Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

197 files changed, 1786 insertions, 741 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 81d1d5a74728..19f4423e70d9 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4713,6 +4713,8 @@
                                         prevent spurious wakeup);
                                 n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
                                         pause after every control message);
+                                o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
+                                        delay after resetting its port);
                         Example: quirks=0781:5580:bk,0a5c:5834:gij
 
         usbhid.mousepoll=
diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
index 164bf71149fd..30187d49dc2c 100644
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -32,16 +32,17 @@ Disclosure and embargoed information
 The security list is not a disclosure channel.  For that, see Coordination
 below.
 
-Once a robust fix has been developed, our preference is to release the
-fix in a timely fashion, treating it no differently than any of the other
-thousands of changes and fixes the Linux kernel project releases every
-month.
-
-However, at the request of the reporter, we will postpone releasing the
-fix for up to 5 business days after the date of the report or after the
-embargo has lifted; whichever comes first.  The only exception to that
-rule is if the bug is publicly known, in which case the preference is to
-release the fix as soon as it's available.
+Once a robust fix has been developed, the release process starts.  Fixes
+for publicly known bugs are released immediately.
+
+Although our preference is to release fixes for publicly undisclosed bugs
+as soon as they become available, this may be postponed at the request of
+the reporter or an affected party for up to 7 calendar days from the start
+of the release process, with an exceptional extension to 14 calendar days
+if it is agreed that the criticality of the bug requires more time.  The
+only valid reason for deferring the publication of a fix is to accommodate
+the logistics of QA and large scale rollouts which require release
+coordination.
 
 Whilst embargoed information may be shared with trusted individuals in
 order to develop a fix, such information will not be published alongside
diff --git a/Documentation/devicetree/bindings/net/dsa/dsa.txt b/Documentation/devicetree/bindings/net/dsa/dsa.txt
index 3ceeb8de1196..35694c0c376b 100644
--- a/Documentation/devicetree/bindings/net/dsa/dsa.txt
+++ b/Documentation/devicetree/bindings/net/dsa/dsa.txt
@@ -7,7 +7,7 @@ limitations.
 Current Binding
 ---------------
 
-Switches are true Linux devices and can be probes by any means. Once
+Switches are true Linux devices and can be probed by any means. Once
 probed, they register to the DSA framework, passing a node
 pointer. This node is expected to fulfil the following binding, and
 may contain additional properties as required by the device it is
diff --git a/Documentation/media/uapi/v4l/dev-meta.rst b/Documentation/media/uapi/v4l/dev-meta.rst
index f7ac8d0d3af1..b65dc078abeb 100644
--- a/Documentation/media/uapi/v4l/dev-meta.rst
+++ b/Documentation/media/uapi/v4l/dev-meta.rst
@@ -40,7 +40,7 @@ To use the :ref:`format` ioctls applications set the ``type`` field of the
 the desired operation. Both drivers and applications must set the remainder of
 the :c:type:`v4l2_format` structure to 0.
 
-.. _v4l2-meta-format:
+.. c:type:: v4l2_meta_format
 
 .. tabularcolumns:: |p{1.4cm}|p{2.2cm}|p{13.9cm}|
 
diff --git a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
index 3ead350e099f..9ea494a8faca 100644
--- a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
+++ b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
@@ -133,6 +133,11 @@ The format as returned by :ref:`VIDIOC_TRY_FMT <VIDIOC_G_FMT>` must be identical
       - Definition of a data format, see :ref:`pixfmt`, used by SDR
         capture and output devices.
     * -
+      - struct :c:type:`v4l2_meta_format`
+      - ``meta``
+      - Definition of a metadata format, see :ref:`meta-formats`, used by
+        metadata capture devices.
+    * -
       - __u8
       - ``raw_data``\ [200]
       - Place holder for future extensions.
diff --git a/MAINTAINERS b/MAINTAINERS
index 68528f176875..81319971ca9a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -180,6 +180,7 @@ F:	drivers/net/hamradio/6pack.c
 
 8169 10/100/1000 GIGABIT ETHERNET DRIVER
 M:      Realtek linux nic maintainers <nic_swsd@realtek.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/realtek/r8169.c
@@ -5534,6 +5535,7 @@ F:	net/bridge/
 ETHERNET PHY LIBRARY
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
@@ -6305,6 +6307,7 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
+M:      Bartosz Golaszewski <bgolaszewski@baylibre.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7442,6 +7445,20 @@ S:	Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/fbdev/intelfb/
 
+INTEL GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-ich.c
+F:      drivers/gpio/gpio-intel-mid.c
+F:      drivers/gpio/gpio-lynxpoint.c
+F:      drivers/gpio/gpio-merrifield.c
+F:      drivers/gpio/gpio-ml-ioh.c
+F:      drivers/gpio/gpio-pch.c
+F:      drivers/gpio/gpio-sch.c
+F:      drivers/gpio/gpio-sodaville.c
+
 INTEL GVT-g DRIVERS (Intel GPU Virtualization)
 M:      Zhenyu Wang <zhenyuw@linux.intel.com>
 M:      Zhi Wang <zhi.a.wang@intel.com>
@@ -7452,12 +7469,6 @@ T:	git https://github.com/intel/gvt-linux.git
 S:      Supported
 F:      drivers/gpu/drm/i915/gvt/
 
-INTEL PMIC GPIO DRIVER
-R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-S:      Maintained
-F:      drivers/gpio/gpio-*cove.c
-F:      drivers/gpio/gpio-msic.c
-
 INTEL HID EVENT DRIVER
 M:      Alex Hung <alex.hung@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -7545,12 +7556,6 @@ W:	https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
 
-INTEL MERRIFIELD GPIO DRIVER
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      drivers/gpio/gpio-merrifield.c
-
 INTEL MIC DRIVERS (mic)
 M:      Sudeep Dutt <sudeep.dutt@intel.com>
 M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
@@ -7583,6 +7588,13 @@ F:	drivers/platform/x86/intel_punit_ipc.c
 F:      arch/x86/include/asm/intel_pmc_ipc.h
 F:      arch/x86/include/asm/intel_punit_ipc.h
 
+INTEL PMIC GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-*cove.c
+F:      drivers/gpio/gpio-msic.c
+
 INTEL MULTIFUNCTION PMIC DEVICE DRIVERS
 R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
@@ -14086,6 +14098,7 @@ F:	Documentation/devicetree/bindings/iio/proximity/vl53l0x.txt
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Sasha Levin <sashal@kernel.org>
 L:      stable@vger.kernel.org
 S:      Supported
 F:      Documentation/process/stable-kernel-rules.rst
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 0c909c4a932f..842fb9572661 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -468,7 +468,7 @@
                          SCTLR_ELx_SA     | SCTLR_ELx_I    | SCTLR_ELx_WXN | \
                          SCTLR_ELx_DSSBS | ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
 
-#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL2 set/clear bits"
 #endif
 
@@ -509,7 +509,7 @@
                          SCTLR_EL1_UMA | SCTLR_ELx_WXN     | ENDIAN_CLEAR_EL1 |\
                          SCTLR_ELx_DSSBS | SCTLR_EL1_NTWI  | SCTLR_EL1_RES0)
 
-#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL1 set/clear bits"
 #endif
 
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index af50064dea51..aec5ecb85737 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1333,7 +1333,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .cpu_enable = cpu_enable_hw_dbm,
         },
 #endif
-#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "CRC32 instructions",
                 .capability = ARM64_HAS_CRC32,
@@ -1343,6 +1342,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .field_pos = ID_AA64ISAR0_CRC32_SHIFT,
                 .min_field_value = 1,
         },
+#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "Speculative Store Bypassing Safe (SSBS)",
                 .capability = ARM64_SSBS,
diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
index 490b12af103c..c52d0efacd14 100644
--- a/arch/mips/configs/cavium_octeon_defconfig
+++ b/arch/mips/configs/cavium_octeon_defconfig
@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_STAGING=y
 CONFIG_OCTEON_ETHERNET=y
+CONFIG_OCTEON_USB=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_RAS=y
 CONFIG_EXT4_FS=y
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index ea09ed6a80a9..8c6c48ed786a 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -794,6 +794,7 @@ static void __init arch_mem_init(char **cmdline_p)
 
         /* call board setup routine */
         plat_mem_setup();
+        memblock_set_bottom_up(true);
 
         /*
          * Make sure all kernel memory is in the maps.  The "UP" and
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 0f852e1b5891..15e103c6d799 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2260,10 +2260,8 @@ void __init trap_init(void)
                 unsigned long size = 0x200 + VECTORSPACING*64;
                 phys_addr_t ebase_pa;
 
-                memblock_set_bottom_up(true);
                 ebase = (unsigned long)
                         memblock_alloc_from(size, 1 << fls(size), 0);
-                memblock_set_bottom_up(false);
 
                 /*
                  * Try to ensure ebase resides in KSeg0 if possible.
@@ -2307,6 +2305,7 @@ void __init trap_init(void)
         if (board_ebase_setup)
                 board_ebase_setup();
         per_cpu_trap_init(true);
+        memblock_set_bottom_up(false);
 
         /*
          * Copy the generic exception handlers to their final destination.
diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c
index 622761878cd1..60bf0a1cb757 100644
--- a/arch/mips/loongson64/loongson-3/numa.c
+++ b/arch/mips/loongson64/loongson-3/numa.c
@@ -231,6 +231,8 @@ static __init void prom_meminit(void)
                         cpumask_clear(&__node_data[(node)]->cpumask);
                 }
         }
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
+
         for (cpu = 0; cpu < loongson_sysconf.nr_cpus; cpu++) {
                 node = cpu / loongson_sysconf.cores_per_node;
                 if (node >= num_online_nodes())
@@ -248,19 +250,9 @@ static __init void prom_meminit(void)
 
 void __init paging_init(void)
 {
-        unsigned node;
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long  start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
 #ifdef CONFIG_ZONE_DMA32
         zones_size[ZONE_DMA32] = MAX_DMA32_PFN;
 #endif
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index d8b8444d6795..813d13f92957 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -435,6 +435,7 @@ void __init prom_meminit(void)
 
         mlreset();
         szmem();
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
 
         for (node = 0; node < MAX_COMPACT_NODES; node++) {
                 if (node_online(node)) {
@@ -455,18 +456,8 @@ extern void setup_zero_pages(void);
 void __init paging_init(void)
 {
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
-        unsigned node;
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
         zones_size[ZONE_NORMAL] = max_low_pfn;
         free_area_init_nodes(zones_size);
 }
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index 4af153a182b0..4b594f2e4f7e 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -71,6 +71,10 @@ KBUILD_CFLAGS += $(call cc-option,-mstrict-align)
 # arch specific predefines for sparse
 CHECKFLAGS += -D__riscv -D__riscv_xlen=$(BITS)
 
+# Default target when executing plain make
+boot            := arch/riscv/boot
+KBUILD_IMAGE    := $(boot)/Image.gz
+
 head-y := arch/riscv/kernel/head.o
 
 core-y += arch/riscv/kernel/ arch/riscv/mm/
@@ -81,4 +85,13 @@ PHONY += vdso_install
 vdso_install:
         $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
 
-all: vmlinux
+all: Image.gz
+
+Image: vmlinux
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+Image.%: Image
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+zinstall install:
+        $(Q)$(MAKE) $(build)=$(boot) $@
diff --git a/arch/riscv/boot/.gitignore b/arch/riscv/boot/.gitignore
new file mode 100644
index 000000000000..8dab0bb6ae66
--- /dev/null
+++ b/arch/riscv/boot/.gitignore
@@ -0,0 +1,2 @@
+Image
+Image.gz
diff --git a/arch/riscv/boot/Makefile b/arch/riscv/boot/Makefile
new file mode 100644
index 000000000000..0990a9fdbe5d
--- /dev/null
+++ b/arch/riscv/boot/Makefile
@@ -0,0 +1,33 @@
+#
+# arch/riscv/boot/Makefile
+#
+# This file is included by the global makefile so that you can add your own
+# architecture-specific flags and dependencies.
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 2018, Anup Patel.
+# Author: Anup Patel <anup@brainfault.org>
+#
+# Based on the ia64 and arm64 boot/Makefile.
+#
+
+OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+
+targets := Image
+
+$(obj)/Image: vmlinux FORCE
+        $(call if_changed,objcopy)
+
+$(obj)/Image.gz: $(obj)/Image FORCE
+        $(call if_changed,gzip)
+
+install:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image System.map "$(INSTALL_PATH)"
+
+zinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image.gz System.map "$(INSTALL_PATH)"
diff --git a/arch/riscv/boot/install.sh b/arch/riscv/boot/install.sh
new file mode 100644
index 000000000000..18c39159c0ff
--- /dev/null
+++ b/arch/riscv/boot/install.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# arch/riscv/boot/install.sh
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 1995 by Linus Torvalds
+#
+# Adapted from code in arch/i386/boot/Makefile by H. Peter Anvin
+# Adapted from code in arch/i386/boot/install.sh by Russell King
+#
+# "make install" script for the RISC-V Linux port
+#
+# Arguments:
+#   $1 - kernel version
+#   $2 - kernel image file
+#   $3 - kernel map file
+#   $4 - default install path (blank if root directory)
+#
+
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
+
+# User may have a custom install script
+if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
+if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
+
+if [ "$(basename $2)" = "Image.gz" ]; then
+# Compressed install
+  echo "Installing compressed kernel"
+  base=vmlinuz
+else
+# Normal install
+  echo "Installing normal kernel"
+  base=vmlinux
+fi
+
+if [ -f $4/$base-$1 ]; then
+  mv $4/$base-$1 $4/$base-$1.old
+fi
+cat $2 > $4/$base-$1
+
+# Install system map file
+if [ -f $4/System.map-$1 ]; then
+  mv $4/System.map-$1 $4/System.map-$1.old
+fi
+cp $3 $4/System.map-$1
diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h
index 349df33808c4..cd2af4b013e3 100644
--- a/arch/riscv/include/asm/module.h
+++ b/arch/riscv/include/asm/module.h
@@ -8,6 +8,7 @@
 
 #define MODULE_ARCH_VERMAGIC    "riscv"
 
+struct module;
 u64 module_emit_got_entry(struct module *mod, u64 val);
 u64 module_emit_plt_entry(struct module *mod, u64 val);
 
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index 473cfc84e412..8c3e3e3c8be1 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
 static inline unsigned long
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        return __asm_copy_to_user(to, from, n);
+        return __asm_copy_from_user(to, from, n);
 }
 
 static inline unsigned long
 raw_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        return __asm_copy_from_user(to, from, n);
+        return __asm_copy_to_user(to, from, n);
 }
 
 extern long strncpy_from_user(char *dest, const char __user *src, long count);
diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
index eff7aa9aa163..fef96f117b4d 100644
--- a/arch/riscv/include/asm/unistd.h
+++ b/arch/riscv/include/asm/unistd.h
@@ -13,10 +13,9 @@
 
 /*
  * There is explicitly no include guard here because this file is expected to
- * be included multiple times.  See uapi/asm/syscalls.h for more info.
+ * be included multiple times.
  */
 
-#define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SYS_CLONE
+
 #include <uapi/asm/unistd.h>
-#include <uapi/asm/syscalls.h>
diff --git a/arch/riscv/include/uapi/asm/syscalls.h b/arch/riscv/include/uapi/asm/unistd.h
index 206dc4b0f6ea..1f3bd3ebbb0d 100644
--- a/arch/riscv/include/uapi/asm/syscalls.h
+++ b/arch/riscv/include/uapi/asm/unistd.h
@@ -1,13 +1,25 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
- * Copyright (C) 2017-2018 SiFive
+ * Copyright (C) 2018 David Abdurachmanov <david.abdurachmanov@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * There is explicitly no include guard here because this file is expected to
- * be included multiple times in order to define the syscall macros via
- * __SYSCALL.
- */
+#ifdef __LP64__
+#define __ARCH_WANT_NEW_STAT
+#endif /* __LP64__ */
+
+#include <asm-generic/unistd.h>
 
 /*
  * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
index 3a5a2ee31547..b4a7d4427fbb 100644
--- a/arch/riscv/kernel/cpu.c
+++ b/arch/riscv/kernel/cpu.c
@@ -64,7 +64,7 @@ int riscv_of_processor_hartid(struct device_node *node)
 
 static void print_isa(struct seq_file *f, const char *orig_isa)
 {
-        static const char *ext = "mafdc";
+        static const char *ext = "mafdcsu";
         const char *isa = orig_isa;
         const char *e;
 
@@ -88,11 +88,14 @@ static void print_isa(struct seq_file *f, const char *orig_isa)
         /*
          * Check the rest of the ISA string for valid extensions, printing those
          * we find.  RISC-V ISA strings define an order, so we only print the
-         * extension bits when they're in order.
+         * extension bits when they're in order. Hide the supervisor (S)
+         * extension from userspace as it's not accessible from there.
          */
         for (e = ext; *e != '\0'; ++e) {
                 if (isa[0] == e[0]) {
-                        seq_write(f, isa, 1);
+                        if (isa[0] != 's')
+                                seq_write(f, isa, 1);
+
                         isa++;
                 }
         }
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 711190d473d4..fe884cd69abd 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -44,6 +44,16 @@ ENTRY(_start)
         amoadd.w a3, a2, (a3)
         bnez a3, .Lsecondary_start
 
+        /* Clear BSS for flat non-ELF images */
+        la a3, __bss_start
+        la a4, __bss_stop
+        ble a4, a3, clear_bss_done
+clear_bss:
+        REG_S zero, (a3)
+        add a3, a3, RISCV_SZPTR
+        blt a3, a4, clear_bss
+clear_bss_done:
+
         /* Save hart ID and DTB physical address */
         mv s0, a0
         mv s1, a1
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index ece84991609c..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -74,7 +74,7 @@ SECTIONS
                 *(.sbss*)
         }
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
 
         EXCEPTION_TABLE(0x10)
         NOTES
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index eaa60c94205a..1f32caa87686 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
         {"PNP0200",  0},        /* AT DMA Controller */
         {"ACPI0009", 0},        /* IOxAPIC */
         {"ACPI000A", 0},        /* IOAPIC */
+        {"SMB0001",  0},        /* ACPI SMBUS virtual device */
         {"", 0},
 };
 
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index 3f0e2a14895a..22b53bf26817 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = {
         {},
 };
 
+static const struct of_device_id *ti_cpufreq_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+
+        np = of_find_node_by_path("/");
+        match = of_match_node(ti_cpufreq_of_match, np);
+        of_node_put(np);
+
+        return match;
+}
+
 static int ti_cpufreq_probe(struct platform_device *pdev)
 {
         u32 version[VERSION_COUNT];
-        struct device_node *np;
         const struct of_device_id *match;
         struct opp_table *ti_opp_table;
         struct ti_cpufreq_data *opp_data;
         const char * const reg_names[] = {"vdd", "vbb"};
         int ret;
 
-        np = of_find_node_by_path("/");
-        match = of_match_node(ti_cpufreq_of_match, np);
-        of_node_put(np);
+        match = dev_get_platdata(&pdev->dev);
         if (!match)
                 return -ENODEV;
 
@@ -290,7 +299,14 @@ fail_put_node:
 
 static int ti_cpufreq_init(void)
 {
-        platform_device_register_simple("ti-cpufreq", -1, NULL, 0);
+        const struct of_device_id *match;
+
+        /* Check to ensure we are on a compatible platform */
+        match = ti_cpufreq_match_node();
+        if (match)
+                platform_device_register_data(NULL, "ti-cpufreq", -1, match,
+                                              sizeof(*match));
+
         return 0;
 }
 module_init(ti_cpufreq_init);
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 5b44ef226904..fc359ca4503d 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -184,6 +184,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
         exp_info.ops  = &udmabuf_ops;
         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
         exp_info.priv = ubuf;
+        exp_info.flags = O_RDWR;
 
         buf = dma_buf_export(&exp_info);
         if (IS_ERR(buf)) {
diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
index b01ba4438501..31e891f00175 100644
--- a/drivers/gnss/serial.c
+++ b/drivers/gnss/serial.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 
@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
index 79cb98950013..71d014edd167 100644
--- a/drivers/gnss/sirf.c
+++ b/drivers/gnss/sirf.c
@@ -16,6 +16,7 @@
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 8269cffc2967..6a50f9f59c90 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -35,8 +35,8 @@
 #define gpio_mockup_err(...)    pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__)
 
 enum {
-        GPIO_MOCKUP_DIR_OUT = 0,
-        GPIO_MOCKUP_DIR_IN = 1,
+        GPIO_MOCKUP_DIR_IN = 0,
+        GPIO_MOCKUP_DIR_OUT = 1,
 };
 
 /*
@@ -131,7 +131,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset)
 {
         struct gpio_mockup_chip *chip = gpiochip_get_data(gc);
 
-        return chip->lines[offset].dir;
+        return !chip->lines[offset].dir;
 }
 
 static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset)
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index bfe4c5c9f41c..e9600b556f39 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
         if (pxa_gpio_has_pinctrl()) {
                 ret = pinctrl_gpio_direction_input(chip->base + offset);
-                if (!ret)
-                        return 0;
+                if (ret)
+                        return ret;
         }
 
         spin_lock_irqsave(&gpio_lock, flags);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 230e41562462..a2cbb474901c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1295,7 +1295,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
         if (!gdev->descs) {
                 status = -ENOMEM;
-                goto err_free_gdev;
+                goto err_free_ida;
         }
 
         if (chip->ngpio == 0) {
@@ -1427,8 +1427,9 @@ err_free_label:
         kfree_const(gdev->label);
 err_free_descs:
         kfree(gdev->descs);
-err_free_gdev:
+err_free_ida:
         ida_simple_remove(&gpio_ida, gdev->id);
+err_free_gdev:
         /* failures here can mean systems won't boot... */
         pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
                gdev->base, gdev->base + gdev->ngpio - 1,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index c31a8849e9f8..1580ec60b89f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -501,8 +501,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
 
