cmd_name, i);
-                        return -ENXIO;
+                        rc = -ENXIO;
+                        goto out;
                 }
-                if (in_len < sizeof(in_env))
-                        copy = min_t(u32, sizeof(in_env) - in_len, in_size);
+                if (in_len < ND_CMD_MAX_ENVELOPE)
+                        copy = min_t(u32, ND_CMD_MAX_ENVELOPE - in_len, in_size);
                 else
                         copy = 0;
-                if (copy && copy_from_user(&in_env[in_len], p + in_len, copy))
-                        return -EFAULT;
+                if (copy && copy_from_user(&in_env[in_len], p + in_len, copy)) {
+                        rc = -EFAULT;
+                        goto out;
+                }
                 in_len += in_size;
         }
 
@@ -1024,6 +1065,12 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         }
 
         /* process an output envelope */
+        out_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
+        if (!out_env) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
         for (i = 0; i < desc->out_num; i++) {
                 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
                                 (u32 *) in_env, (u32 *) out_env, 0);
@@ -1032,15 +1079,18 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 if (out_size == UINT_MAX) {
                         dev_dbg(dev, "%s unknown output size cmd: %s field: %d\n",
                                         dimm_name, cmd_name, i);
-                        return -EFAULT;
+                        rc = -EFAULT;
+                        goto out;
                 }
-                if (out_len < sizeof(out_env))
-                        copy = min_t(u32, sizeof(out_env) - out_len, out_size);
+                if (out_len < ND_CMD_MAX_ENVELOPE)
+                        copy = min_t(u32, ND_CMD_MAX_ENVELOPE - out_len, out_size);
                 else
                         copy = 0;
                 if (copy && copy_from_user(&out_env[out_len],
-                                        p + in_len + out_len, copy))
-                        return -EFAULT;
+                                        p + in_len + out_len, copy)) {
+                        rc = -EFAULT;
+                        goto out;
+                }
                 out_len += out_size;
         }
 
@@ -1048,19 +1098,23 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         if (buf_len > ND_IOCTL_MAX_BUFLEN) {
                 dev_dbg(dev, "%s cmd: %s buf_len: %llu > %d\n", dimm_name,
                                 cmd_name, buf_len, ND_IOCTL_MAX_BUFLEN);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         }
 
         buf = vmalloc(buf_len);
-        if (!buf)
-                return -ENOMEM;
+        if (!buf) {
+                rc = -ENOMEM;
+                goto out;
+        }
 
         if (copy_from_user(buf, p, buf_len)) {
                 rc = -EFAULT;
                 goto out;
         }
 
-        nvdimm_bus_lock(&nvdimm_bus->dev);
+        nd_device_lock(dev);
+        nvdimm_bus_lock(dev);
         rc = nd_cmd_clear_to_send(nvdimm_bus, nvdimm, func, buf);
         if (rc)
                 goto out_unlock;
@@ -1075,39 +1129,24 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                 nvdimm_account_cleared_poison(nvdimm_bus, clear_err->address,
                                 clear_err->cleared);
         }
-        nvdimm_bus_unlock(&nvdimm_bus->dev);
 
         if (copy_to_user(p, buf, buf_len))
                 rc = -EFAULT;
 
-        vfree(buf);
-        return rc;
-
- out_unlock:
-        nvdimm_bus_unlock(&nvdimm_bus->dev);
- out:
+out_unlock:
+        nvdimm_bus_unlock(dev);
+        nd_device_unlock(dev);
+out:
+        kfree(in_env);
+        kfree(out_env);
         vfree(buf);
         return rc;
 }
 
-static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-{
-        long id = (long) file->private_data;
-        int rc = -ENXIO, ro;
-        struct nvdimm_bus *nvdimm_bus;
-
-        ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
-        mutex_lock(&nvdimm_bus_list_mutex);
-        list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
-                if (nvdimm_bus->id == id) {
-                        rc = __nd_ioctl(nvdimm_bus, NULL, ro, cmd, arg);
-                        break;
-                }
-        }
-        mutex_unlock(&nvdimm_bus_list_mutex);
-
-        return rc;
-}
+enum nd_ioctl_mode {
+        BUS_IOCTL,
+        DIMM_IOCTL,
+};
 
 static int match_dimm(struct device *dev, void *data)
 {
@@ -1122,31 +1161,62 @@ static int match_dimm(struct device *dev, void *data)
         return 0;
 }
 
-static long nvdimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
+                enum nd_ioctl_mode mode)
+
 {
-        int rc = -ENXIO, ro;
-        struct nvdimm_bus *nvdimm_bus;
+        struct nvdimm_bus *nvdimm_bus, *found = NULL;
+        long id = (long) file->private_data;
+        struct nvdimm *nvdimm = NULL;
+        int rc, ro;
 
         ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
         mutex_lock(&nvdimm_bus_list_mutex);
         list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
-                struct device *dev = device_find_child(&nvdimm_bus->dev,
-                                file->private_data, match_dimm);
-                struct nvdimm *nvdimm;
-
-                if (!dev)
-                        continue;
+                if (mode == DIMM_IOCTL) {
+                        struct device *dev;
+
+                        dev = device_find_child(&nvdimm_bus->dev,
+                                        file->private_data, match_dimm);
+                        if (!dev)
+                                continue;
+                        nvdimm = to_nvdimm(dev);
+                        found = nvdimm_bus;
+                } else if (nvdimm_bus->id == id) {
+                        found = nvdimm_bus;
+                }
 
-                nvdimm = to_nvdimm(dev);
-                rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
-                put_device(dev);
-                break;
+                if (found) {
+                        atomic_inc(&nvdimm_bus->ioctl_active);
+                        break;
+                }
         }
         mutex_unlock(&nvdimm_bus_list_mutex);
 
+        if (!found)
+                return -ENXIO;
+
+        nvdimm_bus = found;
+        rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
+
+        if (nvdimm)
+                put_device(&nvdimm->dev);
+        if (atomic_dec_and_test(&nvdimm_bus->ioctl_active))
+                wake_up(&nvdimm_bus->wait);
+
         return rc;
 }
 
+static long bus_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return nd_ioctl(file, cmd, arg, BUS_IOCTL);
+}
+
+static long dimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return nd_ioctl(file, cmd, arg, DIMM_IOCTL);
+}
+
 static int nd_open(struct inode *inode, struct file *file)
 {
         long minor = iminor(inode);
@@ -1158,16 +1228,16 @@ static int nd_open(struct inode *inode, struct file *file)
 static const struct file_operations nvdimm_bus_fops = {
         .owner = THIS_MODULE,
         .open = nd_open,
-        .unlocked_ioctl = nd_ioctl,
-        .compat_ioctl = nd_ioctl,
+        .unlocked_ioctl = bus_ioctl,
+        .compat_ioctl = bus_ioctl,
         .llseek = noop_llseek,
 };
 
 static const struct file_operations nvdimm_fops = {
         .owner = THIS_MODULE,
         .open = nd_open,
-        .unlocked_ioctl = nvdimm_ioctl,
-        .compat_ioctl = nvdimm_ioctl,
+        .unlocked_ioctl = dimm_ioctl,
+        .compat_ioctl = dimm_ioctl,
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/nvdimm/core.c b/drivers/nvdimm/core.c
index 5e1f060547bf..9204f1e9fd14 100644
--- a/drivers/nvdimm/core.c
+++ b/drivers/nvdimm/core.c
@@ -246,7 +246,7 @@ static int nd_uuid_parse(struct device *dev, u8 *uuid_out, const char *buf,
  *
  * Enforce that uuids can only be changed while the device is disabled
  * (driver detached)
- * LOCKING: expects device_lock() is held on entry
+ * LOCKING: expects nd_device_lock() is held on entry
  */
 int nd_uuid_store(struct device *dev, u8 **uuid_out, const char *buf,
                 size_t len)
@@ -347,15 +347,15 @@ static DEVICE_ATTR_RO(provider);
 
 static int flush_namespaces(struct device *dev, void *data)
 {
-        device_lock(dev);
-        device_unlock(dev);
+        nd_device_lock(dev);
+        nd_device_unlock(dev);
         return 0;
 }
 
 static int flush_regions_dimms(struct device *dev, void *data)
 {
-        device_lock(dev);
-        device_unlock(dev);
+        nd_device_lock(dev);
+        nd_device_unlock(dev);
         device_for_each_child(dev, NULL, flush_namespaces);
         return 0;
 }
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index dfecd6e17043..29a065e769ea 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -484,12 +484,12 @@ static ssize_t security_store(struct device *dev,
          * done while probing is idle and the DIMM is not in active use
          * in any region.
          */
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         rc = __security_store(dev, buf, len);
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 2d8d7e554877..a16e52251a30 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -410,7 +410,7 @@ static ssize_t alt_name_store(struct device *dev,
         struct nd_region *nd_region = to_nd_region(dev->parent);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         rc = __alt_name_store(dev, buf, len);
@@ -418,7 +418,7 @@ static ssize_t alt_name_store(struct device *dev,
                 rc = nd_namespace_label_update(nd_region, dev);
         dev_dbg(dev, "%s(%zd)\n", rc < 0 ? "fail " : "", rc);
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc < 0 ? rc : len;
 }
@@ -1077,7 +1077,7 @@ static ssize_t size_store(struct device *dev,
         if (rc)
                 return rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         rc = __size_store(dev, val);
@@ -1103,7 +1103,7 @@ static ssize_t size_store(struct device *dev,
         dev_dbg(dev, "%llx %s (%d)\n", val, rc < 0 ? "fail" : "success", rc);
 
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc < 0 ? rc : len;
 }
@@ -1286,7 +1286,7 @@ static ssize_t uuid_store(struct device *dev,
         } else
                 return -ENXIO;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         if (to_ndns(dev)->claim)
@@ -1302,7 +1302,7 @@ static ssize_t uuid_store(struct device *dev,
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc < 0 ? rc : len;
 }
@@ -1376,7 +1376,7 @@ static ssize_t sector_size_store(struct device *dev,
         } else
                 return -ENXIO;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         if (to_ndns(dev)->claim)
                 rc = -EBUSY;
@@ -1387,7 +1387,7 @@ static ssize_t sector_size_store(struct device *dev,
         dev_dbg(dev, "result: %zd %s: %s%s", rc, rc < 0 ? "tried" : "wrote",
                         buf, buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -1502,9 +1502,9 @@ static ssize_t holder_show(struct device *dev,
         struct nd_namespace_common *ndns = to_ndns(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         rc = sprintf(buf, "%s\n", ndns->claim ? dev_name(ndns->claim) : "");
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -1541,7 +1541,7 @@ static ssize_t holder_class_store(struct device *dev,
         struct nd_region *nd_region = to_nd_region(dev->parent);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         rc = __holder_class_store(dev, buf);
@@ -1549,7 +1549,7 @@ static ssize_t holder_class_store(struct device *dev,
                 rc = nd_namespace_label_update(nd_region, dev);
         dev_dbg(dev, "%s(%zd)\n", rc < 0 ? "fail " : "", rc);
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc < 0 ? rc : len;
 }
@@ -1560,7 +1560,7 @@ static ssize_t holder_class_show(struct device *dev,
         struct nd_namespace_common *ndns = to_ndns(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         if (ndns->claim_class == NVDIMM_CCLASS_NONE)
                 rc = sprintf(buf, "\n");
         else if ((ndns->claim_class == NVDIMM_CCLASS_BTT) ||
@@ -1572,7 +1572,7 @@ static ssize_t holder_class_show(struct device *dev,
                 rc = sprintf(buf, "dax\n");
         else
                 rc = sprintf(buf, "<unknown>\n");
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -1586,7 +1586,7 @@ static ssize_t mode_show(struct device *dev,
         char *mode;
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         claim = ndns->claim;
         if (claim && is_nd_btt(claim))
                 mode = "safe";
@@ -1599,7 +1599,7 @@ static ssize_t mode_show(struct device *dev,
         else
                 mode = "raw";
         rc = sprintf(buf, "%s\n", mode);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -1703,8 +1703,8 @@ struct nd_namespace_common *nvdimm_namespace_common_probe(struct device *dev)
                  * Flush any in-progess probes / removals in the driver
                  * for the raw personality of this namespace.
                  */
-                device_lock(&ndns->dev);
-                device_unlock(&ndns->dev);
+                nd_device_lock(&ndns->dev);
+                nd_device_unlock(&ndns->dev);
                 if (ndns->dev.driver) {
                         dev_dbg(&ndns->dev, "is active, can't bind %s\n",
                                         dev_name(dev));
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 391e88de3a29..0ac52b6eb00e 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -9,6 +9,7 @@
 #include <linux/sizes.h>
 #include <linux/mutex.h>
 #include <linux/nd.h>
+#include "nd.h"
 
 extern struct list_head nvdimm_bus_list;
 extern struct mutex nvdimm_bus_list_mutex;
@@ -17,10 +18,11 @@ extern struct workqueue_struct *nvdimm_wq;
 
 struct nvdimm_bus {
         struct nvdimm_bus_descriptor *nd_desc;
-        wait_queue_head_t probe_wait;
+        wait_queue_head_t wait;
         struct list_head list;
         struct device dev;
         int id, probe_active;
+        atomic_t ioctl_active;
         struct list_head mapping_list;
         struct mutex reconfig_mutex;
         struct badrange badrange;
@@ -181,4 +183,71 @@ ssize_t nd_namespace_store(struct device *dev,
                 struct nd_namespace_common **_ndns, const char *buf,
                 size_t len);
 struct nd_pfn *to_nd_pfn_safe(struct device *dev);
+bool is_nvdimm_bus(struct device *dev);
+
+#ifdef CONFIG_PROVE_LOCKING
+extern struct class *nd_class;
+
+enum {
+        LOCK_BUS,
+        LOCK_NDCTL,
+        LOCK_REGION,
+        LOCK_DIMM = LOCK_REGION,
+        LOCK_NAMESPACE,
+        LOCK_CLAIM,
+};
+
+static inline void debug_nvdimm_lock(struct device *dev)
+{
+        if (is_nd_region(dev))
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_REGION);
+        else if (is_nvdimm(dev))
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_DIMM);
+        else if (is_nd_btt(dev) || is_nd_pfn(dev) || is_nd_dax(dev))
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_CLAIM);
+        else if (dev->parent && (is_nd_region(dev->parent)))
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_NAMESPACE);
+        else if (is_nvdimm_bus(dev))
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_BUS);
+        else if (dev->class && dev->class == nd_class)
+                mutex_lock_nested(&dev->lockdep_mutex, LOCK_NDCTL);
+        else
+                dev_WARN(dev, "unknown lock level\n");
+}
+
+static inline void debug_nvdimm_unlock(struct device *dev)
+{
+        mutex_unlock(&dev->lockdep_mutex);
+}
+
+static inline void nd_device_lock(struct device *dev)
+{
+        device_lock(dev);
+        debug_nvdimm_lock(dev);
+}
+
+static inline void nd_device_unlock(struct device *dev)
+{
+        debug_nvdimm_unlock(dev);
+        device_unlock(dev);
+}
+#else
+static inline void nd_device_lock(struct device *dev)
+{
+        device_lock(dev);
+}
+
+static inline void nd_device_unlock(struct device *dev)
+{
+        device_unlock(dev);
+}
+
+static inline void debug_nvdimm_lock(struct device *dev)
+{
+}
+
+static inline void debug_nvdimm_unlock(struct device *dev)
+{
+}
+#endif
 #endif /* __ND_CORE_H__ */
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index df2bdbd22450..3e7b11cf1aae 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -67,7 +67,7 @@ static ssize_t mode_store(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc = 0;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         if (dev->driver)
                 rc = -EBUSY;
@@ -89,7 +89,7 @@ static ssize_t mode_store(struct device *dev,
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -132,14 +132,14 @@ static ssize_t align_store(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         rc = nd_size_select_store(dev, buf, &nd_pfn->align,
                         nd_pfn_supported_alignments());
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -161,11 +161,11 @@ static ssize_t uuid_store(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         rc = nd_uuid_store(dev, &nd_pfn->uuid, buf, len);
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc ? rc : len;
 }
@@ -190,13 +190,13 @@ static ssize_t namespace_store(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         rc = nd_namespace_store(dev, &nd_pfn->ndns, buf, len);
         dev_dbg(dev, "result: %zd wrote: %s%s", rc, buf,
                         buf[len - 1] == '\n' ? "" : "\n");
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -208,7 +208,7 @@ static ssize_t resource_show(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         if (dev->driver) {
                 struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
                 u64 offset = __le64_to_cpu(pfn_sb->dataoff);
@@ -222,7 +222,7 @@ static ssize_t resource_show(struct device *dev,
                 /* no address to convey if the pfn instance is disabled */
                 rc = -ENXIO;
         }
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
@@ -234,7 +234,7 @@ static ssize_t size_show(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         if (dev->driver) {
                 struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
                 u64 offset = __le64_to_cpu(pfn_sb->dataoff);
@@ -250,7 +250,7 @@ static ssize_t size_show(struct device *dev,
                 /* no size to convey if the pfn instance is disabled */
                 rc = -ENXIO;
         }
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 2bf3acd69613..4c121dd03dd9 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -522,8 +522,8 @@ static int nd_pmem_remove(struct device *dev)
                 nvdimm_namespace_detach_btt(to_nd_btt(dev));
         else {
                 /*
-                 * Note, this assumes device_lock() context to not race
-                 * nd_pmem_notify()
+                 * Note, this assumes nd_device_lock() context to not
+                 * race nd_pmem_notify()
                  */
                 sysfs_put(pmem->bb_state);
                 pmem->bb_state = NULL;
diff --git a/drivers/nvdimm/region.c b/drivers/nvdimm/region.c
index ef46cc3a71ae..37bf8719a2a4 100644
--- a/drivers/nvdimm/region.c
+++ b/drivers/nvdimm/region.c
@@ -34,17 +34,6 @@ static int nd_region_probe(struct device *dev)
         if (rc)
                 return rc;
 
