129 files changed, 1355 insertions, 809 deletions
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index e4ffaeec9ec2..a4c8ad98560d 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1138,7 +1138,7 @@ int acpi_subsys_thaw_noirq(struct device *dev)
         * skip all of the subsequent "thaw" callbacks for the device.
         */
        if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                return 0;
        }
diff --git a/drivers/ata/ahci_mtk.c b/drivers/ata/ahci_mtk.c
index 80854f71559a..0ae6971c2a4c 100644
--- a/drivers/ata/ahci_mtk.c
+++ b/drivers/ata/ahci_mtk.c
@@ -1,5 +1,5 @@
 /*
- * MeidaTek AHCI SATA driver
+ * MediaTek AHCI SATA driver
 *
 * Copyright (c) 2017 MediaTek Inc.
 * Author: Ryder Lee <ryder.lee@mediatek.com>
@@ -25,7 +25,7 @@
 #include <linux/reset.h>
 #include "ahci.h"
-#define DRV_NAME                "ahci"
+#define DRV_NAME                "ahci-mtk"
 #define SYS_CFG                 0x14
 #define SYS_CFG_SATA_MSK        GENMASK(31, 30)
@@ -192,5 +192,5 @@ static struct platform_driver mtk_ahci_driver = {
 };
 module_platform_driver(mtk_ahci_driver);
-MODULE_DESCRIPTION("MeidaTek SATA AHCI Driver");
+MODULE_DESCRIPTION("MediaTek SATA AHCI Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index b6b0bf76dfc7..2685f28160f7 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -35,6 +35,8 @@
 /* port register default value */
 #define AHCI_PORT_PHY_1_CFG     0xa003fffe
+#define AHCI_PORT_PHY2_CFG      0x28184d1f
+#define AHCI_PORT_PHY3_CFG      0x0e081509
 #define AHCI_PORT_TRANS_CFG     0x08000029
 #define AHCI_PORT_AXICC_CFG     0x3fffffff
@@ -183,6 +185,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                qpriv->ecc_addr);
                writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                if (qpriv->is_dmacoherent)
                        writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -190,6 +194,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
        case AHCI_LS2080A:
                writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                if (qpriv->is_dmacoherent)
                        writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -201,6 +207,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                qpriv->ecc_addr);
                writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                if (qpriv->is_dmacoherent)
                        writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -212,6 +220,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                writel(readl(qpriv->ecc_addr) | ECC_DIS_LS1088A,
                       qpriv->ecc_addr);
                writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                if (qpriv->is_dmacoherent)
                        writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -219,6 +229,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
        case AHCI_LS2088A:
                writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                if (qpriv->is_dmacoherent)
                        writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2a882929de4a..8193b38a1cae 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3082,13 +3082,19 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
        bit = fls(mask) - 1;
        mask &= ~(1 << bit);
-        /* Mask off all speeds higher than or equal to the current
+        /*
-         * one.  Force 1.5Gbps if current SPD is not available.
+         * Mask off all speeds higher than or equal to the current one.  At
+         * this point, if current SPD is not available and we previously
+         * recorded the link speed from SStatus, the driver has already
+         * masked off the highest bit so mask should already be 1 or 0.
+         * Otherwise, we should not force 1.5Gbps on a link where we have
+         * not previously recorded speed from SStatus.  Just return in this
+         * case.
         */
        if (spd > 1)
                mask &= (1 << (spd - 1)) - 1;
        else
-                mask &= 1;
+                return -EINVAL;
        /* were we already at the bottom? */
        if (!mask)
diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
index ffd8d33c6e0f..6db2e34bd52f 100644
--- a/drivers/ata/pata_pdc2027x.c
+++ b/drivers/ata/pata_pdc2027x.c
@@ -82,7 +82,7 @@ static int pdc2027x_set_mode(struct ata_link *link, struct ata_device **r_failed
 * is issued to the device. However, if the controller clock is 133MHz,
 * the following tables must be used.
 */
-static struct pdc2027x_pio_timing {
+static const struct pdc2027x_pio_timing {
        u8 value0, value1, value2;
 } pdc2027x_pio_timing_tbl[] = {
        { 0xfb, 0x2b, 0xac }, /* PIO mode 0 */
@@ -92,7 +92,7 @@ static struct pdc2027x_pio_timing {
        { 0x23, 0x09, 0x25 }, /* PIO mode 4, IORDY on, Prefetch off */
 };
-static struct pdc2027x_mdma_timing {
+static const struct pdc2027x_mdma_timing {
        u8 value0, value1;
 } pdc2027x_mdma_timing_tbl[] = {
        { 0xdf, 0x5f }, /* MDMA mode 0 */
@@ -100,7 +100,7 @@ static struct pdc2027x_mdma_timing {
        { 0x69, 0x25 }, /* MDMA mode 2 */
 };
-static struct pdc2027x_udma_timing {
+static const struct pdc2027x_udma_timing {
        u8 value0, value1, value2;
 } pdc2027x_udma_timing_tbl[] = {
        { 0x4a, 0x0f, 0xd5 }, /* UDMA mode 0 */
@@ -649,7 +649,7 @@ static long pdc_detect_pll_input_clock(struct ata_host *host)
 * @host: target ATA host
 * @board_idx: board identifier
 */
-static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
+static void pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 {
        long pll_clock;
@@ -665,8 +665,6 @@ static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
        /* Adjust PLL control register */
        pdc_adjust_pll(host, pll_clock, board_idx);
-        return 0;
 }
 /**
@@ -753,8 +751,7 @@ static int pdc2027x_init_one(struct pci_dev *pdev,
        //pci_enable_intx(pdev);
        /* initialize adapter */
-        if (pdc_hardware_init(host, board_idx) != 0)
+        pdc_hardware_init(host, board_idx);
-                return -EIO;
        pci_set_master(pdev);
        return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
@@ -778,8 +775,7 @@ static int pdc2027x_reinit_one(struct pci_dev *pdev)
        else
                board_idx = PDC_UDMA_133;
-        if (pdc_hardware_init(host, board_idx))
+        pdc_hardware_init(host, board_idx);
-                return -EIO;
        ata_host_resume(host);
        return 0;
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index db2f04415927..08744b572af6 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -526,6 +526,21 @@ static void dpm_watchdog_clear(struct dpm_watchdog *wd)
 /*------------------------- Resume routines -------------------------*/
 /**
+ * dev_pm_skip_next_resume_phases - Skip next system resume phases for device.
+ * @dev: Target device.
+ *
+ * Make the core skip the "early resume" and "resume" phases for @dev.
+ *
+ * This function can be called by middle-layer code during the "noirq" phase of
+ * system resume if necessary, but not by device drivers.
+ */
+void dev_pm_skip_next_resume_phases(struct device *dev)
+{
+        dev->power.is_late_suspended = false;
+        dev->power.is_suspended = false;
+}
+/**
 * device_resume_noirq - Execute a "noirq resume" callback for given device.
 * @dev: Device to handle.
 * @state: PM transition of the system being carried out.
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 779869ed32b1..71fad747c0c7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -199,6 +199,9 @@ struct smi_info {
        /* The timer for this si. */
        struct timer_list   si_timer;
+        /* This flag is set, if the timer can be set */
+        bool                timer_can_start;
        /* This flag is set, if the timer is running (timer_pending() isn't enough) */
        bool                timer_running;
@@ -355,6 +358,8 @@ out:
 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 {
+        if (!smi_info->timer_can_start)
+                return;
        smi_info->last_timeout_jiffies = jiffies;
        mod_timer(&smi_info->si_timer, new_val);
        smi_info->timer_running = true;
@@ -374,21 +379,18 @@ static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
        smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
 }
-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
+static void start_check_enables(struct smi_info *smi_info)
 {
        unsigned char msg[2];
        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
        msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
-        if (start_timer)
+        start_new_msg(smi_info, msg, 2);
-                start_new_msg(smi_info, msg, 2);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
        smi_info->si_state = SI_CHECKING_ENABLES;
 }
-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+static void start_clear_flags(struct smi_info *smi_info)
 {
        unsigned char msg[3];
@@ -397,10 +399,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
        msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
        msg[2] = WDT_PRE_TIMEOUT_INT;
-        if (start_timer)
+        start_new_msg(smi_info, msg, 3);
-                start_new_msg(smi_info, msg, 3);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
        smi_info->si_state = SI_CLEARING_FLAGS;
 }
@@ -435,11 +434,11 @@ static void start_getting_events(struct smi_info *smi_info)
 * Note that we cannot just use disable_irq(), since the interrupt may
 * be shared.
 */
-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
+static inline bool disable_si_irq(struct smi_info *smi_info)
 {
        if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
                smi_info->interrupt_disabled = true;
-                start_check_enables(smi_info, start_timer);
+                start_check_enables(smi_info);
                return true;
        }
        return false;
@@ -449,7 +448,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
        if ((smi_info->io.irq) && (smi_info->interrupt_disabled)) {
                smi_info->interrupt_disabled = false;
-                start_check_enables(smi_info, true);
+                start_check_enables(smi_info);
                return true;
        }
        return false;
@@ -467,7 +466,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
        msg = ipmi_alloc_smi_msg();
        if (!msg) {
-                if (!disable_si_irq(smi_info, true))
+                if (!disable_si_irq(smi_info))
                        smi_info->si_state = SI_NORMAL;
        } else if (enable_si_irq(smi_info)) {
                ipmi_free_smi_msg(msg);
@@ -483,7 +482,7 @@ retry:
                /* Watchdog pre-timeout */
                smi_inc_stat(smi_info, watchdog_pretimeouts);
-                start_clear_flags(smi_info, true);
+                start_clear_flags(smi_info);
                smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
                if (smi_info->intf)
                        ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -866,7 +865,7 @@ restart:
                 * disable and messages disabled.
                 */
                if (smi_info->supports_event_msg_buff || smi_info->io.irq) {
-                        start_check_enables(smi_info, true);
+                        start_check_enables(smi_info);
                } else {
                        smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
                        if (!smi_info->curr_msg)
@@ -1167,6 +1166,7 @@ static int smi_start_processing(void       *send_info,
        /* Set up the timer that drives the interface. */
        timer_setup(&new_smi->si_timer, smi_timeout, 0);
+        new_smi->timer_can_start = true;
        smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
        /* Try to claim any interrupts. */
@@ -1936,10 +1936,12 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
        check_set_rcv_irq(smi_info);
 }
-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
+static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
        if (smi_info->thread != NULL)
                kthread_stop(smi_info->thread);
+        smi_info->timer_can_start = false;
        if (smi_info->timer_running)
                del_timer_sync(&smi_info->si_timer);
 }
@@ -2152,7 +2154,7 @@ static int try_smi_init(struct smi_info *new_smi)
         * Start clearing the flags before we enable interrupts or the
         * timer to avoid racing with the timer.
         */
-        start_clear_flags(new_smi, false);
+        start_clear_flags(new_smi);
        /*
         * IRQ is defined to be set when non-zero.  req_events will
@@ -2238,7 +2240,7 @@ out_err_remove_attrs:
        dev_set_drvdata(new_smi->io.dev, NULL);
 out_err_stop_timer:
-        wait_for_timer_and_thread(new_smi);
+        stop_timer_and_thread(new_smi);
 out_err:
        new_smi->interrupt_disabled = true;
@@ -2388,7 +2390,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
         */
        if (to_clean->io.irq_cleanup)
                to_clean->io.irq_cleanup(&to_clean->io);
-        wait_for_timer_and_thread(to_clean);
+        stop_timer_and_thread(to_clean);
        /*
         * Timeouts are stopped, now make sure the interrupts are off
@@ -2400,7 +2402,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
                schedule_timeout_uninterruptible(1);
        }
        if (to_clean->handlers)
-                disable_si_irq(to_clean, false);
+                disable_si_irq(to_clean);
        while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                poll(to_clean);
                schedule_timeout_uninterruptible(1);
diff --git a/drivers/char/ipmi/ipmi_si_parisc.c b/drivers/char/ipmi/ipmi_si_parisc.c
index 090b073ab441..6b10f0e18a95 100644
--- a/drivers/char/ipmi/ipmi_si_parisc.c
+++ b/drivers/char/ipmi/ipmi_si_parisc.c
@@ -10,6 +10,8 @@ static int __init ipmi_parisc_probe(struct parisc_device *dev)
 {
        struct si_sm_io io;
+        memset(&io, 0, sizeof(io));
        io.si_type      = SI_KCS;
        io.addr_source  = SI_DEVICETREE;
        io.addr_type    = IPMI_MEM_ADDR_SPACE;
diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
index 99771f5cad07..27dd11c49d21 100644
--- a/drivers/char/ipmi/ipmi_si_pci.c
+++ b/drivers/char/ipmi/ipmi_si_pci.c
@@ -103,10 +103,13 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
        io.addr_source_cleanup = ipmi_pci_cleanup;
        io.addr_source_data = pdev;
-        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO)
+        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
                io.addr_type = IPMI_IO_ADDR_SPACE;
-        else
+                io.io_setup = ipmi_si_port_setup;
+        } else {
                io.addr_type = IPMI_MEM_ADDR_SPACE;
+                io.io_setup = ipmi_si_mem_setup;
+        }
        io.addr_data = pci_resource_start(pdev, 0);
        io.regspacing = ipmi_pci_probe_regspacing(&io);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index fbab271b3bf9..a861b5b4d443 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
                         unsigned long flags)
 {
        struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct data_chunk       *first = xt->sgl;
+        struct data_chunk       *first;
        struct at_desc          *desc = NULL;
        size_t                  xfer_count;
        unsigned int            dwidth;
@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
        if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
                return NULL;
+        first = xt->sgl;
        dev_info(chan2dev(chan),
                 "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
                __func__, &xt->src_start, &xt->dst_start, xt->numf,
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index d50273fed715..afd5e10f8927 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platform_device *pdev)
        ret = dma_async_device_register(dd);
        if (ret)
-                return ret;
+                goto err_clk;
        irq = platform_get_irq(pdev, 0);
        ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platform_device *pdev)
 err_unregister:
        dma_async_device_unregister(dd);
+err_clk:
+        clk_disable_unprepare(dmadev->clk);
        return ret;
 }
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 47edc7fbf91f..ec5f9d2bc820 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -155,6 +155,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)");
 #define PATTERN_COUNT_MASK      0x1f
 #define PATTERN_MEMSET_IDX      0x01
+/* poor man's completion - we want to use wait_event_freezable() on it */
+struct dmatest_done {
+        bool                    done;
+        wait_queue_head_t       *wait;
+};
 struct dmatest_thread {
        struct list_head        node;
        struct dmatest_info     *info;
@@ -165,6 +171,8 @@ struct dmatest_thread {
        u8                      **dsts;
        u8                      **udsts;
        enum dma_transaction_type type;
+        wait_queue_head_t done_wait;
+        struct dmatest_done test_done;
        bool                    done;
 };
@@ -342,18 +350,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start,
        return error_count;
 }
-/* poor man's completion - we want to use wait_event_freezable() on it */
-struct dmatest_done {
-        bool                    done;
-        wait_queue_head_t       *wait;
-};
 static void dmatest_callback(void *arg)
 {
        struct dmatest_done *done = arg;
+        struct dmatest_thread *thread =
-        done->done = true;
+                container_of(arg, struct dmatest_thread, done_wait);
-        wake_up_all(done->wait);
+        if (!thread->done) {
+                done->done = true;
+                wake_up_all(done->wait);
+        } else {
+                /*
+                 * If thread->done, it means that this callback occurred
+                 * after the parent thread has cleaned up. This can
+                 * happen in the case that driver doesn't implement
+                 * the terminate_all() functionality and a dma operation
+                 * did not occur within the timeout period
+                 */
+                WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
+        }
 }
 static unsigned int min_odd(unsigned int x, unsigned int y)
@@ -424,9 +439,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len)
 */
 static int dmatest_func(void *data)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
        struct dmatest_thread   *thread = data;
-        struct dmatest_done     done = { .wait = &done_wait };
+        struct dmatest_done     *done = &thread->test_done;
        struct dmatest_info     *info;
        struct dmatest_params   *params;
        struct dma_chan         *chan;
@@ -673,9 +687,9 @@ static int dmatest_func(void *data)
                        continue;
                }
-                done.done = false;
+                done->done = false;
                tx->callback = dmatest_callback;
-                tx->callback_param = &done;
+                tx->callback_param = done;
                cookie = tx->tx_submit(tx);
                if (dma_submit_error(cookie)) {
@@ -688,21 +702,12 @@ static int dmatest_func(void *data)
                }
                dma_async_issue_pending(chan);
-                wait_event_freezable_timeout(done_wait, done.done,
+                wait_event_freezable_timeout(thread->done_wait, done->done,
                                             msecs_to_jiffies(params->timeout));
                status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
-                if (!done.done) {
+                if (!done->done) {
-                        /*
-                         * We're leaving the timed out dma operation with
-                         * dangling pointer to done_wait.  To make this
-                         * correct, we'll need to allocate wait_done for
-                         * each test iteration and perform "who's gonna
-                         * free it this time?" dancing.  For now, just
-                         * leave it dangling.