-        amdgpu_dpm_switch_power_profile(adev,
-                                        PP_SMC_POWER_PROFILE_COMPUTE, !idle);
+        if (adev->powerplay.pp_funcs &&
+            adev->powerplay.pp_funcs->switch_power_profile)
+                amdgpu_dpm_switch_power_profile(adev,
+                                                PP_SMC_POWER_PROFILE_COMPUTE,
+                                                !idle);
 }
 
 bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 6748cd7fc129..686a26de50f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev)
                                          "dither",
                                          amdgpu_dither_enum_list, sz);
 
+        if (amdgpu_device_has_dc_support(adev)) {
+                adev->mode_info.max_bpc_property =
+                        drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16);
+                if (!adev->mode_info.max_bpc_property)
+                        return -ENOMEM;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index b9e9e8b02fb7..d1b4d9b6aae0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -339,6 +339,8 @@ struct amdgpu_mode_info {
         struct drm_property *audio_property;
         /* FMT dithering */
         struct drm_property *dither_property;
+        /* maximum number of bits per channel for monitor color */
+        struct drm_property *max_bpc_property;
         /* hardcoded DFP edid from BIOS */
         struct edid *bios_hardcoded_edid;
         int bios_hardcoded_edid_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index e1c2b4e9c7b2..73ad02aea2b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -46,6 +46,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
 MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
 MODULE_FIRMWARE("amdgpu/verde_mc.bin");
 MODULE_FIRMWARE("amdgpu/oland_mc.bin");
+MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
 MODULE_FIRMWARE("amdgpu/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index bf5e6a413dee..4cc0dcb1a187 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -65,6 +65,13 @@
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL                                                             0x01ba
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL_BASE_IDX                                                    0
 
+/* for Vega20 register name change */
+#define mmHDP_MEM_POWER_CTRL    0x00d4
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK  0x00000001L
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK    0x00000002L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK   0x00010000L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK             0x00020000L
+#define mmHDP_MEM_POWER_CTRL_BASE_IDX   0
 /*
  * Indirect registers accessor
  */
@@ -870,15 +877,33 @@ static void soc15_update_hdp_light_sleep(struct amdgpu_device *adev, bool enable
 {
         uint32_t def, data;
 
-        def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+        if (adev->asic_type == CHIP_VEGA20) {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL));
 
-        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
-                data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
-        else
-                data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK;
+                else
+                        data &= ~(HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK);
 
-        if (def != data)
-                WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL), data);
+        } else {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                else
+                        data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+        }
 }
 
 static void soc15_update_drm_clock_gating(struct amdgpu_device *adev, bool enable)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c1262f62cd9f..ca925200fe09 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2358,8 +2358,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
 static enum dc_color_depth
 convert_color_depth_from_display_info(const struct drm_connector *connector)
 {
+        struct dm_connector_state *dm_conn_state =
+                to_dm_connector_state(connector->state);
         uint32_t bpc = connector->display_info.bpc;
 
+        /* TODO: Remove this when there's support for max_bpc in drm */
+        if (dm_conn_state && bpc > dm_conn_state->max_bpc)
+                /* Round down to nearest even number. */
+                bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1);
+
         switch (bpc) {
         case 0:
                 /*
@@ -2943,6 +2950,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 dm_new_state->underscan_enable = val;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                dm_new_state->max_bpc = val;
+                ret = 0;
         }
 
         return ret;
@@ -2985,6 +2995,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 *val = dm_state->underscan_enable;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                *val = dm_state->max_bpc;
+                ret = 0;
         }
         return ret;
 }
@@ -3795,6 +3808,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         drm_object_attach_property(&aconnector->base.base,
                                 adev->mode_info.underscan_vborder_property,
                                 0);
+        drm_object_attach_property(&aconnector->base.base,
+                                adev->mode_info.max_bpc_property,
+                                0);
 
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 924a38a1fc44..6e069d777ab2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -204,6 +204,7 @@ struct dm_connector_state {
         enum amdgpu_rmx_type scaling;
         uint8_t underscan_vborder;
         uint8_t underscan_hborder;
+        uint8_t max_bpc;
         bool underscan_enable;
         bool freesync_enable;
         bool freesync_capable;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index ed35ec0341e6..88f6b35ea6fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4525,12 +4525,12 @@ static int smu7_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *sclk_table = &(data->dpm_table.sclk_table);
         struct smu7_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.sclk_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -4567,12 +4567,12 @@ static int smu7_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *mclk_table = &(data->dpm_table.mclk_table);
         struct smu7_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mclk_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
-        value = (mclk_table->dpm_levels[mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 8c4db86bb4b7..e2bc6e0c229f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4522,15 +4522,13 @@ static int vega10_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega10_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
-
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels
-                        [golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
                         [golden_sclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
@@ -4575,16 +4573,13 @@ static int vega10_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega10_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 74bc37308dc0..54364444ecd1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -2243,12 +2243,12 @@ static int vega12_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega12_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -2264,16 +2264,13 @@ static int vega12_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega12_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 99861f32b1f9..b4eadd47f3a4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -75,7 +75,17 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->phy_clk_quad_eqn_b = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
         data->phy_clk_quad_eqn_c = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
 
-        data->registry_data.disallowed_features = 0x0;
+        /*
+         * Disable the following features for now:
+         *   GFXCLK DS
+         *   SOCLK DS
+         *   LCLK DS
+         *   DCEFCLK DS
+         *   FCLK DS
+         *   MP1CLK DS
+         *   MP0CLK DS
+         */
+        data->registry_data.disallowed_features = 0xE0041C00;
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -1313,12 +1323,13 @@ static int vega20_get_sclk_od(
                         &(data->dpm_table.gfx_table);
         struct vega20_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((sclk_table->dpm_levels[sclk_table->count - 1].value -
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) * 100,
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -1358,12 +1369,13 @@ static int vega20_get_mclk_od(
                         &(data->dpm_table.mem_table);
         struct vega20_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((mclk_table->dpm_levels[mclk_table->count - 1].value -
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) * 100,
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index 69dab82a3771..bf589c53b908 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
 
 MODULE_DEVICE_TABLE(pci, pciidlist);
 
+static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
+{
+        struct apertures_struct *ap;
+        bool primary = false;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        ap->ranges[0].base = pci_resource_start(pdev, 0);
+        ap->ranges[0].size = pci_resource_len(pdev, 0);
+
+#ifdef CONFIG_X86
+        primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+#endif
+        drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
+        kfree(ap);
+}
+
 static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        ast_kick_out_firmware_fb(pdev);
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 5e77d456d9bb..7c6ac3cadb6b 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
         }
         ast_bo_unreserve(bo);
 
+        ast_set_offset_reg(crtc);
         ast_set_start_address_crt1(crtc, (u32)gpu_addr);
 
         return 0;
@@ -1254,7 +1255,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
         ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
 
         /* dummy write to fire HWC */
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
+        ast_show_cursor(crtc);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index a502f3e519fd..dd852a25d375 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -219,6 +219,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
         mutex_lock(&fb_helper->lock);
         drm_connector_list_iter_begin(dev, &conn_iter);
         drm_for_each_connector_iter(connector, &conn_iter) {
+                if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+                        continue;
+
                 ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
                 if (ret)
                         goto fail;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 1aaccbe7e1de..d4fac09095f8 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1268,7 +1268,7 @@ relocate_entry(struct i915_vma *vma,
                 else if (gen >= 4)
                         len = 4;
                 else
-                        len = 3;
+                        len = 6;
 
                 batch = reloc_gpu(eb, vma, len);
                 if (IS_ERR(batch))
@@ -1309,6 +1309,11 @@ relocate_entry(struct i915_vma *vma,
                         *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
                         *batch++ = addr;
                         *batch++ = target_offset;
+
+                        /* And again for good measure (blb/pnv) */
+                        *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
+                        *batch++ = addr;
+                        *batch++ = target_offset;
                 }
 
                 goto out;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 47c302543799..07999fe09ad2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -3413,6 +3413,11 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
                 ggtt->vm.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
                 if (ggtt->vm.clear_range != nop_clear_range)
                         ggtt->vm.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+
+                /* Prevent recursively calling stop_machine() and deadlocks. */
+                dev_info(dev_priv->drm.dev,
+                         "Disabling error capture for VT-d workaround\n");
+                i915_disable_error_state(dev_priv, -ENODEV);
         }
 
         ggtt->invalidate = gen6_ggtt_invalidate;
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 8762d17b6659..3eb33e000d6f 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -648,6 +648,9 @@ int i915_error_state_to_str(struct drm_i915_error_state_buf *m,
                 return 0;
         }
 
+        if (IS_ERR(error))
+                return PTR_ERR(error);
+
         if (*error->error_msg)
                 err_printf(m, "%s\n", error->error_msg);
         err_printf(m, "Kernel: " UTS_RELEASE "\n");
@@ -1859,6 +1862,7 @@ void i915_capture_error_state(struct drm_i915_private *i915,
         error = i915_capture_gpu_state(i915);
         if (!error) {
                 DRM_DEBUG_DRIVER("out of memory, not capturing error state\n");
+                i915_disable_error_state(i915, -ENOMEM);
                 return;
         }
 
@@ -1914,5 +1918,14 @@ void i915_reset_error_state(struct drm_i915_private *i915)
         i915->gpu_error.first_error = NULL;
         spin_unlock_irq(&i915->gpu_error.lock);
 
-        i915_gpu_state_put(error);
+        if (!IS_ERR(error))
+                i915_gpu_state_put(error);
+}
+
+void i915_disable_error_state(struct drm_i915_private *i915, int err)
+{
+        spin_lock_irq(&i915->gpu_error.lock);
+        if (!i915->gpu_error.first_error)
+                i915->gpu_error.first_error = ERR_PTR(err);
+        spin_unlock_irq(&i915->gpu_error.lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.h b/drivers/gpu/drm/i915/i915_gpu_error.h
index 8710fb18ed74..3ec89a504de5 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.h
+++ b/drivers/gpu/drm/i915/i915_gpu_error.h
@@ -343,6 +343,7 @@ static inline void i915_gpu_state_put(struct i915_gpu_state *gpu)
 
 struct i915_gpu_state *i915_first_error_state(struct drm_i915_private *i915);
 void i915_reset_error_state(struct drm_i915_private *i915);
+void i915_disable_error_state(struct drm_i915_private *i915, int err);
 
 #else
 
@@ -355,13 +356,18 @@ static inline void i915_capture_error_state(struct drm_i915_private *dev_priv,
 static inline struct i915_gpu_state *
 i915_first_error_state(struct drm_i915_private *i915)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline void i915_reset_error_state(struct drm_i915_private *i915)
 {
 }
 
+static inline void i915_disable_error_state(struct drm_i915_private *i915,
+                                            int err)
+{
+}
+
 #endif /* IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR) */
 
 #endif /* _I915_GPU_ERROR_H_ */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a54843fdeb2f..c9878dd1f7cd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2890,6 +2890,7 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
+        intel_state->base.rotation = plane_config->rotation;
         intel_fill_fb_ggtt_view(&intel_state->view, fb,
                                 intel_state->base.rotation);
         intel_state->color_plane[0].stride =
@@ -7882,8 +7883,15 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                         plane_config->tiling = I915_TILING_X;
                         fb->modifier = I915_FORMAT_MOD_X_TILED;
                 }
+
+                if (val & DISPPLANE_ROTATE_180)
+                        plane_config->rotation = DRM_MODE_ROTATE_180;
         }
 
+        if (IS_CHERRYVIEW(dev_priv) && pipe == PIPE_B &&
+            val & DISPPLANE_MIRROR)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         pixel_format = val & DISPPLANE_PIXFORMAT_MASK;
         fourcc = i9xx_format_to_fourcc(pixel_format);
         fb->format = drm_format_info(fourcc);
@@ -8952,6 +8960,29 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                 goto error;
         }
 
+        /*
+         * DRM_MODE_ROTATE_ is counter clockwise to stay compatible with Xrandr
+         * while i915 HW rotation is clockwise, thats why this swapping.
+         */
+        switch (val & PLANE_CTL_ROTATE_MASK) {
+        case PLANE_CTL_ROTATE_0:
+                plane_config->rotation = DRM_MODE_ROTATE_0;
+                break;
+        case PLANE_CTL_ROTATE_90:
+                plane_config->rotation = DRM_MODE_ROTATE_270;
+                break;
+        case PLANE_CTL_ROTATE_180:
+                plane_config->rotation = DRM_MODE_ROTATE_180;
+                break;
+        case PLANE_CTL_ROTATE_270:
+                plane_config->rotation = DRM_MODE_ROTATE_90;
+                break;
+        }
+
+        if (INTEL_GEN(dev_priv) >= 10 &&
+            val & PLANE_CTL_FLIP_HORIZONTAL)
+                plane_config->rotation |= DRM_MODE_REFLECT_X;
+
         base = I915_READ(PLANE_SURF(pipe, plane_id)) & 0xfffff000;
         plane_config->base = base;
 
@@ -15267,6 +15298,14 @@ retry:
                         ret = drm_atomic_add_affected_planes(state, crtc);
                         if (ret)
                                 goto out;
+
+                        /*
+                         * FIXME hack to force a LUT update to avoid the
+                         * plane update forcing the pipe gamma on without
+                         * having a proper LUT loaded. Remove once we
+                         * have readout for pipe gamma enable.
+                         */
+                        crtc_state->color_mgmt_changed = true;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 8b298e5f012d..db6fa1d0cbda 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -547,6 +547,7 @@ struct intel_initial_plane_config {
         unsigned int tiling;
         int size;
         u32 base;
+        u8 rotation;
 };
 
 #define SKL_MIN_SRC_W 8
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 245f0022bcfd..3fe358db1276 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2493,6 +2493,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2522,6 +2525,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate,
         uint32_t method1, method2;
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -2545,6 +2551,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate,
 {
         int cpp;
 
+        if (mem_value == 0)
+                return U32_MAX;
+
         if (!intel_wm_plane_visible(cstate, pstate))
                 return 0;
 
@@ -3008,6 +3017,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 }
 
+static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
+{
+        /*
+         * On some SNB machines (Thinkpad X220 Tablet at least)
+         * LP3 usage can cause vblank interrupts to be lost.
+         * The DEIIR bit will go high but it looks like the CPU
+         * never gets interrupted.
+         *
+         * It's not clear whether other interrupt source could
+         * be affected or if this is somehow limited to vblank
+         * interrupts only. To play it safe we disable LP3
+         * watermarks entirely.
+         */
+        if (dev_priv->wm.pri_latency[3] == 0 &&
+            dev_priv->wm.spr_latency[3] == 0 &&
+            dev_priv->wm.cur_latency[3] == 0)
+                return;
+
+        dev_priv->wm.pri_latency[3] = 0;
+        dev_priv->wm.spr_latency[3] = 0;
+        dev_priv->wm.cur_latency[3] = 0;
+
+        DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
+        intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
+        intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+        intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+}
+
 static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
 {
         intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
@@ -3024,8 +3061,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
         intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
         intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
 
-        if (IS_GEN6(dev_priv))
+        if (IS_GEN6(dev_priv)) {
                 snb_wm_latency_quirk(dev_priv);
+                snb_wm_lp3_irq_quirk(dev_priv);
+        }
 }
 
 static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 127468785f74..1f94b9affe4b 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -214,6 +214,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
                 return 0;
         }
 
+        /* We know for sure we don't want an async update here. Set
+         * state->legacy_cursor_update to false to prevent
+         * drm_atomic_helper_setup_commit() from auto-completing
+         * commit->flip_done.
+         */
+        state->legacy_cursor_update = false;
         ret = drm_atomic_helper_setup_commit(state, nonblock);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 9dc3fcbd290b..c6635f23918a 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -807,7 +807,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb)
 static void vc4_plane_atomic_async_update(struct drm_plane *plane,
                                           struct drm_plane_state *state)
 {
-        struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+        struct vc4_plane_state *vc4_state, *new_vc4_state;
 
         if (plane->state->fb != state->fb) {
                 vc4_plane_async_set_fb(plane, state->fb);
@@ -828,7 +828,18 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
         plane->state->src_y = state->src_y;
 
         /* Update the display list based on the new crtc_x/y. */
-        vc4_plane_atomic_check(plane, plane->state);
+        vc4_plane_atomic_check(plane, state);
+
+        new_vc4_state = to_vc4_plane_state(state);
+        vc4_state = to_vc4_plane_state(plane->state);
+
+        /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
+        vc4_state->dlist[vc4_state->pos0_offset] =
+                new_vc4_state->dlist[vc4_state->pos0_offset];
+        vc4_state->dlist[vc4_state->pos2_offset] =
+                new_vc4_state->dlist[vc4_state->pos2_offset];
+        vc4_state->dlist[vc4_state->ptr0_offset] =
+                new_vc4_state->dlist[vc4_state->ptr0_offset];
 
         /* Note that we can't just call vc4_plane_write_dlist()
          * because that would smash the context data that the HVS is
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index a7513a8a8e37..d6106e1a0d4a 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -353,6 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
 
                 out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
 
+                /* fallthrough */
+
+        case KVP_OP_GET_IP_INFO:
                 utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
                                 MAX_ADAPTER_ID_SIZE,
                                 UTF16_LITTLE_ENDIAN,
@@ -405,7 +408,11 @@ kvp_send_key(struct work_struct *dummy)
                 process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
                 break;
         case KVP_OP_GET_IP_INFO:
-                /* We only need to pass on message->kvp_hdr.operation.  */
+                /*
+                 * We only need to pass on the info of operation, adapter_id
+                 * and addr_family to the userland kvp daemon.
+                 */
+                process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
                 break;
         case KVP_OP_SET:
                 switch (in_msg->body.kvp_set.data.value_type) {
@@ -446,9 +453,9 @@ kvp_send_key(struct work_struct *dummy)
 
                 }
 
-                break;
-
-        case KVP_OP_GET:
+                /*
+                 * The key is always a string - utf16 encoding.
+                 */
                 message->body.kvp_set.data.key_size =
                         utf16s_to_utf8s(
                         (wchar_t *)in_msg->body.kvp_set.data.key,
@@ -456,6 +463,17 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_set.data.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+
+                break;
+
+        case KVP_OP_GET:
+                message->body.kvp_get.data.key_size =
+                        utf16s_to_utf8s(
+                        (wchar_t *)in_msg->body.kvp_get.data.key,
+                        in_msg->body.kvp_get.data.key_size,
+                        UTF16_LITTLE_ENDIAN,
+                        message->body.kvp_get.data.key,
+                        HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
                 break;
 
         case KVP_OP_DELETE:
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bb2cd29e1658..d8f7000a466a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
         entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
                     &entry, sizeof(entry));
-        entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
+        entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
+                 (BIT_ULL(52)-1)) & ~7ULL;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
                     &entry, sizeof(entry));
         writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f3ccf025108b..41a4b8808802 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3075,7 +3075,7 @@ static int copy_context_table(struct intel_iommu *iommu,
                         }
 
                         if (old_ce)
-                                iounmap(old_ce);
+                                memunmap(old_ce);
 
                         ret = 0;
                         if (devfn < 0x80)
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index db301efe126d..887150907526 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -595,7 +595,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                         pr_err("%s: Page request without PASID: %08llx %08llx\n",
                                iommu->name, ((unsigned long long *)req)[0],
                                ((unsigned long long *)req)[1]);
-                        goto bad_req;
+                        goto no_pasid;
                 }
 
                 if (!svm || svm->pasid != req->pasid) {
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index b98a03189580..ddf3a492e1d5 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
 
 static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
 {
+        if (!domain->mmu)
+                return;
+
         /*
          * Disable the context. Flush the TLB as required when modifying the
          * context registers.
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 31d1f4ab915e..65a933a21e68 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -807,7 +807,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
-                dprintk(1, "%s: transmit queue full\n", __func__);
+                dprintk(2, "%s: transmit queue full\n", __func__);
                 return -EBUSY;
         }
 
@@ -1180,6 +1180,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
 {
         struct cec_log_addrs *las = &adap->log_addrs;
         struct cec_msg msg = { };
+        const unsigned int max_retries = 2;
+        unsigned int i;
         int err;
 
         if (cec_has_log_addr(adap, log_addr))
@@ -1188,19 +1190,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
         /* Send poll message */
         msg.len = 1;
         msg.msg[0] = (log_addr << 4) | log_addr;
-        err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        /*
-         * While trying to poll the physical address was reset
-         * and the adapter was unconfigured, so bail out.
-         */
-        if (!adap->is_configuring)
-                return -EINTR;
+        for (i = 0; i < max_retries; i++) {
+                err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        if (err)
-                return err;
+                /*
+                 * While trying to poll the physical address was reset
+                 * and the adapter was unconfigured, so bail out.
+                 */
+                if (!adap->is_configuring)
+                        return -EINTR;
+
+                if (err)
+                        return err;
 
-        if (msg.tx_status & CEC_TX_STATUS_OK)
+                /*
+                 * The message was aborted due to a disconnect or
+                 * unconfigure, just bail out.
+                 */
+                if (msg.tx_status & CEC_TX_STATUS_ABORTED)
+                        return -EINTR;
+                if (msg.tx_status & CEC_TX_STATUS_OK)
+                        return 0;
+                if (msg.tx_status & CEC_TX_STATUS_NACK)
+                        break;
+                /*
+                 * Retry up to max_retries times if the message was neither
+                 * OKed or NACKed. This can happen due to e.g. a Lost
+                 * Arbitration condition.
+                 */
+        }
+
+        /*
+         * If we are unable to get an OK or a NACK after max_retries attempts
+         * (and note that each attempt already consists of four polls), then
+         * then we assume that something is really weird and that it is not a
+         * good idea to try and claim this logical address.
+         */
+        if (i == max_retries)
                 return 0;
 