-        rc = nd_region_register_namespaces(nd_region, &err);
-        if (rc < 0)
-                return rc;
-
-        ndrd = dev_get_drvdata(dev);
-        ndrd->ns_active = rc;
-        ndrd->ns_count = rc + err;
-
-        if (rc && err && rc == err)
-                return -ENODEV;
-
         if (is_nd_pmem(&nd_region->dev)) {
                 struct resource ndr_res;
 
@@ -60,6 +49,17 @@ static int nd_region_probe(struct device *dev)
                 nvdimm_badblocks_populate(nd_region, &nd_region->bb, &ndr_res);
         }
 
+        rc = nd_region_register_namespaces(nd_region, &err);
+        if (rc < 0)
+                return rc;
+
+        ndrd = dev_get_drvdata(dev);
+        ndrd->ns_active = rc;
+        ndrd->ns_count = rc + err;
+
+        if (rc && err && rc == err)
+                return -ENODEV;
+
         nd_region->btt_seed = nd_btt_create(nd_region);
         nd_region->pfn_seed = nd_pfn_create(nd_region);
         nd_region->dax_seed = nd_dax_create(nd_region);
@@ -102,7 +102,7 @@ static int nd_region_remove(struct device *dev)
         nvdimm_bus_unlock(dev);
 
         /*
-         * Note, this assumes device_lock() context to not race
+         * Note, this assumes nd_device_lock() context to not race
          * nd_region_notify()
          */
         sysfs_put(nd_region->bb_state);
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index 56f2227f192a..af30cbe7a8ea 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -331,7 +331,7 @@ static ssize_t set_cookie_show(struct device *dev,
          * the v1.1 namespace label cookie definition. To read all this
          * data we need to wait for probing to settle.
          */
-        device_lock(dev);
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         if (nd_region->ndr_mappings) {
@@ -348,7 +348,7 @@ static ssize_t set_cookie_show(struct device *dev,
                 }
         }
         nvdimm_bus_unlock(dev);
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         if (rc)
                 return rc;
@@ -424,10 +424,12 @@ static ssize_t available_size_show(struct device *dev,
          * memory nvdimm_bus_lock() is dropped, but that's userspace's
          * problem to not race itself.
          */
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         available = nd_region_available_dpa(nd_region);
         nvdimm_bus_unlock(dev);
+        nd_device_unlock(dev);
 
         return sprintf(buf, "%llu\n", available);
 }
@@ -439,10 +441,12 @@ static ssize_t max_available_extent_show(struct device *dev,
         struct nd_region *nd_region = to_nd_region(dev);
         unsigned long long available = 0;
 
+        nd_device_lock(dev);
         nvdimm_bus_lock(dev);
         wait_nvdimm_bus_probe_idle(dev);
         available = nd_region_allocatable_dpa(nd_region);
         nvdimm_bus_unlock(dev);
+        nd_device_unlock(dev);
 
         return sprintf(buf, "%llu\n", available);
 }
@@ -561,12 +565,12 @@ static ssize_t region_badblocks_show(struct device *dev,
         struct nd_region *nd_region = to_nd_region(dev);
         ssize_t rc;
 
-        device_lock(dev);
+        nd_device_lock(dev);
         if (dev->driver)
                 rc = badblocks_show(&nd_region->bb, buf, 0);
         else
                 rc = -ENXIO;
-        device_unlock(dev);
+        nd_device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index cc09b81fc7f4..8f3fbe5ca937 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2311,17 +2311,15 @@ static void nvme_init_subnqn(struct nvme_subsystem *subsys, struct nvme_ctrl *ct
         memset(subsys->subnqn + off, 0, sizeof(subsys->subnqn) - off);
 }
 
-static void __nvme_release_subsystem(struct nvme_subsystem *subsys)
+static void nvme_release_subsystem(struct device *dev)
 {
+        struct nvme_subsystem *subsys =
+                container_of(dev, struct nvme_subsystem, dev);
+
         ida_simple_remove(&nvme_subsystems_ida, subsys->instance);
         kfree(subsys);
 }
 
-static void nvme_release_subsystem(struct device *dev)
-{
-        __nvme_release_subsystem(container_of(dev, struct nvme_subsystem, dev));
-}
-
 static void nvme_destroy_subsystem(struct kref *ref)
 {
         struct nvme_subsystem *subsys =
@@ -2477,7 +2475,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
         mutex_lock(&nvme_subsystems_lock);
         found = __nvme_find_get_subsystem(subsys->subnqn);
         if (found) {
-                __nvme_release_subsystem(subsys);
+                put_device(&subsys->dev);
                 subsys = found;
 
                 if (!nvme_validate_cntlid(subsys, ctrl, id)) {
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index a9a927677970..4f0d0d12744e 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -12,11 +12,6 @@ module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
         "turn on native support for multiple controllers per subsystem");
 
-inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
-{
-        return multipath && ctrl->subsys && (ctrl->subsys->cmic & (1 << 3));
-}
-
 /*
  * If multipathing is enabled we need to always use the subsystem instance
  * number for numbering our devices to avoid conflicts between subsystems that
@@ -622,7 +617,8 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
 {
         int error;
 
-        if (!nvme_ctrl_use_ana(ctrl))
+        /* check if multipath is enabled and we have the capability */
+        if (!multipath || !ctrl->subsys || !(ctrl->subsys->cmic & (1 << 3)))
                 return 0;
 
         ctrl->anacap = id->anacap;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 716a876119c8..26b563f9985b 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -485,7 +485,11 @@ extern const struct attribute_group *nvme_ns_id_attr_groups[];
 extern const struct block_device_operations nvme_ns_head_ops;
 
 #ifdef CONFIG_NVME_MULTIPATH
-bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl);
+static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
+{
+        return ctrl->ana_log_buf != NULL;
+}
+
 void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
                         struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index bb970ca82517..db160cee42ad 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2254,9 +2254,7 @@ static int nvme_dev_add(struct nvme_dev *dev)
         if (!dev->ctrl.tagset) {
                 dev->tagset.ops = &nvme_mq_ops;
                 dev->tagset.nr_hw_queues = dev->online_queues - 1;
-                dev->tagset.nr_maps = 1; /* default */
-                if (dev->io_queues[HCTX_TYPE_READ])
-                        dev->tagset.nr_maps++;
+                dev->tagset.nr_maps = 2; /* default + read */
                 if (dev->io_queues[HCTX_TYPE_POLL])
                         dev->tagset.nr_maps++;
                 dev->tagset.timeout = NVME_IO_TIMEOUT;
@@ -3029,6 +3027,8 @@ static const struct pci_device_id nvme_id_table[] = {
                 .driver_data = NVME_QUIRK_LIGHTNVM, },
         { PCI_DEVICE(0x1d1d, 0x2601),   /* CNEX Granby */
                 .driver_data = NVME_QUIRK_LIGHTNVM, },
+        { PCI_DEVICE(0x10ec, 0x5762),   /* ADATA SX6000LNP */
+                .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
         { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
         { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
         { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 2d06b8095a19..df352b334ea7 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -723,8 +723,8 @@ static int cpu_pm_pmu_notify(struct notifier_block *b, unsigned long cmd,
                 cpu_pm_pmu_setup(armpmu, cmd);
                 break;
         case CPU_PM_EXIT:
-                cpu_pm_pmu_setup(armpmu, cmd);
         case CPU_PM_ENTER_FAILED:
+                cpu_pm_pmu_setup(armpmu, cmd);
                 armpmu->start(armpmu);
                 break;
         default:
diff --git a/drivers/platform/olpc/olpc-xo175-ec.c b/drivers/platform/olpc/olpc-xo175-ec.c
index 48d6f0d87583..83ed1fbf73cf 100644
--- a/drivers/platform/olpc/olpc-xo175-ec.c
+++ b/drivers/platform/olpc/olpc-xo175-ec.c
@@ -736,6 +736,12 @@ static const struct of_device_id olpc_xo175_ec_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, olpc_xo175_ec_of_match);
 
+static const struct spi_device_id olpc_xo175_ec_id_table[] = {
+        { "xo1.75-ec", 0 },
+        {}
+};
+MODULE_DEVICE_TABLE(spi, olpc_xo175_ec_id_table);
+
 static struct spi_driver olpc_xo175_ec_spi_driver = {
         .driver = {
                 .name   = "olpc-xo175-ec",
diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c
index 235c0b89f824..c510d0d72475 100644
--- a/drivers/platform/x86/intel_pmc_core.c
+++ b/drivers/platform/x86/intel_pmc_core.c
@@ -812,6 +812,7 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = {
         INTEL_CPU_FAM6(KABYLAKE_DESKTOP, spt_reg_map),
         INTEL_CPU_FAM6(CANNONLAKE_MOBILE, cnp_reg_map),
         INTEL_CPU_FAM6(ICELAKE_MOBILE, icl_reg_map),
+        INTEL_CPU_FAM6(ICELAKE_NNPI, icl_reg_map),
         {}
 };
 
diff --git a/drivers/platform/x86/pcengines-apuv2.c b/drivers/platform/x86/pcengines-apuv2.c
index b0d3110ae378..e4c68efac0c2 100644
--- a/drivers/platform/x86/pcengines-apuv2.c
+++ b/drivers/platform/x86/pcengines-apuv2.c
@@ -93,7 +93,7 @@ static struct gpiod_lookup_table gpios_led_table = {
 
 static struct gpio_keys_button apu2_keys_buttons[] = {
         {
-                .code                   = KEY_SETUP,
+                .code                   = KEY_RESTART,
                 .active_low             = 1,
                 .desc                   = "front button",
                 .type                   = EV_KEY,
@@ -255,6 +255,4 @@ MODULE_DESCRIPTION("PC Engines APUv2/APUv3 board GPIO/LED/keys driver");
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(dmi, apu_gpio_dmi_table);
 MODULE_ALIAS("platform:pcengines-apuv2");
-MODULE_SOFTDEP("pre: platform:" AMD_FCH_GPIO_DRIVER_NAME);
-MODULE_SOFTDEP("pre: platform:leds-gpio");
-MODULE_SOFTDEP("pre: platform:gpio_keys_polled");
+MODULE_SOFTDEP("pre: platform:" AMD_FCH_GPIO_DRIVER_NAME " platform:leds-gpio platform:gpio_keys_polled");
diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c
index 9fd6dd342169..6df481896b5f 100644
--- a/drivers/powercap/intel_rapl_common.c
+++ b/drivers/powercap/intel_rapl_common.c
@@ -1454,7 +1454,7 @@ static void __exit rapl_exit(void)
         unregister_pm_notifier(&rapl_pm_notifier);
 }
 
-module_init(rapl_init);
+fs_initcall(rapl_init);
 module_exit(rapl_exit);
 
 MODULE_DESCRIPTION("Intel Runtime Average Power Limit (RAPL) common code");
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 540e8aafc990..f808c5fa9838 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -671,7 +671,7 @@ static int __init powercap_init(void)
         return class_register(&powercap_class);
 }
 
-device_initcall(powercap_init);
+fs_initcall(powercap_init);
 
 MODULE_DESCRIPTION("PowerCap sysfs Driver");
 MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index 152053361862..989506bd90b1 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -174,14 +174,14 @@
 #define AXP803_DCDC5_1140mV_STEPS       35
 #define AXP803_DCDC5_1140mV_END         \
         (AXP803_DCDC5_1140mV_START + AXP803_DCDC5_1140mV_STEPS)
-#define AXP803_DCDC5_NUM_VOLTAGES       68
+#define AXP803_DCDC5_NUM_VOLTAGES       69
 
 #define AXP803_DCDC6_600mV_START        0x00
 #define AXP803_DCDC6_600mV_STEPS        50
 #define AXP803_DCDC6_600mV_END          \
         (AXP803_DCDC6_600mV_START + AXP803_DCDC6_600mV_STEPS)
 #define AXP803_DCDC6_1120mV_START       0x33
-#define AXP803_DCDC6_1120mV_STEPS       14
+#define AXP803_DCDC6_1120mV_STEPS       20
 #define AXP803_DCDC6_1120mV_END         \
         (AXP803_DCDC6_1120mV_START + AXP803_DCDC6_1120mV_STEPS)
 #define AXP803_DCDC6_NUM_VOLTAGES       72
@@ -240,7 +240,7 @@
 #define AXP806_DCDCA_600mV_END          \
         (AXP806_DCDCA_600mV_START + AXP806_DCDCA_600mV_STEPS)
 #define AXP806_DCDCA_1120mV_START       0x33
-#define AXP806_DCDCA_1120mV_STEPS       14
+#define AXP806_DCDCA_1120mV_STEPS       20
 #define AXP806_DCDCA_1120mV_END         \
         (AXP806_DCDCA_1120mV_START + AXP806_DCDCA_1120mV_STEPS)
 #define AXP806_DCDCA_NUM_VOLTAGES       72
@@ -774,8 +774,8 @@ static const struct regulator_linear_range axp806_dcdcd_ranges[] = {
                                AXP806_DCDCD_600mV_END,
                                20000),
         REGULATOR_LINEAR_RANGE(1600000,
-                               AXP806_DCDCD_600mV_START,
-                               AXP806_DCDCD_600mV_END,
+                               AXP806_DCDCD_1600mV_START,
+                               AXP806_DCDCD_1600mV_END,
                                100000),
 };
 
diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
index 5d067f7c2116..0c440c5e2832 100644
--- a/drivers/regulator/lp87565-regulator.c
+++ b/drivers/regulator/lp87565-regulator.c
@@ -163,7 +163,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
         struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
         struct regulator_config config = { };
         struct regulator_dev *rdev;
-        int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
+        int i, min_idx, max_idx;
 
         platform_set_drvdata(pdev, lp87565);
 
@@ -182,9 +182,9 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
                 max_idx = LP87565_BUCK_3210;
                 break;
         default:
-                dev_err(lp87565->dev, "Invalid lp config %d\n",
-                        lp87565->dev_type);
-                return -EINVAL;
+                min_idx = LP87565_BUCK_0;
+                max_idx = LP87565_BUCK_3;
+                break;
         }
 
         for (i = min_idx; i <= max_idx; i++) {
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 397918ebba55..9112faa6a9a0 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -416,8 +416,10 @@ device_node *regulator_of_get_init_node(struct device *dev,
                 if (!name)
                         name = child->name;
 