-                         */
-                        WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
                        dmaengine_unmap_put(um);
                        result("test timed out", total_tests, src_off, dst_off,
                               len, 0);
@@ -789,7 +794,7 @@ err_thread_type:
                dmatest_KBs(runtime, total_len), ret);
        /* terminate all transfers on specified channels */
-        if (ret)
+        if (ret || failed_tests)
                dmaengine_terminate_all(chan);
        thread->done = true;
@@ -849,6 +854,8 @@ static int dmatest_add_threads(struct dmatest_info *info,
                thread->info = info;
                thread->chan = dtc->chan;
                thread->type = type;
+                thread->test_done.wait = &thread->done_wait;
+                init_waitqueue_head(&thread->done_wait);
                smp_wmb();
                thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
                                dma_chan_name(chan), op, i);
diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 6775f2c74e25..c7568869284e 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
        }
 }
-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
+static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
 {
        int i;
-        for (i = 0; i < DMAMUX_NR; i++)
+        for (i = 0; i < nr_clocks; i++)
                clk_disable_unprepare(fsl_edma->muxclk[i]);
 }
@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev)
                res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
                fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(fsl_edma->muxbase[i]))
+                if (IS_ERR(fsl_edma->muxbase[i])) {
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                        return PTR_ERR(fsl_edma->muxbase[i]);
+                }
                sprintf(clkname, "dmamux%d", i);
                fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
                if (IS_ERR(fsl_edma->muxclk[i])) {
                        dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                        return PTR_ERR(fsl_edma->muxclk[i]);
                }
                ret = clk_prepare_enable(fsl_edma->muxclk[i]);
-                if (ret) {
+                if (ret)
-                        /* disable only clks which were enabled on error */
+                        /* on error: disable all previously enabled clks */
-                        for (; i >= 0; i--)
+                        fsl_disable_clocks(fsl_edma, i);
-                                clk_disable_unprepare(fsl_edma->muxclk[i]);
-                        dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
-                        return ret;
-                }
        }
@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
        if (ret) {
                dev_err(&pdev->dev,
                        "Can't register Freescale eDMA engine. (%d)\n", ret);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                return ret;
        }
@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
                dev_err(&pdev->dev,
                        "Can't register Freescale eDMA of_dma. (%d)\n", ret);
                dma_async_device_unregister(&fsl_edma->dma_dev);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                return ret;
        }
@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev)
        fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
        of_dma_controller_free(np);
        dma_async_device_unregister(&fsl_edma->dma_dev);
-        fsl_disable_clocks(fsl_edma);
+        fsl_disable_clocks(fsl_edma, DMAMUX_NR);
        return 0;
 }
diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 2f31d3d0caa6..7792a9186f9c 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma)
        if (memcmp(src, dest, IOAT_TEST_SIZE)) {
                dev_err(dev, "Self-test copy failed compare, disabling\n");
                err = -ENODEV;
-                goto free_resources;
+                goto unmap_dma;
        }
 unmap_dma:
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 482014137953..9ae236036e32 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -152,14 +152,23 @@ static void drm_connector_free(struct kref *kref)
        connector->funcs->destroy(connector);
 }
-static void drm_connector_free_work_fn(struct work_struct *work)
+void drm_connector_free_work_fn(struct work_struct *work)
 {
-        struct drm_connector *connector =
+        struct drm_connector *connector, *n;
-                container_of(work, struct drm_connector, free_work);
+        struct drm_device *dev =
-        struct drm_device *dev = connector->dev;
+                container_of(work, struct drm_device, mode_config.connector_free_work);
+        struct drm_mode_config *config = &dev->mode_config;
+        unsigned long flags;
+        struct llist_node *freed;
-        drm_mode_object_unregister(dev, &connector->base);
+        spin_lock_irqsave(&config->connector_list_lock, flags);
-        connector->funcs->destroy(connector);
+        freed = llist_del_all(&config->connector_free_list);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
+        llist_for_each_entry_safe(connector, n, freed, free_node) {
+                drm_mode_object_unregister(dev, &connector->base);
+                connector->funcs->destroy(connector);
+        }
 }
 /**
@@ -191,8 +200,6 @@ int drm_connector_init(struct drm_device *dev,
        if (ret)
                return ret;
-        INIT_WORK(&connector->free_work, drm_connector_free_work_fn);
        connector->base.properties = &connector->properties;
        connector->dev = dev;
        connector->funcs = funcs;
@@ -547,10 +554,17 @@ EXPORT_SYMBOL(drm_connector_list_iter_begin);
 * actually release the connector when dropping our final reference.
 */
 static void
-drm_connector_put_safe(struct drm_connector *conn)
+__drm_connector_put_safe(struct drm_connector *conn)
 {
-        if (refcount_dec_and_test(&conn->base.refcount.refcount))
+        struct drm_mode_config *config = &conn->dev->mode_config;
-                schedule_work(&conn->free_work);
+        lockdep_assert_held(&config->connector_list_lock);
+        if (!refcount_dec_and_test(&conn->base.refcount.refcount))
+                return;
+        llist_add(&conn->free_node, &config->connector_free_list);
+        schedule_work(&config->connector_free_work);
 }
 /**
@@ -582,10 +596,10 @@ drm_connector_list_iter_next(struct drm_connector_list_iter *iter)
                /* loop until it's not a zombie connector */
        } while (!kref_get_unless_zero(&iter->conn->base.refcount));
-        spin_unlock_irqrestore(&config->connector_list_lock, flags);
        if (old_conn)
-                drm_connector_put_safe(old_conn);
+                __drm_connector_put_safe(old_conn);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
        return iter->conn;
 }
@@ -602,9 +616,15 @@ EXPORT_SYMBOL(drm_connector_list_iter_next);
 */
 void drm_connector_list_iter_end(struct drm_connector_list_iter *iter)
 {
+        struct drm_mode_config *config = &iter->dev->mode_config;
+        unsigned long flags;
        iter->dev = NULL;
-        if (iter->conn)
+        if (iter->conn) {
-                drm_connector_put_safe(iter->conn);
+                spin_lock_irqsave(&config->connector_list_lock, flags);
+                __drm_connector_put_safe(iter->conn);
+                spin_unlock_irqrestore(&config->connector_list_lock, flags);
+        }
        lock_release(&connector_list_iter_dep_map, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(drm_connector_list_iter_end);
@@ -1231,6 +1251,19 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
        if (edid)
                size = EDID_LENGTH * (1 + edid->extensions);
+        /* Set the display info, using edid if available, otherwise
+         * reseting the values to defaults. This duplicates the work
+         * done in drm_add_edid_modes, but that function is not
+         * consistently called before this one in all drivers and the
+         * computation is cheap enough that it seems better to
+         * duplicate it rather than attempt to ensure some arbitrary
+         * ordering of calls.
+         */
+        if (edid)
+                drm_add_display_info(connector, edid);
+        else
+                drm_reset_display_info(connector);
        drm_object_property_set_value(&connector->base,
                                      dev->mode_config.non_desktop_property,
                                      connector->display_info.non_desktop);
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index 9ebb8841778c..af00f42ba269 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -142,6 +142,7 @@ int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
                                    uint64_t value);
 int drm_connector_create_standard_properties(struct drm_device *dev);
 const char *drm_get_connector_force_name(enum drm_connector_force force);
+void drm_connector_free_work_fn(struct work_struct *work);
 /* IOCTL */
 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5dfe14763871..cb487148359a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1731,7 +1731,7 @@ EXPORT_SYMBOL(drm_edid_duplicate);
 *
 * Returns true if @vendor is in @edid, false otherwise
 */
-static bool edid_vendor(struct edid *edid, const char *vendor)
+static bool edid_vendor(const struct edid *edid, const char *vendor)
 {
        char edid_vendor[3];
@@ -1749,7 +1749,7 @@ static bool edid_vendor(struct edid *edid, const char *vendor)
 *
 * This tells subsequent routines what fixes they need to apply.
 */
-static u32 edid_get_quirks(struct edid *edid)
+static u32 edid_get_quirks(const struct edid *edid)
 {
        const struct edid_quirk *quirk;
        int i;
@@ -2813,7 +2813,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid,
 /*
 * Search EDID for CEA extension block.
 */
-static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
+static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
 {
        u8 *edid_ext = NULL;
        int i;
@@ -2835,12 +2835,12 @@ static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
        return edid_ext;
 }
-static u8 *drm_find_cea_extension(struct edid *edid)
+static u8 *drm_find_cea_extension(const struct edid *edid)
 {
        return drm_find_edid_extension(edid, CEA_EXT);
 }
-static u8 *drm_find_displayid_extension(struct edid *edid)
+static u8 *drm_find_displayid_extension(const struct edid *edid)
 {
        return drm_find_edid_extension(edid, DISPLAYID_EXT);
 }
@@ -4363,7 +4363,7 @@ drm_parse_hdmi_vsdb_video(struct drm_connector *connector, const u8 *db)
 }
 static void drm_parse_cea_ext(struct drm_connector *connector,
-                              struct edid *edid)
+                              const struct edid *edid)
 {
        struct drm_display_info *info = &connector->display_info;
        const u8 *edid_ext;
@@ -4397,11 +4397,33 @@ static void drm_parse_cea_ext(struct drm_connector *connector,
        }
 }
-static void drm_add_display_info(struct drm_connector *connector,
+/* A connector has no EDID information, so we've got no EDID to compute quirks from. Reset
-                                 struct edid *edid, u32 quirks)
+ * all of the values which would have been set from EDID
+ */
+void
+drm_reset_display_info(struct drm_connector *connector)
 {
        struct drm_display_info *info = &connector->display_info;
+        info->width_mm = 0;
+        info->height_mm = 0;
+        info->bpc = 0;
+        info->color_formats = 0;
+        info->cea_rev = 0;
+        info->max_tmds_clock = 0;
+        info->dvi_dual = false;
+        info->non_desktop = 0;
+}
+EXPORT_SYMBOL_GPL(drm_reset_display_info);
+u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edid)
+{
+        struct drm_display_info *info = &connector->display_info;
+        u32 quirks = edid_get_quirks(edid);
        info->width_mm = edid->width_cm * 10;
        info->height_mm = edid->height_cm * 10;
@@ -4414,11 +4436,13 @@ static void drm_add_display_info(struct drm_connector *connector,
        info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
+        DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
        if (edid->revision < 3)
-                return;
+                return quirks;
        if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
-                return;
+                return quirks;
        drm_parse_cea_ext(connector, edid);
@@ -4438,7 +4462,7 @@ static void drm_add_display_info(struct drm_connector *connector,
        /* Only defined for 1.4 with digital displays */
        if (edid->revision < 4)
-                return;
+                return quirks;
        switch (edid->input & DRM_EDID_DIGITAL_DEPTH_MASK) {
        case DRM_EDID_DIGITAL_DEPTH_6:
@@ -4473,7 +4497,9 @@ static void drm_add_display_info(struct drm_connector *connector,
                info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
        if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
                info->color_formats |= DRM_COLOR_FORMAT_YCRCB422;
+        return quirks;
 }
+EXPORT_SYMBOL_GPL(drm_add_display_info);
 static int validate_displayid(u8 *displayid, int length, int idx)
 {
@@ -4627,14 +4653,12 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
                return 0;
        }
-        quirks = edid_get_quirks(edid);
        /*
         * CEA-861-F adds ycbcr capability map block, for HDMI 2.0 sinks.
         * To avoid multiple parsing of same block, lets parse that map
         * from sink info, before parsing CEA modes.
         */
-        drm_add_display_info(connector, edid, quirks);
+        quirks = drm_add_display_info(connector, edid);
        /*
         * EDID spec says modes should be preferred in this order:
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index d1eb56a1eff4..59849f02e2ad 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -254,10 +254,10 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
        return lessee;
 out_lessee:
-        drm_master_put(&lessee);
        mutex_unlock(&dev->mode_config.idr_mutex);
+        drm_master_put(&lessee);
        return ERR_PTR(error);
 }
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 61a1c8ea74bc..c3c79ee6119e 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -575,21 +575,23 @@ EXPORT_SYMBOL(drm_mm_remove_node);
 */
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
+        struct drm_mm *mm = old->mm;
        DRM_MM_BUG_ON(!old->allocated);
        *new = *old;
        list_replace(&old->node_list, &new->node_list);
-        rb_replace_node(&old->rb, &new->rb, &old->mm->interval_tree.rb_root);
+        rb_replace_node_cached(&old->rb, &new->rb, &mm->interval_tree);
        if (drm_mm_hole_follows(old)) {
                list_replace(&old->hole_stack, &new->hole_stack);
                rb_replace_node(&old->rb_hole_size,
                                &new->rb_hole_size,
-                                &old->mm->holes_size);
+                                &mm->holes_size);
                rb_replace_node(&old->rb_hole_addr,
                                &new->rb_hole_addr,
-                                &old->mm->holes_addr);
+                                &mm->holes_addr);
        }
        old->allocated = false;
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index cc78b3d9e5e4..256de7313612 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -382,6 +382,9 @@ void drm_mode_config_init(struct drm_device *dev)
        ida_init(&dev->mode_config.connector_ida);
        spin_lock_init(&dev->mode_config.connector_list_lock);
+        init_llist_head(&dev->mode_config.connector_free_list);
+        INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
        drm_mode_create_standard_properties(dev);
        /* Just to be sure */
@@ -432,7 +435,7 @@ void drm_mode_config_cleanup(struct drm_device *dev)
        }
        drm_connector_list_iter_end(&conn_iter);
        /* connector_iter drops references in a work item. */
-        flush_scheduled_work();
+        flush_work(&dev->mode_config.connector_free_work);
        if (WARN_ON(!list_empty(&dev->mode_config.connector_list))) {
                drm_connector_list_iter_begin(dev, &conn_iter);
                drm_for_each_connector_iter(connector, &conn_iter)
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6c32c89a83a9..638540943c61 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -888,8 +888,10 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
        /* If we got force-completed because of GPU reset rather than
         * through our IRQ handler, signal the fence now.
         */
-        if (exec->fence)
+        if (exec->fence) {
                dma_fence_signal(exec->fence);
+                dma_fence_put(exec->fence);
+        }
        if (exec->bo) {
                for (i = 0; i < exec->bo_count; i++) {
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index 61b2e5377993..26eddbb62893 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_device *dev)
        list_move_tail(&exec->head, &vc4->job_done_list);
        if (exec->fence) {
                dma_fence_signal_locked(exec->fence);
+                dma_fence_put(exec->fence);
                exec->fence = NULL;
        }
        vc4_submit_next_render_job(dev);
diff --git a/drivers/hwtracing/stm/ftrace.c b/drivers/hwtracing/stm/ftrace.c
index bd126a7c6da2..7da75644c750 100644
--- a/drivers/hwtracing/stm/ftrace.c
+++ b/drivers/hwtracing/stm/ftrace.c
@@ -42,9 +42,11 @@ static struct stm_ftrace {
 * @len:        length of the data packet
 */
 static void notrace
-stm_ftrace_write(const void *buf, unsigned int len)
+stm_ftrace_write(struct trace_export *export, const void *buf, unsigned int len)
 {
-        stm_source_write(&stm_ftrace.data, STM_FTRACE_CHAN, buf, len);
+        struct stm_ftrace *stm = container_of(export, struct stm_ftrace, ftrace);
+        stm_source_write(&stm->data, STM_FTRACE_CHAN, buf, len);
 }
 static int stm_ftrace_link(struct stm_source_data *data)
diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
index 0d05dadb2dc5..44cffad43701 100644
--- a/drivers/i2c/busses/i2c-cht-wc.c
+++ b/drivers/i2c/busses/i2c-cht-wc.c
@@ -379,7 +379,7 @@ static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev)
        return 0;
 }
-static struct platform_device_id cht_wc_i2c_adap_id_table[] = {
+static const struct platform_device_id cht_wc_i2c_adap_id_table[] = {
        { .name = "cht_wcove_ext_chgr" },
        {},
 };
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 174579d32e5f..462948e2c535 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -983,7 +983,7 @@ static void piix4_adap_remove(struct i2c_adapter *adap)
        if (adapdata->smba) {
                i2c_del_adapter(adap);
-                if (adapdata->port == (0 << 1)) {
+                if (adapdata->port == (0 << piix4_port_shift_sb800)) {
                        release_region(adapdata->smba, SMBIOSIZE);
                        if (adapdata->sb800_main)
                                release_region(SB800_PIIX4_SMB_IDX, 2);
diff --git a/drivers/i2c/busses/i2c-stm32.h b/drivers/i2c/busses/i2c-stm32.h
index dab51761f8c5..d4f9cef251ac 100644
--- a/drivers/i2c/busses/i2c-stm32.h
+++ b/drivers/i2c/busses/i2c-stm32.h
@@ -1,10 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * i2c-stm32.h
 *
 * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
 * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
 *
- * License terms:  GNU General Public License (GPL), version 2
 */
 #ifndef _I2C_STM32_H
diff --git a/drivers/i2c/busses/i2c-stm32f4.c b/drivers/i2c/busses/i2c-stm32f4.c
index 4ec108496f15..47c8d00de53f 100644
--- a/drivers/i2c/busses/i2c-stm32f4.c
+++ b/drivers/i2c/busses/i2c-stm32f4.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Driver for STMicroelectronics STM32 I2C controller
 *
@@ -6,11 +7,11 @@
 * http://www.st.com/resource/en/reference_manual/DM00031020.pdf
 *
 * Copyright (C) M'boumba Cedric Madianga 2016
+ * Copyright (C) STMicroelectronics 2017
 * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
 *
 * This driver is based on i2c-st.c
 *
- * License terms:  GNU General Public License (GPL), version 2
 */
 #include <linux/clk.h>
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index d4a6e9c2e9aa..b445b3bb0bb1 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Driver for STMicroelectronics STM32F7 I2C controller
 *
@@ -7,11 +8,11 @@
 * http://www.st.com/resource/en/reference_manual/dm00124865.pdf
 *
 * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
 * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
 *
 * This driver is based on i2c-stm32f4.c
 *
- * License terms:  GNU General Public License (GPL), version 2
 */
 #include <linux/clk.h>
 #include <linux/delay.h>
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f6983357145d..6294a7001d33 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4458,7 +4458,7 @@ out:
        return skb->len;
 }
-static const struct rdma_nl_cbs cma_cb_table[] = {
+static const struct rdma_nl_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = {
        [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},
 };
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 5e1be4949d5f..30914f3baa5f 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1146,7 +1146,7 @@ struct net_device *ib_get_net_dev_by_params(struct ib_device *dev,
 }
 EXPORT_SYMBOL(ib_get_net_dev_by_params);
-static const struct rdma_nl_cbs ibnl_ls_cb_table[] = {
+static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
        [RDMA_NL_LS_OP_RESOLVE] = {
                .doit = ib_nl_handle_resolve_resp,
                .flags = RDMA_NL_ADMIN_PERM,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index e9e189ec7502..5d676cff41f4 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -80,7 +80,7 @@ const char *__attribute_const__ iwcm_reject_msg(int reason)
 }
 EXPORT_SYMBOL(iwcm_reject_msg);
-static struct rdma_nl_cbs iwcm_nl_cb_table[] = {
+static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
        [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},
        [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},
        [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 2fae850a3eff..9a05245a1acf 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -303,7 +303,7 @@ out:	cb->args[0] = idx;
        return skb->len;
 }
-static const struct rdma_nl_cbs nldev_cb_table[] = {
+static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
        [RDMA_NLDEV_CMD_GET] = {
                .doit = nldev_get_doit,
                .dump = nldev_get_dumpit,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index a337386652b0..feafdb961c48 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -739,8 +739,11 @@ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
        if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
                return 0;
-        if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
+        if (map->agent.qp->qp_type == IB_QPT_SMI) {
-                return -EACCES;
+                if (!map->agent.smp_allowed)
+                        return -EACCES;
+                return 0;
+        }
        return ib_security_pkey_access(map->agent.device,
                                       map->agent.port_num,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 16d55710b116..d0202bb176a4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1971,6 +1971,12 @@ static int modify_qp(struct ib_uverbs_file *file,
                goto release_qp;
        }
+        if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
+            !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+                ret = -EINVAL;
+                goto release_qp;
+        }
        attr->qp_state            = cmd->base.qp_state;
        attr->cur_qp_state        = cmd->base.cur_qp_state;
        attr->path_mtu            = cmd->base.path_mtu;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index ea55e95cd2c5..b7bfc536e00f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -395,6 +395,11 @@ next_cqe:
 static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
 {
+        if (CQE_OPCODE(cqe) == C4IW_DRAIN_OPCODE) {
+                WARN_ONCE(1, "Unexpected DRAIN CQE qp id %u!\n", wq->sq.qid);
+                return 0;
+        }
        if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
                return 0;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 5ee7fe433136..38bddd02a943 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -868,7 +868,12 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        qhp = to_c4iw_qp(ibqp);
        spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                spin_unlock_irqrestore(&qhp->lock, flag);
                complete_sq_drain_wr(qhp, wr);
                return err;
@@ -1011,7 +1016,12 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
        qhp = to_c4iw_qp(ibqp);
        spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                spin_unlock_irqrestore(&qhp->lock, flag);
                complete_rq_drain_wr(qhp, wr);
                return err;
@@ -1285,21 +1295,21 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
        spin_unlock_irqrestore(&rchp->lock, flag);
        if (schp == rchp) {
-                if (t4_clear_cq_armed(&rchp->cq) &&
+                if ((rq_flushed || sq_flushed) &&
-                    (rq_flushed || sq_flushed)) {
+                    t4_clear_cq_armed(&rchp->cq)) {
                        spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                        (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                   rchp->ibcq.cq_context);
                        spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                }
        } else {
-                if (t4_clear_cq_armed(&rchp->cq) && rq_flushed) {
+                if (rq_flushed && t4_clear_cq_armed(&rchp->cq)) {
                        spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                        (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                   rchp->ibcq.cq_context);
                        spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                }
-                if (t4_clear_cq_armed(&schp->cq) && sq_flushed) {
+                if (sq_flushed && t4_clear_cq_armed(&schp->cq)) {
                        spin_lock_irqsave(&schp->comp_handler_lock, flag);
                        (*schp->ibcq.comp_handler)(&schp->ibcq,
                                                   schp->ibcq.cq_context);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 013049bcdb53..caf490ab24c8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                return (-EOPNOTSUPP);
        }
+        if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4      |
+                                          MLX4_IB_RX_HASH_DST_IPV4      |
+                                          MLX4_IB_RX_HASH_SRC_IPV6      |
+                                          MLX4_IB_RX_HASH_DST_IPV6      |
+                                          MLX4_IB_RX_HASH_SRC_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_SRC_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
+                         ucmd->rx_hash_fields_mask);
+                return (-EOPNOTSUPP);
+        }
        if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
            (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
                rss_ctx->flags = MLX4_RSS_IPV4;
@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                        return (-EOPNOTSUPP);
                }
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                        rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                        rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                        pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
                        return (-EOPNOTSUPP);
                }
@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
        if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
            (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                        rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                        rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                        pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
                        return (-EOPNOTSUPP);
                }
        } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
                   (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
                pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 87f4bd99cdf7..2c13123bfd69 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1145,6 +1145,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
        noio_flag = memalloc_noio_save();
        p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
        if (!p->tx_ring) {
+                memalloc_noio_restore(noio_flag);
                ret = -ENOMEM;
                goto err_tx;
        }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index b8ac591aaaa7..c546b567f3b5 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1611,7 +1611,8 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
        int l;
        struct dm_buffer *b, *tmp;
        unsigned long freed = 0;
-        unsigned long count = nr_to_scan;
+        unsigned long count = c->n_buffers[LIST_CLEAN] +
+                              c->n_buffers[LIST_DIRTY];
        unsigned long retain_target = get_retain_buffers(c);
        for (l = 0; l < LIST_SIZE; l++) {
@@ -1647,8 +1648,11 @@ static unsigned long
 dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
        struct dm_bufio_client *c = container_of(shrink, struct dm_bufio_client, shrinker);
+        unsigned long count = READ_ONCE(c->n_buffers[LIST_CLEAN]) +
+                              READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        unsigned long retain_target = get_retain_buffers(c);
-        return READ_ONCE(c->n_buffers[LIST_CLEAN]) + READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        return (count < retain_target) ? 0 : (count - retain_target);
 }
 /*
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index cf23a14f9c6a..47407e43b96a 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -3472,18 +3472,18 @@ static int __init dm_cache_init(void)
 {
        int r;
-        r = dm_register_target(&cache_target);
-        if (r) {
-                DMERR("cache target registration failed: %d", r);
-                return r;
-        }
        migration_cache = KMEM_CACHE(dm_cache_migration, 0);
        if (!migration_cache) {
                dm_unregister_target(&cache_target);
                return -ENOMEM;
        }
+        r = dm_register_target(&cache_target);
+        if (r) {
+                DMERR("cache target registration failed: %d", r);
+                return r;
+        }
        return 0;
 }
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index c8faa2b85842..f7810cc869ac 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -458,6 +458,38 @@ do {									\
 } while (0)
 /*
+ * Check whether bios must be queued in the device-mapper core rather
+ * than here in the target.