         /*
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index ca5d92942820..41d470d9ca94 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1918,7 +1918,6 @@ static int tc358743_probe_of(struct tc358743_state *state)
         ret = v4l2_fwnode_endpoint_alloc_parse(of_fwnode_handle(ep), &endpoint);
         if (ret) {
                 dev_err(dev, "failed to parse endpoint\n");
-                ret = ret;
                 goto put_node;
         }
 
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 452eb9b42140..447baaebca44 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1844,14 +1844,12 @@ fail_mutex_destroy:
 static void cio2_pci_remove(struct pci_dev *pci_dev)
 {
         struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
-        unsigned int i;
 
+        media_device_unregister(&cio2->media_dev);
         cio2_notifier_exit(cio2);
+        cio2_queues_exit(cio2);
         cio2_fbpt_exit_dummy(cio2);
-        for (i = 0; i < CIO2_QUEUES; i++)
-                cio2_queue_exit(cio2, &cio2->queue[i]);
         v4l2_device_unregister(&cio2->v4l2_dev);
-        media_device_unregister(&cio2->media_dev);
         media_device_cleanup(&cio2->media_dev);
         mutex_destroy(&cio2->lock);
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 77fb7987b42f..13f2828d880d 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
 
 static void isp_unregister_entities(struct isp_device *isp)
 {
+        media_device_unregister(&isp->media_dev);
+
         omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
         omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
         omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
         omap3isp_stat_unregister_entities(&isp->isp_hist);
 
         v4l2_device_unregister(&isp->v4l2_dev);
-        media_device_unregister(&isp->media_dev);
         media_device_cleanup(&isp->media_dev);
 }
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 1eb9132bfc85..b292cff26c86 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
 #define MAX_WIDTH               4096U
 #define MIN_WIDTH               640U
 #define MAX_HEIGHT              2160U
-#define MIN_HEIGHT              480U
+#define MIN_HEIGHT              360U
 
 #define dprintk(dev, fmt, arg...) \
         v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index af150a0395df..d82db738f174 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1009,7 +1009,7 @@ static const struct v4l2_m2m_ops m2m_ops = {
 
 static const struct media_device_ops m2m_media_ops = {
         .req_validate = vb2_request_validate,
-        .req_queue = vb2_m2m_request_queue,
+        .req_queue = v4l2_m2m_request_queue,
 };
 
 static int vim2m_probe(struct platform_device *pdev)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6e37950292cd..5f2b033a7a42 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1664,6 +1664,11 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
                     p_mpeg2_slice_params->forward_ref_index >= VIDEO_MAX_FRAME)
                         return -EINVAL;
 
+                if (p_mpeg2_slice_params->pad ||
+                    p_mpeg2_slice_params->picture.pad ||
+                    p_mpeg2_slice_params->sequence.pad)
+                        return -EINVAL;
+
                 return 0;
 
         case V4L2_CTRL_TYPE_MPEG2_QUANTIZATION:
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index a3ef1f50a4b3..481e3c65cf97 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
 }
 EXPORT_SYMBOL_GPL(v4l2_event_pending);
 
+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
+{
+        struct v4l2_fh *fh = sev->fh;
+        unsigned int i;
+
+        lockdep_assert_held(&fh->subscribe_lock);
+        assert_spin_locked(&fh->vdev->fh_lock);
+
+        /* Remove any pending events for this subscription */
+        for (i = 0; i < sev->in_use; i++) {
+                list_del(&sev->events[sev_pos(sev, i)].list);
+                fh->navailable--;
+        }
+        list_del(&sev->list);
+}
+
 int v4l2_event_subscribe(struct v4l2_fh *fh,
                          const struct v4l2_event_subscription *sub, unsigned elems,
                          const struct v4l2_subscribed_event_ops *ops)
@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
         found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+        if (!found_ev)
+                list_add(&sev->list, &fh->subscribed);
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
         if (found_ev) {
                 /* Already listening */
                 kvfree(sev);
-                goto out_unlock;
-        }
-
-        if (sev->ops && sev->ops->add) {
+        } else if (sev->ops && sev->ops->add) {
                 ret = sev->ops->add(sev, elems);
                 if (ret) {
+                        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+                        __v4l2_event_unsubscribe(sev);
+                        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
                         kvfree(sev);
-                        goto out_unlock;
                 }
         }
 
-        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        list_add(&sev->list, &fh->subscribed);
-        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-
-out_unlock:
         mutex_unlock(&fh->subscribe_lock);
 
         return ret;
@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
 {
         struct v4l2_subscribed_event *sev;
         unsigned long flags;
-        int i;
 
         if (sub->type == V4L2_EVENT_ALL) {
                 v4l2_event_unsubscribe_all(fh);
@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
         sev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (sev != NULL) {
-                /* Remove any pending events for this subscription */
-                for (i = 0; i < sev->in_use; i++) {
-                        list_del(&sev->events[sev_pos(sev, i)].list);
-                        fh->navailable--;
-                }
-                list_del(&sev->list);
-        }
+        if (sev != NULL)
+                __v4l2_event_unsubscribe(sev);
 
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index d7806db222d8..1ed2465972ac 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -953,7 +953,7 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_buf_queue);
 
-void vb2_m2m_request_queue(struct media_request *req)
+void v4l2_m2m_request_queue(struct media_request *req)
 {
         struct media_request_object *obj, *obj_safe;
         struct v4l2_m2m_ctx *m2m_ctx = NULL;
@@ -997,7 +997,7 @@ void vb2_m2m_request_queue(struct media_request *req)
         if (m2m_ctx)
                 v4l2_m2m_try_schedule(m2m_ctx);
 }
-EXPORT_SYMBOL_GPL(vb2_m2m_request_queue);
+EXPORT_SYMBOL_GPL(v4l2_m2m_request_queue);
 
 /* Videobuf2 ioctl helpers */
 
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index b2a0340f277e..d8e3cc2dc747 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
 MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
 #endif
 
-static inline const struct atmel_ssc_platform_data * __init
+static inline const struct atmel_ssc_platform_data *
         atmel_ssc_get_driver_data(struct platform_device *pdev)
 {
         if (pdev->dev.of_node) {
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 313da3150262..1540a7785e14 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -27,6 +27,9 @@
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <asm/uv/uv_hub.h>
+
+#include <linux/nospec.h>
+
 #include "gru.h"
 #include "grutables.h"
 #include "gruhandles.h"
@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
         /* Currently, only dump by gid is implemented */
         if (req.gid >= gru_max_gids)
                 return -EINVAL;
+        req.gid = array_index_nospec(req.gid, gru_max_gids);
 
         gru = GID_TO_GRU(req.gid);
         ubuf = req.buf;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 7bfd366d970d..c4115bae5db1 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -12,6 +12,7 @@
  *     - JMicron (hardware and technical support)
  */
 
+#include <linux/bitfield.h>
 #include <linux/string.h>
 #include <linux/delay.h>
 #include <linux/highmem.h>
@@ -462,6 +463,9 @@ struct intel_host {
         u32     dsm_fns;
         int     drv_strength;
         bool    d3_retune;
+        bool    rpm_retune_ok;
+        u32     glk_rx_ctrl1;
+        u32     glk_tun_val;
 };
 
 static const guid_t intel_dsm_guid =
@@ -791,6 +795,77 @@ cleanup:
         return ret;
 }
 
+#ifdef CONFIG_PM
+#define GLK_RX_CTRL1    0x834
+#define GLK_TUN_VAL     0x840
+#define GLK_PATH_PLL    GENMASK(13, 8)
+#define GLK_DLY         GENMASK(6, 0)
+/* Workaround firmware failing to restore the tuning value */
+static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
+{
+        struct sdhci_pci_slot *slot = chip->slots[0];
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct sdhci_host *host = slot->host;
+        u32 glk_rx_ctrl1;
+        u32 glk_tun_val;
+        u32 dly;
+
+        if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
+                return;
+
+        glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
+        glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
+
+        if (susp) {
+                intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
+                intel_host->glk_tun_val = glk_tun_val;
+                return;
+        }
+
+        if (!intel_host->glk_tun_val)
+                return;
+
+        if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
+                intel_host->rpm_retune_ok = true;
+                return;
+        }
+
+        dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
+                                  (intel_host->glk_tun_val << 1));
+        if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
+                return;
+
+        glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
+        sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
+
+        intel_host->rpm_retune_ok = true;
+        chip->rpm_retune = true;
+        mmc_retune_needed(host->mmc);
+        pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
+}
+
+static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
+{
+        if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+            !chip->rpm_retune)
+                glk_rpm_retune_wa(chip, susp);
+}
+
+static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, true);
+
+        return sdhci_cqhci_runtime_suspend(chip);
+}
+
+static int glk_runtime_resume(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, false);
+
+        return sdhci_cqhci_runtime_resume(chip);
+}
+#endif
+
 #ifdef CONFIG_ACPI
 static int ni_set_max_freq(struct sdhci_pci_slot *slot)
 {
@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
         .resume                 = sdhci_cqhci_resume,
 #endif
 #ifdef CONFIG_PM
-        .runtime_suspend        = sdhci_cqhci_runtime_suspend,
-        .runtime_resume         = sdhci_cqhci_runtime_resume,
+        .runtime_suspend        = glk_runtime_suspend,
+        .runtime_resume         = glk_runtime_resume,
 #endif
         .quirks                 = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
         .quirks2                = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
                 device_init_wakeup(&pdev->dev, true);
 
         if (slot->cd_idx >= 0) {
-                ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
+                ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
                                            slot->cd_override_level, 0, NULL);
+                if (ret && ret != -EPROBE_DEFER)
+                        ret = mmc_gpiod_request_cd(host->mmc, NULL,
+                                                   slot->cd_idx,
+                                                   slot->cd_override_level,
+                                                   0, NULL);
                 if (ret == -EPROBE_DEFER)
                         goto remove;
 
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index fb33f6be7c4f..ad720494e8f7 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2032,8 +2032,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
         int ret;
 
         nand_np = dev->of_node;
-        nfc_np = of_find_compatible_node(dev->of_node, NULL,
-                                         "atmel,sama5d3-nfc");
+        nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
         if (!nfc_np) {
                 dev_err(dev, "Could not find device node for sama5d3-nfc\n");
                 return -ENODEV;
@@ -2447,15 +2446,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
         }
 
         if (caps->legacy_of_bindings) {
+                struct device_node *nfc_node;
                 u32 ale_offs = 21;
 
                 /*
                  * If we are parsing legacy DT props and the DT contains a
                  * valid NFC node, forward the request to the sama5 logic.
                  */
-                if (of_find_compatible_node(pdev->dev.of_node, NULL,
-                                            "atmel,sama5d3-nfc"))
+                nfc_node = of_get_compatible_child(pdev->dev.of_node,
+                                                   "atmel,sama5d3-nfc");
+                if (nfc_node) {
                         caps = &atmel_sama5_nand_caps;
+                        of_node_put(nfc_node);
+                }
 
                 /*
                  * Even if the compatible says we are dealing with an
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index ef75dfa62a4f..699d3cf49c6d 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -150,15 +150,15 @@
 #define NAND_VERSION_MINOR_SHIFT        16
 
 /* NAND OP_CMDs */
-#define PAGE_READ                       0x2
-#define PAGE_READ_WITH_ECC              0x3
-#define PAGE_READ_WITH_ECC_SPARE        0x4
-#define PROGRAM_PAGE                    0x6
-#define PAGE_PROGRAM_WITH_ECC           0x7
-#define PROGRAM_PAGE_SPARE              0x9
-#define BLOCK_ERASE                     0xa
-#define FETCH_ID                        0xb
-#define RESET_DEVICE                    0xd
+#define OP_PAGE_READ                    0x2
+#define OP_PAGE_READ_WITH_ECC           0x3
+#define OP_PAGE_READ_WITH_ECC_SPARE     0x4
+#define OP_PROGRAM_PAGE                 0x6
+#define OP_PAGE_PROGRAM_WITH_ECC        0x7
+#define OP_PROGRAM_PAGE_SPARE           0x9
+#define OP_BLOCK_ERASE                  0xa
+#define OP_FETCH_ID                     0xb
+#define OP_RESET_DEVICE                 0xd
 
 /* Default Value for NAND_DEV_CMD_VLD */
 #define NAND_DEV_CMD_VLD_VAL            (READ_START_VLD | WRITE_START_VLD | \
@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
 
         if (read) {
                 if (host->use_ecc)
-                        cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
                 else
-                        cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
         } else {
-                        cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
+                cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
         }
 
         if (host->use_ecc) {
@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host)
          * in use. we configure the controller to perform a raw read of 512
          * bytes to read onfi params
          */
-        nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, 0);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
         nandc_set_reg(nandc, NAND_FLASH_CMD,
-                      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+                      OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, page_addr);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0,
@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column)
         if (column == -1)
                 return 0;
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
         nandc_set_reg(nandc, NAND_ADDR0, column);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host)
         struct nand_chip *chip = &host->chip;
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
         nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
 
         write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index d846428ef038..04cedd3a2bf6 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                 ndelay(cqspi->wr_delay);
 
         while (remaining > 0) {
+                size_t write_words, mod_bytes;
+
                 write_bytes = remaining > page_size ? page_size : remaining;
-                iowrite32_rep(cqspi->ahb_base, txbuf,
-                              DIV_ROUND_UP(write_bytes, 4));
+                write_words = write_bytes / 4;
+                mod_bytes = write_bytes % 4;
+                /* Write 4 bytes at a time then single bytes. */
+                if (write_words) {
+                        iowrite32_rep(cqspi->ahb_base, txbuf, write_words);
+                        txbuf += (write_words * 4);
+                }
+                if (mod_bytes) {
+                        unsigned int temp = 0xFFFFFFFF;
+
+                        memcpy(&temp, txbuf, mod_bytes);
+                        iowrite32(temp, cqspi->ahb_base);
+                        txbuf += mod_bytes;
+                }
 
                 if (!wait_for_completion_timeout(&cqspi->transfer_complete,
                                         msecs_to_jiffies(CQSPI_TIMEOUT_MS))) {
@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                         goto failwr;
                 }
 
-                txbuf += write_bytes;
                 remaining -= write_bytes;
 
                 if (remaining > 0)
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 3e54e31889c7..93c9bc8931fc 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -2156,7 +2156,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the serial flash memory
  * @len:        number of bytes to read
- * @buf:        buffer where the data is copied into
+ * @buf:        buffer where the data is copied into (dma-safe memory)
  *
  * Return: 0 on success, -errno otherwise.
  */
@@ -2522,6 +2522,34 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 }
 
 /**
+ * spi_nor_sort_erase_mask() - sort erase mask
+ * @map:        the erase map of the SPI NOR
+ * @erase_mask: the erase type mask to be sorted
+ *
+ * Replicate the sort done for the map's erase types in BFPT: sort the erase
+ * mask in ascending order with the smallest erase type size starting from
+ * BIT(0) in the sorted erase mask.
+ *
+ * Return: sorted erase mask.
+ */
+static u8 spi_nor_sort_erase_mask(struct spi_nor_erase_map *map, u8 erase_mask)
+{
+        struct spi_nor_erase_type *erase_type = map->erase_type;
+        int i;
+        u8 sorted_erase_mask = 0;
+
+        if (!erase_mask)
+                return 0;
+
+        /* Replicate the sort done for the map's erase types. */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (erase_type[i].size && erase_mask & BIT(erase_type[i].idx))
+                        sorted_erase_mask |= BIT(i);
+
+        return sorted_erase_mask;
+}
+
+/**
  * spi_nor_regions_sort_erase_types() - sort erase types in each region
  * @map:        the erase map of the SPI NOR
  *
@@ -2536,19 +2564,13 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 static void spi_nor_regions_sort_erase_types(struct spi_nor_erase_map *map)
 {
         struct spi_nor_erase_region *region = map->regions;
-        struct spi_nor_erase_type *erase_type = map->erase_type;
-        int i;
         u8 region_erase_mask, sorted_erase_mask;
 
         while (region) {
                 region_erase_mask = region->offset & SNOR_ERASE_TYPE_MASK;
 
-                /* Replicate the sort done for the map's erase types. */
-                sorted_erase_mask = 0;
-                for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
-                        if (erase_type[i].size &&
-                            region_erase_mask & BIT(erase_type[i].idx))
-                                sorted_erase_mask |= BIT(i);
+                sorted_erase_mask = spi_nor_sort_erase_mask(map,
+                                                            region_erase_mask);
 
                 /* Overwrite erase mask. */
                 region->offset = (region->offset & ~SNOR_ERASE_TYPE_MASK) |
@@ -2855,52 +2877,84 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)
  * spi_nor_get_map_in_use() - get the configuration map in use
  * @nor:        pointer to a 'struct spi_nor'
  * @smpt:       pointer to the sector map parameter table
+ * @smpt_len:   sector map parameter table length
+ *
+ * Return: pointer to the map in use, ERR_PTR(-errno) otherwise.
  */
-static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt)
+static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
+                                         u8 smpt_len)
 {
-        const u32 *ret = NULL;
-        u32 i, addr;
+        const u32 *ret;
+        u8 *buf;
+        u32 addr;
         int err;
+        u8 i;
         u8 addr_width, read_opcode, read_dummy;
-        u8 read_data_mask, data_byte, map_id;
+        u8 read_data_mask, map_id;
+
+        /* Use a kmalloc'ed bounce buffer to guarantee it is DMA-able. */
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
 
         addr_width = nor->addr_width;
         read_dummy = nor->read_dummy;
         read_opcode = nor->read_opcode;
 
         map_id = 0;
-        i = 0;
         /* Determine if there are any optional Detection Command Descriptors */
-        while (!(smpt[i] & SMPT_DESC_TYPE_MAP)) {
+        for (i = 0; i < smpt_len; i += 2) {
+                if (smpt[i] & SMPT_DESC_TYPE_MAP)
+                        break;
+
                 read_data_mask = SMPT_CMD_READ_DATA(smpt[i]);
                 nor->addr_width = spi_nor_smpt_addr_width(nor, smpt[i]);
                 nor->read_dummy = spi_nor_smpt_read_dummy(nor, smpt[i]);
                 nor->read_opcode = SMPT_CMD_OPCODE(smpt[i]);
                 addr = smpt[i + 1];
 
-                err = spi_nor_read_raw(nor, addr, 1, &data_byte);
-                if (err)
+                err = spi_nor_read_raw(nor, addr, 1, buf);
+                if (err) {
+                        ret = ERR_PTR(err);
                         goto out;
+                }
 
                 /*
                  * Build an index value that is used to select the Sector Map
                  * Configuration that is currently in use.
                  */
-                map_id = map_id << 1 | !!(data_byte & read_data_mask);
-                i = i + 2;
+                map_id = map_id << 1 | !!(*buf & read_data_mask);
         }
 
-        /* Find the matching configuration map */
-        while (SMPT_MAP_ID(smpt[i]) != map_id) {
+        /*
+         * If command descriptors are provided, they always precede map
+         * descriptors in the table. There is no need to start the iteration
+         * over smpt array all over again.
+         *
+         * Find the matching configuration map.
+         */
+        ret = ERR_PTR(-EINVAL);
+        while (i < smpt_len) {
+                if (SMPT_MAP_ID(smpt[i]) == map_id) {
+                        ret = smpt + i;
+                        break;
+                }
+
+                /*
+                 * If there are no more configuration map descriptors and no
+                 * configuration ID matched the configuration identifier, the
+                 * sector address map is unknown.
+                 */
                 if (smpt[i] & SMPT_DESC_END)
-                        goto out;
+                        break;
+
                 /* increment the table index to the next map */
                 i += SMPT_MAP_REGION_COUNT(smpt[i]) + 1;
         }
 
-        ret = smpt + i;
         /* fall through */
 out:
+        kfree(buf);
         nor->addr_width = addr_width;
         nor->read_dummy = read_dummy;
         nor->read_opcode = read_opcode;
@@ -2946,7 +3000,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
         u64 offset;
         u32 region_count;
         int i, j;
-        u8 erase_type;
+        u8 erase_type, uniform_erase_type;
 
         region_count = SMPT_MAP_REGION_COUNT(*smpt);
         /*
@@ -2959,7 +3013,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                 return -ENOMEM;
         map->regions = region;
 
-        map->uniform_erase_type = 0xff;
+        uniform_erase_type = 0xff;
         offset = 0;
         /* Populate regions. */
         for (i = 0; i < region_count; i++) {
@@ -2974,12 +3028,15 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                  * Save the erase types that are supported in all regions and
                  * can erase the entire flash memory.
                  */
-                map->uniform_erase_type &= erase_type;
+                uniform_erase_type &= erase_type;
 
                 offset = (region[i].offset & ~SNOR_ERASE_FLAGS_MASK) +
                          region[i].size;
         }
 
+        map->uniform_erase_type = spi_nor_sort_erase_mask(map,
+                                                          uniform_erase_type);
+
         spi_nor_region_mark_end(&region[i - 1]);
 
         return 0;
@@ -3020,9 +3077,9 @@ static int spi_nor_parse_smpt(struct spi_nor *nor,
         for (i = 0; i < smpt_header->length; i++)
                 smpt[i] = le32_to_cpu(smpt[i]);
 