-                if (!strcmp(desc->of_match, name))
+                if (!strcmp(desc->of_match, name)) {
+                        of_node_put(search);
                         return of_node_get(child);
+                }
         }
 
         of_node_put(search);
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index b9ce93e9df89..99f86612f775 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -383,6 +383,20 @@ suborder_not_supported(struct dasd_ccw_req *cqr)
         char msg_format;
         char msg_no;
 
+        /*
+         * intrc values ENODEV, ENOLINK and EPERM
+         * will be optained from sleep_on to indicate that no
+         * IO operation can be started
+         */
+        if (cqr->intrc == -ENODEV)
+                return 1;
+
+        if (cqr->intrc == -ENOLINK)
+                return 1;
+
+        if (cqr->intrc == -EPERM)
+                return 1;
+
         sense = dasd_get_sense(&cqr->irb);
         if (!sense)
                 return 0;
@@ -447,12 +461,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
         lcu->flags &= ~NEED_UAC_UPDATE;
         spin_unlock_irqrestore(&lcu->lock, flags);
 
-        do {
-                rc = dasd_sleep_on(cqr);
-                if (rc && suborder_not_supported(cqr))
-                        return -EOPNOTSUPP;
-        } while (rc && (cqr->retries > 0));
-        if (rc) {
+        rc = dasd_sleep_on(cqr);
+        if (rc && !suborder_not_supported(cqr)) {
                 spin_lock_irqsave(&lcu->lock, flags);
                 lcu->flags |= NEED_UAC_UPDATE;
                 spin_unlock_irqrestore(&lcu->lock, flags);
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 8c9d412b6d33..e7cf0a1d4f71 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -398,6 +398,7 @@ static void raw3215_irq(struct ccw_device *cdev, unsigned long intparm,
                 }
                 if (dstat == 0x08)
                         break;
+                /* else, fall through */
         case 0x04:
                 /* Device end interrupt. */
                 if ((raw = req->info) == NULL)
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 8d3370da2dfc..3e0b2f63a9d2 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -677,6 +677,7 @@ tape_generic_remove(struct ccw_device *cdev)
         switch (device->tape_state) {
                 case TS_INIT:
                         tape_state_set(device, TS_NOT_OPER);
+                        /* fallthrough */
                 case TS_NOT_OPER:
                         /*
                          * Nothing to do.
@@ -949,6 +950,7 @@ __tape_start_request(struct tape_device *device, struct tape_request *request)
                                 break;
                         if (device->tape_state == TS_UNUSED)
                                 break;
+                        /* fallthrough */
                 default:
                         if (device->tape_state == TS_BLKUSE)
                                 break;
@@ -1116,6 +1118,7 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                         case -ETIMEDOUT:
                                 DBF_LH(1, "(%08x): Request timed out\n",
                                        device->cdev_id);
+                                /* fallthrough */
                         case -EIO:
                                 __tape_end_request(device, request, -EIO);
                                 break;
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 730c4e68094b..4142c85e77d8 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -319,9 +319,7 @@ static int qdio_siga_output(struct qdio_q *q, unsigned int *busy_bit,
         int retries = 0, cc;
         unsigned long laob = 0;
 
-        WARN_ON_ONCE(aob && ((queue_type(q) != QDIO_IQDIO_QFMT) ||
-                             !q->u.out.use_cq));
-        if (q->u.out.use_cq && aob != 0) {
+        if (aob) {
                 fc = QDIO_SIGA_WRITEQ;
                 laob = aob;
         }
@@ -621,9 +619,6 @@ static inline unsigned long qdio_aob_for_buffer(struct qdio_output_q *q,
 {
         unsigned long phys_aob = 0;
 
-        if (!q->use_cq)
-                return 0;
-
         if (!q->aobs[bufnr]) {
                 struct qaob *aob = qdio_allocate_aob();
                 q->aobs[bufnr] = aob;
@@ -1308,6 +1303,8 @@ static void qdio_detect_hsicq(struct qdio_irq *irq_ptr)
 
         for_each_output_queue(irq_ptr, q, i) {
                 if (use_cq) {
+                        if (multicast_outbound(q))
+                                continue;
                         if (qdio_enable_async_operation(&q->u.out) < 0) {
                                 use_cq = 0;
                                 continue;
@@ -1553,18 +1550,19 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
                 /* One SIGA-W per buffer required for unicast HSI */
                 WARN_ON_ONCE(count > 1 && !multicast_outbound(q));
 
-                phys_aob = qdio_aob_for_buffer(&q->u.out, bufnr);
+                if (q->u.out.use_cq)
+                        phys_aob = qdio_aob_for_buffer(&q->u.out, bufnr);
 
                 rc = qdio_kick_outbound_q(q, phys_aob);
         } else if (need_siga_sync(q)) {
                 rc = qdio_siga_sync_q(q);
+        } else if (count < QDIO_MAX_BUFFERS_PER_Q &&
+                   get_buf_state(q, prev_buf(bufnr), &state, 0) > 0 &&
+                   state == SLSB_CU_OUTPUT_PRIMED) {
+                /* The previous buffer is not processed yet, tack on. */
+                qperf_inc(q, fast_requeue);
         } else {
-                /* try to fast requeue buffers */
-                get_buf_state(q, prev_buf(bufnr), &state, 0);
-                if (state != SLSB_CU_OUTPUT_PRIMED)
-                        rc = qdio_kick_outbound_q(q, 0);
-                else
-                        qperf_inc(q, fast_requeue);
+                rc = qdio_kick_outbound_q(q, 0);
         }
 
         /* in case of SIGA errors we must process the error immediately */
diff --git a/drivers/s390/cio/vfio_ccw_async.c b/drivers/s390/cio/vfio_ccw_async.c
index 8c1d2357ef5b..7a838e3d7c0f 100644
--- a/drivers/s390/cio/vfio_ccw_async.c
+++ b/drivers/s390/cio/vfio_ccw_async.c
@@ -70,7 +70,7 @@ static void vfio_ccw_async_region_release(struct vfio_ccw_private *private,
 
 }
 
-const struct vfio_ccw_regops vfio_ccw_async_region_ops = {
+static const struct vfio_ccw_regops vfio_ccw_async_region_ops = {
         .read = vfio_ccw_async_region_read,
         .write = vfio_ccw_async_region_write,
         .release = vfio_ccw_async_region_release,
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 1d4c893ead23..3645d1720c4b 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -72,8 +72,10 @@ static int pfn_array_alloc(struct pfn_array *pa, u64 iova, unsigned int len)
                                   sizeof(*pa->pa_iova_pfn) +
                                   sizeof(*pa->pa_pfn),
                                   GFP_KERNEL);
-        if (unlikely(!pa->pa_iova_pfn))
+        if (unlikely(!pa->pa_iova_pfn)) {
+                pa->pa_nr = 0;
                 return -ENOMEM;
+        }
         pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr;
 
         pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
@@ -421,7 +423,7 @@ static int ccwchain_loop_tic(struct ccwchain *chain,
 static int ccwchain_handle_ccw(u32 cda, struct channel_program *cp)
 {
         struct ccwchain *chain;
-        int len;
+        int len, ret;
 
         /* Copy 2K (the most we support today) of possible CCWs */
         len = copy_from_iova(cp->mdev, cp->guest_cp, cda,
@@ -448,7 +450,12 @@ static int ccwchain_handle_ccw(u32 cda, struct channel_program *cp)
         memcpy(chain->ch_ccw, cp->guest_cp, len * sizeof(struct ccw1));
 
         /* Loop for tics on this new chain. */
-        return ccwchain_loop_tic(chain, cp);
+        ret = ccwchain_loop_tic(chain, cp);
+
+        if (ret)
+                ccwchain_free(chain);
+
+        return ret;
 }
 
 /* Loop for TICs. */
@@ -642,17 +649,16 @@ int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
 
         /* Build a ccwchain for the first CCW segment */
         ret = ccwchain_handle_ccw(orb->cmd.cpa, cp);
-        if (ret)
-                cp_free(cp);
-
-        /* It is safe to force: if not set but idals used
-         * ccwchain_calc_length returns an error.
-         */
-        cp->orb.cmd.c64 = 1;
 
-        if (!ret)
+        if (!ret) {
                 cp->initialized = true;
 
+                /* It is safe to force: if it was not set but idals used
+                 * ccwchain_calc_length would have returned an error.
+                 */
+                cp->orb.cmd.c64 = 1;
+        }
+
         return ret;
 }
 
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index 2b90a5ecaeb9..9208c0e56c33 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
                      (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
         if (scsw_is_solicited(&irb->scsw)) {
                 cp_update_scsw(&private->cp, &irb->scsw);
-                if (is_final)
+                if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING)
                         cp_free(&private->cp);
         }
         mutex_lock(&private->io_mutex);
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 5ea83dc4f1d7..dad2be333d82 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -152,6 +152,7 @@ static struct ap_queue_status ap_sm_recv(struct ap_queue *aq)
                         ap_msg->receive(aq, ap_msg, aq->reply);
                         break;
                 }
+                /* fall through */
         case AP_RESPONSE_NO_PENDING_REPLY:
                 if (!status.queue_empty || aq->queue_count <= 0)
                         break;
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 12fe9deb265e..a36251d138fb 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -801,10 +801,7 @@ static int convert_response_ica(struct zcrypt_queue *zq,
                 if (msg->cprbx.cprb_ver_id == 0x02)
                         return convert_type86_ica(zq, reply,
                                                   outputdata, outputdatalength);
-                /*
-                 * Fall through, no break, incorrect cprb version is an unknown
-                 * response
-                 */
+                /* fall through - wrong cprb version is an unknown response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zq->online = 0;
                 pr_err("Cryptographic device %02x.%04x failed and was set offline\n",
@@ -837,10 +834,7 @@ static int convert_response_xcrb(struct zcrypt_queue *zq,
                 }
                 if (msg->cprbx.cprb_ver_id == 0x02)
                         return convert_type86_xcrb(zq, reply, xcRB);
-                /*
-                 * Fall through, no break, incorrect cprb version is an unknown
-                 * response
-                 */
+                /* fall through - wrong cprb version is an unknown response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
                 zq->online = 0;
@@ -870,7 +864,7 @@ static int convert_response_ep11_xcrb(struct zcrypt_queue *zq,
                         return convert_error(zq, reply);
                 if (msg->cprbx.cprb_ver_id == 0x04)
                         return convert_type86_ep11_xcrb(zq, reply, xcRB);
-        /* Fall through, no break, incorrect cprb version is an unknown resp.*/
+                /* fall through - wrong cprb version is an unknown resp */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zq->online = 0;
                 pr_err("Cryptographic device %02x.%04x failed and was set offline\n",
@@ -900,10 +894,7 @@ static int convert_response_rng(struct zcrypt_queue *zq,
                         return -EINVAL;
                 if (msg->cprbx.cprb_ver_id == 0x02)
                         return convert_type86_rng(zq, reply, data);
-                /*
-                 * Fall through, no break, incorrect cprb version is an unknown
-                 * response
-                 */
+                /* fall through - wrong cprb version is an unknown response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zq->online = 0;
                 pr_err("Cryptographic device %02x.%04x failed and was set offline\n",
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 1a55e5942d36..957889a42d2e 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -145,6 +145,8 @@ struct airq_info {
         struct airq_iv *aiv;
 };
 static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
+static DEFINE_MUTEX(airq_areas_lock);
+
 static u8 *summary_indicators;
 
 static inline u8 *get_summary_indicator(struct airq_info *info)
@@ -265,9 +267,11 @@ static unsigned long get_airq_indicator(struct virtqueue *vqs[], int nvqs,
         unsigned long bit, flags;
 
         for (i = 0; i < MAX_AIRQ_AREAS && !indicator_addr; i++) {
+                mutex_lock(&airq_areas_lock);
                 if (!airq_areas[i])
                         airq_areas[i] = new_airq_info(i);
                 info = airq_areas[i];
+                mutex_unlock(&airq_areas_lock);
                 if (!info)
                         return 0;
                 write_lock_irqsave(&info->lock, flags);
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 75f66f8ad3ea..1b92f3c19ff3 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1523,10 +1523,10 @@ config SCSI_VIRTIO
 
 source "drivers/scsi/csiostor/Kconfig"
 
-endif # SCSI_LOWLEVEL
-
 source "drivers/scsi/pcmcia/Kconfig"
 
+endif # SCSI_LOWLEVEL
+
 source "drivers/scsi/device_handler/Kconfig"
 
 endmenu
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index f0066f8a1786..4971104b1817 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -40,6 +40,7 @@
 #define ALUA_FAILOVER_TIMEOUT           60
 #define ALUA_FAILOVER_RETRIES           5
 #define ALUA_RTPG_DELAY_MSECS           5
+#define ALUA_RTPG_RETRY_DELAY           2
 
 /* device handler flags */
 #define ALUA_OPTIMIZE_STPG              0x01
@@ -682,7 +683,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
         case SCSI_ACCESS_STATE_TRANSITIONING:
                 if (time_before(jiffies, pg->expiry)) {
                         /* State transition, retry */
-                        pg->interval = 2;
+                        pg->interval = ALUA_RTPG_RETRY_DELAY;
                         err = SCSI_DH_RETRY;
                 } else {
                         struct alua_dh_data *h;
@@ -807,6 +808,8 @@ static void alua_rtpg_work(struct work_struct *work)
                                 spin_lock_irqsave(&pg->lock, flags);
                                 pg->flags &= ~ALUA_PG_RUNNING;
                                 pg->flags |= ALUA_PG_RUN_RTPG;
+                                if (!pg->interval)
+                                        pg->interval = ALUA_RTPG_RETRY_DELAY;
                                 spin_unlock_irqrestore(&pg->lock, flags);
                                 queue_delayed_work(kaluad_wq, &pg->rtpg_work,
                                                    pg->interval * HZ);
@@ -818,6 +821,8 @@ static void alua_rtpg_work(struct work_struct *work)
                 spin_lock_irqsave(&pg->lock, flags);
                 if (err == SCSI_DH_RETRY || pg->flags & ALUA_PG_RUN_RTPG) {
                         pg->flags &= ~ALUA_PG_RUNNING;
+                        if (!pg->interval && !(pg->flags & ALUA_PG_RUN_RTPG))
+                                pg->interval = ALUA_RTPG_RETRY_DELAY;
                         pg->flags |= ALUA_PG_RUN_RTPG;
                         spin_unlock_irqrestore(&pg->lock, flags);
                         queue_delayed_work(kaluad_wq, &pg->rtpg_work,
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 590ec8009f52..1791a393795d 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -1019,7 +1019,7 @@ static void fcoe_ctlr_recv_adv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
         struct fcoe_fcf *fcf;
         struct fcoe_fcf new;
-        unsigned long sol_tov = msecs_to_jiffies(FCOE_CTRL_SOL_TOV);
+        unsigned long sol_tov = msecs_to_jiffies(FCOE_CTLR_SOL_TOV);
         int first = 0;
         int mtu_valid;
         int found = 0;
@@ -2005,7 +2005,7 @@ EXPORT_SYMBOL_GPL(fcoe_wwn_from_mac);
  */
 static inline struct fcoe_rport *fcoe_ctlr_rport(struct fc_rport_priv *rdata)
 {
-        return (struct fcoe_rport *)(rdata + 1);
+        return container_of(rdata, struct fcoe_rport, rdata);
 }
 
 /**
@@ -2269,7 +2269,7 @@ static void fcoe_ctlr_vn_start(struct fcoe_ctlr *fip)
  */
 static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
                               struct sk_buff *skb,
-                              struct fc_rport_priv *rdata)
+                              struct fcoe_rport *frport)
 {
         struct fip_header *fiph;
         struct fip_desc *desc = NULL;
@@ -2277,16 +2277,12 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
         struct fip_wwn_desc *wwn = NULL;
         struct fip_vn_desc *vn = NULL;
         struct fip_size_desc *size = NULL;
-        struct fcoe_rport *frport;
         size_t rlen;
         size_t dlen;
         u32 desc_mask = 0;
         u32 dtype;
         u8 sub;
 