+ *
+ * If MPATHF_QUEUE_IF_NO_PATH and MPATHF_SAVED_QUEUE_IF_NO_PATH hold
+ * the same value then we are not between multipath_presuspend()
+ * and multipath_resume() calls and we have no need to check
+ * for the DMF_NOFLUSH_SUSPENDING flag.
+ */
+static bool __must_push_back(struct multipath *m, unsigned long flags)
+{
+        return ((test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) !=
+                 test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &flags)) &&
+                dm_noflush_suspending(m->ti));
+}
+/*
+ * Following functions use READ_ONCE to get atomic access to
+ * all m->flags to avoid taking spinlock
+ */
+static bool must_push_back_rq(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) || __must_push_back(m, flags);
+}
+static bool must_push_back_bio(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return __must_push_back(m, flags);
+}
+/*
 * Map cloned requests (request-based multipath)
 */
 static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
@@ -478,7 +510,7 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
                pgpath = choose_pgpath(m, nr_bytes);
        if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_rq(m))
                        return DM_MAPIO_DELAY_REQUEUE;
                dm_report_EIO(m);       /* Failed */
                return DM_MAPIO_KILL;
@@ -553,7 +585,7 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio, struct dm_m
        }
        if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_bio(m))
                        return DM_MAPIO_REQUEUE;
                dm_report_EIO(m);
                return DM_MAPIO_KILL;
@@ -651,8 +683,7 @@ static int queue_if_no_path(struct multipath *m, bool queue_if_no_path,
        assign_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &m->flags,
                   (save_old_value && test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) ||
                   (!save_old_value && queue_if_no_path));
-        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags,
+        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags, queue_if_no_path);
-                   queue_if_no_path || dm_noflush_suspending(m->ti));
        spin_unlock_irqrestore(&m->lock, flags);
        if (!queue_if_no_path) {
@@ -1486,7 +1517,7 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
                        fail_path(pgpath);
                if (atomic_read(&m->nr_valid_paths) == 0 &&
-                    !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+                    !must_push_back_rq(m)) {
                        if (error == BLK_STS_IOERR)
                                dm_report_EIO(m);
                        /* complete with the original error */
@@ -1521,8 +1552,12 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone,
        if (atomic_read(&m->nr_valid_paths) == 0 &&
            !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
-                dm_report_EIO(m);
+                if (must_push_back_bio(m)) {
-                *error = BLK_STS_IOERR;
+                        r = DM_ENDIO_REQUEUE;
+                } else {
+                        dm_report_EIO(m);
+                        *error = BLK_STS_IOERR;
+                }
                goto done;
        }
@@ -1957,13 +1992,6 @@ static int __init dm_multipath_init(void)
 {
        int r;
-        r = dm_register_target(&multipath_target);
-        if (r < 0) {
-                DMERR("request-based register failed %d", r);
-                r = -EINVAL;
-                goto bad_register_target;
-        }
        kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
        if (!kmultipathd) {
                DMERR("failed to create workqueue kmpathd");
@@ -1985,13 +2013,20 @@ static int __init dm_multipath_init(void)
                goto bad_alloc_kmpath_handlerd;
        }
+        r = dm_register_target(&multipath_target);
+        if (r < 0) {
+                DMERR("request-based register failed %d", r);
+                r = -EINVAL;
+                goto bad_register_target;
+        }
        return 0;
+bad_register_target:
+        destroy_workqueue(kmpath_handlerd);
 bad_alloc_kmpath_handlerd:
        destroy_workqueue(kmultipathd);
 bad_alloc_kmultipathd:
-        dm_unregister_target(&multipath_target);
-bad_register_target:
        return r;
 }
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 1113b42e1eda..a0613bd8ed00 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -2411,24 +2411,6 @@ static int __init dm_snapshot_init(void)
                return r;
        }
-        r = dm_register_target(&snapshot_target);
-        if (r < 0) {
-                DMERR("snapshot target register failed %d", r);
-                goto bad_register_snapshot_target;
-        }
-        r = dm_register_target(&origin_target);
-        if (r < 0) {
-                DMERR("Origin target register failed %d", r);
-                goto bad_register_origin_target;
-        }
-        r = dm_register_target(&merge_target);
-        if (r < 0) {
-                DMERR("Merge target register failed %d", r);
-                goto bad_register_merge_target;
-        }
        r = init_origin_hash();
        if (r) {
                DMERR("init_origin_hash failed.");
@@ -2449,19 +2431,37 @@ static int __init dm_snapshot_init(void)
                goto bad_pending_cache;
        }
+        r = dm_register_target(&snapshot_target);
+        if (r < 0) {
+                DMERR("snapshot target register failed %d", r);
+                goto bad_register_snapshot_target;
+        }
+        r = dm_register_target(&origin_target);
+        if (r < 0) {
+                DMERR("Origin target register failed %d", r);
+                goto bad_register_origin_target;
+        }
+        r = dm_register_target(&merge_target);
+        if (r < 0) {
+                DMERR("Merge target register failed %d", r);
+                goto bad_register_merge_target;
+        }
        return 0;
-bad_pending_cache:
-        kmem_cache_destroy(exception_cache);
-bad_exception_cache:
-        exit_origin_hash();
-bad_origin_hash:
-        dm_unregister_target(&merge_target);
 bad_register_merge_target:
        dm_unregister_target(&origin_target);
 bad_register_origin_target:
        dm_unregister_target(&snapshot_target);
 bad_register_snapshot_target:
+        kmem_cache_destroy(pending_cache);
+bad_pending_cache:
+        kmem_cache_destroy(exception_cache);
+bad_exception_cache:
+        exit_origin_hash();
+bad_origin_hash:
        dm_exception_store_exit();
        return r;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 88130b5d95f9..aaffd0c0ee9a 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -453,14 +453,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
                refcount_set(&dd->count, 1);
                list_add(&dd->list, &t->devices);
+                goto out;
        } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
                r = upgrade_mode(dd, mode, t->md);
                if (r)
                        return r;
-                refcount_inc(&dd->count);
        }
+        refcount_inc(&dd->count);
+out:
        *result = dd->dm_dev;
        return 0;
 }
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 89e5dff9b4cf..f91d771fff4b 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -4355,30 +4355,28 @@ static struct target_type thin_target = {
 static int __init dm_thin_init(void)
 {
-        int r;
+        int r = -ENOMEM;
        pool_table_init();
+        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
+        if (!_new_mapping_cache)
+                return r;
        r = dm_register_target(&thin_target);
        if (r)
-                return r;
+                goto bad_new_mapping_cache;
        r = dm_register_target(&pool_target);
        if (r)
-                goto bad_pool_target;
+                goto bad_thin_target;
-        r = -ENOMEM;
-        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
-        if (!_new_mapping_cache)
-                goto bad_new_mapping_cache;
        return 0;
-bad_new_mapping_cache:
+bad_thin_target:
-        dm_unregister_target(&pool_target);
-bad_pool_target:
        dm_unregister_target(&thin_target);
+bad_new_mapping_cache:
+        kmem_cache_destroy(_new_mapping_cache);
        return r;
 }
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index a385a35c7de9..0e30ee1c8677 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2077,8 +2077,9 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
        } else {
                ret = of_property_read_u32(child, "bank-width",
                                           &gpmc_s.device_width);
-                if (ret < 0) {
+                if (ret < 0 && !gpmc_s.device_width) {
-                        dev_err(&pdev->dev, "%pOF has no 'bank-width' property\n",
+                        dev_err(&pdev->dev,
+                                "%pOF has no 'gpmc,device-width' property\n",
                                child);
                        goto err;
                }
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 305a7a464d09..4d63ac8a82e0 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -562,7 +562,7 @@ static ssize_t at24_eeprom_write_i2c(struct at24_data *at24, const char *buf,
 static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 {
        struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
        char *buf = val;
        int ret;
@@ -572,11 +572,9 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
        if (off + count > at24->chip.byte_len)
                return -EINVAL;
-        client = at24_translate_offset(at24, &off);
+        ret = pm_runtime_get_sync(dev);
-        ret = pm_runtime_get_sync(&client->dev);
        if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                return ret;
        }
@@ -592,7 +590,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
                status = at24->read_func(at24, buf, off, count);
                if (status < 0) {
                        mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                        return status;
                }
                buf += status;
@@ -602,7 +600,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
        mutex_unlock(&at24->lock);
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
        return 0;
 }
@@ -610,7 +608,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 {
        struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
        char *buf = val;
        int ret;
@@ -620,11 +618,9 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
        if (off + count > at24->chip.byte_len)
                return -EINVAL;
-        client = at24_translate_offset(at24, &off);
+        ret = pm_runtime_get_sync(dev);
-        ret = pm_runtime_get_sync(&client->dev);
        if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                return ret;
        }
@@ -640,7 +636,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
                status = at24->write_func(at24, buf, off, count);
                if (status < 0) {
                        mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                        return status;
                }
                buf += status;
@@ -650,7 +646,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
        mutex_unlock(&at24->lock);
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
        return 0;
 }
@@ -880,7 +876,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
        at24->nvmem_config.reg_read = at24_read;
        at24->nvmem_config.reg_write = at24_write;
        at24->nvmem_config.priv = at24;
-        at24->nvmem_config.stride = 4;
+        at24->nvmem_config.stride = 1;
        at24->nvmem_config.word_size = 1;
        at24->nvmem_config.size = chip.byte_len;
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index eda38cbe8530..41f2a9f6851d 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -32,7 +32,7 @@
 #include <linux/pci.h>
 #include <linux/mutex.h>
 #include <linux/miscdevice.h>
-#include <linux/pti.h>
+#include <linux/intel-pti.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index f06cd91964ce..79a5b985ccf5 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -75,9 +75,11 @@ struct mmc_fixup {
 #define EXT_CSD_REV_ANY (-1u)
 #define CID_MANFID_SANDISK      0x2
+#define CID_MANFID_ATP          0x9
 #define CID_MANFID_TOSHIBA      0x11
 #define CID_MANFID_MICRON       0x13
 #define CID_MANFID_SAMSUNG      0x15
+#define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX        0x90
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index d209fb466979..208a762b87ef 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1290,7 +1290,7 @@ out_err:
 static void mmc_select_driver_type(struct mmc_card *card)
 {
-        int card_drv_type, drive_strength, drv_type;
+        int card_drv_type, drive_strength, drv_type = 0;
        int fixed_drv_type = card->host->fixed_drv_type;
        card_drv_type = card->ext_csd.raw_driver_strength |
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index f664e9cbc9f8..75d317623852 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -53,6 +53,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
                  MMC_QUIRK_BLK_NO_CMD23),
        /*
+         * Some SD cards lockup while using CMD23 multiblock transfers.
+         */
+        MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+        MMC_FIXUP("APUSD", CID_MANFID_APACER, 0x5048, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+        /*
         * Some MMC cards need longer data read timeout than indicated in CSD.