-        sector_map = spi_nor_get_map_in_use(nor, smpt);
-        if (!sector_map) {
-                ret = -EINVAL;
+        sector_map = spi_nor_get_map_in_use(nor, smpt, smpt_header->length);
+        if (IS_ERR(sector_map)) {
+                ret = PTR_ERR(sector_map);
                 goto out;
         }
 
@@ -3125,7 +3182,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         if (err)
                 goto exit;
 
-        /* Parse other parameter headers. */
+        /* Parse optional parameter tables. */
         for (i = 0; i < header.nph; i++) {
                 param_header = &param_headers[i];
 
@@ -3138,8 +3195,17 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
                         break;
                 }
 
-                if (err)
-                        goto exit;
+                if (err) {
+                        dev_warn(dev, "Failed to parse optional parameter table: %04x\n",
+                                 SFDP_PARAM_HEADER_ID(param_header));
+                        /*
+                         * Let's not drop all information we extracted so far
+                         * if optional table parsers fail. In case of failing,
+                         * each optional parser is responsible to roll back to
+                         * the previously known spi_nor data.
+                         */
+                        err = 0;
+                }
         }
 
 exit:
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 18956e7604a3..a70bb1bb90e7 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1848,6 +1848,8 @@ static void ena_down(struct ena_adapter *adapter)
                 rc = ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
                 if (rc)
                         dev_err(&adapter->pdev->dev, "Device reset failed\n");
+                /* stop submitting admin commands on a device that was reset */
+                ena_com_set_admin_running_state(adapter->ena_dev, false);
         }
 
         ena_destroy_all_io_queues(adapter);
@@ -1914,6 +1916,9 @@ static int ena_close(struct net_device *netdev)
 
         netif_dbg(adapter, ifdown, netdev, "%s\n", __func__);
 
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return 0;
+
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
 
@@ -2613,9 +2618,7 @@ static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
                 ena_down(adapter);
 
         /* Stop the device from sending AENQ events (in case reset flag is set
-         *  and device is up, ena_close already reset the device
-         * In case the reset flag is set and the device is up, ena_down()
-         * already perform the reset, so it can be skipped.
+         *  and device is up, ena_down() already reset the device.
          */
         if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up))
                 ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
@@ -2694,8 +2697,8 @@ err_device_destroy:
         ena_com_abort_admin_commands(ena_dev);
         ena_com_wait_for_abort_completion(ena_dev);
         ena_com_admin_destroy(ena_dev);
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE);
+        ena_com_mmio_reg_read_request_destroy(ena_dev);
 err:
         clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
         clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
@@ -3452,6 +3455,8 @@ err_rss:
         ena_com_rss_destroy(ena_dev);
 err_free_msix:
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_INIT_ERR);
+        /* stop submitting admin commands on a device that was reset */
+        ena_com_set_admin_running_state(ena_dev, false);
         ena_free_mgmnt_irq(adapter);
         ena_disable_msix(adapter);
 err_worker_destroy:
@@ -3498,18 +3503,12 @@ static void ena_remove(struct pci_dev *pdev)
 
         cancel_work_sync(&adapter->reset_task);
 
-        unregister_netdev(netdev);
-
-        /* If the device is running then we want to make sure the device will be
-         * reset to make sure no more events will be issued by the device.
-         */
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-
         rtnl_lock();
         ena_destroy_device(adapter, true);
         rtnl_unlock();
 
+        unregister_netdev(netdev);
+
         free_netdev(netdev);
 
         ena_com_rss_destroy(ena_dev);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 521873642339..dc8b6173d8d8 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 1
+#define DRV_MODULE_VER_SUBMINOR 2
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
index b4fc0ed5bce8..9d4899826823 100644
--- a/drivers/net/ethernet/amd/sunlance.c
+++ b/drivers/net/ethernet/amd/sunlance.c
@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
 
                         prop = of_get_property(nd, "tpe-link-test?", NULL);
                         if (!prop)
-                                goto no_link_test;
+                                goto node_put;
 
                         if (strcmp(prop, "true")) {
                                 printk(KERN_NOTICE "SunLance: warning: overriding option "
@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
                                        "to ecd@skynet.be\n");
                                 auxio_set_lte(AUXIO_LTE_ON);
                         }
+node_put:
+                        of_node_put(nd);
 no_link_test:
                         lp->auto_select = 1;
                         lp->tpe = 0;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dc155c692c40..3b1397af81f7 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12434,6 +12434,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 {
         struct tg3 *tp = netdev_priv(dev);
         int i, irq_sync = 0, err = 0;
+        bool reset_phy = false;
 
         if ((ering->rx_pending > tp->rx_std_ring_mask) ||
             (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
@@ -12465,7 +12466,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                err = tg3_restart_hw(tp, false);
+                /* Reset PHY to avoid PHY lock up */
+                if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5720)
+                        reset_phy = true;
+
+                err = tg3_restart_hw(tp, reset_phy);
                 if (!err)
                         tg3_netif_start(tp);
         }
@@ -12499,6 +12506,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 {
         struct tg3 *tp = netdev_priv(dev);
         int err = 0;
+        bool reset_phy = false;
 
         if (tp->link_config.autoneg == AUTONEG_ENABLE)
                 tg3_warn_mgmt_link_flap(tp);
@@ -12568,7 +12576,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
                 if (netif_running(dev)) {
                         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                        err = tg3_restart_hw(tp, false);
+                        /* Reset PHY to avoid PHY lock up */
+                        if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5720)
+                                reset_phy = true;
+
+                        err = tg3_restart_hw(tp, reset_phy);
                         if (!err)
                                 tg3_netif_start(tp);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 768f584f8392..88f8a8fa93cd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1784,6 +1784,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool if_up = netif_running(nic->netdev);
         struct bpf_prog *old_prog;
         bool bpf_attached = false;
+        int ret = 0;
 
         /* For now just support only the usual MTU sized frames */
         if (prog && (dev->mtu > 1500)) {
@@ -1817,8 +1818,12 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         if (nic->xdp_prog) {
                 /* Attach BPF program */
                 nic->xdp_prog = bpf_prog_add(nic->xdp_prog, nic->rx_queues - 1);
-                if (!IS_ERR(nic->xdp_prog))
+                if (!IS_ERR(nic->xdp_prog)) {
                         bpf_attached = true;
+                } else {
+                        ret = PTR_ERR(nic->xdp_prog);
+                        nic->xdp_prog = NULL;
+                }
         }
 
         /* Calculate Tx queues needed for XDP and network stack */
@@ -1830,7 +1835,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
                 netif_trans_update(nic->netdev);
         }
 
-        return 0;
+        return ret;
 }
 
 static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 187a249ff2d1..fcaf18fa3904 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -585,10 +585,12 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         if (!sq->dmem.base)
                 return;
 
-        if (sq->tso_hdrs)
+        if (sq->tso_hdrs) {
                 dma_free_coherent(&nic->pdev->dev,
                                   sq->dmem.q_len * TSO_HEADER_SIZE,
                                   sq->tso_hdrs, sq->tso_hdrs_phys);
+                sq->tso_hdrs = NULL;
+        }
 
         /* Free pending skbs in the queue */
         smp_rmb();
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ceec467f590d..949103db8a8a 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -660,7 +660,7 @@ static void gmac_clean_txq(struct net_device *netdev, struct gmac_txq *txq,
 
                         u64_stats_update_begin(&port->tx_stats_syncp);
                         port->tx_frag_stats[nfrags]++;
-                        u64_stats_update_end(&port->ir_stats_syncp);
+                        u64_stats_update_end(&port->tx_stats_syncp);
                 }
         }
 
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 570caeb8ee9e..084f24daf2b5 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
         struct net_device *netdev = dev_id;
         struct ftmac100 *priv = netdev_priv(netdev);
 
-        if (likely(netif_running(netdev))) {
-                /* Disable interrupts for polling */
-                ftmac100_disable_all_int(priv);
+        /* Disable interrupts for polling */
+        ftmac100_disable_all_int(priv);
+        if (likely(netif_running(netdev)))
                 napi_schedule(&priv->napi);
-        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index c9d5d0a7fbf1..c0203a0d5e3b 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
                 for (j = 0; j < rx_pool->size; j++) {
                         if (rx_pool->rx_buff[j].skb) {
-                                dev_kfree_skb_any(rx_pool->rx_buff[i].skb);
-                                rx_pool->rx_buff[i].skb = NULL;
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
                         }
                 }
 
@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
-
         if (adapter->state != VNIC_CLOSED) {
                 rc = ibmvnic_login(netdev);
-                if (rc) {
-                        mutex_unlock(&adapter->reset_lock);
+                if (rc)
                         return rc;
-                }
 
                 rc = init_resources(adapter);
                 if (rc) {
                         netdev_err(netdev, "failed to initialize resources\n");
                         release_resources(adapter);
-                        mutex_unlock(&adapter->reset_lock);
                         return rc;
                 }
         }
@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        mutex_unlock(&adapter->reset_lock);
-
         return rc;
 }
 
@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
         rc = __ibmvnic_close(netdev);
         ibmvnic_cleanup(netdev);
-        mutex_unlock(&adapter->reset_lock);
 
         return rc;
 }
@@ -1746,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
         u64 old_num_rx_queues, old_num_tx_queues;
+        u64 old_num_rx_slots, old_num_tx_slots;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1757,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
+        old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq;
+        old_num_tx_slots = adapter->req_tx_entries_per_subcrq;
 
         ibmvnic_cleanup(netdev);
 
@@ -1819,21 +1813,20 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         if (rc)
                                 return rc;
                 } else if (adapter->req_rx_queues != old_num_rx_queues ||
-                           adapter->req_tx_queues != old_num_tx_queues) {
-                        adapter->map_id = 1;
+                           adapter->req_tx_queues != old_num_tx_queues ||
+                           adapter->req_rx_add_entries_per_subcrq !=
+                                                        old_num_rx_slots ||
+                           adapter->req_tx_entries_per_subcrq !=
+                                                        old_num_tx_slots) {
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        rc = init_rx_pools(netdev);
-                        if (rc)
-                                return rc;
-                        rc = init_tx_pools(netdev);
-                        if (rc)
-                                return rc;
-
                         release_napi(adapter);
-                        rc = init_napi(adapter);
+                        release_vpd_data(adapter);
+
+                        rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -1917,17 +1910,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
                 adapter->state = VNIC_PROBED;
                 return 0;
         }
-        /* netif_set_real_num_xx_queues needs to take rtnl lock here
-         * unless wait_for_reset is set, in which case the rtnl lock
-         * has already been taken before initializing the reset
-         */
-        if (!adapter->wait_for_reset) {
-                rtnl_lock();
-                rc = init_resources(adapter);
-                rtnl_unlock();
-        } else {
-                rc = init_resources(adapter);
-        }
+
+        rc = init_resources(adapter);
         if (rc)
                 return rc;
 
@@ -1986,13 +1970,21 @@ static void __ibmvnic_reset(struct work_struct *work)
         struct ibmvnic_rwi *rwi;
         struct ibmvnic_adapter *adapter;
         struct net_device *netdev;
+        bool we_lock_rtnl = false;
         u32 reset_state;
         int rc = 0;
 
         adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
         netdev = adapter->netdev;
 
-        mutex_lock(&adapter->reset_lock);
+        /* netif_set_real_num_xx_queues needs to take rtnl lock here
+         * unless wait_for_reset is set, in which case the rtnl lock
+         * has already been taken before initializing the reset
+         */
+        if (!adapter->wait_for_reset) {
+                rtnl_lock();
+                we_lock_rtnl = true;
+        }
         reset_state = adapter->state;
 
         rwi = get_next_rwi(adapter);
@@ -2020,12 +2012,11 @@ static void __ibmvnic_reset(struct work_struct *work)
         if (rc) {
                 netdev_dbg(adapter->netdev, "Reset failed\n");
                 free_all_rwi(adapter);
-                mutex_unlock(&adapter->reset_lock);
-                return;
         }
 
         adapter->resetting = false;
-        mutex_unlock(&adapter->reset_lock);
+        if (we_lock_rtnl)
+                rtnl_unlock();
 }
 
 static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
@@ -4768,7 +4759,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
-        mutex_init(&adapter->reset_lock);
         mutex_init(&adapter->rwi_lock);
         adapter->resetting = false;
 
@@ -4840,8 +4830,8 @@ static int ibmvnic_remove(struct vio_dev *dev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
 
         adapter->state = VNIC_REMOVING;
-        unregister_netdev(netdev);
-        mutex_lock(&adapter->reset_lock);
+        rtnl_lock();
+        unregister_netdevice(netdev);
 
         release_resources(adapter);
         release_sub_crqs(adapter, 1);
@@ -4852,7 +4842,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
 
         adapter->state = VNIC_REMOVED;
 
-        mutex_unlock(&adapter->reset_lock);
+        rtnl_unlock();
         device_remove_file(&dev->dev, &dev_attr_failover);
         free_netdev(netdev);
         dev_set_drvdata(&dev->dev, NULL);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 18103b811d4d..99c4f8d331ce 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1075,7 +1075,7 @@ struct ibmvnic_adapter {
         struct tasklet_struct tasklet;
         enum vnic_state state;
         enum ibmvnic_reset_reason reset_reason;
-        struct mutex reset_lock, rwi_lock;
+        struct mutex rwi_lock;
         struct list_head rwi_list;
         struct work_struct ibmvnic_reset;
         bool resetting;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index d7fbd5b6ac95..118324802926 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -569,6 +569,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        unsigned int           hw_mtu;
 
         struct net_dim         dim; /* Dynamic Interrupt Moderation */
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 023dc4bccd28..4a37713023be 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
 
         eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
         *speed = mlx5e_port_ptys2speed(eth_proto_oper);
-        if (!(*speed)) {
-                mlx5_core_warn(mdev, "cannot get port speed\n");
+        if (!(*speed))
                 err = -EINVAL;
-        }
 
         return err;
 }
@@ -258,7 +256,7 @@ static int mlx5e_fec_admin_field(u32 *pplm,
         case 40000:
                 if (!write)
                         *fec_policy = MLX5_GET(pplm_reg, pplm,
-                                               fec_override_cap_10g_40g);
+                                               fec_override_admin_10g_40g);
                 else
                         MLX5_SET(pplm_reg, pplm,
                                  fec_override_admin_10g_40g, *fec_policy);
@@ -310,7 +308,7 @@ static int mlx5e_get_fec_cap_field(u32 *pplm,
         case 10000:
         case 40000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
-                                    fec_override_admin_10g_40g);
+                                    fec_override_cap_10g_40g);
                 break;
         case 25000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
@@ -394,12 +392,12 @@ int mlx5e_get_fec_mode(struct mlx5_core_dev *dev, u32 *fec_mode_active,
 
 int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
 {
+        u8 fec_policy_nofec = BIT(MLX5E_FEC_NOFEC);
         bool fec_mode_not_supp_in_speed = false;
-        u8 no_fec_policy = BIT(MLX5E_FEC_NOFEC);
         u32 out[MLX5_ST_SZ_DW(pplm_reg)] = {};
         u32 in[MLX5_ST_SZ_DW(pplm_reg)] = {};
         int sz = MLX5_ST_SZ_BYTES(pplm_reg);
-        u32 current_fec_speed;
+        u8 fec_policy_auto = 0;
         u8 fec_caps = 0;
         int err;
         int i;
@@ -415,23 +413,19 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
         if (err)
                 return err;
 
-        err = mlx5e_port_linkspeed(dev, &current_fec_speed);
-        if (err)
-                return err;
+        MLX5_SET(pplm_reg, out, local_port, 1);
 
-        memset(in, 0, sz);
-        MLX5_SET(pplm_reg, in, local_port, 1);
-        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS && !!fec_policy; i++) {
+        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS; i++) {
                 mlx5e_get_fec_cap_field(out, &fec_caps, fec_supported_speeds[i]);
-                /* policy supported for link speed */
-                if (!!(fec_caps & fec_policy)) {
-                        mlx5e_fec_admin_field(in, &fec_policy, 1,
+                /* policy supported for link speed, or policy is auto */
+                if (fec_caps & fec_policy || fec_policy == fec_policy_auto) {
+                        mlx5e_fec_admin_field(out, &fec_policy, 1,
                                               fec_supported_speeds[i]);
                 } else {
-                        if (fec_supported_speeds[i] == current_fec_speed)
-                                return -EOPNOTSUPP;
-                        mlx5e_fec_admin_field(in, &no_fec_policy, 1,
-                                              fec_supported_speeds[i]);
+                        /* turn off FEC if supported. Else, leave it the same */
+                        if (fec_caps & fec_policy_nofec)
+                                mlx5e_fec_admin_field(out, &fec_policy_nofec, 1,
+                                                      fec_supported_speeds[i]);
                         fec_mode_not_supp_in_speed = true;
                 }
         }
@@ -441,5 +435,5 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
                               "FEC policy 0x%x is not supported for some speeds",
                               fec_policy);
 
-        return mlx5_core_access_reg(dev, in, sz, out, sz, MLX5_REG_PPLM, 0, 1);
+        return mlx5_core_access_reg(dev, out, sz, out, sz, MLX5_REG_PPLM, 0, 1);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index c047da8752da..eac245a93f91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err)
+        if (err) {
+                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
                 return 0;
+        }
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3e770abfd802..25c1c4f96841 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -843,8 +843,7 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported,
                                              Autoneg);
 
-        err = get_fec_supported_advertised(mdev, link_ksettings);
-        if (err)
+        if (get_fec_supported_advertised(mdev, link_ksettings))
                 netdev_dbg(netdev, "%s: FEC caps query failed: %d\n",
                            __func__, err);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1243edbedc9e..871313d6b34d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -502,6 +502,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         rq->channel = c;
         rq->ix      = c->ix;
         rq->mdev    = mdev;
+        rq->hw_mtu  = MLX5E_SW2HW_MTU(params, params->sw_mtu);
         rq->stats   = &c->priv->channel_stats[c->ix].rq;
 
         rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL;
@@ -1623,13 +1624,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev,
         int err;
         u32 i;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
+        if (err)
+                return err;
+
         err = mlx5_cqwq_create(mdev, &param->wq, param->cqc, &cq->wq,
                                &cq->wq_ctrl);
         if (err)
                 return err;
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
-
         mcq->cqe_sz     = 64;
         mcq->set_ci_db  = cq->wq_ctrl.db.db;
         mcq->arm_db     = cq->wq_ctrl.db.db + 1;
@@ -1687,6 +1690,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         int eqn;
         int err;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
+        if (err)
+                return err;
+
         inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
                 sizeof(u64) * cq->wq_ctrl.buf.npages;
         in = kvzalloc(inlen, GFP_KERNEL);
@@ -1700,8 +1707,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         mlx5_fill_page_frag_array(&cq->wq_ctrl.buf,
                                   (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
-
         MLX5_SET(cqc,   cqc, cq_period_mode, param->cq_period_mode);
         MLX5_SET(cqc,   cqc, c_eqn,         eqn);
         MLX5_SET(cqc,   cqc, uar_page,      mdev->priv.uar->index);
@@ -1921,6 +1926,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         int err;
         int eqn;
 
+        err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
+        if (err)
+                return err;
+
         c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
@@ -1937,7 +1946,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->xdp      = !!params->xdp_prog;
         c->stats    = &priv->channel_stats[ix].ch;
 
-        mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
         c->irq_desc = irq_to_desc(irq);
 
         netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64);
@@ -3574,6 +3582,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable)
         return 0;
 }
 
+#ifdef CONFIG_MLX5_ESWITCH
 static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -3586,6 +3595,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 
         return 0;
 }
+#endif
 
 static int set_feature_rx_all(struct net_device *netdev, bool enable)
 {
@@ -3684,7 +3694,9 @@ static int mlx5e_set_features(struct net_device *netdev,
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
                                     set_feature_cvlan_filter);
+#ifdef CONFIG_MLX5_ESWITCH
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters);
+#endif
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
@@ -3755,10 +3767,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
         }
 
         if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+                bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params);
                 u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params);
                 u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params);
 
-                reset = reset && (ppw_old != ppw_new);
+                reset = reset && (is_linear || (ppw_old != ppw_new));
         }
 
         if (!reset) {
@@ -4678,7 +4691,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
             FT_CAP(modify_root) &&
             FT_CAP(identified_miss_table_mode) &&
             FT_CAP(flow_table_modify)) {
+#ifdef CONFIG_MLX5_ESWITCH
                 netdev->hw_features      |= NETIF_F_HW_TC;
+#endif
 #ifdef CONFIG_MLX5_EN_ARFS
                 netdev->hw_features      |= NETIF_F_NTUPLE;
 #endif
@@ -5004,11 +5019,21 @@ err_free_netdev:
 int mlx5e_attach_netdev(struct mlx5e_priv *priv)
 {
         const struct mlx5e_profile *profile;
+        int max_nch;
         int err;
 
         profile = priv->profile;
         clear_bit(MLX5E_STATE_DESTROYING, &priv->state);
 
+        /* max number of channels may have changed */
+        max_nch = mlx5e_get_max_num_channels(priv->mdev);
+        if (priv->channels.params.num_channels > max_nch) {
+                mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch);
+                priv->channels.params.num_channels = max_nch;
+                mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, max_nch);
+        }
+
         err = profile->init_tx(priv);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 79638dcbae78..16985ca3248d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1104,6 +1104,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
         u32 frag_size;
         bool consumed;
 
+        /* Check packet size. Note LRO doesn't use linear SKB */
+        if (unlikely(cqe_bcnt > rq->hw_mtu)) {
+                rq->stats->oversize_pkts_sw_drop++;
+                return NULL;
+        }
+
         va             = page_address(di->page) + head_offset;
         data           = va + rx_headroom;
         frag_size      = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 35ded91203f5..4382ef85488c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
         return 1;
 }
 