-        memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
-        frport = fcoe_ctlr_rport(rdata);
-
         fiph = (struct fip_header *)skb->data;
         frport->flags = ntohs(fiph->fip_flags);
 
@@ -2349,15 +2345,17 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
                         if (dlen != sizeof(struct fip_wwn_desc))
                                 goto len_err;
                         wwn = (struct fip_wwn_desc *)desc;
-                        rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
+                        frport->rdata.ids.node_name =
+                                get_unaligned_be64(&wwn->fd_wwn);
                         break;
                 case FIP_DT_VN_ID:
                         if (dlen != sizeof(struct fip_vn_desc))
                                 goto len_err;
                         vn = (struct fip_vn_desc *)desc;
                         memcpy(frport->vn_mac, vn->fd_mac, ETH_ALEN);
-                        rdata->ids.port_id = ntoh24(vn->fd_fc_id);
-                        rdata->ids.port_name = get_unaligned_be64(&vn->fd_wwpn);
+                        frport->rdata.ids.port_id = ntoh24(vn->fd_fc_id);
+                        frport->rdata.ids.port_name =
+                                get_unaligned_be64(&vn->fd_wwpn);
                         break;
                 case FIP_DT_FC4F:
                         if (dlen != sizeof(struct fip_fc4_feat))
@@ -2403,16 +2401,14 @@ static void fcoe_ctlr_vn_send_claim(struct fcoe_ctlr *fip)
 /**
  * fcoe_ctlr_vn_probe_req() - handle incoming VN2VN probe request.
  * @fip: The FCoE controller
- * @rdata: parsed remote port with frport from the probe request
+ * @frport: parsed FCoE rport from the probe request
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vn_probe_req(struct fcoe_ctlr *fip,
-                                   struct fc_rport_priv *rdata)
+                                   struct fcoe_rport *frport)
 {
-        struct fcoe_rport *frport = fcoe_ctlr_rport(rdata);
-
-        if (rdata->ids.port_id != fip->port_id)
+        if (frport->rdata.ids.port_id != fip->port_id)
                 return;
 
         switch (fip->state) {
@@ -2432,7 +2428,7 @@ static void fcoe_ctlr_vn_probe_req(struct fcoe_ctlr *fip,
                  * Probe's REC bit is not set.
                  * If we don't reply, we will change our address.
                  */
-                if (fip->lp->wwpn > rdata->ids.port_name &&
+                if (fip->lp->wwpn > frport->rdata.ids.port_name &&
                     !(frport->flags & FIP_FL_REC_OR_P2P)) {
                         LIBFCOE_FIP_DBG(fip, "vn_probe_req: "
                                         "port_id collision\n");
@@ -2456,14 +2452,14 @@ static void fcoe_ctlr_vn_probe_req(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_vn_probe_reply() - handle incoming VN2VN probe reply.
  * @fip: The FCoE controller
- * @rdata: parsed remote port with frport from the probe request
+ * @frport: parsed FCoE rport from the probe request
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vn_probe_reply(struct fcoe_ctlr *fip,
-                                   struct fc_rport_priv *rdata)
+                                     struct fcoe_rport *frport)
 {
-        if (rdata->ids.port_id != fip->port_id)
+        if (frport->rdata.ids.port_id != fip->port_id)
                 return;
         switch (fip->state) {
         case FIP_ST_VNMP_START:
@@ -2486,11 +2482,11 @@ static void fcoe_ctlr_vn_probe_reply(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_vn_add() - Add a VN2VN entry to the list, based on a claim reply.
  * @fip: The FCoE controller
- * @new: newly-parsed remote port with frport as a template for new rdata
+ * @new: newly-parsed FCoE rport as a template for new rdata
  *
  * Called with ctlr_mutex held.
  */
-static void fcoe_ctlr_vn_add(struct fcoe_ctlr *fip, struct fc_rport_priv *new)
+static void fcoe_ctlr_vn_add(struct fcoe_ctlr *fip, struct fcoe_rport *new)
 {
         struct fc_lport *lport = fip->lp;
         struct fc_rport_priv *rdata;
@@ -2498,7 +2494,7 @@ static void fcoe_ctlr_vn_add(struct fcoe_ctlr *fip, struct fc_rport_priv *new)
         struct fcoe_rport *frport;
         u32 port_id;
 
-        port_id = new->ids.port_id;
+        port_id = new->rdata.ids.port_id;
         if (port_id == fip->port_id)
                 return;
 
@@ -2515,22 +2511,28 @@ static void fcoe_ctlr_vn_add(struct fcoe_ctlr *fip, struct fc_rport_priv *new)
         rdata->disc_id = lport->disc.disc_id;
 
         ids = &rdata->ids;
-        if ((ids->port_name != -1 && ids->port_name != new->ids.port_name) ||
-            (ids->node_name != -1 && ids->node_name != new->ids.node_name)) {
+        if ((ids->port_name != -1 &&
+             ids->port_name != new->rdata.ids.port_name) ||
+            (ids->node_name != -1 &&
+             ids->node_name != new->rdata.ids.node_name)) {
                 mutex_unlock(&rdata->rp_mutex);
                 LIBFCOE_FIP_DBG(fip, "vn_add rport logoff %6.6x\n", port_id);
                 fc_rport_logoff(rdata);
                 mutex_lock(&rdata->rp_mutex);
         }
-        ids->port_name = new->ids.port_name;
-        ids->node_name = new->ids.node_name;
+        ids->port_name = new->rdata.ids.port_name;
+        ids->node_name = new->rdata.ids.node_name;
         mutex_unlock(&rdata->rp_mutex);
 
         frport = fcoe_ctlr_rport(rdata);
         LIBFCOE_FIP_DBG(fip, "vn_add rport %6.6x %s state %d\n",
                         port_id, frport->fcoe_len ? "old" : "new",
                         rdata->rp_state);
-        *frport = *fcoe_ctlr_rport(new);
+        frport->fcoe_len = new->fcoe_len;
+        frport->flags = new->flags;
+        frport->login_count = new->login_count;
+        memcpy(frport->enode_mac, new->enode_mac, ETH_ALEN);
+        memcpy(frport->vn_mac, new->vn_mac, ETH_ALEN);
         frport->time = 0;
 }
 
@@ -2562,16 +2564,14 @@ static int fcoe_ctlr_vn_lookup(struct fcoe_ctlr *fip, u32 port_id, u8 *mac)
 /**
  * fcoe_ctlr_vn_claim_notify() - handle received FIP VN2VN Claim Notification
  * @fip: The FCoE controller
- * @new: newly-parsed remote port with frport as a template for new rdata
+ * @new: newly-parsed FCoE rport as a template for new rdata
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vn_claim_notify(struct fcoe_ctlr *fip,
-                                      struct fc_rport_priv *new)
+                                      struct fcoe_rport *new)
 {
-        struct fcoe_rport *frport = fcoe_ctlr_rport(new);
-
-        if (frport->flags & FIP_FL_REC_OR_P2P) {
+        if (new->flags & FIP_FL_REC_OR_P2P) {
                 LIBFCOE_FIP_DBG(fip, "send probe req for P2P/REC\n");
                 fcoe_ctlr_vn_send(fip, FIP_SC_VN_PROBE_REQ, fcoe_all_vn2vn, 0);
                 return;
@@ -2580,7 +2580,7 @@ static void fcoe_ctlr_vn_claim_notify(struct fcoe_ctlr *fip,
         case FIP_ST_VNMP_START:
         case FIP_ST_VNMP_PROBE1:
         case FIP_ST_VNMP_PROBE2:
-                if (new->ids.port_id == fip->port_id) {
+                if (new->rdata.ids.port_id == fip->port_id) {
                         LIBFCOE_FIP_DBG(fip, "vn_claim_notify: "
                                         "restart, state %d\n",
                                         fip->state);
@@ -2589,8 +2589,8 @@ static void fcoe_ctlr_vn_claim_notify(struct fcoe_ctlr *fip,
                 break;
         case FIP_ST_VNMP_CLAIM:
         case FIP_ST_VNMP_UP:
-                if (new->ids.port_id == fip->port_id) {
-                        if (new->ids.port_name > fip->lp->wwpn) {
+                if (new->rdata.ids.port_id == fip->port_id) {
+                        if (new->rdata.ids.port_name > fip->lp->wwpn) {
                                 LIBFCOE_FIP_DBG(fip, "vn_claim_notify: "
                                                 "restart, port_id collision\n");
                                 fcoe_ctlr_vn_restart(fip);
@@ -2602,15 +2602,16 @@ static void fcoe_ctlr_vn_claim_notify(struct fcoe_ctlr *fip,
                         break;
                 }
                 LIBFCOE_FIP_DBG(fip, "vn_claim_notify: send reply to %x\n",
-                                new->ids.port_id);
-                fcoe_ctlr_vn_send(fip, FIP_SC_VN_CLAIM_REP, frport->enode_mac,
-                                  min((u32)frport->fcoe_len,
+                                new->rdata.ids.port_id);
+                fcoe_ctlr_vn_send(fip, FIP_SC_VN_CLAIM_REP, new->enode_mac,
+                                  min((u32)new->fcoe_len,
                                       fcoe_ctlr_fcoe_size(fip)));
                 fcoe_ctlr_vn_add(fip, new);
                 break;
         default:
                 LIBFCOE_FIP_DBG(fip, "vn_claim_notify: "
-                                "ignoring claim from %x\n", new->ids.port_id);
+                                "ignoring claim from %x\n",
+                                new->rdata.ids.port_id);
                 break;
         }
 }
@@ -2618,15 +2619,15 @@ static void fcoe_ctlr_vn_claim_notify(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_vn_claim_resp() - handle received Claim Response
  * @fip: The FCoE controller that received the frame
- * @new: newly-parsed remote port with frport from the Claim Response
+ * @new: newly-parsed FCoE rport from the Claim Response
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vn_claim_resp(struct fcoe_ctlr *fip,
-                                    struct fc_rport_priv *new)
+                                    struct fcoe_rport *new)
 {
         LIBFCOE_FIP_DBG(fip, "claim resp from from rport %x - state %s\n",
-                        new->ids.port_id, fcoe_ctlr_state(fip->state));
+                        new->rdata.ids.port_id, fcoe_ctlr_state(fip->state));
         if (fip->state == FIP_ST_VNMP_UP || fip->state == FIP_ST_VNMP_CLAIM)
                 fcoe_ctlr_vn_add(fip, new);
 }
@@ -2634,28 +2635,28 @@ static void fcoe_ctlr_vn_claim_resp(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_vn_beacon() - handle received beacon.
  * @fip: The FCoE controller that received the frame
- * @new: newly-parsed remote port with frport from the Beacon
+ * @new: newly-parsed FCoE rport from the Beacon
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vn_beacon(struct fcoe_ctlr *fip,
-                                struct fc_rport_priv *new)
+                                struct fcoe_rport *new)
 {
         struct fc_lport *lport = fip->lp;
         struct fc_rport_priv *rdata;
         struct fcoe_rport *frport;
 
-        frport = fcoe_ctlr_rport(new);
-        if (frport->flags & FIP_FL_REC_OR_P2P) {
+        if (new->flags & FIP_FL_REC_OR_P2P) {
                 LIBFCOE_FIP_DBG(fip, "p2p beacon while in vn2vn mode\n");
                 fcoe_ctlr_vn_send(fip, FIP_SC_VN_PROBE_REQ, fcoe_all_vn2vn, 0);
                 return;
         }
-        rdata = fc_rport_lookup(lport, new->ids.port_id);
+        rdata = fc_rport_lookup(lport, new->rdata.ids.port_id);
         if (rdata) {
-                if (rdata->ids.node_name == new->ids.node_name &&
-                    rdata->ids.port_name == new->ids.port_name) {
+                if (rdata->ids.node_name == new->rdata.ids.node_name &&
+                    rdata->ids.port_name == new->rdata.ids.port_name) {
                         frport = fcoe_ctlr_rport(rdata);
+
                         LIBFCOE_FIP_DBG(fip, "beacon from rport %x\n",
                                         rdata->ids.port_id);
                         if (!frport->time && fip->state == FIP_ST_VNMP_UP) {
@@ -2678,7 +2679,7 @@ static void fcoe_ctlr_vn_beacon(struct fcoe_ctlr *fip,
          * Don't add the neighbor yet.
          */
         LIBFCOE_FIP_DBG(fip, "beacon from new rport %x. sending claim notify\n",
-                        new->ids.port_id);
+                        new->rdata.ids.port_id);
         if (time_after(jiffies,
                        fip->sol_time + msecs_to_jiffies(FIP_VN_ANN_WAIT)))
                 fcoe_ctlr_vn_send_claim(fip);
@@ -2738,10 +2739,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
         struct fip_header *fiph;
         enum fip_vn2vn_subcode sub;
-        struct {
-                struct fc_rport_priv rdata;
-                struct fcoe_rport frport;
-        } buf;
+        struct fcoe_rport frport = { };
         int rc, vlan_id = 0;
 
         fiph = (struct fip_header *)skb->data;
@@ -2757,7 +2755,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
                 goto drop;
         }
 
-        rc = fcoe_ctlr_vn_parse(fip, skb, &buf.rdata);
+        rc = fcoe_ctlr_vn_parse(fip, skb, &frport);
         if (rc) {
                 LIBFCOE_FIP_DBG(fip, "vn_recv vn_parse error %d\n", rc);
                 goto drop;
@@ -2766,19 +2764,19 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
         mutex_lock(&fip->ctlr_mutex);
         switch (sub) {
         case FIP_SC_VN_PROBE_REQ:
-                fcoe_ctlr_vn_probe_req(fip, &buf.rdata);
+                fcoe_ctlr_vn_probe_req(fip, &frport);
                 break;
         case FIP_SC_VN_PROBE_REP:
-                fcoe_ctlr_vn_probe_reply(fip, &buf.rdata);
+                fcoe_ctlr_vn_probe_reply(fip, &frport);
                 break;
         case FIP_SC_VN_CLAIM_NOTIFY:
-                fcoe_ctlr_vn_claim_notify(fip, &buf.rdata);
+                fcoe_ctlr_vn_claim_notify(fip, &frport);
                 break;
         case FIP_SC_VN_CLAIM_REP:
-                fcoe_ctlr_vn_claim_resp(fip, &buf.rdata);
+                fcoe_ctlr_vn_claim_resp(fip, &frport);
                 break;
         case FIP_SC_VN_BEACON:
-                fcoe_ctlr_vn_beacon(fip, &buf.rdata);
+                fcoe_ctlr_vn_beacon(fip, &frport);
                 break;
         default:
                 LIBFCOE_FIP_DBG(fip, "vn_recv unknown subcode %d\n", sub);
@@ -2802,22 +2800,18 @@ drop:
  */
 static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
                               struct sk_buff *skb,
-                              struct fc_rport_priv *rdata)
+                              struct fcoe_rport *frport)
 {
         struct fip_header *fiph;
         struct fip_desc *desc = NULL;
         struct fip_mac_desc *macd = NULL;
         struct fip_wwn_desc *wwn = NULL;
-        struct fcoe_rport *frport;
         size_t rlen;
         size_t dlen;
         u32 desc_mask = 0;
         u32 dtype;
         u8 sub;
 
-        memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
-        frport = fcoe_ctlr_rport(rdata);
-
         fiph = (struct fip_header *)skb->data;
         frport->flags = ntohs(fiph->fip_flags);
 