         */
        MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index a7801f6668a5..6315774d72b3 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -338,6 +338,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                cmode = MV88E6XXX_PORT_STS_CMODE_2500BASEX;
                break;
        case PHY_INTERFACE_MODE_XGMII:
+        case PHY_INTERFACE_MODE_XAUI:
                cmode = MV88E6XXX_PORT_STS_CMODE_XAUI;
                break;
        case PHY_INTERFACE_MODE_RXAUI:
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 57e796870595..105fdb958cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -50,7 +50,7 @@
 #define AQ_CFG_PCI_FUNC_MSIX_IRQS   9U
 #define AQ_CFG_PCI_FUNC_PORTS       2U
-#define AQ_CFG_SERVICE_TIMER_INTERVAL    (2 * HZ)
+#define AQ_CFG_SERVICE_TIMER_INTERVAL    (1 * HZ)
 #define AQ_CFG_POLLING_TIMER_INTERVAL   ((unsigned int)(2 * HZ))
 #define AQ_CFG_SKB_FRAGS_MAX   32U
@@ -80,6 +80,7 @@
 #define AQ_CFG_DRV_VERSION      __stringify(NIC_MAJOR_DRIVER_VERSION)"."\
                                __stringify(NIC_MINOR_DRIVER_VERSION)"."\
                                __stringify(NIC_BUILD_DRIVER_VERSION)"."\
-                                __stringify(NIC_REVISION_DRIVER_VERSION)
+                                __stringify(NIC_REVISION_DRIVER_VERSION) \
+                                AQ_CFG_DRV_VERSION_SUFFIX
 #endif /* AQ_CFG_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
index 70efb7467bf3..f2d8063a2cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -66,14 +66,14 @@ static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = {
        "OutUCast",
        "OutMCast",
        "OutBCast",
-        "InUCastOctects",
+        "InUCastOctets",
-        "OutUCastOctects",
+        "OutUCastOctets",
-        "InMCastOctects",
+        "InMCastOctets",
-        "OutMCastOctects",
+        "OutMCastOctets",
-        "InBCastOctects",
+        "InBCastOctets",
-        "OutBCastOctects",
+        "OutBCastOctets",
-        "InOctects",
+        "InOctets",
-        "OutOctects",
+        "OutOctets",
        "InPacketsDma",
        "OutPacketsDma",
        "InOctetsDma",
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index 0207927dc8a6..b3825de6cdfb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -46,6 +46,28 @@ struct aq_hw_link_status_s {
        unsigned int mbps;
 };
+struct aq_stats_s {
+        u64 uprc;
+        u64 mprc;
+        u64 bprc;
+        u64 erpt;
+        u64 uptc;
+        u64 mptc;
+        u64 bptc;
+        u64 erpr;
+        u64 mbtc;
+        u64 bbtc;
+        u64 mbrc;
+        u64 bbrc;
+        u64 ubrc;
+        u64 ubtc;
+        u64 dpc;
+        u64 dma_pkt_rc;
+        u64 dma_pkt_tc;
+        u64 dma_oct_rc;
+        u64 dma_oct_tc;
+};
 #define AQ_HW_IRQ_INVALID 0U
 #define AQ_HW_IRQ_LEGACY  1U
 #define AQ_HW_IRQ_MSI     2U
@@ -85,7 +107,9 @@ struct aq_hw_ops {
        void (*destroy)(struct aq_hw_s *self);
        int (*get_hw_caps)(struct aq_hw_s *self,
-                           struct aq_hw_caps_s *aq_hw_caps);
+                           struct aq_hw_caps_s *aq_hw_caps,
+                           unsigned short device,
+                           unsigned short subsystem_device);
        int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring,
                               unsigned int frags);
@@ -164,8 +188,7 @@ struct aq_hw_ops {
        int (*hw_update_stats)(struct aq_hw_s *self);
-        int (*hw_get_hw_stats)(struct aq_hw_s *self, u64 *data,
+        struct aq_stats_s *(*hw_get_hw_stats)(struct aq_hw_s *self);
-                               unsigned int *p_count);
        int (*hw_get_fw_version)(struct aq_hw_s *self, u32 *fw_version);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 78dfb2ab78ce..75a894a9251c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -37,6 +37,8 @@ static unsigned int aq_itr_rx;
 module_param_named(aq_itr_rx, aq_itr_rx, uint, 0644);
 MODULE_PARM_DESC(aq_itr_rx, "RX interrupt throttle rate");
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self);
 static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
 {
        struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
@@ -166,11 +168,8 @@ static int aq_nic_update_link_status(struct aq_nic_s *self)
 static void aq_nic_service_timer_cb(struct timer_list *t)
 {
        struct aq_nic_s *self = from_timer(self, t, service_timer);
-        struct net_device *ndev = aq_nic_get_ndev(self);
+        int ctimer = AQ_CFG_SERVICE_TIMER_INTERVAL;
        int err = 0;
-        unsigned int i = 0U;
-        struct aq_ring_stats_rx_s stats_rx;
-        struct aq_ring_stats_tx_s stats_tx;
        if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                goto err_exit;
@@ -182,23 +181,14 @@ static void aq_nic_service_timer_cb(struct timer_list *t)
        if (self->aq_hw_ops.hw_update_stats)
                self->aq_hw_ops.hw_update_stats(self->aq_hw);
-        memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
+        aq_nic_update_ndev_stats(self);
-        memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
-        for (i = AQ_DIMOF(self->aq_vec); i--;) {
-                if (self->aq_vec[i])
-                        aq_vec_add_stats(self->aq_vec[i], &stats_rx, &stats_tx);
-        }
-        ndev->stats.rx_packets = stats_rx.packets;
+        /* If no link - use faster timer rate to detect link up asap */
-        ndev->stats.rx_bytes = stats_rx.bytes;
+        if (!netif_carrier_ok(self->ndev))
-        ndev->stats.rx_errors = stats_rx.errors;
+                ctimer = max(ctimer / 2, 1);
-        ndev->stats.tx_packets = stats_tx.packets;
-        ndev->stats.tx_bytes = stats_tx.bytes;
-        ndev->stats.tx_errors = stats_tx.errors;
 err_exit:
-        mod_timer(&self->service_timer,
+        mod_timer(&self->service_timer, jiffies + ctimer);
-                  jiffies + AQ_CFG_SERVICE_TIMER_INTERVAL);
 }
 static void aq_nic_polling_timer_cb(struct timer_list *t)
@@ -222,7 +212,7 @@ static struct net_device *aq_nic_ndev_alloc(void)
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                   const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                   struct aq_pci_func_s *aq_pci_func,
                                   unsigned int port,
                                   const struct aq_hw_ops *aq_hw_ops)
@@ -242,7 +232,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
        ndev->netdev_ops = ndev_ops;
        ndev->ethtool_ops = et_ops;
-        SET_NETDEV_DEV(ndev, dev);
+        SET_NETDEV_DEV(ndev, &pdev->dev);
        ndev->if_port = port;
        self->ndev = ndev;
@@ -254,7 +244,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
        self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
                                                &self->aq_hw_ops);
-        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
+        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
+                                          pdev->device, pdev->subsystem_device);
        if (err < 0)
                goto err_exit;
@@ -749,16 +740,40 @@ int aq_nic_get_regs_count(struct aq_nic_s *self)
 void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
 {
-        struct aq_vec_s *aq_vec = NULL;
        unsigned int i = 0U;
        unsigned int count = 0U;
-        int err = 0;
+        struct aq_vec_s *aq_vec = NULL;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
-        err = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw, data, &count);
+        if (!stats)
-        if (err < 0)
                goto err_exit;
-        data += count;
+        data[i] = stats->uprc + stats->mprc + stats->bprc;
+        data[++i] = stats->uprc;
+        data[++i] = stats->mprc;
+        data[++i] = stats->bprc;
+        data[++i] = stats->erpt;
+        data[++i] = stats->uptc + stats->mptc + stats->bptc;
+        data[++i] = stats->uptc;
+        data[++i] = stats->mptc;
+        data[++i] = stats->bptc;
+        data[++i] = stats->ubrc;
+        data[++i] = stats->ubtc;
+        data[++i] = stats->mbrc;
+        data[++i] = stats->mbtc;
+        data[++i] = stats->bbrc;
+        data[++i] = stats->bbtc;
+        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
+        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
+        data[++i] = stats->dma_pkt_rc;
+        data[++i] = stats->dma_pkt_tc;
+        data[++i] = stats->dma_oct_rc;
+        data[++i] = stats->dma_oct_tc;
+        data[++i] = stats->dpc;
+        i++;
+        data += i;
        count = 0U;
        for (i = 0U, aq_vec = self->aq_vec[0];
@@ -768,7 +783,20 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
        }
 err_exit:;
-        (void)err;
+}
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self)
+{
+        struct net_device *ndev = self->ndev;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
+        ndev->stats.rx_packets = stats->uprc + stats->mprc + stats->bprc;
+        ndev->stats.rx_bytes = stats->ubrc + stats->mbrc + stats->bbrc;
+        ndev->stats.rx_errors = stats->erpr;
+        ndev->stats.tx_packets = stats->uptc + stats->mptc + stats->bptc;
+        ndev->stats.tx_bytes = stats->ubtc + stats->mbtc + stats->bbtc;
+        ndev->stats.tx_errors = stats->erpt;
+        ndev->stats.multicast = stats->mprc;
 }
 void aq_nic_get_link_ksettings(struct aq_nic_s *self,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 4309983acdd6..3c9f8db03d5f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -71,7 +71,7 @@ struct aq_nic_cfg_s {
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                   const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                   struct aq_pci_func_s *aq_pci_func,
                                   unsigned int port,
                                   const struct aq_hw_ops *aq_hw_ops);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index cadaa646c89f..58c29d04b186 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
        pci_set_drvdata(pdev, self);
        self->pdev = pdev;
-        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
+        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
+                                     pdev->subsystem_device);
        if (err < 0)
                goto err_exit;
@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
        for (port = 0; port < self->ports; ++port) {
                struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
-                                                            &pdev->dev, self,
+                                                            pdev, self,
                                                            port, aq_hw_ops);
                if (!aq_nic) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 07b3c49a16a4..f18dce14c93c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -18,9 +18,20 @@
 #include "hw_atl_a0_internal.h"
 static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
        memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
+        }
        return 0;
 }
@@ -333,6 +344,10 @@ static int hw_atl_a0_hw_init(struct aq_hw_s *self,
        hw_atl_a0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
        hw_atl_a0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
        err = aq_hw_err_from_flags(self);
        if (err < 0)
                goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index ec68c20efcbd..e4a22ce7bf09 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -16,11 +16,23 @@
 #include "hw_atl_utils.h"
 #include "hw_atl_llh.h"
 #include "hw_atl_b0_internal.h"
+#include "hw_atl_llh_internal.h"
 static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
        memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
+        }
        return 0;
 }
@@ -357,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
        };
        int err = 0;
+        u32 val;
        self->aq_nic_cfg = aq_nic_cfg;
@@ -374,6 +387,20 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
        hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
        hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
+        /* Force limit MRRS on RDM/TDM to 2K */
+        val = aq_hw_read_reg(self, pci_reg_control6_adr);
+        aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404);
+        /* TX DMA total request limit. B0 hardware is not capable to
+         * handle more than (8K-MRRS) incoming DMA data.
+         * Value 24 in 256byte units
+         */
+        aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
        err = aq_hw_err_from_flags(self);
        if (err < 0)
                goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
index 5527fc0e5942..93450ec930e8 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
@@ -2343,6 +2343,9 @@
 #define tx_dma_desc_base_addrmsw_adr(descriptor) \
                        (0x00007c04u + (descriptor) * 0x40)
+/* tx dma total request limit */
+#define tx_dma_total_req_limit_adr 0x00007b20u
 /* tx interrupt moderation control register definitions
 * Preprocessor definitions for TX Interrupt Moderation Control Register
 * Base Address: 0x00008980
@@ -2369,6 +2372,9 @@
 /* default value of bitfield reg_res_dsbl */
 #define pci_reg_res_dsbl_default 0x1
+/* PCI core control register */
+#define pci_reg_control6_adr 0x1014u
 /* global microprocessor scratch pad definitions */
 #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 1fe016fc4bc7..f2ce12ed4218 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -503,73 +503,43 @@ int hw_atl_utils_update_stats(struct aq_hw_s *self)
        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
        struct hw_aq_atl_utils_mbox mbox;
-        if (!self->aq_link_status.mbps)
-                return 0;
        hw_atl_utils_mpi_read_stats(self, &mbox);
 #define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \
                        mbox.stats._N_ - hw_self->last_stats._N_)
+        if (self->aq_link_status.mbps) {
-        AQ_SDELTA(uprc);
+                AQ_SDELTA(uprc);
-        AQ_SDELTA(mprc);
+                AQ_SDELTA(mprc);
-        AQ_SDELTA(bprc);
+                AQ_SDELTA(bprc);
-        AQ_SDELTA(erpt);
+                AQ_SDELTA(erpt);
-        AQ_SDELTA(uptc);
+                AQ_SDELTA(uptc);
-        AQ_SDELTA(mptc);
+                AQ_SDELTA(mptc);
-        AQ_SDELTA(bptc);
+                AQ_SDELTA(bptc);
-        AQ_SDELTA(erpr);
+                AQ_SDELTA(erpr);
-        AQ_SDELTA(ubrc);
+                AQ_SDELTA(ubrc);
-        AQ_SDELTA(ubtc);
+                AQ_SDELTA(ubtc);
-        AQ_SDELTA(mbrc);
+                AQ_SDELTA(mbrc);
-        AQ_SDELTA(mbtc);
+                AQ_SDELTA(mbtc);
-        AQ_SDELTA(bbrc);
+                AQ_SDELTA(bbrc);
-        AQ_SDELTA(bbtc);
+                AQ_SDELTA(bbtc);
-        AQ_SDELTA(dpc);
+                AQ_SDELTA(dpc);
+        }
 #undef AQ_SDELTA
+        hw_self->curr_stats.dma_pkt_rc = stats_rx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_pkt_tc = stats_tx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_rc = stats_rx_dma_good_octet_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_tc = stats_tx_dma_good_octet_counterlsw_get(self);
        memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));
        return 0;
 }
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self)
-                              u64 *data, unsigned int *p_count)
 {
-        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
+        return &PHAL_ATLANTIC->curr_stats;
-        struct hw_atl_stats_s *stats = &hw_self->curr_stats;
-        int i = 0;
-        data[i] = stats->uprc + stats->mprc + stats->bprc;
-        data[++i] = stats->uprc;
-        data[++i] = stats->mprc;
-        data[++i] = stats->bprc;
-        data[++i] = stats->erpt;
-        data[++i] = stats->uptc + stats->mptc + stats->bptc;
-        data[++i] = stats->uptc;
-        data[++i] = stats->mptc;
-        data[++i] = stats->bptc;
-        data[++i] = stats->ubrc;
-        data[++i] = stats->ubtc;
-        data[++i] = stats->mbrc;
-        data[++i] = stats->mbtc;
-        data[++i] = stats->bbrc;
-        data[++i] = stats->bbtc;
-        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
-        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
-        data[++i] = stats_rx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_rx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats->dpc;
-        if (p_count)
-                *p_count = ++i;
-        return 0;
 }
 static const u32 hw_atl_utils_hw_mac_regs[] = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index c99cc690e425..21aeca6908d3 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -129,7 +129,7 @@ struct __packed hw_aq_atl_utils_mbox {
 struct __packed hw_atl_s {
        struct aq_hw_s base;
        struct hw_atl_stats_s last_stats;
-        struct hw_atl_stats_s curr_stats;
+        struct aq_stats_s curr_stats;
        u64 speed;
        unsigned int chip_features;
        u32 fw_ver_actual;
@@ -207,8 +207,6 @@ int hw_atl_utils_get_fw_version(struct aq_hw_s *self, u32 *fw_version);
 int hw_atl_utils_update_stats(struct aq_hw_s *self);
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
-                              u64 *data,
-                              unsigned int *p_count);
 #endif /* HW_ATL_UTILS_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/ver.h b/drivers/net/ethernet/aquantia/atlantic/ver.h
index 0de858d215c2..9009f2651e70 100644
--- a/drivers/net/ethernet/aquantia/atlantic/ver.h
+++ b/drivers/net/ethernet/aquantia/atlantic/ver.h
@@ -11,8 +11,10 @@
 #define VER_H
 #define NIC_MAJOR_DRIVER_VERSION           1
-#define NIC_MINOR_DRIVER_VERSION           5
+#define NIC_MINOR_DRIVER_VERSION           6
-#define NIC_BUILD_DRIVER_VERSION           345
+#define NIC_BUILD_DRIVER_VERSION           13
 #define NIC_REVISION_DRIVER_VERSION        0
+#define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
 #endif /* VER_H */
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index c6163874e4e7..16f9bee992fe 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -199,9 +199,11 @@ static int emac_rockchip_probe(struct platform_device *pdev)
        /* RMII interface needs always a rate of 50MHz */
        err = clk_set_rate(priv->refclk, 50000000);
-        if (err)
+        if (err) {
                dev_err(dev,
                        "failed to change reference clock rate (%d)\n", err);
+                goto out_regulator_disable;
+        }
        if (priv->soc_data->need_div_macclk) {
                priv->macclk = devm_clk_get(dev, "macclk");
@@ -230,12 +232,14 @@ static int emac_rockchip_probe(struct platform_device *pdev)
        err = arc_emac_probe(ndev, interface);
        if (err) {
                dev_err(dev, "failed to probe arc emac (%d)\n", err);
-                goto out_regulator_disable;
+                goto out_clk_disable_macclk;
        }
        return 0;
 out_clk_disable_macclk:
-        clk_disable_unprepare(priv->macclk);
+        if (priv->soc_data->need_div_macclk)
+                clk_disable_unprepare(priv->macclk);
 out_regulator_disable:
        if (priv->regulator)
                regulator_disable(priv->regulator);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 6e423f098a60..31efc47c847e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4081,7 +4081,6 @@ static void skge_remove(struct pci_dev *pdev)
        if (hw->ports > 1) {
                skge_write32(hw, B0_IMSK, 0);
                skge_read32(hw, B0_IMSK);
-                free_irq(pdev->irq, hw);
        }
        spin_unlock_irq(&hw->hw_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index e0eb695318e6..1fa4849a6f56 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -188,7 +188,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        struct net_device *dev = mdev->pndev[port];
        struct mlx4_en_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
-        struct mlx4_cmd_mailbox *mailbox;
+        struct mlx4_cmd_mailbox *mailbox, *mailbox_priority;
        u64 in_mod = reset << 8 | port;
        int err;
        int i, counter_index;
@@ -198,6 +198,13 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
        if (IS_ERR(mailbox))
                return PTR_ERR(mailbox);
+        mailbox_priority = mlx4_alloc_cmd_mailbox(mdev->dev);
+        if (IS_ERR(mailbox_priority)) {
+                mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+                return PTR_ERR(mailbox_priority);
+        }
        err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
                           MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
                           MLX4_CMD_NATIVE);
@@ -206,6 +213,28 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        mlx4_en_stats = mailbox->buf;
+        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
+        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
+        err = mlx4_get_counter_stats(mdev->dev, counter_index,
+                                     &tmp_counter_stats, reset);
+        /* 0xffs indicates invalid value */
+        memset(mailbox_priority->buf, 0xff,
+               sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
+                memset(mailbox_priority->buf, 0,
+                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+                err = mlx4_cmd_box(mdev->dev, 0, mailbox_priority->dma,
+                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
+                                   0, MLX4_CMD_DUMP_ETH_STATS,
+                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
+                if (err)
+                        goto out;
+        }
+        flowstats = mailbox_priority->buf;
        spin_lock_bh(&priv->stats_lock);
        mlx4_en_fold_software_stats(dev);
@@ -345,31 +374,6 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        priv->pkstats.tx_prio[8][0] = be64_to_cpu(mlx4_en_stats->TTOT_novlan);
        priv->pkstats.tx_prio[8][1] = be64_to_cpu(mlx4_en_stats->TOCT_novlan);
-        spin_unlock_bh(&priv->stats_lock);
-        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
-        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
-        err = mlx4_get_counter_stats(mdev->dev, counter_index,
-                                     &tmp_counter_stats, reset);
-        /* 0xffs indicates invalid value */
-        memset(mailbox->buf, 0xff, sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
-                memset(mailbox->buf, 0,
-                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-                err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
-                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
-                                   0, MLX4_CMD_DUMP_ETH_STATS,
-                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
-                if (err)
-                        goto out;
-        }
-        flowstats = mailbox->buf;
-        spin_lock_bh(&priv->stats_lock);
        if (tmp_counter_stats.counter_mode == 0) {
                priv->pf_stats.rx_bytes   = be64_to_cpu(tmp_counter_stats.rx_bytes);
                priv->pf_stats.tx_bytes   = be64_to_cpu(tmp_counter_stats.tx_bytes);
@@ -410,6 +414,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 out:
        mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+        mlx4_free_cmd_mailbox(mdev->dev, mailbox_priority);
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 88699b181946..946d9db7c8c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -185,7 +185,7 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                if (priv->mdev->dev->caps.flags &
                                        MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
                        buf[3] = mlx4_en_test_registers(priv);
-                        if (priv->port_up)
+                        if (priv->port_up && dev->mtu >= MLX4_SELFTEST_LB_MIN_MTU)
                                buf[4] = mlx4_en_test_loopback(priv);
                }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 1856e279a7e0..2b72677eccd4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -153,6 +153,9 @@
 #define SMALL_PACKET_SIZE      (256 - NET_IP_ALIGN)
 #define HEADER_COPY_SIZE       (128 - NET_IP_ALIGN)
 #define MLX4_LOOPBACK_TEST_PAYLOAD (HEADER_COPY_SIZE - ETH_HLEN)
+#define PREAMBLE_LEN           8
+#define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
+                                  ETH_HLEN + PREAMBLE_LEN)
 #define MLX4_EN_MIN_MTU         46
 /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 04304dd894c6..606a0e0beeae 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -611,7 +611,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
                                                MLX4_MAX_PORTS;
                                else
                                        res_alloc->guaranteed[t] = 0;
-                                res_alloc->res_free -= res_alloc->guaranteed[t];
                                break;
                        default:
                                break;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 2d0897b7d860..9bd8d28de152 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4300,6 +4300,7 @@ static int mlxsw_sp_port_stp_set(struct mlxsw_sp_port *mlxsw_sp_port,
 static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid = 1;
        int err;
        err = mlxsw_sp_port_vp_mode_set(mlxsw_sp_port, true);
@@ -4312,8 +4313,19 @@ static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
                                     true, false);
        if (err)
                goto err_port_vlan_set;
+        for (; vid <= VLAN_N_VID - 1; vid++) {
+                err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                                     vid, false);
+                if (err)
+                        goto err_vid_learning_set;
+        }
        return 0;
+err_vid_learning_set:
+        for (vid--; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port, vid, true);
 err_port_vlan_set:
        mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
 err_port_stp_set:
@@ -4323,6 +4335,12 @@ err_port_stp_set:
 static void mlxsw_sp_port_ovs_leave(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid;
+        for (vid = VLAN_N_VID - 1; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                               vid, true);
        mlxsw_sp_port_vlan_set(mlxsw_sp_port, 2, VLAN_N_VID - 1,
                               false, false);
        mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 18461fcb9815..53dbf1e163a8 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -47,6 +47,7 @@
 #define MDIO_CLK_25_28                                               7
 #define MDIO_WAIT_TIMES                                           1000
+#define MDIO_STATUS_DELAY_TIME                                       1
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
@@ -65,7 +66,7 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
        if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                               !(reg & (MDIO_START | MDIO_BUSY)),
-                               100, MDIO_WAIT_TIMES * 100))
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                return -EIO;
        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
@@ -88,8 +89,8 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
        writel(reg, adpt->base + EMAC_MDIO_CTRL);
        if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
-                               !(reg & (MDIO_START | MDIO_BUSY)), 100,
+                               !(reg & (MDIO_START | MDIO_BUSY)),
-                               MDIO_WAIT_TIMES * 100))
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                return -EIO;
        return 0;
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 2b962d349f5f..009780df664b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2308,32 +2308,9 @@ static int __maybe_unused ravb_resume(struct device *dev)
        struct ravb_private *priv = netdev_priv(ndev);
        int ret = 0;
-        if (priv->wol_enabled) {
+        /* If WoL is enabled set reset mode to rearm the WoL logic */
-                /* Reduce the usecount of the clock to zero and then
+        if (priv->wol_enabled)
-                 * restore it to its original value. This is done to force
-                 * the clock to be re-enabled which is a workaround
-                 * for renesas-cpg-mssr driver which do not enable clocks
-                 * when resuming from PSCI suspend/resume.