-#ifdef CONFIG_INET
-/* loopback test */
-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN)
-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST";
-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
-
 struct mlx5ehdr {
         __be32 version;
         __be64 magic;
-        char   text[ETH_GSTRING_LEN];
 };
 
+#ifdef CONFIG_INET
+/* loopback test */
+#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\
+                             sizeof(struct udphdr) + sizeof(struct mlx5ehdr))
+#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
+
 static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
 {
         struct sk_buff *skb = NULL;
@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         struct ethhdr *ethh;
         struct udphdr *udph;
         struct iphdr *iph;
-        int datalen, iplen;
-
-        datalen = MLX5E_TEST_PKT_SIZE -
-                  (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph));
+        int    iplen;
 
         skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE);
         if (!skb) {
@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         /* Fill UDP header */
         udph->source = htons(9);
         udph->dest = htons(9); /* Discard Protocol */
-        udph->len = htons(datalen + sizeof(struct udphdr));
+        udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
         udph->check = 0;
 
         /* Fill IP header */
@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         iph->ttl = 32;
         iph->version = 4;
         iph->protocol = IPPROTO_UDP;
-        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
+        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) +
+                sizeof(struct mlx5ehdr);
         iph->tot_len = htons(iplen);
         iph->frag_off = 0;
         iph->saddr = 0;
@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         mlxh = skb_put(skb, sizeof(*mlxh));
         mlxh->version = 0;
         mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC);
-        strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text));
-        datalen -= sizeof(*mlxh);
-        skb_put_zero(skb, datalen);
 
         skb->csum = 0;
         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1e55b9c27ffc..3e99d0728b2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -83,6 +83,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
@@ -161,6 +162,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler_cqes    += rq_stats->mpwqe_filler_cqes;
                 s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides;
+                s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop;
                 s->rx_buff_alloc_err += rq_stats->buff_alloc_err;
                 s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks;
                 s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts;
@@ -1189,6 +1191,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 77f74ce11280..3f8e870ef4c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -96,6 +96,7 @@ struct mlx5e_sw_stats {
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler_cqes;
         u64 rx_mpwqe_filler_strides;
+        u64 rx_oversize_pkts_sw_drop;
         u64 rx_buff_alloc_err;
         u64 rx_cqe_compress_blks;
         u64 rx_cqe_compress_pkts;
@@ -193,6 +194,7 @@ struct mlx5e_rq_stats {
         u64 wqe_err;
         u64 mpwqe_filler_cqes;
         u64 mpwqe_filler_strides;
+        u64 oversize_pkts_sw_drop;
         u64 buff_alloc_err;
         u64 cqe_compress_blks;
         u64 cqe_compress_pkts;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 608025ca5c04..fca6f4132c91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1447,31 +1447,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                                          inner_headers);
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
-                struct flow_dissector_key_eth_addrs *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                struct flow_dissector_key_basic *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->key);
-                struct flow_dissector_key_eth_addrs *mask =
+                struct flow_dissector_key_basic *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->mask);
+                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
+                         ntohs(mask->n_proto));
+                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
+                         ntohs(key->n_proto));
 
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             dmac_47_16),
-                                mask->dst);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             dmac_47_16),
-                                key->dst);
-
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             smac_47_16),
-                                mask->src);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             smac_47_16),
-                                key->src);
-
-                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
+                if (mask->n_proto)
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1505,9 +1495,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         *match_level = MLX5_MATCH_L2;
                 }
-        } else {
+        } else if (*match_level != MLX5_MATCH_NONE) {
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
+                *match_level = MLX5_MATCH_L2;
         }
 
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
@@ -1545,21 +1536,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
-                struct flow_dissector_key_basic *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                struct flow_dissector_key_eth_addrs *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->key);
-                struct flow_dissector_key_basic *mask =
+                struct flow_dissector_key_eth_addrs *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->mask);
-                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
-                         ntohs(mask->n_proto));
-                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
-                         ntohs(key->n_proto));
 
-                if (mask->n_proto)
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             dmac_47_16),
+                                mask->dst);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             dmac_47_16),
+                                key->dst);
+
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             smac_47_16),
+                                mask->src);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             smac_47_16),
+                                key->src);
+
+                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1586,10 +1587,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         /* the HW doesn't need L3 inline to match on frag=no */
                         if (!(key->flags & FLOW_DIS_IS_FRAGMENT))
-                                *match_level = MLX5_INLINE_MODE_L2;
+                                *match_level = MLX5_MATCH_L2;
         /* ***  L2 attributes parsing up to here *** */
                         else
-                                *match_level = MLX5_INLINE_MODE_IP;
+                                *match_level = MLX5_MATCH_L3;
                 }
         }
 
@@ -2979,7 +2980,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         if (!actions_match_supported(priv, exts, parse_attr, flow, extack))
                 return -EOPNOTSUPP;
 
-        if (attr->out_count > 1 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
+        if (attr->mirror_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "current firmware doesn't support split rule for port mirroring");
                 netdev_warn_once(priv->netdev, "current firmware doesn't support split rule for port mirroring\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 515e3d6de051..5a22c5874f3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule {
 };
 
 static const struct rhashtable_params rhash_sa = {
-        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
-        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
+        /* Keep out "cmd" field from the key as it's
+         * value is not constant during the lifetime
+         * of the key object.
+         */
+        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) -
+                   FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
+        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) +
+                      FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
         .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash),
         .automatic_shrinking = true,
         .min_size = 1,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index b59953daf8b4..11dabd62e2c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -560,9 +560,9 @@ static int mlx5i_close(struct net_device *netdev)
 
         netif_carrier_off(epriv->netdev);
         mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn);
-        mlx5i_uninit_underlay_qp(epriv);
         mlx5e_deactivate_priv_channels(epriv);
         mlx5e_close_channels(&epriv->channels);
+        mlx5i_uninit_underlay_qp(epriv);
 unlock:
         mutex_unlock(&epriv->state_lock);
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index cff141077558..88a8576ca9ce 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -485,8 +485,16 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1)
+        if (bitmap_weight((unsigned long *)&pq_flags,
+                          sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
                 goto err;
+        }
+
+        if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+                goto err;
+        }
 
         switch (pq_flags) {
         case PQ_FLAGS_RLS:
@@ -510,8 +518,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         }
 
 err:
-        DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags);
-        return NULL;
+        return &qm_info->start_pq;
 }
 
 /* save pq index in qm info */
@@ -535,20 +542,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc)
 {
         u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn);
 
+        if (max_tc == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_MCOS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (tc > max_tc)
                 DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc);
 }
 
 u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf)
 {
         u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn);
 
+        if (max_vf == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_VFS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (vf > max_vf)
                 DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf);
 }
 
 u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc)
diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
index 62269e578718..cfe680f78a3f 100644
--- a/drivers/net/phy/mscc.c
+++ b/drivers/net/phy/mscc.c
@@ -810,17 +810,13 @@ static int vsc85xx_default_config(struct phy_device *phydev)
 
         phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
         mutex_lock(&phydev->lock);
-        rc = phy_select_page(phydev, MSCC_PHY_PAGE_EXTENDED_2);
-        if (rc < 0)
-                goto out_unlock;
 
-        reg_val = phy_read(phydev, MSCC_PHY_RGMII_CNTL);
-        reg_val &= ~(RGMII_RX_CLK_DELAY_MASK);
-        reg_val |= (RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS);
-        phy_write(phydev, MSCC_PHY_RGMII_CNTL, reg_val);
+        reg_val = RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS;
+
+        rc = phy_modify_paged(phydev, MSCC_PHY_PAGE_EXTENDED_2,
+                              MSCC_PHY_RGMII_CNTL, RGMII_RX_CLK_DELAY_MASK,
+                              reg_val);
 
-out_unlock:
-        rc = phy_restore_page(phydev, rc, rc > 0 ? 0 : rc);
         mutex_unlock(&phydev->lock);
 
         return rc;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index db633ae9f784..364f514d56d8 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team,
         team->en_port_count--;
         team_queue_override_port_del(team, port);
         team_adjust_ops(team);
-        team_notify_peers(team);
-        team_mcast_rejoin(team);
         team_lower_state_changed(port);
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2c041d76ac..cecfd77c9f3c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,7 +70,8 @@ static const unsigned long guest_offloads[] = {
         VIRTIO_NET_F_GUEST_TSO4,
         VIRTIO_NET_F_GUEST_TSO6,
         VIRTIO_NET_F_GUEST_ECN,
-        VIRTIO_NET_F_GUEST_UFO
+        VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_CSUM
 };
 
 struct virtnet_stat_desc {
@@ -2334,9 +2335,6 @@ static int virtnet_clear_guest_offloads(struct virtnet_info *vi)
         if (!vi->guest_offloads)
                 return 0;
 
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads = 1ULL << VIRTIO_NET_F_GUEST_CSUM;
-
         return virtnet_set_guest_offloads(vi, offloads);
 }
 
@@ -2346,8 +2344,6 @@ static int virtnet_restore_guest_offloads(struct virtnet_info *vi)
 
         if (!vi->guest_offloads)
                 return 0;
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads |= 1ULL << VIRTIO_NET_F_GUEST_CSUM;
 
         return virtnet_set_guest_offloads(vi, offloads);
 }
@@ -2365,8 +2361,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
             && (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
-                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO))) {
-                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO, disable LRO first");
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
                 return -EOPNOTSUPP;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a1c2801ded10..7e49342bae38 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6867,7 +6867,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         u32 bitmap;
 
         if (drop) {
-                if (vif->type == NL80211_IFTYPE_STATION) {
+                if (vif && vif->type == NL80211_IFTYPE_STATION) {
                         bitmap = ~(1 << WMI_MGMT_TID);
                         list_for_each_entry(arvif, &ar->arvifs, list) {
                                 if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1e3b5f4a4cf9..f23cb2f3d296 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1251,6 +1251,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_node *an = &avp->mcast_node;
 
+        mutex_lock(&sc->mutex);
         if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
                 if (sc->cur_chan->nvifs >= 1) {
                         mutex_unlock(&sc->mutex);
@@ -1259,8 +1260,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 sc->tx99_vif = vif;
         }
 
-        mutex_lock(&sc->mutex);
-
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->cur_chan->nvifs++;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 230a378c26fc..7f0a5bade70a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6005,7 +6005,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
                          * for subsequent chanspecs.
                          */
                         channel->flags = IEEE80211_CHAN_NO_HT40 |
-                                         IEEE80211_CHAN_NO_80MHZ;
+                                         IEEE80211_CHAN_NO_80MHZ |
+                                         IEEE80211_CHAN_NO_160MHZ;
                         ch.bw = BRCMU_CHAN_BW_20;
                         cfg->d11inf.encchspec(&ch);
                         chaninfo = ch.chspec;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
index e7584b842dce..eb5db94f5745 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_160:
+                ch->bw = BRCMU_CHAN_BW_160;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
                 switch (ch->sb) {
                 case BRCMU_CHAN_SB_LLL:
                         ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 2439e98431ee..7492dfb6729b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,7 +83,7 @@
 #define ACPI_WRDS_WIFI_DATA_SIZE        (ACPI_SAR_TABLE_SIZE + 2)
 #define ACPI_EWRD_WIFI_DATA_SIZE        ((ACPI_SAR_PROFILE_NUM - 1) * \
                                          ACPI_SAR_TABLE_SIZE + 3)
-#define ACPI_WGDS_WIFI_DATA_SIZE        18
+#define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index 6b95d0e75889..2b8b50a77990 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -154,7 +154,11 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
                         const struct iwl_fw_runtime_ops *ops, void *ops_ctx,
                         struct dentry *dbgfs_dir);
 
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
+static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
+{
+        kfree(fwrt->dump.d3_debug_data);
+        fwrt->dump.d3_debug_data = NULL;
+}
 
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index dade206d5511..2ba890445c35 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -893,7 +893,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
         IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
-                     ACPI_WGDS_TABLE_SIZE !=  ACPI_WGDS_WIFI_DATA_SIZE);
+                     ACPI_WGDS_TABLE_SIZE + 1 !=  ACPI_WGDS_WIFI_DATA_SIZE);
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
 
@@ -928,6 +928,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
         return -ENOENT;
 }
 
+static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
+{
+        return -ENOENT;
+}
+
 static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 {
         return 0;
@@ -954,8 +959,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
                 IWL_DEBUG_RADIO(mvm,
                                 "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
                                 ret);
-                /* if not available, don't fail and don't bother with EWRD */
-                return 0;
+                /*
+                 * If not available, don't fail and don't bother with EWRD.
+                 * Return 1 to tell that we can't use WGDS either.
+                 */
+                return 1;
         }
 
         ret = iwl_mvm_sar_get_ewrd_table(mvm);
@@ -968,9 +976,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
         /* choose profile 1 (WRDS) as default for both chains */
         ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
 
-        /* if we don't have profile 0 from BIOS, just skip it */
+        /*
+         * If we don't have profile 0 from BIOS, just skip it.  This
+         * means that SAR Geo will not be enabled either, even if we
+         * have other valid profiles.
+         */
         if (ret == -ENOENT)
-                return 0;
+                return 1;
 
         return ret;
 }
@@ -1168,11 +1180,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
         ret = iwl_mvm_sar_init(mvm);
-        if (ret)
-                goto error;
+        if (ret == 0) {
+                ret = iwl_mvm_sar_geo_init(mvm);
+        } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
+                /*
+                 * If basic SAR is not available, we check for WGDS,
+                 * which should *not* be available either.  If it is
+                 * available, issue an error, because we can't use SAR
+                 * Geo without basic SAR.
+                 */
+                IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
+        }
 
-        ret = iwl_mvm_sar_geo_init(mvm);
-        if (ret)
+        if (ret < 0)
                 goto error;
 
         iwl_mvm_leds_sync(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 505b0385d800..00f831d88366 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -301,8 +301,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
                 goto out;
         }
 
-        if (changed)
-                *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
+        if (changed) {
+                u32 status = le32_to_cpu(resp->status);
+
+                *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
+                            status == MCC_RESP_ILLEGAL);
+        }
 
         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                       __le32_to_cpu(resp->n_channels),
@@ -4444,10 +4448,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
         }
 
-        if (!fw_has_capa(&mvm->fw->ucode_capa,
-                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
-                return;
-
         /* if beacon filtering isn't on mac80211 does it anyway */
         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 3633f27d048a..6fc5cc1f2b5b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -539,9 +539,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
         }
 
         IWL_DEBUG_LAR(mvm,
-                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
-                      status, mcc, mcc >> 8, mcc & 0xff,
-                      !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
+                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
+                      status, mcc, mcc >> 8, mcc & 0xff, n_channels);
 
 exit:
         iwl_free_resp(&cmd);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 0e2092526fae..af3fba10abc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -858,6 +858,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_mvm_thermal_exit(mvm);
  out_free:
         iwl_fw_flush_dump(&mvm->fwrt);
+        iwl_fw_runtime_free(&mvm->fwrt);
 
         if (iwlmvm_mod_params.init_dbg)
                 return op_mode;
@@ -910,6 +911,7 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_tof_clean(mvm);
 
+        iwl_fw_runtime_free(&mvm->fwrt);
         mutex_destroy(&mvm->mutex);
         mutex_destroy(&mvm->d0i3_suspend_mutex);
 
diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig
index 0ccbcd7e887d..c30d8f5bbf2a 100644
--- a/drivers/net/wireless/mediatek/mt76/Kconfig
+++ b/drivers/net/wireless/mediatek/mt76/Kconfig
@@ -1,6 +1,12 @@
 config MT76_CORE
         tristate
 
+config MT76_LEDS
+        bool
+        depends on MT76_CORE
+        depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS
+        default y
+
 config MT76_USB
         tristate
         depends on MT76_CORE
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 2a699e8b79bf..7d219ff2d480 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -345,9 +345,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
         mt76_check_sband(dev, NL80211_BAND_2GHZ);
         mt76_check_sband(dev, NL80211_BAND_5GHZ);
 
-        ret = mt76_led_init(dev);
-        if (ret)
-                return ret;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                ret = mt76_led_init(dev);
+                if (ret)
+                        return ret;
+        }
 
         return ieee80211_register_hw(hw);
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index 47c42c607964..7806963b1905 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -71,7 +71,6 @@ struct mt76x02_dev {
         struct mac_address macaddr_list[8];
 
         struct mutex phy_mutex;
-        struct mutex mutex;
 
         u8 txdone_seq;
         DECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
index 3824290b219d..fd125722d1fb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
@@ -507,8 +507,10 @@ int mt76x2_register_device(struct mt76x02_dev *dev)
         mt76x2_dfs_init_detector(dev);
 
         /* init led callbacks */
-        dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
-        dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
+                dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        }
 
         ret = mt76_register_device(&dev->mt76, true, mt76x02_rates,
                                    ARRAY_SIZE(mt76x02_rates));
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
index 034a06295668..3f001bd6806c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
@@ -272,9 +272,9 @@ mt76x2_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
         if (val != ~0 && val > 0xffff)
                 return -EINVAL;
 
-        mutex_lock(&dev->mutex);
+        mutex_lock(&dev->mt76.mutex);
         mt76x2_mac_set_tx_protection(dev, val);
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&dev->mt76.mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 4c2154b9e6a3..bd10165d7eec 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -285,7 +285,7 @@ static int wl1271_probe(struct sdio_func *func,
         struct resource res[2];
         mmc_pm_flag_t mmcflags;
         int ret = -ENOMEM;
-        int irq, wakeirq;
+        int irq, wakeirq, num_irqs;
         const char *chip_family;
 
         /* We are only able to handle the wlan function */
@@ -353,12 +353,17 @@ static int wl1271_probe(struct sdio_func *func,
                        irqd_get_trigger_type(irq_get_irq_data(irq));
         res[0].name = "irq";
 
-        res[1].start = wakeirq;
-        res[1].flags = IORESOURCE_IRQ |
-                       irqd_get_trigger_type(irq_get_irq_data(wakeirq));
-        res[1].name = "wakeirq";
 
-        ret = platform_device_add_resources(glue->core, res, ARRAY_SIZE(res));
+        if (wakeirq > 0) {
+                res[1].start = wakeirq;
+                res[1].flags = IORESOURCE_IRQ |
+                               irqd_get_trigger_type(irq_get_irq_data(wakeirq));
+                res[1].name = "wakeirq";
+                num_irqs = 2;
+        } else {
+                num_irqs = 1;
+        }
+        ret = platform_device_add_resources(glue->core, res, num_irqs);
         if (ret) {
                 dev_err(glue->dev, "can't add resources\n");
                 goto out_dev_put;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0b70c8bab045..54032c466636 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -152,6 +152,7 @@ struct nvme_fc_ctrl {
 
         bool                    ioq_live;
         bool                    assoc_active;
+        atomic_t                err_work_active;
         u64                     association_id;
 
         struct list_head        ctrl_list;      /* rport->ctrl_list */
@@ -160,6 +161,7 @@ struct nvme_fc_ctrl {
         struct blk_mq_tag_set   tag_set;
 
         struct delayed_work     connect_work;
+        struct work_struct      err_work;
 
         struct kref             ref;
         u32                     flags;
@@ -1531,6 +1533,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
         int i;
 
+        /* ensure we've initialized the ops once */
+        if (!(aen_op->flags & FCOP_FLAGS_AEN))
+                return;
+
         for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
                 __nvme_fc_abort_op(ctrl, aen_op);
 }
@@ -2049,7 +2055,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
 static void
 nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
 {
-        /* only proceed if in LIVE state - e.g. on first error */
+        int active;
+
+        /*
+         * if an error (io timeout, etc) while (re)connecting,
+         * it's an error on creating the new association.
+         * Start the error recovery thread if it hasn't already
+         * been started. It is expected there could be multiple
+         * ios hitting this path before things are cleaned up.
+         */
+        if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+                active = atomic_xchg(&ctrl->err_work_active, 1);
+                if (!active && !schedule_work(&ctrl->err_work)) {
+                        atomic_set(&ctrl->err_work_active, 0);
+                        WARN_ON(1);
+                }
+                return;
+        }
+
+        /* Otherwise, only proceed if in LIVE state - e.g. on first error */
         if (ctrl->ctrl.state != NVME_CTRL_LIVE)
                 return;
 
@@ -2814,6 +2838,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
         /*
          * kill the association on the link side.  this will block
@@ -2866,23 +2891,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
 }
 
 static void
-nvme_fc_reset_ctrl_work(struct work_struct *work)
+__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
 {
-        struct nvme_fc_ctrl *ctrl =
-                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
-        int ret;
-
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+            !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
                         "to CONNECTING\n", ctrl->cnum);
-                return;
-        }
+}
+
+static void
+nvme_fc_reset_ctrl_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
+        int ret;
+
+        __nvme_fc_terminate_io(ctrl);
+
+        nvme_stop_ctrl(&ctrl->ctrl);
 
         if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE)
                 ret = nvme_fc_create_association(ctrl);
@@ -2897,6 +2929,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
                         ctrl->cnum);
 }
 