@@ -2871,7 +2865,8 @@ static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
                         if (dlen != sizeof(struct fip_wwn_desc))
                                 goto len_err;
                         wwn = (struct fip_wwn_desc *)desc;
-                        rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
+                        frport->rdata.ids.node_name =
+                                get_unaligned_be64(&wwn->fd_wwn);
                         break;
                 default:
                         LIBFCOE_FIP_DBG(fip, "unexpected descriptor type %x "
@@ -2957,13 +2952,13 @@ static void fcoe_ctlr_vlan_send(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_vlan_disk_reply() - send FIP VLAN Discovery Notification.
  * @fip: The FCoE controller
+ * @frport: The newly-parsed FCoE rport from the Discovery Request
  *
  * Called with ctlr_mutex held.
  */
 static void fcoe_ctlr_vlan_disc_reply(struct fcoe_ctlr *fip,
-                                      struct fc_rport_priv *rdata)
+                                      struct fcoe_rport *frport)
 {
-        struct fcoe_rport *frport = fcoe_ctlr_rport(rdata);
         enum fip_vlan_subcode sub = FIP_SC_VL_NOTE;
 
         if (fip->mode == FIP_MODE_VN2VN)
@@ -2982,22 +2977,19 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
         struct fip_header *fiph;
         enum fip_vlan_subcode sub;
-        struct {
-                struct fc_rport_priv rdata;
-                struct fcoe_rport frport;
-        } buf;
+        struct fcoe_rport frport = { };
         int rc;
 
         fiph = (struct fip_header *)skb->data;
         sub = fiph->fip_subcode;
-        rc = fcoe_ctlr_vlan_parse(fip, skb, &buf.rdata);
+        rc = fcoe_ctlr_vlan_parse(fip, skb, &frport);
         if (rc) {
                 LIBFCOE_FIP_DBG(fip, "vlan_recv vlan_parse error %d\n", rc);
                 goto drop;
         }
         mutex_lock(&fip->ctlr_mutex);
         if (sub == FIP_SC_VL_REQ)
-                fcoe_ctlr_vlan_disc_reply(fip, &buf.rdata);
+                fcoe_ctlr_vlan_disc_reply(fip, &frport);
         mutex_unlock(&fip->ctlr_mutex);
 
 drop:
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 43a6b5350775..1bb6aada93fa 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2334,6 +2334,8 @@ static int handle_ioaccel_mode2_error(struct ctlr_info *h,
         case IOACCEL2_SERV_RESPONSE_COMPLETE:
                 switch (c2->error_data.status) {
                 case IOACCEL2_STATUS_SR_TASK_COMP_GOOD:
+                        if (cmd)
+                                cmd->result = 0;
                         break;
                 case IOACCEL2_STATUS_SR_TASK_COMP_CHK_COND:
                         cmd->result |= SAM_STAT_CHECK_CONDITION;
@@ -2483,8 +2485,10 @@ static void process_ioaccel2_completion(struct ctlr_info *h,
 
         /* check for good status */
         if (likely(c2->error_data.serv_response == 0 &&
-                        c2->error_data.status == 0))
+                        c2->error_data.status == 0)) {
+                cmd->result = 0;
                 return hpsa_cmd_free_and_done(h, c, cmd);
+        }
 
         /*
          * Any RAID offload error results in retry which will use
@@ -5654,6 +5658,12 @@ static int hpsa_scsi_queue_command(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
                 return SCSI_MLQUEUE_DEVICE_BUSY;
 
         /*
+         * This is necessary because the SML doesn't zero out this field during
+         * error recovery.
+         */
+        cmd->result = 0;
+
+        /*
          * Call alternate submit routine for I/O accelerated commands.
          * Retries always go down the normal I/O path.
          */
@@ -6081,8 +6091,6 @@ static struct CommandList *cmd_tagged_alloc(struct ctlr_info *h,
                 if (idx != h->last_collision_tag) { /* Print once per tag */
                         dev_warn(&h->pdev->dev,
                                 "%s: tag collision (tag=%d)\n", __func__, idx);
-                        if (c->scsi_cmd != NULL)
-                                scsi_print_command(c->scsi_cmd);
                         if (scmd)
                                 scsi_print_command(scmd);
                         h->last_collision_tag = idx;
@@ -7798,7 +7806,7 @@ static void hpsa_free_pci_init(struct ctlr_info *h)
         hpsa_disable_interrupt_mode(h);         /* pci_init 2 */
         /*
          * call pci_disable_device before pci_release_regions per
-         * Documentation/PCI/pci.rst
+         * Documentation/driver-api/pci/pci.rst
          */
         pci_disable_device(h->pdev);            /* pci_init 1 */
         pci_release_regions(h->pdev);           /* pci_init 2 */
@@ -7881,7 +7889,7 @@ clean2:	/* intmode+region, pci */
 clean1:
         /*
          * call pci_disable_device before pci_release_regions per
-         * Documentation/PCI/pci.rst
+         * Documentation/driver-api/pci/pci.rst
          */
         pci_disable_device(h->pdev);
         pci_release_regions(h->pdev);
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index acd16e0d52cf..8cdbac076a1b 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4864,8 +4864,8 @@ static int ibmvfc_remove(struct vio_dev *vdev)
 
         spin_lock_irqsave(vhost->host->host_lock, flags);
         ibmvfc_purge_requests(vhost, DID_ERROR);
-        ibmvfc_free_event_pool(vhost);
         spin_unlock_irqrestore(vhost->host->host_lock, flags);
+        ibmvfc_free_event_pool(vhost);
 
         ibmvfc_free_mem(vhost);
         spin_lock(&ibmvfc_driver_lock);
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index e0f3852fdad1..da6e97d8dc3b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -128,6 +128,7 @@ EXPORT_SYMBOL(fc_rport_lookup);
 struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
 {
         struct fc_rport_priv *rdata;
+        size_t rport_priv_size = sizeof(*rdata);
 
         lockdep_assert_held(&lport->disc.disc_mutex);
 
@@ -135,7 +136,9 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
         if (rdata)
                 return rdata;
 
-        rdata = kzalloc(sizeof(*rdata) + lport->rport_priv_size, GFP_KERNEL);
+        if (lport->rport_priv_size > 0)
+                rport_priv_size = lport->rport_priv_size;
+        rdata = kzalloc(rport_priv_size, GFP_KERNEL);
         if (!rdata)
                 return NULL;
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index b2339d04a700..f9f07935556e 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3163,6 +3163,7 @@ fw_crash_buffer_show(struct device *cdev,
                 (struct megasas_instance *) shost->hostdata;
         u32 size;
         unsigned long dmachunk = CRASH_DMA_BUF_SIZE;
+        unsigned long chunk_left_bytes;
         unsigned long src_addr;
         unsigned long flags;
         u32 buff_offset;
@@ -3186,6 +3187,8 @@ fw_crash_buffer_show(struct device *cdev,
         }
 
         size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset;
+        chunk_left_bytes = dmachunk - (buff_offset % dmachunk);
+        size = (size > chunk_left_bytes) ? chunk_left_bytes : size;
         size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size;
 
         src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] +
@@ -8763,7 +8766,7 @@ static int __init megasas_init(void)
 
         if ((event_log_level < MFI_EVT_CLASS_DEBUG) ||
             (event_log_level > MFI_EVT_CLASS_DEAD)) {
-                printk(KERN_WARNING "megarid_sas: provided event log level is out of range, setting it to default 2(CLASS_CRITICAL), permissible range is: -2 to 4\n");
+                pr_warn("megaraid_sas: provided event log level is out of range, setting it to default 2(CLASS_CRITICAL), permissible range is: -2 to 4\n");
                 event_log_level = MFI_EVT_CLASS_CRITICAL;
         }
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index a32b3f0fcd15..120e3c4de8c2 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -537,7 +537,7 @@ static int megasas_create_sg_sense_fusion(struct megasas_instance *instance)
         return 0;
 }
 
-int
+static int
 megasas_alloc_cmdlist_fusion(struct megasas_instance *instance)
 {
         u32 max_mpt_cmd, i, j;
@@ -576,7 +576,8 @@ megasas_alloc_cmdlist_fusion(struct megasas_instance *instance)
 
         return 0;
 }
-int
+
+static int
 megasas_alloc_request_fusion(struct megasas_instance *instance)
 {
         struct fusion_context *fusion;
@@ -657,7 +658,7 @@ retry_alloc:
         return 0;
 }
 
-int
+static int
 megasas_alloc_reply_fusion(struct megasas_instance *instance)
 {
         int i, count;
@@ -734,7 +735,7 @@ megasas_alloc_reply_fusion(struct megasas_instance *instance)
         return 0;
 }
 
-int
+static int
 megasas_alloc_rdpq_fusion(struct megasas_instance *instance)
 {
         int i, j, k, msix_count;
@@ -916,7 +917,7 @@ megasas_free_reply_fusion(struct megasas_instance *instance) {
  * and is used as SMID of the cmd.
  * SMID value range is from 1 to max_fw_cmds.
  */
-int
+static int
 megasas_alloc_cmds_fusion(struct megasas_instance *instance)
 {
         int i;
@@ -1736,7 +1737,7 @@ static inline void megasas_free_ioc_init_cmd(struct megasas_instance *instance)
  *
  * This is the main function for initializing firmware.
  */
-u32
+static u32
 megasas_init_adapter_fusion(struct megasas_instance *instance)
 {
         struct fusion_context *fusion;
@@ -1962,7 +1963,7 @@ megasas_fusion_stop_watchdog(struct megasas_instance *instance)
  * @ext_status :        ext status of cmd returned by FW
  */
 
-void
+static void
 map_cmd_status(struct fusion_context *fusion,
                 struct scsi_cmnd *scmd, u8 status, u8 ext_status,
                 u32 data_length, u8 *sense)
@@ -2375,7 +2376,7 @@ int megasas_make_sgl(struct megasas_instance *instance, struct scsi_cmnd *scp,
  *
  * Used to set the PD LBA in CDB for FP IOs
  */
-void
+static void
 megasas_set_pd_lba(struct MPI2_RAID_SCSI_IO_REQUEST *io_request, u8 cdb_len,
                    struct IO_REQUEST_INFO *io_info, struct scsi_cmnd *scp,
                    struct MR_DRV_RAID_MAP_ALL *local_map_ptr, u32 ref_tag)
@@ -2714,7 +2715,7 @@ megasas_set_raidflag_cpu_affinity(struct fusion_context *fusion,
  * Prepares the io_request and chain elements (sg_frame) for IO
  * The IO can be for PD (Fast Path) or LD
  */
-void
+static void
 megasas_build_ldio_fusion(struct megasas_instance *instance,
                           struct scsi_cmnd *scp,
                           struct megasas_cmd_fusion *cmd)
@@ -3211,7 +3212,7 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
  * Invokes helper functions to prepare request frames
  * and sets flags appropriate for IO/Non-IO cmd
  */
-int
+static int
 megasas_build_io_fusion(struct megasas_instance *instance,
                         struct scsi_cmnd *scp,
                         struct megasas_cmd_fusion *cmd)
@@ -3325,9 +3326,9 @@ megasas_get_request_descriptor(struct megasas_instance *instance, u16 index)
 /* megasas_prepate_secondRaid1_IO
  *  It prepares the raid 1 second IO
  */
-void megasas_prepare_secondRaid1_IO(struct megasas_instance *instance,
-                            struct megasas_cmd_fusion *cmd,
-                            struct megasas_cmd_fusion *r1_cmd)
+static void megasas_prepare_secondRaid1_IO(struct megasas_instance *instance,
+                                           struct megasas_cmd_fusion *cmd,
+                                           struct megasas_cmd_fusion *r1_cmd)
 {
         union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc, *req_desc2 = NULL;
         struct fusion_context *fusion;
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 684662888792..050c0f029ef9 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2703,6 +2703,8 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
 {
         u64 required_mask, coherent_mask;
         struct sysinfo s;
+        /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
+        int dma_mask = (ioc->hba_mpi_version_belonged > MPI2_VERSION) ? 63 : 64;
 
         if (ioc->is_mcpu_endpoint)
                 goto try_32bit;
@@ -2712,17 +2714,17 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
                 goto try_32bit;
 
         if (ioc->dma_mask)
-                coherent_mask = DMA_BIT_MASK(64);
+                coherent_mask = DMA_BIT_MASK(dma_mask);
         else
                 coherent_mask = DMA_BIT_MASK(32);
 
-        if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) ||
+        if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(dma_mask)) ||
             dma_set_coherent_mask(&pdev->dev, coherent_mask))
                 goto try_32bit;
 
         ioc->base_add_sg_single = &_base_add_sg_single_64;
         ioc->sge_size = sizeof(Mpi2SGESimple64_t);
-        ioc->dma_mask = 64;
+        ioc->dma_mask = dma_mask;
         goto out;
 
  try_32bit:
@@ -2744,7 +2746,7 @@ static int
 _base_change_consistent_dma_mask(struct MPT3SAS_ADAPTER *ioc,
                                       struct pci_dev *pdev)
 {
-        if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(ioc->dma_mask))) {
                 if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))
                         return -ENODEV;
         }
@@ -4989,7 +4991,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc)
                 total_sz += sz;
         } while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count));
 
-        if (ioc->dma_mask == 64) {
+        if (ioc->dma_mask > 32) {
                 if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) {
                         ioc_warn(ioc, "no suitable consistent DMA mask for %s\n",
                                  pci_name(ioc->pdev));
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 4059655639d9..da83034d4759 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4877,7 +4877,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
                 ql_log(ql_log_warn, vha, 0xd049,
                     "Failed to allocate ct_sns request.\n");
                 kfree(fcport);
-                fcport = NULL;
+                return NULL;
         }
 
         INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9381171c2fc0..11e64b50497f 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1784,8 +1784,10 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
                 blk_queue_max_integrity_segments(q, shost->sg_prot_tablesize);
         }
 
-        shost->max_sectors = min_t(unsigned int, shost->max_sectors,
-                        dma_max_mapping_size(dev) << SECTOR_SHIFT);
+        if (dev->dma_mask) {
+                shost->max_sectors = min_t(unsigned int, shost->max_sectors,
+                                dma_max_mapping_size(dev) >> SECTOR_SHIFT);
+        }
         blk_queue_max_hw_sectors(q, shost->max_sectors);
         if (shost->unchecked_isa_dma)
                 blk_queue_bounce_limit(q, BLK_BOUNCE_ISA);
diff --git a/drivers/soc/fsl/qe/qe.c b/drivers/soc/fsl/qe/qe.c
index 62c6ba17991a..c9519e62308c 100644
--- a/drivers/soc/fsl/qe/qe.c
+++ b/drivers/soc/fsl/qe/qe.c
@@ -419,7 +419,7 @@ static void qe_upload_microcode(const void *base,
 /*
  * Upload a microcode to the I-RAM at a specific address.
  *
- * See Documentation/powerpc/qe_firmware.txt for information on QE microcode
+ * See Documentation/powerpc/qe_firmware.rst for information on QE microcode
  * uploading.
  *
  * Currently, only version 1 is supported, so the 'version' field must be
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 6f243a90c844..840b1b8ff3dc 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -834,7 +834,8 @@ static int bcm2835_spi_transfer_one(struct spi_controller *ctlr,
         bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv);
 
         /* handle all the 3-wire mode */
-        if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf))
+        if (spi->mode & SPI_3WIRE && tfr->rx_buf &&
+            tfr->rx_buf != ctlr->dummy_rx)
                 cs |= BCM2835_SPI_CS_REN;
         else
                 cs &= ~BCM2835_SPI_CS_REN;
diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c
index 41a49b93ca60..448c00e4065b 100644
--- a/drivers/spi/spi-fsl-qspi.c
+++ b/drivers/spi/spi-fsl-qspi.c
@@ -206,7 +206,7 @@ static const struct fsl_qspi_devtype_data imx6sx_data = {
 };
 
 static const struct fsl_qspi_devtype_data imx7d_data = {
-        .rxfifo = SZ_512,
+        .rxfifo = SZ_128,
         .txfifo = SZ_512,
         .ahb_buf_size = SZ_1K,
         .quirks = QUADSPI_QUIRK_TKT253890 | QUADSPI_QUIRK_4X_INT_CLK,
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index eca9d52ecf65..9eb82150666e 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -410,6 +410,12 @@ static int spi_gpio_probe(struct platform_device *pdev)
 
         bb = &spi_gpio->bitbang;
         bb->master = master;
+        /*
+         * There is some additional business, apart from driving the CS GPIO
+         * line, that we need to do on selection. This makes the local
+         * callback for chipselect always get called.
+         */
+        master->flags |= SPI_MASTER_GPIO_SS;
         bb->chipselect = spi_gpio_chipselect;
         bb->set_line_direction = spi_gpio_set_direction;
 