-                 *
-                 * Without this workaround the driver fails to communicate
-                 * with the hardware if WoL was enabled when the system
-                 * entered PSCI suspend. This is due to that if WoL is enabled
-                 * we explicitly keep the clock from being turned off when
-                 * suspending, but in PSCI sleep power is cut so the clock
-                 * is disabled anyhow, the clock driver is not aware of this
-                 * so the clock is not turned back on when resuming.
-                 *
-                 * TODO: once the renesas-cpg-mssr suspend/resume is working
-                 *       this clock dance should be removed.
-                 */
-                clk_disable(priv->clk);
-                clk_disable(priv->clk);
-                clk_enable(priv->clk);
-                clk_enable(priv->clk);
-                /* Set reset mode to rearm the WoL logic */
                ravb_write(ndev, CCC_OPC_RESET, CCC);
-        }
        /* All register have been reset to default values.
         * Restore all registers which where setup at probe time and
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index db72d13cebb9..75323000c364 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1892,6 +1892,16 @@ static int sh_eth_phy_init(struct net_device *ndev)
                return PTR_ERR(phydev);
        }
+        /* mask with MAC supported features */
+        if (mdp->cd->register_type != SH_ETH_REG_GIGABIT) {
+                int err = phy_set_max_speed(phydev, SPEED_100);
+                if (err) {
+                        netdev_err(ndev, "failed to limit PHY to 100 Mbit/s\n");
+                        phy_disconnect(phydev);
+                        return err;
+                }
+        }
        phy_attached_info(phydev);
        return 0;
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index 8483f03d5a41..1ab97d99b9ba 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1379,8 +1379,8 @@ static int rr_close(struct net_device *dev)
                            rrpriv->info_dma);
        rrpriv->info = NULL;
-        free_irq(pdev->irq, dev);
        spin_unlock_irqrestore(&rrpriv->lock, flags);
+        free_irq(pdev->irq, dev);
        return 0;
 }
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 5f93e6add563..e911e4990b20 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_device *phydev)
 {
        int value;
-        mutex_lock(&phydev->lock);
        value = phy_read(phydev, MII_BMCR);
        value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
        phy_write(phydev, MII_BMCR, value);
-        mutex_unlock(&phydev->lock);
        return 0;
 }
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 4d02b27df044..b5a8f750e433 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -637,6 +637,10 @@ static int m88e1510_config_aneg(struct phy_device *phydev)
        if (err < 0)
                goto error;
+        /* Do not touch the fiber page if we're in copper->sgmii mode */
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII)
+                return 0;
        /* Then the fiber link */
        err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE);
        if (err < 0)
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2df7b62c1a36..54d00a1d2bef 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -270,6 +270,7 @@ static void of_mdiobus_link_mdiodev(struct mii_bus *bus,
                if (addr == mdiodev->addr) {
                        dev->of_node = child;
+                        dev->fwnode = of_fwnode_handle(child);
                        return;
                }
        }
diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
index 1ea69b7585d9..842eb871a6e3 100644
--- a/drivers/net/phy/meson-gxl.c
+++ b/drivers/net/phy/meson-gxl.c
@@ -22,6 +22,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/netdevice.h>
+#include <linux/bitfield.h>
 static int meson_gxl_config_init(struct phy_device *phydev)
 {
@@ -50,6 +51,77 @@ static int meson_gxl_config_init(struct phy_device *phydev)
        return 0;
 }
+/* This function is provided to cope with the possible failures of this phy
+ * during aneg process. When aneg fails, the PHY reports that aneg is done
+ * but the value found in MII_LPA is wrong:
+ *  - Early failures: MII_LPA is just 0x0001. if MII_EXPANSION reports that
+ *    the link partner (LP) supports aneg but the LP never acked our base
+ *    code word, it is likely that we never sent it to begin with.
+ *  - Late failures: MII_LPA is filled with a value which seems to make sense
+ *    but it actually is not what the LP is advertising. It seems that we
+ *    can detect this using a magic bit in the WOL bank (reg 12 - bit 12).
+ *    If this particular bit is not set when aneg is reported being done,
+ *    it means MII_LPA is likely to be wrong.
+ *
+ * In both case, forcing a restart of the aneg process solve the problem.
+ * When this failure happens, the first retry is usually successful but,
+ * in some cases, it may take up to 6 retries to get a decent result
+ */
+static int meson_gxl_read_status(struct phy_device *phydev)
+{
+        int ret, wol, lpa, exp;
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                ret = genphy_aneg_done(phydev);
+                if (ret < 0)
+                        return ret;
+                else if (!ret)
+                        goto read_status_continue;
+                /* Need to access WOL bank, make sure the access is open */
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+                /* Request LPI_STATUS WOL register */
+                ret = phy_write(phydev, 0x14, 0x8D80);
+                if (ret)
+                        return ret;
+                /* Read LPI_STATUS value */
+                wol = phy_read(phydev, 0x15);
+                if (wol < 0)
+                        return wol;
+                lpa = phy_read(phydev, MII_LPA);
+                if (lpa < 0)
+                        return lpa;
+                exp = phy_read(phydev, MII_EXPANSION);
+                if (exp < 0)
+                        return exp;
+                if (!(wol & BIT(12)) ||
+                    ((exp & EXPANSION_NWAY) && !(lpa & LPA_LPACK))) {
+                        /* Looks like aneg failed after all */
+                        phydev_dbg(phydev, "LPA corruption - aneg restart\n");
+                        return genphy_restart_aneg(phydev);
+                }
+        }
+read_status_continue:
+        return genphy_read_status(phydev);
+}
 static struct phy_driver meson_gxl_phy[] = {
        {
                .phy_id         = 0x01814400,
@@ -60,7 +132,7 @@ static struct phy_driver meson_gxl_phy[] = {
                .config_init    = meson_gxl_config_init,
                .config_aneg    = genphy_config_aneg,
                .aneg_done      = genphy_aneg_done,
-                .read_status    = genphy_read_status,
+                .read_status    = meson_gxl_read_status,
                .suspend        = genphy_suspend,
                .resume         = genphy_resume,
        },
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 2b1e67bc1e73..ed10d1fc8f59 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop);
 */
 void phy_start(struct phy_device *phydev)
 {
-        bool do_resume = false;
        int err = 0;
        mutex_lock(&phydev->lock);
@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev)
                phydev->state = PHY_UP;
                break;
        case PHY_HALTED:
+                /* if phy was suspended, bring the physical link up again */
+                phy_resume(phydev);
                /* make sure interrupts are re-enabled for the PHY */
                if (phydev->irq != PHY_POLL) {
                        err = phy_enable_interrupts(phydev);
@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev)
                }
                phydev->state = PHY_RESUMING;
-                do_resume = true;
                break;
        default:
                break;
        }
        mutex_unlock(&phydev->lock);
-        /* if phy was suspended, bring the physical link up again */
-        if (do_resume)
-                phy_resume(phydev);
        phy_trigger_machine(phydev, true);
 }
 EXPORT_SYMBOL(phy_start);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 67f25ac29025..b15b31ca2618 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -135,7 +135,9 @@ static int mdio_bus_phy_resume(struct device *dev)
        if (!mdio_bus_phy_may_suspend(phydev))
                goto no_resume;
+        mutex_lock(&phydev->lock);
        ret = phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
        if (ret < 0)
                return ret;
@@ -1026,7 +1028,9 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
        if (err)
                goto error;
+        mutex_lock(&phydev->lock);
        phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
        phy_led_triggers_register(phydev);
        return err;
@@ -1157,6 +1161,8 @@ int phy_resume(struct phy_device *phydev)
        struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
        int ret = 0;
+        WARN_ON(!mutex_is_locked(&phydev->lock));
        if (phydev->drv && phydrv->resume)
                ret = phydrv->resume(phydev);
@@ -1639,13 +1645,9 @@ int genphy_resume(struct phy_device *phydev)
 {
        int value;
-        mutex_lock(&phydev->lock);
        value = phy_read(phydev, MII_BMCR);
        phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
-        mutex_unlock(&phydev->lock);
        return 0;
 }
 EXPORT_SYMBOL(genphy_resume);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 304ec6555cd8..3000ddd1c7e2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1204,12 +1204,14 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
        {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},    /* Telit ME910 dual modem */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
        {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 98258583abb0..3481e69738b5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -81,6 +81,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio,
         * can be looked up later */
        of_node_get(child);
        phy->mdio.dev.of_node = child;
+        phy->mdio.dev.fwnode = of_fwnode_handle(child);
        /* All data is now stored in the phy struct;
         * register it */
@@ -111,6 +112,7 @@ static int of_mdiobus_register_device(struct mii_bus *mdio,
         */
        of_node_get(child);
        mdiodev->dev.of_node = child;
+        mdiodev->dev.fwnode = of_fwnode_handle(child);
        /* All data is now stored in the mdiodev struct; register it. */
        rc = mdio_device_register(mdiodev);
@@ -206,6 +208,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
        mdio->phy_mask = ~0;
        mdio->dev.of_node = np;
+        mdio->dev.fwnode = of_fwnode_handle(np);
        /* Get bus level PHY reset GPIO details */
        mdio->reset_delay_us = DEFAULT_GPIO_RESET_DELAY;
diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
index 12796eccb2be..52ab3cb0a0bf 100644
--- a/drivers/pci/host/pcie-rcar.c
+++ b/drivers/pci/host/pcie-rcar.c
@@ -1128,12 +1128,12 @@ static int rcar_pcie_probe(struct platform_device *pdev)
        err = rcar_pcie_get_resources(pcie);
        if (err < 0) {
                dev_err(dev, "failed to request resources: %d\n", err);
-                goto err_free_bridge;
+                goto err_free_resource_list;
        }
        err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
        if (err)
-                goto err_free_bridge;
+                goto err_free_resource_list;
        pm_runtime_enable(dev);
        err = pm_runtime_get_sync(dev);
@@ -1176,9 +1176,9 @@ err_pm_put:
 err_pm_disable:
        pm_runtime_disable(dev);
-err_free_bridge:
+err_free_resource_list:
-        pci_free_host_bridge(bridge);
        pci_free_resource_list(&pcie->resources);
+        pci_free_host_bridge(bridge);
        return err;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 7f47bb72bf30..945099d49f8f 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -999,7 +999,7 @@ static int pci_pm_thaw_noirq(struct device *dev)
         * the subsequent "thaw" callbacks for the device.
         */
        if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                return 0;
        }
diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index f3796164329e..d4aeac3477f5 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -118,6 +118,7 @@ static void asus_wireless_notify(struct acpi_device *adev, u32 event)
                return;
        }
        input_report_key(data->idev, KEY_RFKILL, 1);
+        input_sync(data->idev);
        input_report_key(data->idev, KEY_RFKILL, 0);
        input_sync(data->idev);
 }
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index bf897b1832b1..cd4725e7e0b5 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -37,6 +37,7 @@
 struct quirk_entry {
        u8 touchpad_led;
+        u8 kbd_led_levels_off_1;
        int needs_kbd_timeouts;
        /*
@@ -67,6 +68,10 @@ static struct quirk_entry quirk_dell_xps13_9333 = {
        .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
 };
+static struct quirk_entry quirk_dell_latitude_e6410 = {
+        .kbd_led_levels_off_1 = 1,
+};
 static struct platform_driver platform_driver = {
        .driver = {
                .name = "dell-laptop",
@@ -269,6 +274,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
                },
                .driver_data = &quirk_dell_xps13_9333,
        },
+        {
+                .callback = dmi_matched,
+                .ident = "Dell Latitude E6410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
+                },
+                .driver_data = &quirk_dell_latitude_e6410,
+        },
        { }
 };
@@ -1149,6 +1163,9 @@ static int kbd_get_info(struct kbd_info *info)
        units = (buffer->output[2] >> 8) & 0xFF;
        info->levels = (buffer->output[2] >> 16) & 0xFF;
+        if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
+                info->levels--;
        if (units & BIT(0))
                info->seconds = (buffer->output[3] >> 0) & 0xFF;
        if (units & BIT(1))
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 39d2f4518483..fb25b20df316 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -639,6 +639,8 @@ static int dell_wmi_events_set_enabled(bool enable)
        int ret;
        buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
        buffer->cmd_class = CLASS_INFO;
        buffer->cmd_select = SELECT_APP_REGISTRATION;
        buffer->input[0] = 0x10000;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 15015a24f8ad..badf42acbf95 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -565,9 +565,9 @@ enum qeth_cq {
 };
 struct qeth_ipato {
-        int enabled;
+        bool enabled;
-        int invert4;
+        bool invert4;
-        int invert6;
+        bool invert6;
        struct list_head entries;
 };
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 430e3214f7e2..6c815207f4f5 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1480,9 +1480,9 @@ static int qeth_setup_card(struct qeth_card *card)
        qeth_set_intial_options(card);
        /* IP address takeover */
        INIT_LIST_HEAD(&card->ipato.entries);
-        card->ipato.enabled = 0;
+        card->ipato.enabled = false;
-        card->ipato.invert4 = 0;
+        card->ipato.invert4 = false;
-        card->ipato.invert6 = 0;
+        card->ipato.invert6 = false;
        /* init QDIO stuff */
        qeth_init_qdio_info(card);
        INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work);
diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h
index 194ae9b577cc..e5833837b799 100644
--- a/drivers/s390/net/qeth_l3.h
+++ b/drivers/s390/net/qeth_l3.h
@@ -82,7 +82,7 @@ void qeth_l3_del_vipa(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 int qeth_l3_add_rxip(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions,
                        const u8 *);
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *, struct qeth_ipaddr *);
+void qeth_l3_update_ipato(struct qeth_card *card);
 struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions);
 int qeth_l3_add_ip(struct qeth_card *, struct qeth_ipaddr *);
 int qeth_l3_delete_ip(struct qeth_card *, struct qeth_ipaddr *);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 6a73894b0cb5..ef0961e18686 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -164,8 +164,8 @@ static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len)
        }
 }
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
+static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
-                                                struct qeth_ipaddr *addr)
+                                             struct qeth_ipaddr *addr)
 {
        struct qeth_ipato_entry *ipatoe;
        u8 addr_bits[128] = {0, };
@@ -174,6 +174,8 @@ int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
        if (!card->ipato.enabled)
                return 0;
+        if (addr->type != QETH_IP_TYPE_NORMAL)
+                return 0;
        qeth_l3_convert_addr_to_bits((u8 *) &addr->u, addr_bits,
                                  (addr->proto == QETH_PROT_IPV4)? 4:16);
@@ -290,8 +292,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                memcpy(addr, tmp_addr, sizeof(struct qeth_ipaddr));
                addr->ref_counter = 1;
-                if (addr->type == QETH_IP_TYPE_NORMAL  &&
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr)) {
-                                qeth_l3_is_addr_covered_by_ipato(card, addr)) {
                        QETH_CARD_TEXT(card, 2, "tkovaddr");
                        addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
                }
@@ -605,6 +606,27 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
 /*
 * IP address takeover related functions
 */
+/**
+ * qeth_l3_update_ipato() - Update 'takeover' property, for all NORMAL IPs.
+ *
+ * Caller must hold ip_lock.