+static void
+nvme_fc_connect_err_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                        container_of(work, struct nvme_fc_ctrl, err_work);
+
+        __nvme_fc_terminate_io(ctrl);
+
+        atomic_set(&ctrl->err_work_active, 0);
+
+        /*
+         * Rescheduling the connection after recovering
+         * from the io error is left to the reconnect work
+         * item, which is what should have stalled waiting on
+         * the io that had the error that scheduled this work.
+         */
+}
+
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
@@ -3007,6 +3057,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         ctrl->cnum = idx;
         ctrl->ioq_live = false;
         ctrl->assoc_active = false;
+        atomic_set(&ctrl->err_work_active, 0);
         init_waitqueue_head(&ctrl->ioabort_wait);
 
         get_device(ctrl->dev);
@@ -3014,6 +3065,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
         INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
+        INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work);
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -3103,6 +3155,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 fail_ctrl:
         nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
         cancel_work_sync(&ctrl->ctrl.reset_work);
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
 
         ctrl->ctrl.opts = NULL;
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 9b18ce90f907..27f67dfa649d 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -44,6 +44,7 @@ struct nvmem_cell {
         int                     bytes;
         int                     bit_offset;
         int                     nbits;
+        struct device_node      *np;
         struct nvmem_device     *nvmem;
         struct list_head        node;
 };
@@ -298,6 +299,7 @@ static void nvmem_cell_drop(struct nvmem_cell *cell)
         mutex_lock(&nvmem_mutex);
         list_del(&cell->node);
         mutex_unlock(&nvmem_mutex);
+        of_node_put(cell->np);
         kfree(cell->name);
         kfree(cell);
 }
@@ -530,6 +532,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
                         return -ENOMEM;
 
                 cell->nvmem = nvmem;
+                cell->np = of_node_get(child);
                 cell->offset = be32_to_cpup(addr++);
                 cell->bytes = be32_to_cpup(addr);
                 cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
@@ -960,14 +963,13 @@ out:
 
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell *
-nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
+nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
 {
         struct nvmem_cell *cell = NULL;
-        int i = 0;
 
         mutex_lock(&nvmem_mutex);
         list_for_each_entry(cell, &nvmem->cells, node) {
-                if (index == i++)
+                if (np == cell->np)
                         break;
         }
         mutex_unlock(&nvmem_mutex);
@@ -1011,7 +1013,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
-        cell = nvmem_find_cell_by_index(nvmem, index);
+        cell = nvmem_find_cell_by_node(nvmem, cell_np);
         if (!cell) {
                 __nvmem_device_put(nvmem);
                 return ERR_PTR(-ENOENT);
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 9e5a9a3112c9..3f4fb4dbbe33 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
         int ret;
 
         vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
-                                          new_supply_vbb->u_volt);
+                                          new_supply_vdd->u_volt);
+
+        if (new_supply_vdd->u_volt_min < vdd_uv)
+                new_supply_vdd->u_volt_min = vdd_uv;
 
         /* Scaling up? Scale voltage before frequency */
         if (freq > old_freq) {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 20c85eed1a75..b658b9a5eb1e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1749,7 +1749,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 static void
 __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
 {
-        int cnt;
+        int cnt, status;
         unsigned long flags;
         srb_t *sp;
         scsi_qla_host_t *vha = qp->vha;
@@ -1799,10 +1799,16 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
                                         if (!sp_get(sp)) {
                                                 spin_unlock_irqrestore
                                                         (qp->qp_lock_ptr, flags);
-                                                qla2xxx_eh_abort(
+                                                status = qla2xxx_eh_abort(
                                                         GET_CMD_SP(sp));
                                                 spin_lock_irqsave
                                                         (qp->qp_lock_ptr, flags);
+                                                /*
+                                                 * Get rid of extra reference caused
+                                                 * by early exit from qla2xxx_eh_abort
+                                                 */
+                                                if (status == FAST_IO_FAIL)
+                                                        atomic_dec(&sp->ref_count);
                                         }
                                 }
                                 sp->done(sp, res);
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index 46df707e6f2c..452e19f8fb47 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -20,6 +20,7 @@
 #include "unipro.h"
 #include "ufs-hisi.h"
 #include "ufshci.h"
+#include "ufs_quirks.h"
 
 static int ufs_hisi_check_hibern8(struct ufs_hba *hba)
 {
@@ -390,6 +391,14 @@ static void ufs_hisi_set_dev_cap(struct ufs_hisi_dev_params *hisi_param)
 
 static void ufs_hisi_pwr_change_pre_change(struct ufs_hba *hba)
 {
+        if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME) {
+                pr_info("ufs flash device must set VS_DebugSaveConfigTime 0x10\n");
+                /* VS_DebugSaveConfigTime */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0xD0A0), 0x10);
+                /* sync length */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0x1556), 0x48);
+        }
+
         /* update */
         ufshcd_dme_set(hba, UIC_ARG_MIB(0x15A8), 0x1);
         /* PA_TxSkip */
diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
index 71f73d1d1ad1..5d2dfdb41a6f 100644
--- a/drivers/scsi/ufs/ufs_quirks.h
+++ b/drivers/scsi/ufs/ufs_quirks.h
@@ -131,4 +131,10 @@ struct ufs_dev_fix {
  */
 #define UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME (1 << 8)
 
+/*
+ * Some UFS devices require VS_DebugSaveConfigTime is 0x10,
+ * enabling this quirk ensure this.
+ */
+#define UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME    (1 << 9)
+
 #endif /* UFS_QUIRKS_H_ */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 27db55b0ca7f..f1c57cd33b5b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -231,6 +231,8 @@ static struct ufs_dev_fix ufs_fixups[] = {
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ),
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL,
                 UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME),
+        UFS_FIX(UFS_VENDOR_SKHYNIX, "hB8aL1" /*H28U62301AMR*/,
+                UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME),
 
         END_FIX
 };
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 7218fb963d0a..1382a8df6c75 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -777,9 +777,6 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
         u8 la = txn->la;
         bool usr_msg = false;
 
-        if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
-                return -EPROTONOSUPPORT;
-
         if (txn->mt == SLIM_MSG_MT_CORE &&
                 (txn->mc >= SLIM_MSG_MC_BEGIN_RECONFIGURATION &&
                  txn->mc <= SLIM_MSG_MC_RECONFIGURE_NOW))
diff --git a/drivers/slimbus/slimbus.h b/drivers/slimbus/slimbus.h
index 4399d1873e2d..9be41089edde 100644
--- a/drivers/slimbus/slimbus.h
+++ b/drivers/slimbus/slimbus.h
@@ -61,12 +61,6 @@
 #define SLIM_MSG_MC_NEXT_REMOVE_CHANNEL          0x58
 #define SLIM_MSG_MC_RECONFIGURE_NOW              0x5F
 
-/*
- * Clock pause flag to indicate that the reconfig message
- * corresponds to clock pause sequence
- */
-#define SLIM_MSG_CLK_PAUSE_SEQ_FLG              (1U << 8)
-
 /* Clock pause values per SLIMbus spec */
 #define SLIM_CLK_FAST                           0
 #define SLIM_CLK_CONST_PHASE                    1
diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
index a53231b08d30..e3425bf082ae 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
@@ -310,6 +310,7 @@ static int ipipeif_hw_setup(struct v4l2_subdev *sd)
                         ipipeif_write(val, ipipeif_base_addr, IPIPEIF_CFG2);
                         break;
                 }
+                /* fall through */
 
         case IPIPEIF_SDRAM_YUV:
                 /* Set clock divider */
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 82558455384a..dd121f66fa2d 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -253,7 +253,7 @@ static const struct v4l2_m2m_ops cedrus_m2m_ops = {
 
 static const struct media_device_ops cedrus_m2m_media_ops = {
         .req_validate   = cedrus_request_validate,
-        .req_queue      = vb2_m2m_request_queue,
+        .req_queue      = v4l2_m2m_request_queue,
 };
 
 static int cedrus_probe(struct platform_device *pdev)
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 85644669fbe7..0a357db4b31b 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -961,6 +961,8 @@ int __uio_register_device(struct module *owner,
         if (ret)
                 goto err_uio_dev_add_attributes;
 
+        info->uio_dev = idev;
+
         if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
                 /*
                  * Note that we deliberately don't use devm_request_irq
@@ -972,11 +974,12 @@ int __uio_register_device(struct module *owner,
                  */
                 ret = request_irq(info->irq, uio_interrupt,
                                   info->irq_flags, info->name, idev);
-                if (ret)
+                if (ret) {
+                        info->uio_dev = NULL;
                         goto err_request_irq;
+                }
         }
 
-        info->uio_dev = idev;
         return 0;
 
 err_request_irq:
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 47d75c20c211..1b68fed464cb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1696,6 +1696,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
         .driver_info = QUIRK_CONTROL_LINE_STATE, },
         { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index c6077d582d29..0f9381b69a3b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2794,6 +2794,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
         int i, status;
         u16 portchange, portstatus;
         struct usb_port *port_dev = hub->ports[port1 - 1];
+        int reset_recovery_time;
 
         if (!hub_is_superspeed(hub->hdev)) {
                 if (warm) {
@@ -2849,7 +2850,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                        usb_clear_port_feature(hub->hdev, port1,
+
+                        if (udev)
+                                usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_CONNECTION);
 
                         /*
@@ -2885,11 +2888,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
 
 done:
         if (status == 0) {
-                /* TRSTRCY = 10 ms; plus some extra */
                 if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
                         usleep_range(10000, 12000);
-                else
-                        msleep(10 + 40);
+                else {
+                        /* TRSTRCY = 10 ms; plus some extra */
+                        reset_recovery_time = 10 + 40;
+
+                        /* Hub needs extra delay after resetting its port. */
+                        if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
+                                reset_recovery_time += 100;
+
+                        msleep(reset_recovery_time);
+                }
 
                 if (udev) {
                         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 178d6c6063c0..f9ff03e6af93 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
                         case 'n':
                                 flags |= USB_QUIRK_DELAY_CTRL_MSG;
                                 break;
+                        case 'o':
+                                flags |= USB_QUIRK_HUB_SLOW_RESET;
+                                break;
                         /* Ignore unrecognized flag characters */
                         }
                 }
@@ -380,6 +383,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Terminus Technology Inc. Hub */
+        { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
         /* Corsair K70 RGB */
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -391,6 +397,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
           USB_QUIRK_DELAY_CTRL_MSG },
 
+        /* Corsair K70 LUX RGB */
+        { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -411,6 +420,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x2040, 0x7200), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Raydium Touchscreen */
+        { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
+
+        { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+
         /* DJI CineSSD */
         { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index d257c541e51b..7afc10872f1f 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci,
         dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO);
         if (!dwc2) {
                 dev_err(dev, "couldn't allocate dwc2 device\n");
+                ret = -ENOMEM;
                 goto err;
         }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index becfbb87f791..2f2048aa5fde 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
 
 err5:
         dwc3_event_buffers_cleanup(dwc);
+        dwc3_ulpi_exit(dwc);
 
 err4:
         dwc3_free_scratch_buffers(dwc);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 1286076a8890..842795856bf4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -283,8 +283,10 @@ err:
 static void dwc3_pci_remove(struct pci_dev *pci)
 {
         struct dwc3_pci         *dwc = pci_get_drvdata(pci);
+        struct pci_dev          *pdev = dwc->pci;
 
-        gpiod_remove_lookup_table(&platform_bytcr_gpios);
+        if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
+                gpiod_remove_lookup_table(&platform_bytcr_gpios);
 #ifdef CONFIG_PM
         cancel_work_sync(&dwc->wakeup_work);
 #endif
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 679c12e14522..9faad896b3a1 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1081,7 +1081,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
                         /* Now prepare one extra TRB to align transfer size */
                         trb = &dep->trb_pool[dep->trb_enqueue];
                         __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
-                                        maxp - rem, false, 0,
+                                        maxp - rem, false, 1,
                                         req->request.stream_id,
                                         req->request.short_not_ok,
                                         req->request.no_interrupt);
@@ -1125,7 +1125,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to align transfer size */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else if (req->request.zero && req->request.length &&
@@ -1141,7 +1141,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to handle ZLP */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else {
@@ -2259,7 +2259,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
          * with one TRB pending in the ring. We need to manually clear HWO bit
          * from that TRB.
          */
-        if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
+        if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 return 1;
         }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3ada83d81bda..31e8bf3578c8 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -215,7 +215,6 @@ struct ffs_io_data {
 
         struct mm_struct *mm;
         struct work_struct work;
-        struct work_struct cancellation_work;
 
         struct usb_ep *ep;
         struct usb_request *req;
@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static void ffs_aio_cancel_worker(struct work_struct *work)
-{
-        struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
-                                                   cancellation_work);
-
-        ENTER();
-
-        usb_ep_dequeue(io_data->ep, io_data->req);
-}
-
 static int ffs_aio_cancel(struct kiocb *kiocb)
 {
         struct ffs_io_data *io_data = kiocb->private;
-        struct ffs_data *ffs = io_data->ffs;
+        struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
         int value;
 
         ENTER();
 
-        if (likely(io_data && io_data->ep && io_data->req)) {
-                INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
-                queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
-                value = -EINPROGRESS;
-        } else {
+        spin_lock_irq(&epfile->ffs->eps_lock);
+
+        if (likely(io_data && io_data->ep && io_data->req))
+                value = usb_ep_dequeue(io_data->ep, io_data->req);
+        else
                 value = -EINVAL;
-        }
+
+        spin_unlock_irq(&epfile->ffs->eps_lock);
 
         return value;
 }
diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
index 27f00160332e..3c4abb5a1c3f 100644
--- a/drivers/usb/host/xhci-histb.c
+++ b/drivers/usb/host/xhci-histb.c
@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
         struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
         struct usb_hcd *hcd = histb->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_wakeup_disable(&dev->dev);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         xhci_histb_host_disable(histb);
         usb_put_hcd(hcd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 12eea73d9f20..94aca1b5ac8a 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
         }
         if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
-                !DEV_SUPERSPEED_ANY(raw_port_status)) {
+                !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
                 if ((raw_port_status & PORT_RESET) ||
                                 !(raw_port_status & PORT_PE))
                         return 0xffffffff;
@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         time_left = wait_for_completion_timeout(
                                         &bus_state->rexit_done[wIndex],
                                         msecs_to_jiffies(
-                                                XHCI_MAX_REXIT_TIMEOUT));
+                                                XHCI_MAX_REXIT_TIMEOUT_MS));
                         spin_lock_irqsave(&xhci->lock, flags);
 
                         if (time_left) {
@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         } else {
                                 int port_status = readl(port->addr);
                                 xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
-                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                XHCI_MAX_REXIT_TIMEOUT_MS,
                                                 port_status);
                                 status |= USB_PORT_STAT_SUSPEND;
                                 clear_bit(wIndex, &bus_state->rexit_ports);
@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         unsigned long flags;
         struct xhci_hub *rhub;
         struct xhci_port **ports;
+        u32 portsc_buf[USB_MAXCHILDREN];
+        bool wake_enabled;
 
         rhub = xhci_get_rhub(hcd);
         ports = rhub->ports;
         max_ports = rhub->num_ports;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
+        wake_enabled = hcd->self.root_hub->do_remote_wakeup;
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        if (hcd->self.root_hub->do_remote_wakeup) {
+        if (wake_enabled) {
                 if (bus_state->resuming_ports ||        /* USB2 */
                     bus_state->port_remote_wakeup) {    /* USB3 */
                         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                         return -EBUSY;
                 }
         }
-
-        port_index = max_ports;
+        /*
+         * Prepare ports for suspend, but don't write anything before all ports
+         * are checked and we know bus suspend can proceed
+         */
         bus_state->bus_suspended = 0;
+        port_index = max_ports;
         while (port_index--) {
-                /* suspend the port if the port is not suspended */
                 u32 t1, t2;
-                int slot_id;
 
                 t1 = readl(ports[port_index]->addr);
                 t2 = xhci_port_state_to_neutral(t1);
+                portsc_buf[port_index] = 0;
 
-                if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
-                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-                                        port_index + 1);
-                        if (slot_id) {
+                /* Bail out if a USB3 port has a new device in link training */
+                if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+                        bus_state->bus_suspended = 0;
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+                        return -EBUSY;
+                }
+
+                /* suspend ports in U0, or bail out for new connect changes */
+                if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+                        if ((t1 & PORT_CSC) && wake_enabled) {
+                                bus_state->bus_suspended = 0;
                                 spin_unlock_irqrestore(&xhci->lock, flags);
-                                xhci_stop_device(xhci, slot_id, 1);
-                                spin_lock_irqsave(&xhci->lock, flags);
+                                xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
+                                return -EBUSY;
                         }
+                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
                         t2 &= ~PORT_PLS_MASK;
                         t2 |= PORT_LINK_STROBE | XDEV_U3;
                         set_bit(port_index, &bus_state->bus_suspended);
@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (wake_enabled) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
 
                 t1 = xhci_port_state_to_neutral(t1);
                 if (t1 != t2)
-                        writel(t2, ports[port_index]->addr);
+                        portsc_buf[port_index] = t2;
+        }
+
+        /* write port settings, stopping and suspending ports if needed */
+        port_index = max_ports;
+        while (port_index--) {
+                if (!portsc_buf[port_index])
+                        continue;
+                if (test_bit(port_index, &bus_state->bus_suspended)) {
+                        int slot_id;
+
+                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                                                            port_index + 1);
+                        if (slot_id) {
+                                spin_unlock_irqrestore(&xhci->lock, flags);
+                                xhci_stop_device(xhci, slot_id, 1);
+                                spin_lock_irqsave(&xhci->lock, flags);
+                        }
+                }
+                writel(portsc_buf[port_index], ports[port_index]->addr);
         }
         hcd->state = HC_STATE_SUSPENDED;
         bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 71d0d33c3286..60987c787e44 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
         struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
         struct usb_hcd  *hcd = mtk->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd  *shared_hcd = xhci->shared_hcd;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_init_wakeup(&dev->dev, false);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
         usb_put_hcd(hcd);
         xhci_mtk_sch_exit(mtk);
         xhci_mtk_clks_disable(mtk);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 01c57055c0c5..a9515265db4d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -248,6 +248,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
+             pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
+             pdev->device == 0x9026)
+                xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
@@ -380,6 +385,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
         if (xhci->shared_hcd) {
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
+                xhci->shared_hcd = NULL;
         }
 
         /* Workaround for spurious wakeups at shutdown with HSW */
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 32b5574ad5c5..ef09cb06212f 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -362,14 +362,16 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
         struct clk *reg_clk = xhci->reg_clk;
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_phy_shutdown(hcd->usb_phy);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         clk_disable_unprepare(clk);
         clk_disable_unprepare(reg_clk);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a8d92c90fb58..65750582133f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1521,6 +1521,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
                 usb_wakeup_notification(udev->parent, udev->portnum);
 }
 
+/*
+ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
+ * Controller.
+ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
+ * If a connection to a USB 1 device is followed by another connection
+ * to a USB 2 device.
+ *
+ * Reset the PHY after the USB device is disconnected if device speed
+ * is less than HCD_USB3.
+ * Retry the reset sequence max of 4 times checking the PLL lock status.
+ *
+ */
+static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
+{
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        u32 pll_lock_check;
+        u32 retry_count = 4;
+
+        do {
+                /* Assert PHY reset */
+                writel(0x6F, hcd->regs + 0x1048);
+                udelay(10);
+                /* De-assert the PHY reset */
+                writel(0x7F, hcd->regs + 0x1048);
+                udelay(200);
+                pll_lock_check = readl(hcd->regs + 0x1070);
+        } while (!(pll_lock_check & 0x1) && --retry_count);
+}
+
 static void handle_port_status(struct xhci_hcd *xhci,
                 union xhci_trb *event)
 {
@@ -1556,6 +1585,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
+        /* We might get interrupts after shared_hcd is removed */
+        if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
+                xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
+                bogus_port_status = true;
+                goto cleanup;
+        }
+
         hcd = port->rhub->hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         hcd_portnum = port->hcd_portnum;
@@ -1639,7 +1675,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * RExit to a disconnect state).  If so, let the the driver know it's
          * out of the RExit state.
          */
-        if (!DEV_SUPERSPEED_ANY(portsc) &&
+        if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
                         test_and_clear_bit(hcd_portnum,
                                 &bus_state->rexit_ports)) {
                 complete(&bus_state->rexit_done[hcd_portnum]);
@@ -1647,8 +1683,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
-        if (hcd->speed < HCD_USB3)
+        if (hcd->speed < HCD_USB3) {
                 xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+                if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
+                    (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
+                        xhci_cavium_reset_phy_quirk(xhci);
+        }
 
 cleanup:
         /* Update event ring dequeue pointer before dropping the lock */
@@ -2266,6 +2306,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         goto cleanup;
                 case COMP_RING_UNDERRUN:
                 case COMP_RING_OVERRUN:
+                case COMP_STOPPED_LENGTH_INVALID:
                         goto cleanup;
                 default:
                         xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 6b5db344de30..938ff06c0349 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1303,6 +1303,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
 
         usb_remove_hcd(xhci->shared_hcd);
         usb_put_hcd(xhci->shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_remove_hcd(tegra->hcd);
         usb_put_hcd(tegra->hcd);
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0420eefa647a..c928dbbff881 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         /* Only halt host and free memory after both hcds are removed */
         if (!usb_hcd_is_primary_hcd(hcd)) {
-                /* usb core will free this hcd shortly, unset pointer */
-                xhci->shared_hcd = NULL;
                 mutex_unlock(&xhci->mutex);
                 return;
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index bf0b3692dc9a..260b259b72bc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1680,7 +1680,7 @@ struct xhci_bus_state {
  * It can take up to 20 ms to transition from RExit to U0 on the
  * Intel Lynx Point LP xHCI host.
  */
-#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
+#define XHCI_MAX_REXIT_TIMEOUT_MS       20
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
@@ -1849,6 +1849,7 @@ struct xhci_hcd {
 #define XHCI_INTEL_USB_ROLE_SW  BIT_ULL(31)
 #define XHCI_ZERO_64B_REGS      BIT_ULL(32)
 #define XHCI_DEFAULT_PM_RUNTIME_ALLOW   BIT_ULL(33)
+#define XHCI_RESET_PLL_ON_DISCONNECT    BIT_ULL(34)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index bd539f3058bc..85b48c6ddc7e 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
         { APPLEDISPLAY_DEVICE(0x9219) },
         { APPLEDISPLAY_DEVICE(0x921c) },
         { APPLEDISPLAY_DEVICE(0x921d) },
+        { APPLEDISPLAY_DEVICE(0x9222) },
         { APPLEDISPLAY_DEVICE(0x9236) },
 