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index fc7ab4b26880..bb6a14d1ab0f 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1457,6 +1457,14 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
         { PCI_VDEVICE(INTEL, 0x02aa), LPSS_CNL_SSP },
         { PCI_VDEVICE(INTEL, 0x02ab), LPSS_CNL_SSP },
         { PCI_VDEVICE(INTEL, 0x02fb), LPSS_CNL_SSP },
+        /* TGL-LP */
+        { PCI_VDEVICE(INTEL, 0xa0aa), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0ab), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0de), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0df), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0fb), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0fd), LPSS_CNL_SSP },
+        { PCI_VDEVICE(INTEL, 0xa0fe), LPSS_CNL_SSP },
         { },
 };
 
@@ -1831,14 +1839,16 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
         status = devm_spi_register_controller(&pdev->dev, controller);
         if (status != 0) {
                 dev_err(&pdev->dev, "problem registering spi controller\n");
-                goto out_error_clock_enabled;
+                goto out_error_pm_runtime_enabled;
         }
 
         return status;
 
-out_error_clock_enabled:
+out_error_pm_runtime_enabled:
         pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
+
+out_error_clock_enabled:
         clk_disable_unprepare(ssp->clk);
 
 out_error_dma_irq_alloc:
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index 22dd4c457d6a..c70caf4ea490 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -875,10 +875,12 @@ static u8 cxgbit_get_iscsi_dcb_priority(struct net_device *ndev, u16 local_port)
                 return 0;
 
         if (caps & DCB_CAP_DCBX_VER_IEEE) {
-                iscsi_dcb_app.selector = IEEE_8021QAZ_APP_SEL_ANY;
-
+                iscsi_dcb_app.selector = IEEE_8021QAZ_APP_SEL_STREAM;
                 ret = dcb_ieee_getapp_mask(ndev, &iscsi_dcb_app);
-
+                if (!ret) {
+                        iscsi_dcb_app.selector = IEEE_8021QAZ_APP_SEL_ANY;
+                        ret = dcb_ieee_getapp_mask(ndev, &iscsi_dcb_app);
+                }
         } else if (caps & DCB_CAP_DCBX_VER_CEE) {
                 iscsi_dcb_app.selector = DCB_APP_IDTYPE_PORTNUM;
 
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_main.c b/drivers/target/iscsi/cxgbit/cxgbit_main.c
index 343b129c2cfa..e877b917c15f 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_main.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_main.c
@@ -589,7 +589,8 @@ static void cxgbit_dcb_workfn(struct work_struct *work)
         iscsi_app = &dcb_work->dcb_app;
 
         if (iscsi_app->dcbx & DCB_CAP_DCBX_VER_IEEE) {
-                if (iscsi_app->app.selector != IEEE_8021QAZ_APP_SEL_ANY)
+                if ((iscsi_app->app.selector != IEEE_8021QAZ_APP_SEL_STREAM) &&
+                    (iscsi_app->app.selector != IEEE_8021QAZ_APP_SEL_ANY))
                         goto out;
 
                 priority = iscsi_app->app.priority;
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 213ab3cc6b80..d3446acf9bbd 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -487,6 +487,7 @@ static int proc_thermal_rapl_add(struct pci_dev *pdev,
                                 rapl_mmio_cpu_online, rapl_mmio_cpu_down_prep);
         if (ret < 0) {
                 powercap_unregister_control_type(rapl_mmio_priv.control_type);
+                rapl_mmio_priv.control_type = NULL;
                 return ret;
         }
         rapl_mmio_priv.pcap_rapl_online = ret;
@@ -496,6 +497,9 @@ static int proc_thermal_rapl_add(struct pci_dev *pdev,
 
 static void proc_thermal_rapl_remove(void)
 {
+        if (IS_ERR_OR_NULL(rapl_mmio_priv.control_type))
+                return;
+
         cpuhp_remove_state(rapl_mmio_priv.pcap_rapl_online);
         powercap_unregister_control_type(rapl_mmio_priv.control_type);
 }
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index cb4db1b3ca3c..5fb214e67d73 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -47,7 +47,7 @@
  * using the 2.6 Linux kernel kref construct.
  *
  * For direction on installation and usage of this driver please reference
- * Documentation/powerpc/hvcs.txt.
+ * Documentation/powerpc/hvcs.rst.
  */
 
 #include <linux/device.h>
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index fd385c8c53a5..3083dbae35f7 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1035,25 +1035,6 @@ config SERIAL_VT8500_CONSOLE
         depends on SERIAL_VT8500=y
         select SERIAL_CORE_CONSOLE
 