+ */
+void qeth_l3_update_ipato(struct qeth_card *card)
+{
+        struct qeth_ipaddr *addr;
+        unsigned int i;
+        hash_for_each(card->ip_htable, i, addr, hnode) {
+                if (addr->type != QETH_IP_TYPE_NORMAL)
+                        continue;
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr))
+                        addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
+                else
+                        addr->set_flags &= ~QETH_IPA_SETIP_TAKEOVER_FLAG;
+        }
+}
 static void qeth_l3_clear_ipato_list(struct qeth_card *card)
 {
        struct qeth_ipato_entry *ipatoe, *tmp;
@@ -616,6 +638,7 @@ static void qeth_l3_clear_ipato_list(struct qeth_card *card)
                kfree(ipatoe);
        }
+        qeth_l3_update_ipato(card);
        spin_unlock_bh(&card->ip_lock);
 }
@@ -640,8 +663,10 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card,
                }
        }
-        if (!rc)
+        if (!rc) {
                list_add_tail(&new->entry, &card->ipato.entries);
+                qeth_l3_update_ipato(card);
+        }
        spin_unlock_bh(&card->ip_lock);
@@ -664,6 +689,7 @@ void qeth_l3_del_ipato_entry(struct qeth_card *card,
                            (proto == QETH_PROT_IPV4)? 4:16) &&
                    (ipatoe->mask_bits == mask_bits)) {
                        list_del(&ipatoe->entry);
+                        qeth_l3_update_ipato(card);
                        kfree(ipatoe);
                }
        }
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index bd12fdf678be..6ea2b528a64e 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -370,8 +370,8 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
                struct device_attribute *attr, const char *buf, size_t count)
 {
        struct qeth_card *card = dev_get_drvdata(dev);
-        struct qeth_ipaddr *addr;
+        bool enable;
-        int i, rc = 0;
+        int rc = 0;
        if (!card)
                return -EINVAL;
@@ -384,25 +384,18 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
        }
        if (sysfs_streq(buf, "toggle")) {
-                card->ipato.enabled = (card->ipato.enabled)? 0 : 1;
+                enable = !card->ipato.enabled;
-        } else if (sysfs_streq(buf, "1")) {
+        } else if (kstrtobool(buf, &enable)) {
-                card->ipato.enabled = 1;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                                if ((addr->type == QETH_IP_TYPE_NORMAL) &&
-                                qeth_l3_is_addr_covered_by_ipato(card, addr))
-                                        addr->set_flags |=
-                                        QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else if (sysfs_streq(buf, "0")) {
-                card->ipato.enabled = 0;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                        if (addr->set_flags &
-                        QETH_IPA_SETIP_TAKEOVER_FLAG)
-                                addr->set_flags &=
-                                ~QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else
                rc = -EINVAL;
+                goto out;
+        }
+        if (card->ipato.enabled != enable) {
+                card->ipato.enabled = enable;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
 out:
        mutex_unlock(&card->conf_mutex);
        return rc ? rc : count;
@@ -428,20 +421,27 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev,
                                const char *buf, size_t count)
 {
        struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
        int rc = 0;
        if (!card)
                return -EINVAL;
        mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
+        if (sysfs_streq(buf, "toggle")) {
-                card->ipato.invert4 = (card->ipato.invert4)? 0 : 1;
+                invert = !card->ipato.invert4;
-        else if (sysfs_streq(buf, "1"))
+        } else if (kstrtobool(buf, &invert)) {
-                card->ipato.invert4 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert4 = 0;
-        else
                rc = -EINVAL;
+                goto out;
+        }
+        if (card->ipato.invert4 != invert) {
+                card->ipato.invert4 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
        mutex_unlock(&card->conf_mutex);
        return rc ? rc : count;
 }
@@ -607,20 +607,27 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev,
                struct device_attribute *attr, const char *buf, size_t count)
 {
        struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
        int rc = 0;
        if (!card)
                return -EINVAL;
        mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
+        if (sysfs_streq(buf, "toggle")) {
-                card->ipato.invert6 = (card->ipato.invert6)? 0 : 1;
+                invert = !card->ipato.invert6;
-        else if (sysfs_streq(buf, "1"))
+        } else if (kstrtobool(buf, &invert)) {
-                card->ipato.invert6 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert6 = 0;
-        else
                rc = -EINVAL;
+                goto out;
+        }
+        if (card->ipato.invert6 != invert) {
+                card->ipato.invert6 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
        mutex_unlock(&card->conf_mutex);
        return rc ? rc : count;
 }
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index bec9f3193f60..80a8cb26cdea 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -2482,8 +2482,8 @@ int aac_command_thread(void *data)
                        /* Synchronize our watches */
                        if (((NSEC_PER_SEC - (NSEC_PER_SEC / HZ)) > now.tv_nsec)
                         && (now.tv_nsec > (NSEC_PER_SEC / HZ)))
-                                difference = (((NSEC_PER_SEC - now.tv_nsec) * HZ)
+                                difference = HZ + HZ / 2 -
-                                  + NSEC_PER_SEC / 2) / NSEC_PER_SEC;
+                                             now.tv_nsec / (NSEC_PER_SEC / HZ);
                        else {
                                if (now.tv_nsec > NSEC_PER_SEC / 2)
                                        ++now.tv_sec;
@@ -2507,6 +2507,10 @@ int aac_command_thread(void *data)
                if (kthread_should_stop())
                        break;
+                /*
+                 * we probably want usleep_range() here instead of the
+                 * jiffies computation
+                 */
                schedule_timeout(difference);
                if (kthread_should_stop())
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 72ca2a2e08e2..b2fa195adc7a 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_job *job)
        struct fc_bsg_request *bsg_request = job->request;
        struct fc_bsg_reply *bsg_reply = job->reply;
        uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
        struct bfad_s *bfad = im_port->bfad;
        void *payload_kbuf;
        int rc = -EINVAL;
@@ -3350,7 +3351,8 @@ int
 bfad_im_bsg_els_ct_request(struct bsg_job *job)
 {
        struct bfa_bsg_data *bsg_data;
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
        struct bfad_s *bfad = im_port->bfad;
        bfa_bsg_fcpt_t *bsg_fcpt;
        struct bfad_fcxp    *drv_fcxp;
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 24e657a4ec80..c05d6e91e4bd 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -546,6 +546,7 @@ int
 bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                        struct device *dev)
 {
+        struct bfad_im_port_pointer *im_portp;
        int error = 1;
        mutex_lock(&bfad_mutex);
@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                goto out_free_idr;
        }
-        im_port->shost->hostdata[0] = (unsigned long)im_port;
+        im_portp = shost_priv(im_port->shost);
+        im_portp->p = im_port;
        im_port->shost->unique_id = im_port->idr_id;
        im_port->shost->this_id = -1;
        im_port->shost->max_id = MAX_FCP_TARGET;
@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port_s *im_port, struct bfad_s *bfad)
        sht->sg_tablesize = bfad->cfg_data.io_max_sge;
-        return scsi_host_alloc(sht, sizeof(unsigned long));
+        return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
 }
 void
diff --git a/drivers/scsi/bfa/bfad_im.h b/drivers/scsi/bfa/bfad_im.h
index c81ec2a77ef5..06ce4ba2b7bc 100644
--- a/drivers/scsi/bfa/bfad_im.h
+++ b/drivers/scsi/bfa/bfad_im.h
@@ -69,6 +69,16 @@ struct bfad_im_port_s {
        struct fc_vport *fc_vport;
 };
+struct bfad_im_port_pointer {
+        struct bfad_im_port_s *p;
+};
+static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
+{
+        struct bfad_im_port_pointer *im_portp = shost_priv(host);
+        return im_portp->p;
+}
 enum bfad_itnim_state {
        ITNIM_STATE_NONE,
        ITNIM_STATE_ONLINE,
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 5da46052e179..21be672679fb 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -904,10 +904,14 @@ static void fc_lport_recv_els_req(struct fc_lport *lport,
                case ELS_FLOGI:
                        if (!lport->point_to_multipoint)
                                fc_lport_recv_flogi_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                        break;
                case ELS_LOGO:
                        if (fc_frame_sid(fp) == FC_FID_FLOGI)
                                fc_lport_recv_logo_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                        break;
                case ELS_RSCN:
                        lport->tt.disc_recv_req(lport, fp);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index ca1566237ae7..3183d63de4da 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
                struct sas_rphy *rphy)
 {
        struct domain_device *dev;
-        unsigned int reslen = 0;
+        unsigned int rcvlen = 0;
        int ret = -EINVAL;
        /* no rphy means no smp target support (ie aic94xx host) */
@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
        ret = smp_execute_task_sg(dev, job->request_payload.sg_list,
                        job->reply_payload.sg_list);
-        if (ret > 0) {
+        if (ret >= 0) {
-                /* positive number is the untransferred residual */
+                /* bsg_job_done() requires the length received  */
-                reslen = ret;
+                rcvlen = job->reply_payload.payload_len - ret;
                ret = 0;
        }
 out:
-        bsg_job_done(job, ret, reslen);
+        bsg_job_done(job, ret, rcvlen);
 }
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 56faeb049b4a..87c08ff37ddd 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
        drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
        rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
        if (rc < 0) {
-                (rqbp->rqb_free_buffer)(phba, rqb_entry);
                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                "6409 Cannot post to RQ %d: %x %x\n",
                                rqb_entry->hrq->queue_id,
                                rqb_entry->hrq->host_index,
                                rqb_entry->hrq->hba_index);
+                (rqbp->rqb_free_buffer)(phba, rqb_entry);
        } else {
                list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                rqbp->buffer_count++;
diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c
index 01f08c03f2c1..c3765d29fd3f 100644
--- a/drivers/scsi/scsi_debugfs.c
+++ b/drivers/scsi/scsi_debugfs.c
@@ -8,9 +8,11 @@ void scsi_show_rq(struct seq_file *m, struct request *rq)
 {
        struct scsi_cmnd *cmd = container_of(scsi_req(rq), typeof(*cmd), req);
        int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc);
-        char buf[80];
+        const u8 *const cdb = READ_ONCE(cmd->cmnd);
+        char buf[80] = "(?)";
-        __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
+        if (cdb)
+                __scsi_format_command(buf, sizeof(buf), cdb, cmd->cmd_len);
        seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf,
                   cmd->retries, msecs / 1000, msecs % 1000);
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 78d4aa8df675..449ef5adbb2b 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -34,7 +34,6 @@ struct scsi_dev_info_list_table {
 };
-static const char spaces[] = "                "; /* 16 of them */
 static blist_flags_t scsi_default_dev_flags;
 static LIST_HEAD(scsi_dev_info_list);
 static char scsi_dev_flags[256];
@@ -298,20 +297,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
        size_t from_length;
        from_length = strlen(from);
-        strncpy(to, from, min(to_length, from_length));
+        /* This zero-pads the destination */
-        if (from_length < to_length) {
+        strncpy(to, from, to_length);
-                if (compatible) {
+        if (from_length < to_length && !compatible) {
-                        /*
+                /*
-                         * NUL terminate the string if it is short.
+                 * space pad the string if it is short.
-                         */
+                 */
-                        to[from_length] = '\0';
+                memset(&to[from_length], ' ', to_length - from_length);
-                } else {
-                        /*
-                         * space pad the string if it is short.
-                         */
-                        strncpy(&to[from_length], spaces,
-                                to_length - from_length);
-                }
        }
        if (from_length > to_length)
                 printk(KERN_WARNING "%s: %s string '%s' is too long\n",
@@ -458,7 +450,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                        /*
                         * vendor strings must be an exact match
                         */
-                        if (vmax != strlen(devinfo->vendor) ||
+                        if (vmax != strnlen(devinfo->vendor,
+                                            sizeof(devinfo->vendor)) ||
                            memcmp(devinfo->vendor, vskip, vmax))
                                continue;
@@ -466,7 +459,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                         * @model specifies the full string, and
                         * must be larger or equal to devinfo->model
                         */
-                        mlen = strlen(devinfo->model);
+                        mlen = strnlen(devinfo->model, sizeof(devinfo->model));
                        if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
                                continue;
                        return devinfo;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 00742c50cd44..d9ca1dfab154 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1967,6 +1967,8 @@ static bool scsi_mq_get_budget(struct blk_mq_hw_ctx *hctx)
 out_put_device:
        put_device(&sdev->sdev_gendev);
 out:
+        if (atomic_read(&sdev->device_busy) == 0 && !scsi_device_blocked(sdev))
+                blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
        return false;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 24fe68522716..a028ab3322a9 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1312,6 +1312,7 @@ static int sd_init_command(struct scsi_cmnd *cmd)
 static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
        struct request *rq = SCpnt->request;
+        u8 *cmnd;
        if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
                sd_zbc_write_unlock_zone(SCpnt);
@@ -1320,9 +1321,10 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
                __free_page(rq->special_vec.bv_page);
        if (SCpnt->cmnd != scsi_req(rq)->cmd) {
-                mempool_free(SCpnt->cmnd, sd_cdb_pool);
+                cmnd = SCpnt->cmnd;
                SCpnt->cmnd = NULL;
                SCpnt->cmd_len = 0;
+                mempool_free(cmnd, sd_cdb_pool);
        }
 }
diff --git a/drivers/staging/ccree/ssi_hash.c b/drivers/staging/ccree/ssi_hash.c
index 1799d3f26a9e..2035835b62dc 100644
--- a/drivers/staging/ccree/ssi_hash.c
+++ b/drivers/staging/ccree/ssi_hash.c
@@ -1769,7 +1769,7 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
        struct device *dev = drvdata_to_dev(ctx->drvdata);
        struct ahash_req_ctx *state = ahash_request_ctx(req);
        u32 tmp;
-        int rc;
+        int rc = 0;
        memcpy(&tmp, in, sizeof(u32));
        if (tmp != CC_EXPORT_MAGIC) {
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index e69a2153c999..12c9df9cddde 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -102,7 +102,7 @@ enum modulation rf69_get_modulation(struct spi_device *spi)
        currentValue = READ_REG(REG_DATAMODUL);
-        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE >> 3) { // TODO improvement: change 3 to define
+        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE) {
        case DATAMODUL_MODULATION_TYPE_OOK: return OOK;
        case DATAMODUL_MODULATION_TYPE_FSK: return FSK;
        default:                            return undefined;
diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index a60ae778ccb8..e9843c53fe31 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -240,12 +240,12 @@ static int optee_open(struct tee_context *ctx)
        if (teedev == optee->supp_teedev) {
                bool busy = true;
-                mutex_lock(&optee->supp.ctx_mutex);
+                mutex_lock(&optee->supp.mutex);
                if (!optee->supp.ctx) {
                        busy = false;
                        optee->supp.ctx = ctx;
                }
-                mutex_unlock(&optee->supp.ctx_mutex);
+                mutex_unlock(&optee->supp.mutex);
                if (busy) {
                        kfree(ctxdata);
                        return -EBUSY;
@@ -305,11 +305,8 @@ static void optee_release(struct tee_context *ctx)
        ctx->data = NULL;
-        if (teedev == optee->supp_teedev) {
+        if (teedev == optee->supp_teedev)
-                mutex_lock(&optee->supp.ctx_mutex);
+                optee_supp_release(&optee->supp);
-                optee->supp.ctx = NULL;
-                mutex_unlock(&optee->supp.ctx_mutex);
-        }
 }
 static const struct tee_driver_ops optee_ops = {
diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h
index de7962ebc1b6..a85a24725e31 100644
--- a/drivers/tee/optee/optee_private.h
+++ b/drivers/tee/optee/optee_private.h
@@ -53,36 +53,24 @@ struct optee_wait_queue {
 * @ctx                 the context of current connected supplicant.
 *                      if !NULL the supplicant device is available for use,
 *                      else busy
- * @ctx_mutex:          held while accessing @ctx
+ * @mutex:              held while accessing content of this struct
- * @func:               supplicant function id to call
+ * @req_id:             current request id if supplicant is doing synchronous
- * @ret:                call return value
+ *                      communication, else -1
- * @num_params:         number of elements in @param
+ * @reqs:               queued request not yet retrieved by supplicant
- * @param:              parameters for @func
+ * @idr:                IDR holding all requests currently being processed
- * @req_posted:         if true, a request has been posted to the supplicant
+ *                      by supplicant
- * @supp_next_send:     if true, next step is for supplicant to send response
+ * @reqs_c:             completion used by supplicant when waiting for a
- * @thrd_mutex:         held by the thread doing a request to supplicant
+ *                      request to be queued.
- * @supp_mutex:         held by supplicant while operating on this struct
- * @data_to_supp:       supplicant is waiting on this for next request
- * @data_from_supp:     requesting thread is waiting on this to get the result
 */
 struct optee_supp {
+        /* Serializes access to this struct */
+        struct mutex mutex;
        struct tee_context *ctx;
-        /* Serializes access of ctx */
-        struct mutex ctx_mutex;
+        int req_id;
+        struct list_head reqs;
-        u32 func;
+        struct idr idr;
-        u32 ret;
+        struct completion reqs_c;
-        size_t num_params;
-        struct tee_param *param;
-        bool req_posted;
-        bool supp_next_send;
-        /* Serializes access to this struct for requesting thread */
-        struct mutex thrd_mutex;
-        /* Serializes access to this struct for supplicant threads */
-        struct mutex supp_mutex;
-        struct completion data_to_supp;
-        struct completion data_from_supp;
 };
 /**
@@ -154,6 +142,7 @@ int optee_supp_read(struct tee_context *ctx, void __user *buf, size_t len);
 int optee_supp_write(struct tee_context *ctx, void __user *buf, size_t len);
 void optee_supp_init(struct optee_supp *supp);
 void optee_supp_uninit(struct optee_supp *supp);
+void optee_supp_release(struct optee_supp *supp);
 int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params,
                    struct tee_param *param);
diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c
index 690e48a61aca..41aea12e2bcc 100644
--- a/drivers/tee/optee/rpc.c
+++ b/drivers/tee/optee/rpc.c
@@ -192,10 +192,10 @@ static struct tee_shm *cmd_alloc_suppl(struct tee_context *ctx, size_t sz)
        if (ret)
                return ERR_PTR(-ENOMEM);
-        mutex_lock(&optee->supp.ctx_mutex);
+        mutex_lock(&optee->supp.mutex);
        /* Increases count as secure world doesn't have a reference */
        shm = tee_shm_get_from_id(optee->supp.ctx, param.u.value.c);
-        mutex_unlock(&optee->supp.ctx_mutex);
+        mutex_unlock(&optee->supp.mutex);
        return shm;
 }
diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c
index b4ea0678a436..df35fc01fd3e 100644
--- a/drivers/tee/optee/supp.c
+++ b/drivers/tee/optee/supp.c
@@ -16,21 +16,61 @@
 #include <linux/uaccess.h>
 #include "optee_private.h"
+struct optee_supp_req {
+        struct list_head link;
+        bool busy;
+        u32 func;
+        u32 ret;
+        size_t num_params;
+        struct tee_param *param;
+        struct completion c;
+};
 void optee_supp_init(struct optee_supp *supp)
 {
        memset(supp, 0, sizeof(*supp));
-        mutex_init(&supp->ctx_mutex);
+        mutex_init(&supp->mutex);
-        mutex_init(&supp->thrd_mutex);
+        init_completion(&supp->reqs_c);
-        mutex_init(&supp->supp_mutex);
+        idr_init(&supp->idr);
-        init_completion(&supp->data_to_supp);
+        INIT_LIST_HEAD(&supp->reqs);
-        init_completion(&supp->data_from_supp);
+        supp->req_id = -1;
 }
 void optee_supp_uninit(struct optee_supp *supp)
 {
-        mutex_destroy(&supp->ctx_mutex);
+        mutex_destroy(&supp->mutex);
-        mutex_destroy(&supp->thrd_mutex);
+        idr_destroy(&supp->idr);
-        mutex_destroy(&supp->supp_mutex);
+}
+void optee_supp_release(struct optee_supp *supp)
+{
+        int id;
+        struct optee_supp_req *req;
+        struct optee_supp_req *req_tmp;
+        mutex_lock(&supp->mutex);
+        /* Abort all request retrieved by supplicant */
+        idr_for_each_entry(&supp->idr, req, id) {
+                req->busy = false;
+                idr_remove(&supp->idr, id);
+                req->ret = TEEC_ERROR_COMMUNICATION;
+                complete(&req->c);
+        }
+        /* Abort all queued requests */
+        list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
+                list_del(&req->link);
+                req->ret = TEEC_ERROR_COMMUNICATION;
+                complete(&req->c);
+        }
+        supp->ctx = NULL;
+        supp->req_id = -1;
+        mutex_unlock(&supp->mutex);
 }
 /**
@@ -44,53 +84,42 @@ void optee_supp_uninit(struct optee_supp *supp)
 */
 u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
                        struct tee_param *param)
 {
-        bool interruptable;
        struct optee *optee = tee_get_drvdata(ctx->teedev);
        struct optee_supp *supp = &optee->supp;
+        struct optee_supp_req *req = kzalloc(sizeof(*req), GFP_KERNEL);
+        bool interruptable;
        u32 ret;
-        /*
+        if (!req)
-         * Other threads blocks here until we've copied our answer from
+                return TEEC_ERROR_OUT_OF_MEMORY;
-         * supplicant.