         /* Terminating entry */
diff --git a/fs/exec.c b/fs/exec.c
index fc281b738a98..acc3a5536384 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -62,6 +62,7 @@
 #include <linux/oom.h>
 #include <linux/compat.h>
 #include <linux/vmalloc.h>
+#include <linux/freezer.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1083,7 +1084,7 @@ static int de_thread(struct task_struct *tsk)
         while (sig->notify_count) {
                 __set_current_state(TASK_KILLABLE);
                 spin_unlock_irq(lock);
-                schedule();
+                freezable_schedule();
                 if (unlikely(__fatal_signal_pending(tsk)))
                         goto killed;
                 spin_lock_irq(lock);
@@ -1111,7 +1112,7 @@ static int de_thread(struct task_struct *tsk)
                         __set_current_state(TASK_KILLABLE);
                         write_unlock_irq(&tasklist_lock);
                         cgroup_threadgroup_change_end(tsk);
-                        schedule();
+                        freezable_schedule();
                         if (unlikely(__fatal_signal_pending(tsk)))
                                 goto killed;
                 }
diff --git a/fs/iomap.c b/fs/iomap.c
index 64ce240217a1..3ffb776fbebe 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -142,13 +142,14 @@ static void
 iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
                 loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
 {
+        loff_t orig_pos = *pos;
+        loff_t isize = i_size_read(inode);
         unsigned block_bits = inode->i_blkbits;
         unsigned block_size = (1 << block_bits);
         unsigned poff = offset_in_page(*pos);
         unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
         unsigned first = poff >> block_bits;
         unsigned last = (poff + plen - 1) >> block_bits;
-        unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
 
         /*
          * If the block size is smaller than the page size we need to check the
@@ -183,8 +184,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
          * handle both halves separately so that we properly zero data in the
          * page cache for blocks that are entirely outside of i_size.
          */
-        if (first <= end && last > end)
-                plen -= (last - end) * block_size;
+        if (orig_pos <= isize && orig_pos + length > isize) {
+                unsigned end = offset_in_page(isize - 1) >> block_bits;
+
+                if (first <= end && last > end)
+                        plen -= (last - end) * block_size;
+        }
 
         *offp = poff;
         *lenp = plen;
@@ -1580,7 +1585,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
         struct bio *bio;
         bool need_zeroout = false;
         bool use_fua = false;
-        int nr_pages, ret;
+        int nr_pages, ret = 0;
         size_t copied = 0;
 
         if ((pos | length | align) & ((1 << blkbits) - 1))
@@ -1596,12 +1601,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
         if (iomap->flags & IOMAP_F_NEW) {
                 need_zeroout = true;
-        } else {
+        } else if (iomap->type == IOMAP_MAPPED) {
                 /*
-                 * Use a FUA write if we need datasync semantics, this
-                 * is a pure data IO that doesn't require any metadata
-                 * updates and the underlying device supports FUA. This
-                 * allows us to avoid cache flushes on IO completion.
+                 * Use a FUA write if we need datasync semantics, this is a pure
+                 * data IO that doesn't require any metadata updates (including
+                 * after IO completion such as unwritten extent conversion) and
+                 * the underlying device supports FUA. This allows us to avoid
+                 * cache flushes on IO completion.
                  */
                 if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
                     (dio->flags & IOMAP_DIO_WRITE_FUA) &&
@@ -1644,8 +1650,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
                 ret = bio_iov_iter_get_pages(bio, &iter);
                 if (unlikely(ret)) {
+                        /*
+                         * We have to stop part way through an IO. We must fall
+                         * through to the sub-block tail zeroing here, otherwise
+                         * this short IO may expose stale data in the tail of
+                         * the block we haven't written data to.
+                         */
                         bio_put(bio);
-                        return copied ? copied : ret;
+                        goto zero_tail;
                 }
 
                 n = bio->bi_iter.bi_size;
@@ -1676,13 +1688,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
                 dio->submit.cookie = submit_bio(bio);
         } while (nr_pages);
 
-        if (need_zeroout) {
+        /*
+         * We need to zeroout the tail of a sub-block write if the extent type
+         * requires zeroing or the write extends beyond EOF. If we don't zero
+         * the block tail in the latter case, we can expose stale data via mmap
+         * reads of the EOF block.
+         */
+zero_tail:
+        if (need_zeroout ||
+            ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
                 /* zero out from the end of the write to the end of the block */
                 pad = pos & (fs_block_size - 1);
                 if (pad)
                         iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
         }
-        return copied;
+        return copied ? copied : ret;
 }
 
 static loff_t
@@ -1857,6 +1877,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
+
+                        /*
+                         * Splicing to pipes can fail on a full pipe. We have to
+                         * swallow this to make it look like a short IO
+                         * otherwise the higher splice layers will completely
+                         * mishandle the error and stop moving data.
+                         */
+                        if (ret == -EFAULT)
+                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/read_write.c b/fs/read_write.c
index bfcb4ced5664..4dae0399c75a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -2094,17 +2094,18 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
         off = same->src_offset;
         len = same->src_length;
 
-        ret = -EISDIR;
         if (S_ISDIR(src->i_mode))
-                goto out;
+                return -EISDIR;
 
-        ret = -EINVAL;
         if (!S_ISREG(src->i_mode))
-                goto out;
+                return -EINVAL;
+
+        if (!file->f_op->remap_file_range)
+                return -EOPNOTSUPP;
 
         ret = remap_verify_area(file, off, len, false);
         if (ret < 0)
-                goto out;
+                return ret;
         ret = 0;
 
         if (off + len > i_size_read(src))
@@ -2147,10 +2148,8 @@ next_fdput:
                 fdput(dst_fd);
 next_loop:
                 if (fatal_signal_pending(current))
-                        goto out;
+                        break;
         }
-
-out:
         return ret;
 }
 EXPORT_SYMBOL(vfs_dedupe_file_range);
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 74d7228e755b..19e921d1586f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1694,10 +1694,13 @@ xfs_bmap_add_extent_delay_real(
         case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
                 /*
                  * Filling in all of a previously delayed allocation extent.
-                 * The right neighbor is contiguous, the left is not.
+                 * The right neighbor is contiguous, the left is not. Take care
+                 * with delay -> unwritten extent allocation here because the
+                 * delalloc record we are overwriting is always written.
                  */
                 PREV.br_startblock = new->br_startblock;
                 PREV.br_blockcount += RIGHT.br_blockcount;
+                PREV.br_state = new->br_state;
 
                 xfs_iext_next(ifp, &bma->icur);
                 xfs_iext_remove(bma->ip, &bma->icur, state);
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 86c50208a143..7fbf8af0b159 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -538,15 +538,18 @@ xfs_inobt_rec_check_count(
 
 static xfs_extlen_t
 xfs_inobt_max_size(
-        struct xfs_mount        *mp)
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno)
 {
+        xfs_agblock_t           agblocks = xfs_ag_block_count(mp, agno);
+
         /* Bail out if we're uninitialized, which can happen in mkfs. */
         if (mp->m_inobt_mxr[0] == 0)
                 return 0;
 
         return xfs_btree_calc_size(mp->m_inobt_mnr,
-                (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
-                                XFS_INODES_PER_CHUNK);
+                                (uint64_t)agblocks * mp->m_sb.sb_inopblock /
+                                        XFS_INODES_PER_CHUNK);
 }
 
 static int
@@ -594,7 +597,7 @@ xfs_finobt_calc_reserves(
         if (error)
                 return error;
 
-        *ask += xfs_inobt_max_size(mp);
+        *ask += xfs_inobt_max_size(mp, agno);
         *used += tree_len;
         return 0;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5d263dfdb3bc..404e581f1ea1 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1042,7 +1042,7 @@ out_trans_cancel:
         goto out_unlock;
 }
 
-static int
+int
 xfs_flush_unmap_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
@@ -1195,13 +1195,7 @@ xfs_prepare_shift(
          * Writeback and invalidate cache for the remainder of the file as we're
          * about to shift down every extent from offset to EOF.
          */
-        error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
-        if (error)
-                return error;
-        error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
-                                        offset >> PAGE_SHIFT, -1);
-        if (error)
-                return error;
+        error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
 
         /*
          * Clean out anything hanging around in the cow fork now that
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 87363d136bb6..7a78229cf1a7 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -80,4 +80,7 @@ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
                           int whichfork, xfs_extnum_t *nextents,
                           xfs_filblks_t *count);
 
+int     xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
+                              xfs_off_t len);
+
 #endif  /* __XFS_BMAP_UTIL_H__ */
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 12d8455bfbb2..010db5f8fb00 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1233,9 +1233,23 @@ xfs_buf_iodone(
 }
 
 /*
- * Requeue a failed buffer for writeback
+ * Requeue a failed buffer for writeback.
  *
- * Return true if the buffer has been re-queued properly, false otherwise
+ * We clear the log item failed state here as well, but we have to be careful
+ * about reference counts because the only active reference counts on the buffer
+ * may be the failed log items. Hence if we clear the log item failed state
+ * before queuing the buffer for IO we can release all active references to
+ * the buffer and free it, leading to use after free problems in
+ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
+ * order we process them in - the buffer is locked, and we own the buffer list
+ * so nothing on them is going to change while we are performing this action.
+ *
+ * Hence we can safely queue the buffer for IO before we clear the failed log
+ * item state, therefore  always having an active reference to the buffer and
+ * avoiding the transient zero-reference state that leads to use-after-free.
+ *
+ * Return true if the buffer was added to the buffer list, false if it was
+ * already on the buffer list.
  */
 bool
 xfs_buf_resubmit_failed_buffers(
@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers(
         struct list_head        *buffer_list)
 {
         struct xfs_log_item     *lip;
+        bool                    ret;
+
+        ret = xfs_buf_delwri_queue(bp, buffer_list);
 
         /*
-         * Clear XFS_LI_FAILED flag from all items before resubmit
-         *
-         * XFS_LI_FAILED set/clear is protected by ail_lock, caller  this
+         * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
          * function already have it acquired
          */
         list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
                 xfs_clear_li_failed(lip);
 
-        /* Add this buffer back to the delayed write list */
-        return xfs_buf_delwri_queue(bp, buffer_list);
+        return ret;
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 53c9ab8fb777..e47425071e65 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -920,7 +920,7 @@ out_unlock:
 }
 
 
-loff_t
+STATIC loff_t
 xfs_file_remap_range(
         struct file             *file_in,
         loff_t                  pos_in,
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ecdb086bc23e..322a852ce284 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -296,6 +296,7 @@ xfs_reflink_reserve_cow(
         if (error)
                 return error;
 
+        xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
         trace_xfs_reflink_cow_alloc(ip, &got);
         return 0;
 }
@@ -1351,10 +1352,19 @@ xfs_reflink_remap_prep(
         if (ret)
                 goto out_unlock;
 
-        /* Zap any page cache for the destination file's range. */
-        truncate_inode_pages_range(&inode_out->i_data,
-                        round_down(pos_out, PAGE_SIZE),
-                        round_up(pos_out + *len, PAGE_SIZE) - 1);
+        /*
+         * If pos_out > EOF, we may have dirtied blocks between EOF and
+         * pos_out. In that case, we need to extend the flush and unmap to cover
+         * from EOF to the end of the copy length.
+         */
+        if (pos_out > XFS_ISIZE(dest)) {
+                loff_t  flen = *len + (pos_out - XFS_ISIZE(dest));
+                ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
+        } else {
+                ret = xfs_flush_unmap_range(dest, pos_out, *len);
+        }
+        if (ret)
+                goto out_unlock;
 
         return 1;
 out_unlock:
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 3043e5ed6495..8a6532aae779 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -280,7 +280,10 @@ DECLARE_EVENT_CLASS(xfs_buf_class,
         ),
         TP_fast_assign(
                 __entry->dev = bp->b_target->bt_dev;
-                __entry->bno = bp->b_bn;
+                if (bp->b_bn == XFS_BUF_DADDR_NULL)
+                        __entry->bno = bp->b_maps[0].bm_bn;
+                else
+                        __entry->bno = bp->b_bn;
                 __entry->nblks = bp->b_length;
                 __entry->hold = atomic_read(&bp->b_hold);
                 __entry->pincount = atomic_read(&bp->b_pin_count);
diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
index c79e859408e6..fd458389f7d1 100644
--- a/include/linux/net_dim.h
+++ b/include/linux/net_dim.h
@@ -406,6 +406,8 @@ static inline void net_dim(struct net_dim *dim,
                 }
                 /* fall through */
         case NET_DIM_START_MEASURE:
+                net_dim_sample(end_sample.event_ctr, end_sample.pkt_ctr, end_sample.byte_ctr,
+                               &dim->start_sample);
                 dim->state = NET_DIM_MEASURE_IN_PROGRESS;
                 break;
         case NET_DIM_APPLY_NEW_PROFILE:
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a2e8297a5b00..f17a7452ac7b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1334,6 +1334,22 @@ static inline void skb_zcopy_set(struct sk_buff *skb, struct ubuf_info *uarg)
         }
 }
 
+static inline void skb_zcopy_set_nouarg(struct sk_buff *skb, void *val)
+{
+        skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t) val | 0x1UL);
+        skb_shinfo(skb)->tx_flags |= SKBTX_ZEROCOPY_FRAG;
+}
+
+static inline bool skb_zcopy_is_nouarg(struct sk_buff *skb)
+{
+        return (uintptr_t) skb_shinfo(skb)->destructor_arg & 0x1UL;
+}
+
+static inline void *skb_zcopy_get_nouarg(struct sk_buff *skb)
+{
+        return (void *)((uintptr_t) skb_shinfo(skb)->destructor_arg & ~0x1UL);
+}
+
 /* Release a reference on a zerocopy structure */
 static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
 {
@@ -1343,7 +1359,7 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
                 if (uarg->callback == sock_zerocopy_callback) {
                         uarg->zerocopy = uarg->zerocopy && zerocopy;
                         sock_zerocopy_put(uarg);
-                } else {
+                } else if (!skb_zcopy_is_nouarg(skb)) {
                         uarg->callback(uarg, zerocopy);
                 }
 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8ed77bb4ed86..a9b0280687d5 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -196,6 +196,7 @@ struct tcp_sock {
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
         u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
+        u32     compressed_ack_rcv_nxt;
 
         u32     tsoffset;       /* timestamp offset */
 
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index b7a99ce56bc9..a1be64c9940f 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -66,4 +66,7 @@
 /* Device needs a pause after every control message. */
 #define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 
+/* Hub needs extra delay after resetting its port. */
+#define USB_QUIRK_HUB_SLOW_RESET                BIT(14)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index 58c1ecf3d648..5467264771ec 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -624,7 +624,7 @@ v4l2_m2m_dst_buf_remove_by_idx(struct v4l2_m2m_ctx *m2m_ctx, unsigned int idx)
 
 /* v4l2 request helper */
 
-void vb2_m2m_request_queue(struct media_request *req);
+void v4l2_m2m_request_queue(struct media_request *req);
 
 /* v4l2 ioctl helpers */
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index cdf2e80abc44..38da91d1b4c6 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
                                  SCTP_DEFAULT_MINSEGMENT));
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = sctp_dst_mtu(t->dst);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 51b095898f4b..998983a6e6b7 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -50,6 +50,8 @@
 #ifndef __LINUX_V4L2_CONTROLS_H
 #define __LINUX_V4L2_CONTROLS_H
 
+#include <linux/types.h>
+
 /* Control classes */
 #define V4L2_CTRL_CLASS_USER            0x00980000      /* Old-style 'user' controls */
 #define V4L2_CTRL_CLASS_MPEG            0x00990000      /* MPEG-compression controls */
@@ -1110,6 +1112,7 @@ struct v4l2_mpeg2_sequence {
         __u8    profile_and_level_indication;
         __u8    progressive_sequence;
         __u8    chroma_format;
+        __u8    pad;
 };
 
 struct v4l2_mpeg2_picture {
@@ -1128,6 +1131,7 @@ struct v4l2_mpeg2_picture {
         __u8    alternate_scan;
         __u8    repeat_first_field;
         __u8    progressive_frame;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_slice_params {
@@ -1142,6 +1146,7 @@ struct v4l2_ctrl_mpeg2_slice_params {
 
         __u8    backward_ref_index;
         __u8    forward_ref_index;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_quantization {
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index b984806d7d7b..7cab9a9869ac 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev,
         if (req->fw->size > PAGE_SIZE) {
                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
                 rc = -EINVAL;
+                goto out;
         }
         memcpy(buf, req->fw->data, req->fw->size);
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 57fcc6b4bf6e..2f126eff275d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
         struct bio_vec bvec;
         int ret;
 
-        /* sendpage cannot properly handle pages with page_count == 0,
-         * we need to fallback to sendmsg if that's the case */
-        if (page_count(page) >= 1)
+        /*
+         * sendpage cannot properly handle pages with page_count == 0,
+         * we need to fall back to sendmsg if that's the case.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
+         */
+        if (page_count(page) >= 1 && !PageSlab(page))
                 return __ceph_tcp_sendpage(sock, page, offset, size, more);
 
         bvec.bv_page = page;
diff --git a/net/core/dev.c b/net/core/dev.c
index d83582623cd7..f69b2fcdee40 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5981,11 +5981,14 @@ bool napi_complete_done(struct napi_struct *n, int work_done)
                 if (work_done)
                         timeout = n->dev->gro_flush_timeout;
 
+                /* When the NAPI instance uses a timeout and keeps postponing
+                 * it, we need to bound somehow the time packets are kept in
+                 * the GRO layer
+                 */
+                napi_gro_flush(n, !!timeout);
                 if (timeout)
                         hrtimer_start(&n->timer, ns_to_ktime(timeout),
                                       HRTIMER_MODE_REL_PINNED);
-                else
-                        napi_gro_flush(n, false);
         }
         if (unlikely(!list_empty(&n->poll_list))) {
                 /* If n->poll_list is not empty, we need to mask irqs */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index edaaebfbcd46..568dbf3b711a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4269,7 +4269,7 @@ static void tcp_sack_new_ofo_skb(struct sock *sk, u32 seq, u32 end_seq)
          * If the sack array is full, forget about the last one.
          */
         if (this_sack >= TCP_NUM_SACKS) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
                 this_sack--;
                 tp->rx_opt.num_sacks--;
@@ -4364,6 +4364,7 @@ static bool tcp_try_coalesce(struct sock *sk,
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
                 to->tstamp = from->tstamp;
+                skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp;
         }
 
         return true;
@@ -5189,7 +5190,17 @@ send_now:
         if (!tcp_is_sack(tp) ||
             tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
                 goto send_now;
-        tp->compressed_ack++;
+
+        if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
+                tp->compressed_ack_rcv_nxt = tp->rcv_nxt;
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+                        NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
+                                      tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = 0;
+        }
+
+        if (++tp->compressed_ack <= TCP_FASTRETRANS_THRESH)
+                goto send_now;
 
         if (hrtimer_is_queued(&tp->compressed_ack_timer))
                 return;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index d40d4cc53319..c5dc4c4fdadd 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -180,10 +180,10 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (unlikely(tp->compressed_ack)) {
+        if (unlikely(tp->compressed_ack > TCP_FASTRETRANS_THRESH)) {
                 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
-                              tp->compressed_ack);
-                tp->compressed_ack = 0;
+                              tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = TCP_FASTRETRANS_THRESH;
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 676020663ce8..5f8b6d3cd855 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -740,7 +740,7 @@ static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
         } else {
                 if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 63a808d5af15..045597b9a7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                                    bool send_na);
-static void addrconf_dad_run(struct inet6_dev *idev);
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 static void addrconf_rs_timer(struct timer_list *t);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -3439,6 +3439,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
         struct net *net = dev_net(dev);
@@ -3513,7 +3514,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 break;
                         }
 
-                        if (idev) {
+                        if (!IS_ERR_OR_NULL(idev)) {
                                 if (idev->if_flags & IF_READY) {
                                         /* device is already configured -
                                          * but resend MLD reports, we might
@@ -3521,6 +3522,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                          * multicast snooping switches
                                          */
                                         ipv6_mc_up(idev);
+                                        change_info = ptr;
+                                        if (change_info->flags_changed & IFF_NOARP)
+                                                addrconf_dad_run(idev, true);
                                         rt6_sync_up(dev, RTNH_F_LINKDOWN);
                                         break;
                                 }
@@ -3555,7 +3559,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 
                 if (!IS_ERR_OR_NULL(idev)) {
                         if (run_pending)
-                                addrconf_dad_run(idev);
+                                addrconf_dad_run(idev, false);
 
                         /* Device has an address by now */
                         rt6_sync_up(dev, RTNH_F_DEAD);
@@ -4173,16 +4177,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                 addrconf_verify_rtnl();
 }
 