-config SERIAL_NETX
-        tristate "NetX serial port support"
-        depends on ARCH_NETX
-        select SERIAL_CORE
-        help
-          If you have a machine based on a Hilscher NetX SoC you
-          can enable its onboard serial port by enabling this option.
-
-          To compile this driver as a module, choose M here: the
-          module will be called netx-serial.
-
-config SERIAL_NETX_CONSOLE
-        bool "Console on NetX serial port"
-        depends on SERIAL_NETX=y
-        select SERIAL_CORE_CONSOLE
-        help
-          If you have enabled the serial port on the Hilscher NetX SoC
-          you can make it the console by answering Y to this option.
-
 config SERIAL_OMAP
         tristate "OMAP serial port support"
         depends on ARCH_OMAP2PLUS
diff --git a/drivers/tty/serial/Makefile b/drivers/tty/serial/Makefile
index 7cd7cabfa6c4..15a0fccadf7e 100644
--- a/drivers/tty/serial/Makefile
+++ b/drivers/tty/serial/Makefile
@@ -59,7 +59,6 @@ obj-$(CONFIG_SERIAL_ATMEL) += atmel_serial.o
 obj-$(CONFIG_SERIAL_UARTLITE) += uartlite.o
 obj-$(CONFIG_SERIAL_MSM) += msm_serial.o
 obj-$(CONFIG_SERIAL_QCOM_GENI) += qcom_geni_serial.o
-obj-$(CONFIG_SERIAL_NETX) += netx-serial.o
 obj-$(CONFIG_SERIAL_KS8695) += serial_ks8695.o
 obj-$(CONFIG_SERIAL_OMAP) += omap-serial.o
 obj-$(CONFIG_SERIAL_ALTERA_UART) += altera_uart.o
diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
deleted file mode 100644
index b3556863491f..000000000000
--- a/drivers/tty/serial/netx-serial.c
+++ /dev/null
@@ -1,733 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Copyright (c) 2005 Sascha Hauer <s.hauer@pengutronix.de>, Pengutronix
- */
-
-#if defined(CONFIG_SERIAL_NETX_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
-#define SUPPORT_SYSRQ
-#endif
-
-#include <linux/device.h>
-#include <linux/module.h>
-#include <linux/ioport.h>
-#include <linux/init.h>
-#include <linux/console.h>
-#include <linux/sysrq.h>
-#include <linux/platform_device.h>
-#include <linux/tty.h>
-#include <linux/tty_flip.h>
-#include <linux/serial_core.h>
-#include <linux/serial.h>
-
-#include <asm/io.h>
-#include <asm/irq.h>
-#include <mach/hardware.h>
-#include <mach/netx-regs.h>
-
-/* We've been assigned a range on the "Low-density serial ports" major */
-#define SERIAL_NX_MAJOR 204
-#define MINOR_START     170
-
-enum uart_regs {
-        UART_DR              = 0x00,
-        UART_SR              = 0x04,
-        UART_LINE_CR         = 0x08,
-        UART_BAUDDIV_MSB     = 0x0c,
-        UART_BAUDDIV_LSB     = 0x10,
-        UART_CR              = 0x14,
-        UART_FR              = 0x18,
-        UART_IIR             = 0x1c,
-        UART_ILPR            = 0x20,
-        UART_RTS_CR          = 0x24,
-        UART_RTS_LEAD        = 0x28,
-        UART_RTS_TRAIL       = 0x2c,
-        UART_DRV_ENABLE      = 0x30,
-        UART_BRM_CR          = 0x34,
-        UART_RXFIFO_IRQLEVEL = 0x38,
-        UART_TXFIFO_IRQLEVEL = 0x3c,
-};
-
-#define SR_FE (1<<0)
-#define SR_PE (1<<1)
-#define SR_BE (1<<2)
-#define SR_OE (1<<3)
-
-#define LINE_CR_BRK       (1<<0)
-#define LINE_CR_PEN       (1<<1)
-#define LINE_CR_EPS       (1<<2)
-#define LINE_CR_STP2      (1<<3)
-#define LINE_CR_FEN       (1<<4)
-#define LINE_CR_5BIT      (0<<5)
-#define LINE_CR_6BIT      (1<<5)
-#define LINE_CR_7BIT      (2<<5)
-#define LINE_CR_8BIT      (3<<5)
-#define LINE_CR_BITS_MASK (3<<5)
-
-#define CR_UART_EN (1<<0)
-#define CR_SIREN   (1<<1)
-#define CR_SIRLP   (1<<2)
-#define CR_MSIE    (1<<3)
-#define CR_RIE     (1<<4)
-#define CR_TIE     (1<<5)
-#define CR_RTIE    (1<<6)
-#define CR_LBE     (1<<7)
-
-#define FR_CTS  (1<<0)
-#define FR_DSR  (1<<1)
-#define FR_DCD  (1<<2)
-#define FR_BUSY (1<<3)
-#define FR_RXFE (1<<4)
-#define FR_TXFF (1<<5)
-#define FR_RXFF (1<<6)
-#define FR_TXFE (1<<7)
-
-#define IIR_MIS (1<<0)
-#define IIR_RIS (1<<1)
-#define IIR_TIS (1<<2)
-#define IIR_RTIS (1<<3)
-#define IIR_MASK 0xf
-
-#define RTS_CR_AUTO (1<<0)
-#define RTS_CR_RTS  (1<<1)
-#define RTS_CR_COUNT (1<<2)
-#define RTS_CR_MOD2  (1<<3)
-#define RTS_CR_RTS_POL (1<<4)
-#define RTS_CR_CTS_CTR (1<<5)
-#define RTS_CR_CTS_POL (1<<6)
-#define RTS_CR_STICK   (1<<7)
-
-#define UART_PORT_SIZE 0x40
-#define DRIVER_NAME "netx-uart"
-
-struct netx_port {
-        struct uart_port        port;
-};
-
-static void netx_stop_tx(struct uart_port *port)
-{
-        unsigned int val;
-        val = readl(port->membase + UART_CR);
-        writel(val & ~CR_TIE,  port->membase + UART_CR);
-}
-
-static void netx_stop_rx(struct uart_port *port)
-{
-        unsigned int val;
-        val = readl(port->membase + UART_CR);
-        writel(val & ~CR_RIE,  port->membase + UART_CR);
-}
-
-static void netx_enable_ms(struct uart_port *port)
-{
-        unsigned int val;
-        val = readl(port->membase + UART_CR);
-        writel(val | CR_MSIE, port->membase + UART_CR);
-}
-
-static inline void netx_transmit_buffer(struct uart_port *port)
-{
-        struct circ_buf *xmit = &port->state->xmit;
-
-        if (port->x_char) {
-                writel(port->x_char, port->membase + UART_DR);
-                port->icount.tx++;
-                port->x_char = 0;
-                return;
-        }
-
-        if (uart_tx_stopped(port) || uart_circ_empty(xmit)) {
-                netx_stop_tx(port);
-                return;
-        }
-
-        do {
-                /* send xmit->buf[xmit->tail]
-                 * out the port here */
-                writel(xmit->buf[xmit->tail], port->membase + UART_DR);
-                xmit->tail = (xmit->tail + 1) &
-                         (UART_XMIT_SIZE - 1);
-                port->icount.tx++;
-                if (uart_circ_empty(xmit))
-                        break;
-        } while (!(readl(port->membase + UART_FR) & FR_TXFF));
-
-        if (uart_circ_empty(xmit))
-                netx_stop_tx(port);
-}
-
-static void netx_start_tx(struct uart_port *port)
-{
-        writel(
-            readl(port->membase + UART_CR) | CR_TIE, port->membase + UART_CR);
-
-        if (!(readl(port->membase + UART_FR) & FR_TXFF))
-                netx_transmit_buffer(port);
-}
-
-static unsigned int netx_tx_empty(struct uart_port *port)
-{
-        return readl(port->membase + UART_FR) & FR_BUSY ? 0 : TIOCSER_TEMT;
-}
-
-static void netx_txint(struct uart_port *port)
-{
-        struct circ_buf *xmit = &port->state->xmit;
-
-        if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                netx_stop_tx(port);
-                return;
-        }
-
-        netx_transmit_buffer(port);
-
-        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
-                uart_write_wakeup(port);
-}
-
-static void netx_rxint(struct uart_port *port, unsigned long *flags)
-{
-        unsigned char rx, flg, status;
-
-        while (!(readl(port->membase + UART_FR) & FR_RXFE)) {
-                rx = readl(port->membase + UART_DR);
-                flg = TTY_NORMAL;
-                port->icount.rx++;
-                status = readl(port->membase + UART_SR);
-                if (status & SR_BE) {
-                        writel(0, port->membase + UART_SR);
-                        if (uart_handle_break(port))
-                                continue;
-                }
-
-                if (unlikely(status & (SR_FE | SR_PE | SR_OE))) {
-
-                        if (status & SR_PE)
-                                port->icount.parity++;
-                        else if (status & SR_FE)
-                                port->icount.frame++;
-                        if (status & SR_OE)
-                                port->icount.overrun++;
-
-                        status &= port->read_status_mask;
-
-                        if (status & SR_BE)
-                                flg = TTY_BREAK;
-                        else if (status & SR_PE)
-                                flg = TTY_PARITY;
-                        else if (status & SR_FE)
-                                flg = TTY_FRAME;
-                }
-
-                if (uart_handle_sysrq_char(port, rx))
-                        continue;
-
-                uart_insert_char(port, status, SR_OE, rx, flg);
-        }
-
-        spin_unlock_irqrestore(&port->lock, *flags);
-        tty_flip_buffer_push(&port->state->port);
-        spin_lock_irqsave(&port->lock, *flags);
-}
-
-static irqreturn_t netx_int(int irq, void *dev_id)
-{
-        struct uart_port *port = dev_id;
-        unsigned long flags;
-        unsigned char status;
-
-        spin_lock_irqsave(&port->lock,flags);
-
-        status = readl(port->membase + UART_IIR) & IIR_MASK;
-        while (status) {
-                if (status & IIR_RIS)
-                        netx_rxint(port, &flags);
-                if (status & IIR_TIS)
-                        netx_txint(port);
-                if (status & IIR_MIS) {
-                        if (readl(port->membase + UART_FR) & FR_CTS)
-                                uart_handle_cts_change(port, 1);
-                        else
-                                uart_handle_cts_change(port, 0);
-                }
-                writel(0, port->membase + UART_IIR);
-                status = readl(port->membase + UART_IIR) & IIR_MASK;
-        }
-
-        spin_unlock_irqrestore(&port->lock,flags);
-        return IRQ_HANDLED;
-}
-
-static unsigned int netx_get_mctrl(struct uart_port *port)
-{
-        unsigned int ret = TIOCM_DSR | TIOCM_CAR;
-
-        if (readl(port->membase + UART_FR) & FR_CTS)
-                ret |= TIOCM_CTS;
-
-        return ret;
-}
-
-static void netx_set_mctrl(struct uart_port *port, unsigned int mctrl)
-{
-        unsigned int val;
-
-        /* FIXME: Locking needed ? */
-        if (mctrl & TIOCM_RTS) {
-                val = readl(port->membase + UART_RTS_CR);
-                writel(val | RTS_CR_RTS, port->membase + UART_RTS_CR);
-        }
-}
-
-static void netx_break_ctl(struct uart_port *port, int break_state)
-{
-        unsigned int line_cr;
-        spin_lock_irq(&port->lock);
-
-        line_cr = readl(port->membase + UART_LINE_CR);
-        if (break_state != 0)
-                line_cr |= LINE_CR_BRK;
-        else
-                line_cr &= ~LINE_CR_BRK;
-        writel(line_cr, port->membase + UART_LINE_CR);
-
-        spin_unlock_irq(&port->lock);
-}
-
-static int netx_startup(struct uart_port *port)
-{
-        int ret;
-
-        ret = request_irq(port->irq, netx_int, 0,
-                             DRIVER_NAME, port);
-        if (ret) {
-                dev_err(port->dev, "unable to grab irq%d\n",port->irq);
-                goto exit;
-        }
-
-        writel(readl(port->membase + UART_LINE_CR) | LINE_CR_FEN,
-                port->membase + UART_LINE_CR);
-
-        writel(CR_MSIE | CR_RIE | CR_TIE | CR_RTIE | CR_UART_EN,
-                port->membase + UART_CR);
-
-exit:
-        return ret;
-}
-
-static void netx_shutdown(struct uart_port *port)
-{
-        writel(0, port->membase + UART_CR) ;
-
-        free_irq(port->irq, port);
-}
-
-static void
-netx_set_termios(struct uart_port *port, struct ktermios *termios,
-                   struct ktermios *old)
-{
-        unsigned int baud, quot;
-        unsigned char old_cr;
-        unsigned char line_cr = LINE_CR_FEN;
-        unsigned char rts_cr = 0;
-
-        switch (termios->c_cflag & CSIZE) {
-        case CS5:
-                line_cr |= LINE_CR_5BIT;
-                break;
-        case CS6:
-                line_cr |= LINE_CR_6BIT;
-                break;
-        case CS7:
-                line_cr |= LINE_CR_7BIT;
-                break;
-        case CS8:
-                line_cr |= LINE_CR_8BIT;
-                break;
-        }
-
-        if (termios->c_cflag & CSTOPB)
-                line_cr |= LINE_CR_STP2;
-
-        if (termios->c_cflag & PARENB) {
-                line_cr |= LINE_CR_PEN;
-                if (!(termios->c_cflag & PARODD))
-                        line_cr |= LINE_CR_EPS;
-        }
-
-        if (termios->c_cflag & CRTSCTS)
-                rts_cr = RTS_CR_AUTO | RTS_CR_CTS_CTR | RTS_CR_RTS_POL;
-
-        baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
-        quot = baud * 4096;
-        quot /= 1000;
-        quot *= 256;
-        quot /= 100000;
-
-        spin_lock_irq(&port->lock);
-
-        uart_update_timeout(port, termios->c_cflag, baud);
-
-        old_cr = readl(port->membase + UART_CR);
-
-        /* disable interrupts */
-        writel(old_cr & ~(CR_MSIE | CR_RIE | CR_TIE | CR_RTIE),
-                port->membase + UART_CR);
-
-        /* drain transmitter */
-        while (readl(port->membase + UART_FR) & FR_BUSY);
-
-        /* disable UART */
-        writel(old_cr & ~CR_UART_EN, port->membase + UART_CR);
-
-        /* modem status interrupts */
-        old_cr &= ~CR_MSIE;
-        if (UART_ENABLE_MS(port, termios->c_cflag))
-                old_cr |= CR_MSIE;
-
-        writel((quot>>8) & 0xff, port->membase + UART_BAUDDIV_MSB);
-        writel(quot & 0xff, port->membase + UART_BAUDDIV_LSB);
-        writel(line_cr, port->membase + UART_LINE_CR);
-
-        writel(rts_cr, port->membase + UART_RTS_CR);
-
-        /*
-         * Characters to ignore
-         */
-        port->ignore_status_mask = 0;
-        if (termios->c_iflag & IGNPAR)
-                port->ignore_status_mask |= SR_PE;
-        if (termios->c_iflag & IGNBRK) {
-                port->ignore_status_mask |= SR_BE;
-                /*
-                 * If we're ignoring parity and break indicators,
-                 * ignore overruns too (for real raw support).
-                 */
-                if (termios->c_iflag & IGNPAR)
-                        port->ignore_status_mask |= SR_PE;
-        }
-
-        port->read_status_mask = 0;
-        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
-                port->read_status_mask |= SR_BE;
-        if (termios->c_iflag & INPCK)
-                port->read_status_mask |= SR_PE | SR_FE;
-
-        writel(old_cr, port->membase + UART_CR);
-
-        spin_unlock_irq(&port->lock);
-}
-
-static const char *netx_type(struct uart_port *port)
-{
-        return port->type == PORT_NETX ? "NETX" : NULL;
-}
-
-static void netx_release_port(struct uart_port *port)
-{
-        release_mem_region(port->mapbase, UART_PORT_SIZE);
-}
-
-static int netx_request_port(struct uart_port *port)
-{
-        return request_mem_region(port->mapbase, UART_PORT_SIZE,
-                        DRIVER_NAME) != NULL ? 0 : -EBUSY;
-}
-
-static void netx_config_port(struct uart_port *port, int flags)
-{
-        if (flags & UART_CONFIG_TYPE && netx_request_port(port) == 0)
-                port->type = PORT_NETX;
-}
-
-static int
-netx_verify_port(struct uart_port *port, struct serial_struct *ser)
-{
-        int ret = 0;
-
-        if (ser->type != PORT_UNKNOWN && ser->type != PORT_NETX)
-                ret = -EINVAL;
-
-        return ret;
-}
-
-static struct uart_ops netx_pops = {
-        .tx_empty       = netx_tx_empty,
-        .set_mctrl      = netx_set_mctrl,
-        .get_mctrl      = netx_get_mctrl,
-        .stop_tx        = netx_stop_tx,
-        .start_tx       = netx_start_tx,
-        .stop_rx        = netx_stop_rx,
-        .enable_ms      = netx_enable_ms,
-        .break_ctl      = netx_break_ctl,
-        .startup        = netx_startup,
-        .shutdown       = netx_shutdown,
-        .set_termios    = netx_set_termios,
-        .type           = netx_type,
-        .release_port   = netx_release_port,
-        .request_port   = netx_request_port,
-        .config_port    = netx_config_port,
-        .verify_port    = netx_verify_port,
-};
-
-static struct netx_port netx_ports[] = {
-        {
-        .port = {
-                .type = PORT_NETX,
-                .iotype = UPIO_MEM,
-                .membase = (char __iomem *)io_p2v(NETX_PA_UART0),
-                .mapbase = NETX_PA_UART0,
-                .irq = NETX_IRQ_UART0,
-                .uartclk = 100000000,
-                .fifosize = 16,
-                .flags = UPF_BOOT_AUTOCONF,
-                .ops = &netx_pops,
-                .line = 0,
-        },
-        }, {
-        .port = {
-                .type = PORT_NETX,
-                .iotype = UPIO_MEM,
-                .membase = (char __iomem *)io_p2v(NETX_PA_UART1),
-                .mapbase = NETX_PA_UART1,
-                .irq = NETX_IRQ_UART1,
-                .uartclk = 100000000,
-                .fifosize = 16,
-                .flags = UPF_BOOT_AUTOCONF,
-                .ops = &netx_pops,
-                .line = 1,
-        },
-        }, {
-        .port = {
-                .type = PORT_NETX,
-                .iotype = UPIO_MEM,
-                .membase = (char __iomem *)io_p2v(NETX_PA_UART2),
-                .mapbase = NETX_PA_UART2,
-                .irq = NETX_IRQ_UART2,
-                .uartclk = 100000000,
-                .fifosize = 16,
-                .flags = UPF_BOOT_AUTOCONF,
-                .ops = &netx_pops,
-                .line = 2,
-        },
-        }
-};
-
-#ifdef CONFIG_SERIAL_NETX_CONSOLE
-
-static void netx_console_putchar(struct uart_port *port, int ch)
-{
-        while (readl(port->membase + UART_FR) & FR_BUSY);
-        writel(ch, port->membase + UART_DR);
-}
-
-static void
-netx_console_write(struct console *co, const char *s, unsigned int count)
-{
-        struct uart_port *port = &netx_ports[co->index].port;
-        unsigned char cr_save;
-
-        cr_save = readl(port->membase + UART_CR);
-        writel(cr_save | CR_UART_EN, port->membase + UART_CR);
-
-        uart_console_write(port, s, count, netx_console_putchar);
-
-        while (readl(port->membase + UART_FR) & FR_BUSY);
-        writel(cr_save, port->membase + UART_CR);
-}
-
-static void __init
-netx_console_get_options(struct uart_port *port, int *baud,
-                        int *parity, int *bits, int *flow)
-{
-        unsigned char line_cr;
-
-        *baud = (readl(port->membase + UART_BAUDDIV_MSB) << 8) |
-                readl(port->membase + UART_BAUDDIV_LSB);
-        *baud *= 1000;
-        *baud /= 4096;
-        *baud *= 1000;
-        *baud /= 256;
-        *baud *= 100;
-
-        line_cr = readl(port->membase + UART_LINE_CR);
-        *parity = 'n';
-        if (line_cr & LINE_CR_PEN) {
-                if (line_cr & LINE_CR_EPS)
-                        *parity = 'e';
-                else
-                        *parity = 'o';
-        }
-
-        switch (line_cr & LINE_CR_BITS_MASK) {
-        case LINE_CR_8BIT:
-                *bits = 8;
-                break;
-        case LINE_CR_7BIT:
-                *bits = 7;
-                break;
-        case LINE_CR_6BIT:
-                *bits = 6;
-                break;
-        case LINE_CR_5BIT:
-                *bits = 5;
-                break;
-        }
-
-        if (readl(port->membase + UART_RTS_CR) & RTS_CR_AUTO)
-                *flow = 'r';
-}
-
-static int __init
-netx_console_setup(struct console *co, char *options)
-{
-        struct netx_port *sport;
-        int baud = 9600;
-        int bits = 8;
-        int parity = 'n';
-        int flow = 'n';
-
-        /*
-         * Check whether an invalid uart number has been specified, and
-         * if so, search for the first available port that does have
-         * console support.
-         */
-        if (co->index == -1 || co->index >= ARRAY_SIZE(netx_ports))
-                co->index = 0;
-        sport = &netx_ports[co->index];
-
-        if (options) {
-                uart_parse_options(options, &baud, &parity, &bits, &flow);
-        } else {
-                /* if the UART is enabled, assume it has been correctly setup
-                 * by the bootloader and get the options
-                 */
-                if (readl(sport->port.membase + UART_CR) & CR_UART_EN) {
-                        netx_console_get_options(&sport->port, &baud,
-                        &parity, &bits, &flow);
-                }
-
-        }
-
-        return uart_set_options(&sport->port, co, baud, parity, bits, flow);
-}
-
-static struct uart_driver netx_reg;
-static struct console netx_console = {
-        .name           = "ttyNX",
-        .write          = netx_console_write,
-        .device         = uart_console_device,
-        .setup          = netx_console_setup,
-        .flags          = CON_PRINTBUFFER,
-        .index          = -1,
-        .data           = &netx_reg,
-};
-
-static int __init netx_console_init(void)
-{
-        register_console(&netx_console);
-        return 0;
-}
-console_initcall(netx_console_init);
-
-#define NETX_CONSOLE    &netx_console
-#else
-#define NETX_CONSOLE    NULL
-#endif
-
-static struct uart_driver netx_reg = {
-        .owner          = THIS_MODULE,
-        .driver_name    = DRIVER_NAME,
-        .dev_name       = "ttyNX",
-        .major          = SERIAL_NX_MAJOR,
-        .minor          = MINOR_START,
-        .nr             = ARRAY_SIZE(netx_ports),
-        .cons           = NETX_CONSOLE,
-};
-
-static int serial_netx_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        struct netx_port *sport = platform_get_drvdata(pdev);
-
-        if (sport)
-                uart_suspend_port(&netx_reg, &sport->port);
-
-        return 0;
-}
-
-static int serial_netx_resume(struct platform_device *pdev)
-{
-        struct netx_port *sport = platform_get_drvdata(pdev);
-
-        if (sport)
-                uart_resume_port(&netx_reg, &sport->port);
-
-        return 0;
-}
-
-static int serial_netx_probe(struct platform_device *pdev)
-{
-        struct uart_port *port = &netx_ports[pdev->id].port;
-
-        dev_info(&pdev->dev, "initialising\n");
-
-        port->dev = &pdev->dev;
-
-        writel(1, port->membase + UART_RXFIFO_IRQLEVEL);
-        uart_add_one_port(&netx_reg, &netx_ports[pdev->id].port);
-        platform_set_drvdata(pdev, &netx_ports[pdev->id]);
-
-        return 0;
-}
-
-static int serial_netx_remove(struct platform_device *pdev)
-{
-        struct netx_port *sport = platform_get_drvdata(pdev);
-
-        if (sport)
-                uart_remove_one_port(&netx_reg, &sport->port);
-
-        return 0;
-}
-
-static struct platform_driver serial_netx_driver = {
-        .probe          = serial_netx_probe,
-        .remove         = serial_netx_remove,
-
-        .suspend        = serial_netx_suspend,
-        .resume         = serial_netx_resume,
-
-        .driver         = {
-                .name   = DRIVER_NAME,
-        },
-};
-
-static int __init netx_serial_init(void)
-{
-        int ret;
-
-        printk(KERN_INFO "Serial: NetX driver\n");
-
-        ret = uart_register_driver(&netx_reg);
-        if (ret)
-                return ret;
-
-        ret = platform_driver_register(&serial_netx_driver);
-        if (ret != 0)
-                uart_unregister_driver(&netx_reg);
-
-        return 0;
-}
-
-static void __exit netx_serial_exit(void)
-{
-        platform_driver_unregister(&serial_netx_driver);
-        uart_unregister_driver(&netx_reg);
-}
-
-module_init(netx_serial_init);
-module_exit(netx_serial_exit);
-
-MODULE_AUTHOR("Sascha Hauer");
-MODULE_DESCRIPTION("NetX serial port driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index 717292c1c0df..60ff236a3d63 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -93,8 +93,7 @@ static void __ldsem_wake_readers(struct ld_semaphore *sem)
 
         list_for_each_entry_safe(waiter, next, &sem->read_wait, list) {
                 tsk = waiter->task;
-                smp_mb();
-                waiter->task = NULL;
+                smp_store_release(&waiter->task, NULL);
                 wake_up_process(tsk);
                 put_task_struct(tsk);
         }
@@ -194,7 +193,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout)
         for (;;) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
 
-                if (!waiter.task)
+                if (!smp_load_acquire(&waiter.task))
                         break;
                 if (!timeout)
                         break;
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index ec92f36ab5c4..34aa39d1aed9 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -3771,7 +3771,11 @@ static ssize_t show_bind(struct device *dev, struct device_attribute *attr,
                          char *buf)
 {
         struct con_driver *con = dev_get_drvdata(dev);
-        int bind = con_is_bound(con->con);
+        int bind;
+
+        console_lock();
+        bind = con_is_bound(con->con);
+        console_unlock();
 
         return snprintf(buf, PAGE_SIZE, "%i\n", bind);
 }
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 88533938ce19..9320787ac2e6 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -3052,8 +3052,8 @@ int usb_hcd_setup_local_mem(struct usb_hcd *hcd, phys_addr_t phys_addr,
 
         local_mem = devm_memremap(hcd->self.sysdev, phys_addr,
                                   size, MEMREMAP_WC);
-        if (!local_mem)
-                return -ENOMEM;
+        if (IS_ERR(local_mem))
+                return PTR_ERR(local_mem);
 
         /*
          * Here we pass a dma_addr_t but the arg type is a phys_addr_t.
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index fe9422d3bcdc..b0882c13a1d1 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -149,7 +149,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         case PCI_VENDOR_ID_AMD:
                 /* AMD PLL quirk */
-                if (usb_amd_find_chipset_info())
+                if (usb_amd_quirk_pll_check())
                         ehci->amd_pll_fix = 1;
                 /* AMD8111 EHCI doesn't work, according to AMD errata */
                 if (pdev->device == 0x7463) {
@@ -186,7 +186,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         case PCI_VENDOR_ID_ATI:
                 /* AMD PLL quirk */
-                if (usb_amd_find_chipset_info())
+                if (usb_amd_quirk_pll_check())
                         ehci->amd_pll_fix = 1;
 
                 /*
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 09a8ebd95588..6968b9f2b76b 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ out:
         return result;
 
 error_set_cluster_id:
-        wusb_cluster_id_put(wusbhc->cluster_id);
+        wusb_cluster_id_put(addr);
 error_cluster_id_get:
         goto out;
 