-         */
-        while (mutex_lock_interruptible(&supp->thrd_mutex)) {
-                /* See comment below on when the RPC can be interrupted. */
-                mutex_lock(&supp->ctx_mutex);
-                interruptable = !supp->ctx;
-                mutex_unlock(&supp->ctx_mutex);
-                if (interruptable)
-                        return TEEC_ERROR_COMMUNICATION;
-        }
-        /*
+        init_completion(&req->c);
-         * We have exclusive access now since the supplicant at this
+        req->func = func;
-         * point is either doing a
+        req->num_params = num_params;
-         * wait_for_completion_interruptible(&supp->data_to_supp) or is in
+        req->param = param;
-         * userspace still about to do the ioctl() to enter
-         * optee_supp_recv() below.
-         */
-        supp->func = func;
+        /* Insert the request in the request list */
-        supp->num_params = num_params;
+        mutex_lock(&supp->mutex);
-        supp->param = param;
+        list_add_tail(&req->link, &supp->reqs);
-        supp->req_posted = true;
+        mutex_unlock(&supp->mutex);
-        /* Let supplicant get the data */
+        /* Tell an eventual waiter there's a new request */
-        complete(&supp->data_to_supp);
+        complete(&supp->reqs_c);
        /*
         * Wait for supplicant to process and return result, once we've
-         * returned from wait_for_completion(data_from_supp) we have
+         * returned from wait_for_completion(&req->c) successfully we have
         * exclusive access again.
         */
-        while (wait_for_completion_interruptible(&supp->data_from_supp)) {
+        while (wait_for_completion_interruptible(&req->c)) {
-                mutex_lock(&supp->ctx_mutex);
+                mutex_lock(&supp->mutex);
                interruptable = !supp->ctx;
                if (interruptable) {
                        /*
                         * There's no supplicant available and since the
-                         * supp->ctx_mutex currently is held none can
+                         * supp->mutex currently is held none can
                         * become available until the mutex released
                         * again.
                         *
@@ -101,24 +130,91 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
                         * will serve all requests in a timely manner and
                         * interrupting then wouldn't make sense.
                         */
-                        supp->ret = TEEC_ERROR_COMMUNICATION;
+                        interruptable = !req->busy;
-                        init_completion(&supp->data_to_supp);
+                        if (!req->busy)
+                                list_del(&req->link);
                }
-                mutex_unlock(&supp->ctx_mutex);
+                mutex_unlock(&supp->mutex);
-                if (interruptable)
+                if (interruptable) {
+                        req->ret = TEEC_ERROR_COMMUNICATION;
                        break;
+                }
        }
-        ret = supp->ret;
+        ret = req->ret;
-        supp->param = NULL;
+        kfree(req);
-        supp->req_posted = false;
-        /* We're done, let someone else talk to the supplicant now. */
-        mutex_unlock(&supp->thrd_mutex);
        return ret;
 }
+static struct optee_supp_req  *supp_pop_entry(struct optee_supp *supp,
+                                              int num_params, int *id)
+{
+        struct optee_supp_req *req;
+        if (supp->req_id != -1) {
+                /*
+                 * Supplicant should not mix synchronous and asnynchronous
+                 * requests.
+                 */
+                return ERR_PTR(-EINVAL);
+        }
+        if (list_empty(&supp->reqs))
+                return NULL;
+        req = list_first_entry(&supp->reqs, struct optee_supp_req, link);
+        if (num_params < req->num_params) {
+                /* Not enough room for parameters */
+                return ERR_PTR(-EINVAL);
+        }
+        *id = idr_alloc(&supp->idr, req, 1, 0, GFP_KERNEL);
+        if (*id < 0)
+                return ERR_PTR(-ENOMEM);
+        list_del(&req->link);
+        req->busy = true;
+        return req;
+}
+static int supp_check_recv_params(size_t num_params, struct tee_param *params,
+                                  size_t *num_meta)
+{
+        size_t n;
+        if (!num_params)
+                return -EINVAL;
+        /*
+         * If there's memrefs we need to decrease those as they where
+         * increased earlier and we'll even refuse to accept any below.
+         */
+        for (n = 0; n < num_params; n++)
+                if (tee_param_is_memref(params + n) && params[n].u.memref.shm)
+                        tee_shm_put(params[n].u.memref.shm);
+        /*
+         * We only expect parameters as TEE_IOCTL_PARAM_ATTR_TYPE_NONE with
+         * or without the TEE_IOCTL_PARAM_ATTR_META bit set.
+         */
+        for (n = 0; n < num_params; n++)
+                if (params[n].attr &&
+                    params[n].attr != TEE_IOCTL_PARAM_ATTR_META)
+                        return -EINVAL;
+        /* At most we'll need one meta parameter so no need to check for more */
+        if (params->attr == TEE_IOCTL_PARAM_ATTR_META)
+                *num_meta = 1;
+        else
+                *num_meta = 0;
+        return 0;
+}
 /**
 * optee_supp_recv() - receive request for supplicant
 * @ctx:        context receiving the request
@@ -135,65 +231,99 @@ int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params,
        struct tee_device *teedev = ctx->teedev;
        struct optee *optee = tee_get_drvdata(teedev);
        struct optee_supp *supp = &optee->supp;
+        struct optee_supp_req *req = NULL;
+        int id;
+        size_t num_meta;
        int rc;
-        /*
+        rc = supp_check_recv_params(*num_params, param, &num_meta);
-         * In case two threads in one supplicant is calling this function
+        if (rc)
-         * simultaneously we need to protect the data with a mutex which
+                return rc;
-         * we'll release before returning.
-         */
+        while (true) {
-        mutex_lock(&supp->supp_mutex);
+                mutex_lock(&supp->mutex);
+                req = supp_pop_entry(supp, *num_params - num_meta, &id);
+                mutex_unlock(&supp->mutex);
+                if (req) {
+                        if (IS_ERR(req))
+                                return PTR_ERR(req);
+                        break;
+                }
-        if (supp->supp_next_send) {
                /*
-                 * optee_supp_recv() has been called again without
+                 * If we didn't get a request we'll block in
-                 * a optee_supp_send() in between. Supplicant has
+                 * wait_for_completion() to avoid needless spinning.
-                 * probably been restarted before it was able to
+                 *
-                 * write back last result. Abort last request and
+                 * This is where supplicant will be hanging most of
-                 * wait for a new.
+                 * the time, let's make this interruptable so we
+                 * can easily restart supplicant if needed.
                 */
-                if (supp->req_posted) {
+                if (wait_for_completion_interruptible(&supp->reqs_c))
-                        supp->ret = TEEC_ERROR_COMMUNICATION;
+                        return -ERESTARTSYS;
-                        supp->supp_next_send = false;
-                        complete(&supp->data_from_supp);
-                }
        }
-        /*
+        if (num_meta) {
-         * This is where supplicant will be hanging most of the
+                /*
-         * time, let's make this interruptable so we can easily
+                 * tee-supplicant support meta parameters -> requsts can be
-         * restart supplicant if needed.
+                 * processed asynchronously.
-         */
+                 */
-        if (wait_for_completion_interruptible(&supp->data_to_supp)) {
+                param->attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
-                rc = -ERESTARTSYS;
+                              TEE_IOCTL_PARAM_ATTR_META;
-                goto out;
+                param->u.value.a = id;
+                param->u.value.b = 0;
+                param->u.value.c = 0;
+        } else {
+                mutex_lock(&supp->mutex);
+                supp->req_id = id;
+                mutex_unlock(&supp->mutex);
        }
-        /* We have exlusive access to the data */
+        *func = req->func;
+        *num_params = req->num_params + num_meta;
+        memcpy(param + num_meta, req->param,
+               sizeof(struct tee_param) * req->num_params);
-        if (*num_params < supp->num_params) {
+        return 0;
-                /*
+}
-                 * Not enough room for parameters, tell supplicant
-                 * it failed and abort last request.
+static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
-                 */
+                                           size_t num_params,
-                supp->ret = TEEC_ERROR_COMMUNICATION;
+                                           struct tee_param *param,
-                rc = -EINVAL;
+                                           size_t *num_meta)
-                complete(&supp->data_from_supp);
+{
-                goto out;
+        struct optee_supp_req *req;
+        int id;
+        size_t nm;
+        const u32 attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
+                         TEE_IOCTL_PARAM_ATTR_META;
+        if (!num_params)
+                return ERR_PTR(-EINVAL);
+        if (supp->req_id == -1) {
+                if (param->attr != attr)
+                        return ERR_PTR(-EINVAL);
+                id = param->u.value.a;
+                nm = 1;
+        } else {
+                id = supp->req_id;
+                nm = 0;
        }
-        *func = supp->func;
+        req = idr_find(&supp->idr, id);
-        *num_params = supp->num_params;
+        if (!req)
-        memcpy(param, supp->param,
+                return ERR_PTR(-ENOENT);
-               sizeof(struct tee_param) * supp->num_params);
-        /* Allow optee_supp_send() below to do its work */
+        if ((num_params - nm) != req->num_params)
-        supp->supp_next_send = true;
+                return ERR_PTR(-EINVAL);
-        rc = 0;
+        req->busy = false;
-out:
+        idr_remove(&supp->idr, id);
-        mutex_unlock(&supp->supp_mutex);
+        supp->req_id = -1;
-        return rc;
+        *num_meta = nm;
+        return req;
 }
 /**
@@ -211,63 +341,42 @@ int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params,
        struct tee_device *teedev = ctx->teedev;
        struct optee *optee = tee_get_drvdata(teedev);
        struct optee_supp *supp = &optee->supp;
+        struct optee_supp_req *req;
        size_t n;
-        int rc = 0;
+        size_t num_meta;
-        /*
+        mutex_lock(&supp->mutex);
-         * We still have exclusive access to the data since that's how we
+        req = supp_pop_req(supp, num_params, param, &num_meta);
-         * left it when returning from optee_supp_read().
+        mutex_unlock(&supp->mutex);
-         */
-        /* See comment on mutex in optee_supp_read() above */
-        mutex_lock(&supp->supp_mutex);
-        if (!supp->supp_next_send) {
-                /*
-                 * Something strange is going on, supplicant shouldn't
-                 * enter optee_supp_send() in this state
-                 */
-                rc = -ENOENT;
-                goto out;
-        }
-        if (num_params != supp->num_params) {
+        if (IS_ERR(req)) {
-                /*
+                /* Something is wrong, let supplicant restart. */
-                 * Something is wrong, let supplicant restart. Next call to
+                return PTR_ERR(req);
-                 * optee_supp_recv() will give an error to the requesting
-                 * thread and release it.
-                 */
-                rc = -EINVAL;
-                goto out;
        }
        /* Update out and in/out parameters */
-        for (n = 0; n < num_params; n++) {
+        for (n = 0; n < req->num_params; n++) {
-                struct tee_param *p = supp->param + n;
+                struct tee_param *p = req->param + n;
-                switch (p->attr) {
+                switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
-                        p->u.value.a = param[n].u.value.a;
+                        p->u.value.a = param[n + num_meta].u.value.a;
-                        p->u.value.b = param[n].u.value.b;
+                        p->u.value.b = param[n + num_meta].u.value.b;
-                        p->u.value.c = param[n].u.value.c;
+                        p->u.value.c = param[n + num_meta].u.value.c;
                        break;
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
-                        p->u.memref.size = param[n].u.memref.size;
+                        p->u.memref.size = param[n + num_meta].u.memref.size;
                        break;
                default:
                        break;
                }
        }
-        supp->ret = ret;
+        req->ret = ret;
-        /* Allow optee_supp_recv() above to do its work */
-        supp->supp_next_send = false;
        /* Let the requesting thread continue */
-        complete(&supp->data_from_supp);
+        complete(&req->c);
-out:
-        mutex_unlock(&supp->supp_mutex);
+        return 0;
-        return rc;
 }
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 3d49ac2e3c84..6c4b200a4560 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -209,11 +209,11 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params,
                        return -EFAULT;
                /* All unused attribute bits has to be zero */
-                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_TYPE_MASK)
+                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
                        return -EINVAL;
                params[n].attr = ip.attr;
-                switch (ip.attr) {
+                switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
                case TEE_IOCTL_PARAM_ATTR_TYPE_NONE:
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
                        break;
@@ -278,18 +278,6 @@ static int params_to_user(struct tee_ioctl_param __user *uparams,
        return 0;
 }
-static bool param_is_memref(struct tee_param *param)
-{
-        switch (param->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
-        case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
-        case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
-        case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
-                return true;
-        default:
-                return false;
-        }
-}
 static int tee_ioctl_open_session(struct tee_context *ctx,
                                  struct tee_ioctl_buf_data __user *ubuf)
 {
@@ -353,7 +341,7 @@ out:
        if (params) {
                /* Decrease ref count for all valid shared memory pointers */
                for (n = 0; n < arg.num_params; n++)
-                        if (param_is_memref(params + n) &&
+                        if (tee_param_is_memref(params + n) &&
                            params[n].u.memref.shm)
                                tee_shm_put(params[n].u.memref.shm);
                kfree(params);
@@ -415,7 +403,7 @@ out:
        if (params) {
                /* Decrease ref count for all valid shared memory pointers */
                for (n = 0; n < arg.num_params; n++)
-                        if (param_is_memref(params + n) &&
+                        if (tee_param_is_memref(params + n) &&
                            params[n].u.memref.shm)
                                tee_shm_put(params[n].u.memref.shm);
                kfree(params);
@@ -463,8 +451,8 @@ static int params_to_supp(struct tee_context *ctx,
                struct tee_ioctl_param ip;
                struct tee_param *p = params + n;
-                ip.attr = p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK;
+                ip.attr = p->attr;
-                switch (p->attr) {
+                switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
                        ip.a = p->u.value.a;
@@ -528,6 +516,10 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx,
        if (!params)
                return -ENOMEM;
+        rc = params_from_user(ctx, params, num_params, uarg->params);
+        if (rc)
+                goto out;
        rc = ctx->teedev->desc->ops->supp_recv(ctx, &func, &num_params, params);
        if (rc)
                goto out;
@@ -557,11 +549,11 @@ static int params_from_supp(struct tee_param *params, size_t num_params,
                        return -EFAULT;
                /* All unused attribute bits has to be zero */
-                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_TYPE_MASK)
+                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
                        return -EINVAL;
                p->attr = ip.attr;
-                switch (ip.attr) {
+                switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
                        /* Only out and in/out values can be updated */
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 55b198ba629b..78e92d29f8d9 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -555,6 +555,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
        unsigned iad_num = 0;
        memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+        nintf = nintf_orig = config->desc.bNumInterfaces;
+        config->desc.bNumInterfaces = 0;        // Adjusted later
        if (config->desc.bDescriptorType != USB_DT_CONFIG ||
            config->desc.bLength < USB_DT_CONFIG_SIZE ||
            config->desc.bLength > size) {
@@ -568,7 +571,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
        buffer += config->desc.bLength;
        size -= config->desc.bLength;
-        nintf = nintf_orig = config->desc.bNumInterfaces;
        if (nintf > USB_MAXINTERFACES) {
                dev_warn(ddev, "config %d has too many interfaces: %d, "
                    "using maximum allowed: %d\n",
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index f66c94130cac..31749c79045f 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -537,6 +537,7 @@ struct dwc2_core_params {
 *                       2 - Internal DMA
 * @power_optimized     Are power optimizations enabled?
 * @num_dev_ep          Number of device endpoints available
+ * @num_dev_in_eps      Number of device IN endpoints available
 * @num_dev_perio_in_ep Number of device periodic IN endpoints
 *                      available
 * @dev_token_q_depth   Device Mode IN Token Sequence Learning Queue
@@ -565,6 +566,7 @@ struct dwc2_core_params {
 *                       2 - 8 or 16 bits
 * @snpsid:             Value from SNPSID register
 * @dev_ep_dirs:        Direction of device endpoints (GHWCFG1)
+ * @g_tx_fifo_size[]    Power-on values of TxFIFO sizes
 */
 struct dwc2_hw_params {
        unsigned op_mode:3;
@@ -586,12 +588,14 @@ struct dwc2_hw_params {
        unsigned fs_phy_type:2;
        unsigned i2c_enable:1;
        unsigned num_dev_ep:4;
+        unsigned num_dev_in_eps : 4;
        unsigned num_dev_perio_in_ep:4;
        unsigned total_fifo_size:16;
        unsigned power_optimized:1;
        unsigned utmi_phy_data_width:2;
        u32 snpsid;
        u32 dev_ep_dirs;
+        u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
 };
 /* Size of control and EP0 buffers */
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 88529d092503..e4c3ce0de5de 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -195,55 +195,18 @@ int dwc2_hsotg_tx_fifo_count(struct dwc2_hsotg *hsotg)
 {
        if (hsotg->hw_params.en_multiple_tx_fifo)
                /* In dedicated FIFO mode we need count of IN EPs */
-                return (dwc2_readl(hsotg->regs + GHWCFG4)  &
+                return hsotg->hw_params.num_dev_in_eps;
-                        GHWCFG4_NUM_IN_EPS_MASK) >> GHWCFG4_NUM_IN_EPS_SHIFT;
        else
                /* In shared FIFO mode we need count of Periodic IN EPs */
                return hsotg->hw_params.num_dev_perio_in_ep;
 }
 /**
- * dwc2_hsotg_ep_info_size - return Endpoint Info Control block size in DWORDs
- */
-static int dwc2_hsotg_ep_info_size(struct dwc2_hsotg *hsotg)
-{
-        int val = 0;
-        int i;
-        u32 ep_dirs;
-        /*
-         * Don't need additional space for ep info control registers in
-         * slave mode.
-         */
-        if (!using_dma(hsotg)) {
-                dev_dbg(hsotg->dev, "Buffer DMA ep info size 0\n");
-                return 0;
-        }
-        /*
-         * Buffer DMA mode - 1 location per endpoit
-         * Descriptor DMA mode - 4 locations per endpoint
-         */
-        ep_dirs = hsotg->hw_params.dev_ep_dirs;
-        for (i = 0; i <= hsotg->hw_params.num_dev_ep; i++) {
-                val += ep_dirs & 3 ? 1 : 2;
-                ep_dirs >>= 2;
-        }
-        if (using_desc_dma(hsotg))
-                val = val * 4;
-        return val;
-}
-/**
 * dwc2_hsotg_tx_fifo_total_depth - return total FIFO depth available for
 * device mode TX FIFOs
 */
 int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
 {
-        int ep_info_size;
        int addr;
        int tx_addr_max;
        u32 np_tx_fifo_size;
@@ -252,8 +215,7 @@ int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
                                hsotg->params.g_np_tx_fifo_size);
        /* Get Endpoint Info Control block size in DWORDs. */
-        ep_info_size = dwc2_hsotg_ep_info_size(hsotg);
+        tx_addr_max = hsotg->hw_params.total_fifo_size;
-        tx_addr_max = hsotg->hw_params.total_fifo_size - ep_info_size;
        addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;
        if (tx_addr_max <= addr)
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index ef73af6e03a9..03fd20f0b496 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -484,8 +484,7 @@ static void dwc2_check_param_tx_fifo_sizes(struct dwc2_hsotg *hsotg)
        }
        for (fifo = 1; fifo <= fifo_count; fifo++) {
-                dptxfszn = (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+                dptxfszn = hsotg->hw_params.g_tx_fifo_size[fifo];
-                        FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
                if (hsotg->params.g_tx_fifo_size[fifo] < min ||
                    hsotg->params.g_tx_fifo_size[fifo] >  dptxfszn) {
@@ -609,6 +608,7 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
        struct dwc2_hw_params *hw = &hsotg->hw_params;
        bool forced;
        u32 gnptxfsiz;
+        int fifo, fifo_count;
        if (hsotg->dr_mode == USB_DR_MODE_HOST)
                return;
@@ -617,6 +617,14 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
        gnptxfsiz = dwc2_readl(hsotg->regs + GNPTXFSIZ);
+        fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+        for (fifo = 1; fifo <= fifo_count; fifo++) {
+                hw->g_tx_fifo_size[fifo] =
+                        (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+                         FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+        }
        if (forced)
                dwc2_clear_force_mode(hsotg);
@@ -661,14 +669,6 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
        hwcfg4 = dwc2_readl(hsotg->regs + GHWCFG4);
        grxfsiz = dwc2_readl(hsotg->regs + GRXFSIZ);
-        /*
-         * Host specific hardware parameters. Reading these parameters
-         * requires the controller to be in host mode. The mode will
-         * be forced, if necessary, to read these values.
-         */
-        dwc2_get_host_hwparams(hsotg);
-        dwc2_get_dev_hwparams(hsotg);
        /* hwcfg1 */
        hw->dev_ep_dirs = hwcfg1;
@@ -711,6 +711,8 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
        hw->en_multiple_tx_fifo = !!(hwcfg4 & GHWCFG4_DED_FIFO_EN);
        hw->num_dev_perio_in_ep = (hwcfg4 & GHWCFG4_NUM_DEV_PERIO_IN_EP_MASK) >>
                                  GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT;
+        hw->num_dev_in_eps = (hwcfg4 & GHWCFG4_NUM_IN_EPS_MASK) >>
+                             GHWCFG4_NUM_IN_EPS_SHIFT;
        hw->dma_desc_enable = !!(hwcfg4 & GHWCFG4_DESC_DMA);
        hw->power_optimized = !!(hwcfg4 & GHWCFG4_POWER_OPTIMIZ);
        hw->utmi_phy_data_width = (hwcfg4 & GHWCFG4_UTMI_PHY_DATA_WIDTH_MASK) >>
@@ -719,6 +721,13 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
        /* fifo sizes */
        hw->rx_fifo_size = (grxfsiz & GRXFSIZ_DEPTH_MASK) >>
                                GRXFSIZ_DEPTH_SHIFT;
+        /*
+         * Host specific hardware parameters. Reading these parameters
+         * requires the controller to be in host mode. The mode will
+         * be forced, if necessary, to read these values.
+         */
+        dwc2_get_host_hwparams(hsotg);
+        dwc2_get_dev_hwparams(hsotg);
        return 0;
 }
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index c4a4d7bd2766..7ae0eefc7cc7 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -51,8 +51,10 @@ static int dwc3_of_simple_clk_init(struct dwc3_of_simple *simple, int count)
                clk = of_clk_get(np, i);
                if (IS_ERR(clk)) {
-                        while (--i >= 0)
+                        while (--i >= 0) {
+                                clk_disable_unprepare(simple->clks[i]);
                                clk_put(simple->clks[i]);
+                        }
                        return PTR_ERR(clk);
                }
@@ -203,6 +205,7 @@ static struct platform_driver dwc3_of_simple_driver = {
        .driver         = {
                .name   = "dwc3-of-simple",
                .of_match_table = of_dwc3_simple_match,
+                .pm     = &dwc3_of_simple_dev_pm_ops,
        },
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 981fd986cf82..639dd1b163a0 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -259,7 +259,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
 {
        const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
        struct dwc3             *dwc = dep->dwc;
-        u32                     timeout = 500;
+        u32                     timeout = 1000;
        u32                     reg;
        int                     cmd_status = 0;
@@ -912,7 +912,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                         */
                        if (speed == USB_SPEED_HIGH) {
                                struct usb_ep *ep = &dep->endpoint;
-                                unsigned int mult = ep->mult - 1;
+                                unsigned int mult = 2;
                                unsigned int maxp = usb_endpoint_maxp(ep->desc);
                                if (length <= (2 * maxp))
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 0a19a76645ad..31cce7805eb2 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -508,8 +508,8 @@ choice
          controller, and the relevant drivers for each function declared
          by the device.
-endchoice
 source "drivers/usb/gadget/legacy/Kconfig"
+endchoice
 endif # USB_GADGET
diff --git a/drivers/usb/gadget/legacy/Kconfig b/drivers/usb/gadget/legacy/Kconfig
index 9570bbeced4f..784bf86dad4f 100644
--- a/drivers/usb/gadget/legacy/Kconfig
+++ b/drivers/usb/gadget/legacy/Kconfig
@@ -13,14 +13,6 @@
 # both kinds of controller can also support "USB On-the-Go" (CONFIG_USB_OTG).
 #
-menuconfig USB_GADGET_LEGACY
-        bool "Legacy USB Gadget Support"
-        help
-           Legacy USB gadgets are USB gadgets that do not use the USB gadget
-           configfs interface.
-if USB_GADGET_LEGACY
 config USB_ZERO
        tristate "Gadget Zero (DEVELOPMENT)"
        select USB_LIBCOMPOSITE
@@ -487,7 +479,7 @@ endif
 # or video class gadget drivers), or specific hardware, here.
 config USB_G_WEBCAM
        tristate "USB Webcam Gadget"
-        depends on VIDEO_DEV
+        depends on VIDEO_V4L2
        select USB_LIBCOMPOSITE
        select VIDEOBUF2_VMALLOC
        select USB_F_UVC
@@ -498,5 +490,3 @@ config USB_G_WEBCAM
          Say "y" to link the driver statically, or "m" to build a
          dynamically linked module called "g_webcam".
-endif
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 15f7d422885f..3a29b32a3bd0 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -971,10 +971,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                return 0;
        }
-        xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);
+        dev = kzalloc(sizeof(*dev), flags);
-        if (!xhci->devs[slot_id])
+        if (!dev)
                return 0;
-        dev = xhci->devs[slot_id];
        /* Allocate the (output) device context that will be used in the HC. */
        dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
@@ -1015,9 +1014,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
        trace_xhci_alloc_virt_device(dev);
+        xhci->devs[slot_id] = dev;
        return 1;
 fail:
-        xhci_free_virt_device(xhci, slot_id);
+        if (dev->in_ctx)
+                xhci_free_container_ctx(xhci, dev->in_ctx);
+        if (dev->out_ctx)
+                xhci_free_container_ctx(xhci, dev->out_ctx);
+        kfree(dev);
        return 0;
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6eb87c6e4d24..c5cbc685c691 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3112,7 +3112,7 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
 {
        u32 maxp, total_packet_count;
-        /* MTK xHCI is mostly 0.97 but contains some features from 1.0 */
+        /* MTK xHCI 0.96 contains some features from 1.0 */
        if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))
                return ((td_total_len - transferred) >> 10);
@@ -3121,8 +3121,8 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
            trb_buff_len == td_total_len)
                return 0;
-        /* for MTK xHCI, TD size doesn't include this TRB */
+        /* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
-        if (xhci->quirks & XHCI_MTK_HOST)
+        if ((xhci->quirks & XHCI_MTK_HOST) && (xhci->hci_version < 0x100))
                trb_buff_len = 0;
        maxp = usb_endpoint_maxp(&urb->ep->desc);
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 0397606a211b..6c036de63272 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -284,7 +284,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
                        musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
                        portstate(musb->port1_status |= USB_PORT_STAT_POWER);
                        del_timer(&musb->dev_timer);
-                } else {
+                } else if (!(musb->int_usb & MUSB_INTR_BABBLE)) {
+                        /*
+                         * When babble condition happens, drvvbus interrupt
+                         * is also generated. Ignore this drvvbus interrupt
+                         * and let babble interrupt handler recovers the
+                         * controller; otherwise, the host-mode flag is lost
+                         * due to the MUSB_DEV_MODE() call below and babble
+                         * recovery logic will not be called.
+                         */
                        musb->is_active = 0;
                        MUSB_DEV_MODE(musb);
                        otg->default_a = 0;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2968046e7c05..f72d045ee9ef 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2100,6 +2100,13 @@ UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_BROKEN_FUA ),
+/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
 /*
 * Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
 * JMicron responds to USN and several other SCSI ioctls with a
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index d520374a824e..e6127fb21c12 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -129,6 +129,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
+/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                "VIA",
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 536e037f541f..493ac2928391 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -322,23 +322,34 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
        return priv;
 }
-static int get_pipe(struct stub_device *sdev, int epnum, int dir)
+static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
 {
        struct usb_device *udev = sdev->udev;
        struct usb_host_endpoint *ep;
        struct usb_endpoint_descriptor *epd = NULL;
+        int epnum = pdu->base.ep;
+        int dir = pdu->base.direction;
+        if (epnum < 0 || epnum > 15)
+                goto err_ret;
        if (dir == USBIP_DIR_IN)
                ep = udev->ep_in[epnum & 0x7f];
        else
                ep = udev->ep_out[epnum & 0x7f];
-        if (!ep) {
+        if (!ep)
-                dev_err(&sdev->udev->dev, "no such endpoint?, %d\n",
+                goto err_ret;
-                        epnum);
-                BUG();
-        }
        epd = &ep->desc;
+        /* validate transfer_buffer_length */
+        if (pdu->u.cmd_submit.transfer_buffer_length > INT_MAX) {
+                dev_err(&sdev->udev->dev,
+                        "CMD_SUBMIT: -EMSGSIZE transfer_buffer_length %d\n",
+                        pdu->u.cmd_submit.transfer_buffer_length);
+                return -1;
+        }
        if (usb_endpoint_xfer_control(epd)) {
                if (dir == USBIP_DIR_OUT)
                        return usb_sndctrlpipe(udev, epnum);
@@ -361,15 +372,31 @@ static int get_pipe(struct stub_device *sdev, int epnum, int dir)
        }
        if (usb_endpoint_xfer_isoc(epd)) {
+                /* validate packet size and number of packets */
+                unsigned int maxp, packets, bytes;
+                maxp = usb_endpoint_maxp(epd);
+                maxp *= usb_endpoint_maxp_mult(epd);
+                bytes = pdu->u.cmd_submit.transfer_buffer_length;
+                packets = DIV_ROUND_UP(bytes, maxp);
+                if (pdu->u.cmd_submit.number_of_packets < 0 ||
+                    pdu->u.cmd_submit.number_of_packets > packets) {
+                        dev_err(&sdev->udev->dev,
+                                "CMD_SUBMIT: isoc invalid num packets %d\n",
+                                pdu->u.cmd_submit.number_of_packets);
+                        return -1;
+                }
                if (dir == USBIP_DIR_OUT)
                        return usb_sndisocpipe(udev, epnum);
                else
                        return usb_rcvisocpipe(udev, epnum);
        }
+err_ret:
        /* NOT REACHED */
-        dev_err(&sdev->udev->dev, "get pipe, epnum %d\n", epnum);
+        dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
-        return 0;
+        return -1;
 }
 static void masking_bogus_flags(struct urb *urb)
@@ -433,7 +460,10 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
        struct stub_priv *priv;
        struct usbip_device *ud = &sdev->ud;
        struct usb_device *udev = sdev->udev;
-        int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
+        int pipe = get_pipe(sdev, pdu);
+        if (pipe == -1)
+                return;
        priv = stub_priv_alloc(sdev, pdu);
        if (!priv)
@@ -452,7 +482,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
        }
        /* allocate urb transfer buffer, if needed */
-        if (pdu->u.cmd_submit.transfer_buffer_length > 0) {
+        if (pdu->u.cmd_submit.transfer_buffer_length > 0 &&
+            pdu->u.cmd_submit.transfer_buffer_length <= INT_MAX) {
                priv->urb->transfer_buffer =
                        kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
                                GFP_KERNEL);
diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index b18bce96c212..53172b1f6257 100644
--- a/drivers/usb/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
@@ -167,6 +167,13 @@ static int stub_send_ret_submit(struct stub_device *sdev)
                memset(&pdu_header, 0, sizeof(pdu_header));
                memset(&msg, 0, sizeof(msg));
+                if (urb->actual_length > 0 && !urb->transfer_buffer) {
+                        dev_err(&sdev->udev->dev,
+                                "urb: actual_length %d transfer_buffer null\n",
+                                urb->actual_length);
+                        return -1;
+                }
                if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
                        iovnum = 2 + urb->number_of_packets;
                else
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index e5de35c8c505..473fb8a87289 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -256,6 +256,7 @@ struct usbip_device {
        /* lock for status */
        spinlock_t lock;
+        int sockfd;
        struct socket *tcp_socket;
        struct task_struct *tcp_rx;
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e78f7472cac4..091f76b7196d 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -17,15 +17,20 @@
 /*
 * output example:
- * hub port sta spd dev      socket           local_busid
+ * hub port sta spd dev       sockfd    local_busid
- * hs  0000 004 000 00000000         c5a7bb80 1-2.3
+ * hs  0000 004 000 00000000  3         1-2.3
 * ................................................
- * ss  0008 004 000 00000000         d8cee980 2-3.4
+ * ss  0008 004 000 00000000  4         2-3.4
 * ................................................
 *
- * IP address can be retrieved from a socket pointer address by looking
+ * Output includes socket fd instead of socket pointer address to avoid
- * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
+ * leaking kernel memory address in:
- * port number and its peer IP address.
+ *      /sys/devices/platform/vhci_hcd.0/status and in debug output.
+ * The socket pointer address is not used at the moment and it was made
+ * visible as a convenient way to find IP address from socket pointer
+ * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
+ * hole, the change is made to use sockfd instead.
+ *
 */
 static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
 {
@@ -39,8 +44,8 @@ static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vd
        if (vdev->ud.status == VDEV_ST_USED) {
                *out += sprintf(*out, "%03u %08x ",
                                      vdev->speed, vdev->devid);
-                *out += sprintf(*out, "%16p %s",
+                *out += sprintf(*out, "%u %s",
-                                      vdev->ud.tcp_socket,
+                                      vdev->ud.sockfd,
                                      dev_name(&vdev->udev->dev));
        } else {
@@ -160,7 +165,8 @@ static ssize_t nports_show(struct device *dev, struct device_attribute *attr,
        char *s = out;
        /*
-         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER, thus the * 2.
+         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
+         * thus the * 2.
         */
        out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
        return out - s;
@@ -366,6 +372,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
        vdev->devid         = devid;
        vdev->speed         = speed;
+        vdev->ud.sockfd     = sockfd;
        vdev->ud.tcp_socket = socket;
        vdev->ud.status     = VDEV_ST_NOTASSIGNED;
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index a9192fe4f345..c92131edfaba 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -522,10 +522,8 @@ static int virtio_mmio_probe(struct platform_device *pdev)
                return -EBUSY;
        vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
-        if (!vm_dev) {
+        if (!vm_dev)
-                rc = -ENOMEM;
+                return -ENOMEM;
-                goto free_mem;
-        }
        vm_dev->vdev.dev.parent = &pdev->dev;
        vm_dev->vdev.dev.release = virtio_mmio_release_dev;
@@ -535,17 +533,14 @@ static int virtio_mmio_probe(struct platform_device *pdev)
        spin_lock_init(&vm_dev->lock);
        vm_dev->base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
-        if (vm_dev->base == NULL) {
+        if (vm_dev->base == NULL)
-                rc = -EFAULT;
+                return -EFAULT;
-                goto free_vmdev;
-        }
        /* Check magic value */
        magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);
        if (magic != ('v' | 'i' << 8 | 'r' << 16 | 't' << 24)) {
                dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic);
-                rc = -ENODEV;
+                return -ENODEV;
-                goto unmap;
        }
        /* Check device version */
@@ -553,8 +548,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
        if (vm_dev->version < 1 || vm_dev->version > 2) {
                dev_err(&pdev->dev, "Version %ld not supported!\n",
                                vm_dev->version);
-                rc = -ENXIO;
+                return -ENXIO;
-                goto unmap;
        }
        vm_dev->vdev.id.device = readl(vm_dev->base + VIRTIO_MMIO_DEVICE_ID);
@@ -563,8 +557,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
                 * virtio-mmio device with an ID 0 is a (dummy) placeholder
                 * with no function. End probing now with no error reported.
                 */
-                rc = -ENODEV;
+                return -ENODEV;
-                goto unmap;
        }
        vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);
@@ -590,33 +583,15 @@ static int virtio_mmio_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, vm_dev);
        rc = register_virtio_device(&vm_dev->vdev);
-        if (rc) {
+        if (rc)
-                iounmap(vm_dev->base);
-                devm_release_mem_region(&pdev->dev, mem->start,
-                                        resource_size(mem));
                put_device(&vm_dev->vdev.dev);
-        }
-        return rc;
-unmap:
-        iounmap(vm_dev->base);
-free_mem:
-        devm_release_mem_region(&pdev->dev, mem->start,
-                        resource_size(mem));
-free_vmdev:
-        devm_kfree(&pdev->dev, vm_dev);
        return rc;
 }
 static int virtio_mmio_remove(struct platform_device *pdev)
 {
        struct virtio_mmio_device *vm_dev = platform_get_drvdata(pdev);
-        struct resource *mem;
-        iounmap(vm_dev->base);
-        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (mem)
-                devm_release_mem_region(&pdev->dev, mem->start,
-                        resource_size(mem));
        unregister_virtio_device(&vm_dev->vdev);
        return 0;
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index d8dd54678ab7..e5d0c28372ea 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -269,7 +269,7 @@ config XEN_ACPI_HOTPLUG_CPU
 config XEN_ACPI_PROCESSOR
        tristate "Xen ACPI processor"
-        depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
+        depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
        default m
        help
          This ACPI processor uploads Power Management information to the Xen