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index a033f7d855e0..f4e13a3fddee 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -152,7 +152,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
 {
         struct ohci_hcd *ohci = hcd_to_ohci(hcd);
 
-        if (usb_amd_find_chipset_info())
+        if (usb_amd_quirk_pll_check())
                 ohci->flags |= OHCI_QUIRK_AMD_PLL;
 
         /* SB800 needs pre-fetch fix */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 3ce71cbfbb58..f6d04491df60 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -132,7 +132,7 @@ static struct amd_chipset_info {
         struct amd_chipset_type sb_type;
         int isoc_reqs;
         int probe_count;
-        int probe_result;
+        bool need_pll_quirk;
 } amd_chipset;
 
 static DEFINE_SPINLOCK(amd_lock);
@@ -201,11 +201,11 @@ void sb800_prefetch(struct device *dev, int on)
 }
 EXPORT_SYMBOL_GPL(sb800_prefetch);
 
-int usb_amd_find_chipset_info(void)
+static void usb_amd_find_chipset_info(void)
 {
         unsigned long flags;
         struct amd_chipset_info info;
-        int ret;
+        info.need_pll_quirk = 0;
 
         spin_lock_irqsave(&amd_lock, flags);
 
@@ -213,27 +213,34 @@ int usb_amd_find_chipset_info(void)
         if (amd_chipset.probe_count > 0) {
                 amd_chipset.probe_count++;
                 spin_unlock_irqrestore(&amd_lock, flags);
-                return amd_chipset.probe_result;
+                return;
         }
         memset(&info, 0, sizeof(info));
         spin_unlock_irqrestore(&amd_lock, flags);
 
         if (!amd_chipset_sb_type_init(&info)) {
-                ret = 0;
                 goto commit;
         }
 
-        /* Below chipset generations needn't enable AMD PLL quirk */
-        if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
-                        info.sb_type.gen == AMD_CHIPSET_SB600 ||
-                        info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
-                        (info.sb_type.gen == AMD_CHIPSET_SB700 &&
-                        info.sb_type.rev > 0x3b)) {
+        switch (info.sb_type.gen) {
+        case AMD_CHIPSET_SB700:
+                info.need_pll_quirk = info.sb_type.rev <= 0x3B;
+                break;
+        case AMD_CHIPSET_SB800:
+        case AMD_CHIPSET_HUDSON2:
+        case AMD_CHIPSET_BOLTON:
+                info.need_pll_quirk = 1;
+                break;
+        default:
+                info.need_pll_quirk = 0;
+                break;
+        }
+
+        if (!info.need_pll_quirk) {
                 if (info.smbus_dev) {
                         pci_dev_put(info.smbus_dev);
                         info.smbus_dev = NULL;
                 }
-                ret = 0;
                 goto commit;
         }
 
@@ -252,7 +259,6 @@ int usb_amd_find_chipset_info(void)
                 }
         }
 
-        ret = info.probe_result = 1;
         printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
 
 commit:
@@ -263,7 +269,6 @@ commit:
 
                 /* Mark that we where here */
                 amd_chipset.probe_count++;
-                ret = amd_chipset.probe_result;
 
                 spin_unlock_irqrestore(&amd_lock, flags);
 
@@ -276,10 +281,7 @@ commit:
                 amd_chipset = info;
                 spin_unlock_irqrestore(&amd_lock, flags);
         }
-
-        return ret;
 }
-EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
 
 int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
 {
@@ -315,6 +317,13 @@ bool usb_amd_prefetch_quirk(void)
 }
 EXPORT_SYMBOL_GPL(usb_amd_prefetch_quirk);
 
+bool usb_amd_quirk_pll_check(void)
+{
+        usb_amd_find_chipset_info();
+        return amd_chipset.need_pll_quirk;
+}
+EXPORT_SYMBOL_GPL(usb_amd_quirk_pll_check);
+
 /*
  * The hardware normally enables the A-link power management feature, which
  * lets the system lower the power consumption in idle states.
@@ -520,7 +529,7 @@ void usb_amd_dev_put(void)
         amd_chipset.nb_type = 0;
         memset(&amd_chipset.sb_type, 0, sizeof(amd_chipset.sb_type));
         amd_chipset.isoc_reqs = 0;
-        amd_chipset.probe_result = 0;
+        amd_chipset.need_pll_quirk = 0;
 
         spin_unlock_irqrestore(&amd_lock, flags);
 
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 63c633077d9e..e729de21fad7 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -5,11 +5,11 @@
 #ifdef CONFIG_USB_PCI
 void uhci_reset_hc(struct pci_dev *pdev, unsigned long base);
 int uhci_check_and_reset_hc(struct pci_dev *pdev, unsigned long base);
-int usb_amd_find_chipset_info(void);
 int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev);
 bool usb_amd_hang_symptom_quirk(void);
 bool usb_amd_prefetch_quirk(void);
 void usb_amd_dev_put(void);
+bool usb_amd_quirk_pll_check(void);
 void usb_amd_quirk_pll_disable(void);
 void usb_amd_quirk_pll_enable(void);
 void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index c2fe218e051f..1e0236e90687 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -130,7 +130,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_AMD_0x96_HOST;
 
         /* AMD PLL quirk */
-        if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_quirk_pll_check())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
 
         if (pdev->vendor == PCI_VENDOR_ID_AMD &&
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 7a264962a1a9..f5c41448d067 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb)
         if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) &&
             usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE &&
             urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE &&
-            !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP))
+            !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) &&
+            !urb->num_sgs)
                 return true;
 
         return false;
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4d6ae3795a88..6ca9111d150a 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -375,7 +375,8 @@ out_err:
 
 #ifdef CONFIG_OF
 static void usb251xb_get_ports_field(struct usb251xb *hub,
-                                    const char *prop_name, u8 port_cnt, u8 *fld)
+                                    const char *prop_name, u8 port_cnt,
+                                    bool ds_only, u8 *fld)
 {
         struct device *dev = hub->dev;
         struct property *prop;
@@ -383,7 +384,7 @@ static void usb251xb_get_ports_field(struct usb251xb *hub,
         u32 port;
 
         of_property_for_each_u32(dev->of_node, prop_name, prop, p, port) {
-                if ((port >= 1) && (port <= port_cnt))
+                if ((port >= ds_only ? 1 : 0) && (port <= port_cnt))
                         *fld |= BIT(port);
                 else
                         dev_warn(dev, "port %u doesn't exist\n", port);
@@ -501,15 +502,15 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
 
         hub->non_rem_dev = USB251XB_DEF_NON_REMOVABLE_DEVICES;
         usb251xb_get_ports_field(hub, "non-removable-ports", data->port_cnt,
-                                 &hub->non_rem_dev);
+                                 true, &hub->non_rem_dev);
 
         hub->port_disable_sp = USB251XB_DEF_PORT_DISABLE_SELF;
         usb251xb_get_ports_field(hub, "sp-disabled-ports", data->port_cnt,
-                                 &hub->port_disable_sp);
+                                 true, &hub->port_disable_sp);
 
         hub->port_disable_bp = USB251XB_DEF_PORT_DISABLE_BUS;
         usb251xb_get_ports_field(hub, "bp-disabled-ports", data->port_cnt,
-                                 &hub->port_disable_bp);
+                                 true, &hub->port_disable_bp);
 
         hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
         if (!of_property_read_u32(np, "sp-max-total-current-microamp",
@@ -573,9 +574,7 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
          */
         hub->port_swap = USB251XB_DEF_PORT_SWAP;
         usb251xb_get_ports_field(hub, "swap-dx-lanes", data->port_cnt,
-                                 &hub->port_swap);
-        if (of_get_property(np, "swap-us-lanes", NULL))
-                hub->port_swap |= BIT(0);
+                                 false, &hub->port_swap);
 
         /* The following parameters are currently not exposed to devicetree, but
          * may be as soon as needed.
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 30790240aec6..05b80211290d 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -28,6 +28,8 @@
  * status of a command.
  */
 
+#include <linux/blkdev.h>
+#include <linux/dma-mapping.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 
@@ -99,6 +101,7 @@ static int slave_alloc (struct scsi_device *sdev)
 static int slave_configure(struct scsi_device *sdev)
 {
         struct us_data *us = host_to_us(sdev->host);
+        struct device *dev = us->pusb_dev->bus->sysdev;
 
         /*
          * Many devices have trouble transferring more than 32KB at a time,
@@ -129,6 +132,14 @@ static int slave_configure(struct scsi_device *sdev)
         }
 
         /*
+         * The max_hw_sectors should be up to maximum size of a mapping for
+         * the device. Otherwise, a DMA API might fail on swiotlb environment.
+         */
+        blk_queue_max_hw_sectors(sdev->request_queue,
+                min_t(size_t, queue_max_hw_sectors(sdev->request_queue),
+                      dma_max_mapping_size(dev) >> SECTOR_SHIFT));
+
+        /*
          * Some USB host controllers can't do DMA; they have to use PIO.
          * They indicate this by setting their dma_mask to NULL.  For
          * such controllers we need to make sure the block layer sets
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 819296332913..42a8c2a13ab1 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -96,7 +96,7 @@ struct vhost_uaddr {
 };
 
 #if defined(CONFIG_MMU_NOTIFIER) && ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 0
-#define VHOST_ARCH_CAN_ACCEL_UACCESS 1
+#define VHOST_ARCH_CAN_ACCEL_UACCESS 0
 #else
 #define VHOST_ARCH_CAN_ACCEL_UACCESS 0
 #endif
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 4c339c7e66e5..a446a7221e13 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1143,7 +1143,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                 goto out_put_map;
 
         if (!use_ptemod) {
-                err = vm_map_pages(vma, map->pages, map->count);
+                err = vm_map_pages_zero(vma, map->pages, map->count);
                 if (err)
                         goto out_put_map;
         } else {
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 2f5ce7230a43..c6070e70dd73 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -724,25 +724,6 @@ static long privcmd_ioctl_restrict(struct file *file, void __user *udata)
         return 0;
 }
 
-struct remap_pfn {
-        struct mm_struct *mm;
-        struct page **pages;
-        pgprot_t prot;
-        unsigned long i;
-};
-
-static int remap_pfn_fn(pte_t *ptep, unsigned long addr, void *data)
-{
-        struct remap_pfn *r = data;
-        struct page *page = r->pages[r->i];
-        pte_t pte = pte_mkspecial(pfn_pte(page_to_pfn(page), r->prot));
-
-        set_pte_at(r->mm, addr, ptep, pte);
-        r->i++;
-
-        return 0;
-}
-
 static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
 {
         struct privcmd_data *data = file->private_data;
@@ -774,7 +755,8 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
                 goto out;
         }
 
-        if (xen_feature(XENFEAT_auto_translated_physmap)) {
+        if (IS_ENABLED(CONFIG_XEN_AUTO_XLATE) &&
+            xen_feature(XENFEAT_auto_translated_physmap)) {
                 unsigned int nr = DIV_ROUND_UP(kdata.num, XEN_PFN_PER_PAGE);
                 struct page **pages;
                 unsigned int i;
@@ -808,16 +790,9 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
         if (rc)
                 goto out;
 
-        if (xen_feature(XENFEAT_auto_translated_physmap)) {
-                struct remap_pfn r = {
-                        .mm = vma->vm_mm,
-                        .pages = vma->vm_private_data,
-                        .prot = vma->vm_page_prot,
-                };
-
-                rc = apply_to_page_range(r.mm, kdata.addr,
-                                         kdata.num << PAGE_SHIFT,
-                                         remap_pfn_fn, &r);
+        if (IS_ENABLED(CONFIG_XEN_AUTO_XLATE) &&
+            xen_feature(XENFEAT_auto_translated_physmap)) {
+                rc = xen_remap_vma_range(vma, kdata.addr, kdata.num << PAGE_SHIFT);
         } else {
                 unsigned int domid =
                         (xdata.flags & XENMEM_rsrc_acq_caller_owned) ?
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index cfbe46785a3b..ae1df496bf38 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -83,34 +83,18 @@ static inline dma_addr_t xen_virt_to_bus(void *address)
         return xen_phys_to_bus(virt_to_phys(address));
 }
 
-static int check_pages_physically_contiguous(unsigned long xen_pfn,
-                                             unsigned int offset,
-                                             size_t length)
+static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
 {
-        unsigned long next_bfn;
-        int i;
-        int nr_pages;
+        unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
+        unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
 
         next_bfn = pfn_to_bfn(xen_pfn);
-        nr_pages = (offset + length + XEN_PAGE_SIZE-1) >> XEN_PAGE_SHIFT;
 
-        for (i = 1; i < nr_pages; i++) {
+        for (i = 1; i < nr_pages; i++)
                 if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
-                        return 0;
-        }
-        return 1;
-}
+                        return 1;
 
-static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
-{
-        unsigned long xen_pfn = XEN_PFN_DOWN(p);
-        unsigned int offset = p & ~XEN_PAGE_MASK;
-
-        if (offset + size <= XEN_PAGE_SIZE)
-                return 0;
-        if (check_pages_physically_contiguous(xen_pfn, offset, size))
-                return 0;
-        return 1;
+        return 0;
 }
 
 static int is_xen_swiotlb_buffer(dma_addr_t dma_addr)
@@ -338,6 +322,7 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                         xen_free_coherent_pages(hwdev, size, ret, (dma_addr_t)phys, attrs);
                         return NULL;
                 }
+                SetPageXenRemapped(virt_to_page(ret));
         }
         memset(ret, 0, size);
         return ret;
@@ -361,8 +346,9 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
         /* Convert the size to actually allocated. */
         size = 1UL << (order + XEN_PAGE_SHIFT);
 
-        if (((dev_addr + size - 1 <= dma_mask)) ||
-            range_straddles_page_boundary(phys, size))
+        if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
+                     range_straddles_page_boundary(phys, size)) &&
+            TestClearPageXenRemapped(virt_to_page(vaddr)))
                 xen_destroy_contiguous_region(phys, order);
 
         xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
index 73427d8e0116..e5694133ebe5 100644
--- a/drivers/xen/xen-pciback/conf_space_capability.c
+++ b/drivers/xen/xen-pciback/conf_space_capability.c
@@ -116,13 +116,12 @@ static int pm_ctrl_write(struct pci_dev *dev, int offset, u16 new_value,
 {
         int err;
         u16 old_value;
-        pci_power_t new_state, old_state;
+        pci_power_t new_state;
 
         err = pci_read_config_word(dev, offset, &old_value);
         if (err)
                 goto out;
 
-        old_state = (pci_power_t)(old_value & PCI_PM_CTRL_STATE_MASK);
         new_state = (pci_power_t)(new_value & PCI_PM_CTRL_STATE_MASK);
 
         new_value &= PM_OK_BITS;
diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index ba883a80b3c0..7b1077f0abcb 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -262,3 +262,35 @@ int __init xen_xlate_map_ballooned_pages(xen_pfn_t **gfns, void **virt,
         return 0;
 }
 EXPORT_SYMBOL_GPL(xen_xlate_map_ballooned_pages);
+
+struct remap_pfn {
+        struct mm_struct *mm;
+        struct page **pages;
+        pgprot_t prot;
+        unsigned long i;
+};
+
+static int remap_pfn_fn(pte_t *ptep, unsigned long addr, void *data)
+{
+        struct remap_pfn *r = data;
+        struct page *page = r->pages[r->i];
+        pte_t pte = pte_mkspecial(pfn_pte(page_to_pfn(page), r->prot));
+
+        set_pte_at(r->mm, addr, ptep, pte);
+        r->i++;
+
+        return 0;
+}
+
+/* Used by the privcmd module, but has to be built-in on ARM */
+int xen_remap_vma_range(struct vm_area_struct *vma, unsigned long addr, unsigned long len)
+{
+        struct remap_pfn r = {
+                .mm = vma->vm_mm,
+                .pages = vma->vm_private_data,
+                .prot = vma->vm_page_prot,
+        };
+
+        return apply_to_page_range(vma->vm_mm, addr, len, remap_pfn_fn, &r);
+}
+EXPORT_SYMBOL_GPL(xen_remap_vma_range);