-static void addrconf_dad_run(struct inet6_dev *idev)
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
 {
         struct inet6_ifaddr *ifp;
 
         read_lock_bh(&idev->lock);
         list_for_each_entry(ifp, &idev->addr_list, if_list) {
                 spin_lock(&ifp->lock);
-                if (ifp->flags & IFA_F_TENTATIVE &&
-                    ifp->state == INET6_IFADDR_STATE_DAD)
+                if ((ifp->flags & IFA_F_TENTATIVE &&
+                     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
+                        if (restart)
+                                ifp->state = INET6_IFADDR_STATE_PREDAD;
                         addrconf_dad_kick(ifp);
+                }
                 spin_unlock(&ifp->lock);
         }
         read_unlock_bh(&idev->lock);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ec3095f13aae..a74650e98f42 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2394,7 +2394,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
                 void *ph;
                 __u32 ts;
 
-                ph = skb_shinfo(skb)->destructor_arg;
+                ph = skb_zcopy_get_nouarg(skb);
                 packet_dec_pending(&po->tx_ring);
 
                 ts = __packet_set_timestamp(po, ph, skb);
@@ -2461,7 +2461,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->mark = po->sk.sk_mark;
         skb->tstamp = sockc->transmit_time;
         sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
-        skb_shinfo(skb)->destructor_arg = ph.raw;
+        skb_zcopy_set_nouarg(skb, ph.raw);
 
         skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 052855d47354..37c9b8f0e10f 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -27,10 +27,7 @@ struct tcf_police_params {
         u32                     tcfp_ewma_rate;
         s64                     tcfp_burst;
         u32                     tcfp_mtu;
-        s64                     tcfp_toks;
-        s64                     tcfp_ptoks;
         s64                     tcfp_mtu_ptoks;
-        s64                     tcfp_t_c;
         struct psched_ratecfg   rate;
         bool                    rate_present;
         struct psched_ratecfg   peak;
@@ -41,6 +38,11 @@ struct tcf_police_params {
 struct tcf_police {
         struct tc_action        common;
         struct tcf_police_params __rcu *params;
+
+        spinlock_t              tcfp_lock ____cacheline_aligned_in_smp;
+        s64                     tcfp_toks;
+        s64                     tcfp_ptoks;
+        s64                     tcfp_t_c;
 };
 
 #define to_police(pc) ((struct tcf_police *)pc)
@@ -122,6 +124,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                         return ret;
                 }
                 ret = ACT_P_CREATED;
+                spin_lock_init(&(to_police(*a)->tcfp_lock));
         } else if (!ovr) {
                 tcf_idr_release(*a, bind);
                 return -EEXIST;
@@ -186,12 +189,9 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
-        new->tcfp_toks = new->tcfp_burst;
-        if (new->peak_present) {
+        if (new->peak_present)
                 new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
                                                          new->tcfp_mtu);
-                new->tcfp_ptoks = new->tcfp_mtu_ptoks;
-        }
 
         if (tb[TCA_POLICE_AVRATE])
                 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
@@ -207,7 +207,12 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         spin_lock_bh(&police->tcf_lock);
-        new->tcfp_t_c = ktime_get_ns();
+        spin_lock_bh(&police->tcfp_lock);
+        police->tcfp_t_c = ktime_get_ns();
+        police->tcfp_toks = new->tcfp_burst;
+        if (new->peak_present)
+                police->tcfp_ptoks = new->tcfp_mtu_ptoks;
+        spin_unlock_bh(&police->tcfp_lock);
         police->tcf_action = parm->action;
         rcu_swap_protected(police->params,
                            new,
@@ -257,25 +262,28 @@ static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
                 }
 
                 now = ktime_get_ns();
-                toks = min_t(s64, now - p->tcfp_t_c, p->tcfp_burst);
+                spin_lock_bh(&police->tcfp_lock);
+                toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
                 if (p->peak_present) {
-                        ptoks = toks + p->tcfp_ptoks;
+                        ptoks = toks + police->tcfp_ptoks;
                         if (ptoks > p->tcfp_mtu_ptoks)
                                 ptoks = p->tcfp_mtu_ptoks;
                         ptoks -= (s64)psched_l2t_ns(&p->peak,
                                                     qdisc_pkt_len(skb));
                 }
-                toks += p->tcfp_toks;
+                toks += police->tcfp_toks;
                 if (toks > p->tcfp_burst)
                         toks = p->tcfp_burst;
                 toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
                 if ((toks|ptoks) >= 0) {
-                        p->tcfp_t_c = now;
-                        p->tcfp_toks = toks;
-                        p->tcfp_ptoks = ptoks;
+                        police->tcfp_t_c = now;
+                        police->tcfp_toks = toks;
+                        police->tcfp_ptoks = ptoks;
+                        spin_unlock_bh(&police->tcfp_lock);
                         ret = p->tcfp_result;
                         goto inc_drops;
                 }
+                spin_unlock_bh(&police->tcfp_lock);
         }
 
 inc_overlimits:
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 67939ad99c01..b0e74a3e77ec 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
                 sctp_transport_route(tp, NULL, sp);
                 if (asoc->param_flags & SPP_PMTUD_ENABLE)
                         sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
         if (asoc->pmtu_pending) {
@@ -396,25 +399,6 @@ finish:
         return retval;
 }
 
-static void sctp_packet_release_owner(struct sk_buff *skb)
-{
-        sk_free(skb->sk);
-}
-
-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
-{
-        skb_orphan(skb);
-        skb->sk = sk;
-        skb->destructor = sctp_packet_release_owner;
-
-        /*
-         * The data chunks have already been accounted for in sctp_sendmsg(),
-         * therefore only reserve a single byte to keep socket around until
-         * the packet has been transmitted.
-         */
-        refcount_inc(&sk->sk_wmem_alloc);
-}
-
 static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
 {
         if (SCTP_OUTPUT_CB(head)->last == head)
@@ -601,7 +585,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         if (!head)
                 goto out;
         skb_reserve(head, packet->overhead + MAX_HEADER);
-        sctp_packet_set_owner_w(head, sk);
+        skb_set_owner_w(head, sk);
 
         /* set sctp header */
         sh = skb_push(head, sizeof(struct sctphdr));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e16c090e89f0..1fb2cad94597 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3951,32 +3951,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk,
                                         unsigned int optlen)
 {
         struct sctp_assoc_value params;
-        struct sctp_association *asoc;
-        int retval = -EINVAL;
 
         if (optlen != sizeof(params))
-                goto out;
-
-        if (copy_from_user(&params, optval, optlen)) {
-                retval = -EFAULT;
-                goto out;
-        }
-
-        asoc = sctp_id2assoc(sk, params.assoc_id);
-        if (asoc) {
-                asoc->prsctp_enable = !!params.assoc_value;
-        } else if (!params.assoc_id) {
-                struct sctp_sock *sp = sctp_sk(sk);
+                return -EINVAL;
 
-                sp->ep->prsctp_enable = !!params.assoc_value;
-        } else {
-                goto out;
-        }
+        if (copy_from_user(&params, optval, optlen))
+                return -EFAULT;
 
-        retval = 0;
+        sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
 
-out:
-        return retval;
+        return 0;
 }
 
 static int sctp_setsockopt_default_prinfo(struct sock *sk,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index ffb940d3b57c..3892e7630f3a 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc,
                 goto out;
         }
 
-        stream->incnt = incnt;
         stream->outcnt = outcnt;
 
         asoc->strreset_outstanding = !!out + !!in;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 4b865250e238..63f08b4e51d6 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static int smc_release(struct socket *sock)
         smc = smc_sk(sk);
 
         /* cleanup for a dangling non-blocking connect */
+        if (smc->connect_info && sk->sk_state == SMC_INIT)
+                tcp_abort(smc->clcsock->sk, ECONNABORTED);
         flush_work(&smc->connect_work);
         kfree(smc->connect_info);
         smc->connect_info = NULL;
@@ -551,7 +553,8 @@ static int smc_connect_rdma(struct smc_sock *smc,
 
         mutex_lock(&smc_create_lgr_pending);
         local_contact = smc_conn_create(smc, false, aclc->hdr.flag, ibdev,
-                                        ibport, &aclc->lcl, NULL, 0);
+                                        ibport, ntoh24(aclc->qpn), &aclc->lcl,
+                                        NULL, 0);
         if (local_contact < 0) {
                 if (local_contact == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
@@ -621,7 +624,7 @@ static int smc_connect_ism(struct smc_sock *smc,
         int rc = 0;
 
         mutex_lock(&smc_create_lgr_pending);
-        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0,
+        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0, 0,
                                         NULL, ismdev, aclc->gid);
         if (local_contact < 0)
                 return smc_connect_abort(smc, SMC_CLC_DECL_MEM, 0);
@@ -1086,7 +1089,7 @@ static int smc_listen_rdma_init(struct smc_sock *new_smc,
                                 int *local_contact)
 {
         /* allocate connection / link group */
-        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport,
+        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport, 0,
                                          &pclc->lcl, NULL, 0);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
@@ -1110,7 +1113,7 @@ static int smc_listen_ism_init(struct smc_sock *new_smc,
         struct smc_clc_msg_smcd *pclc_smcd;
 
         pclc_smcd = smc_get_clc_msg_smcd(pclc);
-        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, NULL,
+        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, 0, NULL,
                                          ismdev, pclc_smcd->gid);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index ed5dcf03fe0b..db83332ac1c8 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -81,7 +81,7 @@ static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
                 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
                 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
         BUILD_BUG_ON_MSG(
-                sizeof(struct smc_cdc_msg) != SMC_WR_TX_SIZE,
+                offsetofend(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
                 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
         BUILD_BUG_ON_MSG(
                 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
@@ -177,23 +177,24 @@ void smc_cdc_tx_dismiss_slots(struct smc_connection *conn)
 int smcd_cdc_msg_send(struct smc_connection *conn)
 {
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
+        union smc_host_cursor curs;
         struct smcd_cdc_msg cdc;
         int rc, diff;
 
         memset(&cdc, 0, sizeof(cdc));
         cdc.common.type = SMC_CDC_MSG_TYPE;
-        cdc.prod_wrap = conn->local_tx_ctrl.prod.wrap;
-        cdc.prod_count = conn->local_tx_ctrl.prod.count;
-
-        cdc.cons_wrap = conn->local_tx_ctrl.cons.wrap;
-        cdc.cons_count = conn->local_tx_ctrl.cons.count;
-        cdc.prod_flags = conn->local_tx_ctrl.prod_flags;
-        cdc.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.prod.acurs);
+        cdc.prod.wrap = curs.wrap;
+        cdc.prod.count = curs.count;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.cons.acurs);
+        cdc.cons.wrap = curs.wrap;
+        cdc.cons.count = curs.count;
+        cdc.cons.prod_flags = conn->local_tx_ctrl.prod_flags;
+        cdc.cons.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
         rc = smcd_tx_ism_write(conn, &cdc, sizeof(cdc), 0, 1);
         if (rc)
                 return rc;
-        smc_curs_copy(&conn->rx_curs_confirmed, &conn->local_tx_ctrl.cons,
-                      conn);
+        smc_curs_copy(&conn->rx_curs_confirmed, &curs, conn);
         /* Calculate transmitted data and increment free send buffer space */
         diff = smc_curs_diff(conn->sndbuf_desc->len, &conn->tx_curs_fin,
                              &conn->tx_curs_sent);
@@ -331,13 +332,16 @@ static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
 static void smcd_cdc_rx_tsklet(unsigned long data)
 {
         struct smc_connection *conn = (struct smc_connection *)data;
+        struct smcd_cdc_msg *data_cdc;
         struct smcd_cdc_msg cdc;
         struct smc_sock *smc;
 
         if (!conn)
                 return;
 
-        memcpy(&cdc, conn->rmb_desc->cpu_addr, sizeof(cdc));
+        data_cdc = (struct smcd_cdc_msg *)conn->rmb_desc->cpu_addr;
+        smcd_curs_copy(&cdc.prod, &data_cdc->prod, conn);
+        smcd_curs_copy(&cdc.cons, &data_cdc->cons, conn);
         smc = container_of(conn, struct smc_sock, conn);
         smc_cdc_msg_recv(smc, (struct smc_cdc_msg *)&cdc);
 }
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 934df4473a7c..b5bfe38c7f9b 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -48,21 +48,31 @@ struct smc_cdc_msg {
         struct smc_cdc_producer_flags   prod_flags;
         struct smc_cdc_conn_state_flags conn_state_flags;
         u8                              reserved[18];
-} __packed;                                     /* format defined in RFC7609 */
+};
+
+/* SMC-D cursor format */
+union smcd_cdc_cursor {
+        struct {
+                u16     wrap;
+                u32     count;
+                struct smc_cdc_producer_flags   prod_flags;
+                struct smc_cdc_conn_state_flags conn_state_flags;
+        } __packed;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              acurs;          /* for atomic processing */
+#else
+        u64                     acurs;          /* for atomic processing */
+#endif
+} __aligned(8);
 
 /* CDC message for SMC-D */
 struct smcd_cdc_msg {
         struct smc_wr_rx_hdr common;    /* Type = 0xFE */
         u8 res1[7];
-        u16 prod_wrap;
-        u32 prod_count;
-        u8 res2[2];
-        u16 cons_wrap;
-        u32 cons_count;
-        struct smc_cdc_producer_flags   prod_flags;
-        struct smc_cdc_conn_state_flags conn_state_flags;
+        union smcd_cdc_cursor   prod;
+        union smcd_cdc_cursor   cons;
         u8 res3[8];
-} __packed;
+} __aligned(8);
 
 static inline bool smc_cdc_rxed_any_close(struct smc_connection *conn)
 {
@@ -135,6 +145,21 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
 #endif
 }
 
+static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
+                                  union smcd_cdc_cursor *src,
+                                  struct smc_connection *conn)
+{
+#ifndef KERNEL_HAS_ATOMIC64
+        unsigned long flags;
+
+        spin_lock_irqsave(&conn->acurs_lock, flags);
+        tgt->acurs = src->acurs;
+        spin_unlock_irqrestore(&conn->acurs_lock, flags);
+#else
+        atomic64_set(&tgt->acurs, atomic64_read(&src->acurs));
+#endif
+}
+
 /* calculate cursor difference between old and new, where old <= new */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
@@ -222,12 +247,17 @@ static inline void smcr_cdc_msg_to_host(struct smc_host_cdc_msg *local,
 static inline void smcd_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                                         struct smcd_cdc_msg *peer)
 {
-        local->prod.wrap = peer->prod_wrap;
-        local->prod.count = peer->prod_count;
-        local->cons.wrap = peer->cons_wrap;
-        local->cons.count = peer->cons_count;
-        local->prod_flags = peer->prod_flags;
-        local->conn_state_flags = peer->conn_state_flags;
+        union smc_host_cursor temp;
+
+        temp.wrap = peer->prod.wrap;
+        temp.count = peer->prod.count;
+        atomic64_set(&local->prod.acurs, atomic64_read(&temp.acurs));
+
+        temp.wrap = peer->cons.wrap;
+        temp.count = peer->cons.count;
+        atomic64_set(&local->cons.acurs, atomic64_read(&temp.acurs));
+        local->prod_flags = peer->cons.prod_flags;
+        local->conn_state_flags = peer->cons.conn_state_flags;
 }
 
 static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 1382ddae591e..35c1cdc93e1c 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -189,6 +189,8 @@ free:
 
                 if (!lgr->is_smcd && lnk->state != SMC_LNK_INACTIVE)
                         smc_llc_link_inactive(lnk);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -495,7 +497,7 @@ void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport)
 }
 
 /* Called when SMC-D device is terminated or peer is lost */
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid, unsigned short vlan)
 {
         struct smc_link_group *lgr, *l;
         LIST_HEAD(lgr_free_list);
@@ -505,7 +507,7 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &smc_lgr_list.list, list) {
                 if (lgr->is_smcd && lgr->smcd == dev &&
                     (!peer_gid || lgr->peer_gid == peer_gid) &&
-                    !list_empty(&lgr->list)) {
+                    (vlan == VLAN_VID_MASK || lgr->vlan_id == vlan)) {
                         __smc_lgr_terminate(lgr);
                         list_move(&lgr->list, &lgr_free_list);
                 }
@@ -516,6 +518,8 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &lgr_free_list, list) {
                 list_del_init(&lgr->list);
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (!peer_gid && vlan == VLAN_VID_MASK) /* dev terminated? */
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -569,7 +573,7 @@ out:
 
 static bool smcr_lgr_match(struct smc_link_group *lgr,
                            struct smc_clc_msg_local *lcl,
-                           enum smc_lgr_role role)
+                           enum smc_lgr_role role, u32 clcqpn)
 {
         return !memcmp(lgr->peer_systemid, lcl->id_for_peer,
                        SMC_SYSTEMID_LEN) &&
@@ -577,7 +581,9 @@ static bool smcr_lgr_match(struct smc_link_group *lgr,
                         SMC_GID_SIZE) &&
                 !memcmp(lgr->lnk[SMC_SINGLE_LINK].peer_mac, lcl->mac,
                         sizeof(lcl->mac)) &&
-                lgr->role == role;
+                lgr->role == role &&
+                (lgr->role == SMC_SERV ||
+                 lgr->lnk[SMC_SINGLE_LINK].peer_qpn == clcqpn);
 }
 
 static bool smcd_lgr_match(struct smc_link_group *lgr,
@@ -588,7 +594,7 @@ static bool smcd_lgr_match(struct smc_link_group *lgr,
 
 /* create a new SMC connection (and a new link group if necessary) */
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid)
 {
@@ -613,7 +619,7 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
         list_for_each_entry(lgr, &smc_lgr_list.list, list) {
                 write_lock_bh(&lgr->conns_lock);
                 if ((is_smcd ? smcd_lgr_match(lgr, smcd, peer_gid) :
-                     smcr_lgr_match(lgr, lcl, role)) &&
+                     smcr_lgr_match(lgr, lcl, role, clcqpn)) &&
                     !lgr->sync_err &&
                     lgr->vlan_id == vlan_id &&
                     (role == SMC_CLNT ||
@@ -1034,6 +1040,8 @@ void smc_core_exit(void)
                         smc_llc_link_inactive(lnk);
                 }
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr); /* free link group */
         }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index e177c6675038..b00287989a3d 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -249,7 +249,8 @@ struct smc_clc_msg_local;
 void smc_lgr_forget(struct smc_link_group *lgr);
 void smc_lgr_terminate(struct smc_link_group *lgr);
 void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport);
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid);
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid,
+                        unsigned short vlan);
 int smc_buf_create(struct smc_sock *smc, bool is_smcd);
 int smc_uncompress_bufsize(u8 compressed);
 int smc_rmb_rtoken_handling(struct smc_connection *conn,
@@ -264,7 +265,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id);
 
 void smc_conn_free(struct smc_connection *conn);
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid);
 void smcd_conn_free(struct smc_connection *conn);
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index e36f21ce7252..2fff79db1a59 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -187,22 +187,28 @@ struct smc_ism_event_work {
 #define ISM_EVENT_REQUEST               0x0001
 #define ISM_EVENT_RESPONSE              0x0002
 #define ISM_EVENT_REQUEST_IR            0x00000001
+#define ISM_EVENT_CODE_SHUTDOWN         0x80
 #define ISM_EVENT_CODE_TESTLINK         0x83
 
+union smcd_sw_event_info {
+        u64     info;
+        struct {
+                u8              uid[SMC_LGR_ID_SIZE];
+                unsigned short  vlan_id;
+                u16             code;
+        };
+};
+
 static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
 {
-        union {
-                u64     info;
-                struct {
-                        u32             uid;
-                        unsigned short  vlanid;
-                        u16             code;
-                };
-        } ev_info;
+        union smcd_sw_event_info ev_info;
 
+        ev_info.info = wrk->event.info;
         switch (wrk->event.code) {
+        case ISM_EVENT_CODE_SHUTDOWN:   /* Peer shut down DMBs */
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, ev_info.vlan_id);
+                break;
         case ISM_EVENT_CODE_TESTLINK:   /* Activity timer */
-                ev_info.info = wrk->event.info;
                 if (ev_info.code == ISM_EVENT_REQUEST) {
                         ev_info.code = ISM_EVENT_RESPONSE;
                         wrk->smcd->ops->signal_event(wrk->smcd,
@@ -215,6 +221,21 @@ static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
         }
 }
 
+int smc_ism_signal_shutdown(struct smc_link_group *lgr)
+{
+        int rc;
+        union smcd_sw_event_info ev_info;
+
+        memcpy(ev_info.uid, lgr->id, SMC_LGR_ID_SIZE);
+        ev_info.vlan_id = lgr->vlan_id;
+        ev_info.code = ISM_EVENT_REQUEST;
+        rc = lgr->smcd->ops->signal_event(lgr->smcd, lgr->peer_gid,
+                                          ISM_EVENT_REQUEST_IR,
+                                          ISM_EVENT_CODE_SHUTDOWN,
+                                          ev_info.info);
+        return rc;
+}
+
 /* worker for SMC-D events */
 static void smc_ism_event_work(struct work_struct *work)
 {
@@ -223,7 +244,7 @@ static void smc_ism_event_work(struct work_struct *work)
 
         switch (wrk->event.type) {
         case ISM_EVENT_GID:     /* GID event, token is peer GID */
-                smc_smcd_terminate(wrk->smcd, wrk->event.tok);
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, VLAN_VID_MASK);
                 break;
         case ISM_EVENT_DMB:
                 break;
@@ -289,7 +310,7 @@ void smcd_unregister_dev(struct smcd_dev *smcd)
         spin_unlock(&smcd_dev_list.lock);
         flush_workqueue(smcd->event_wq);
         destroy_workqueue(smcd->event_wq);
-        smc_smcd_terminate(smcd, 0);
+        smc_smcd_terminate(smcd, 0, VLAN_VID_MASK);
 
         device_del(&smcd->dev);
 }
diff --git a/net/smc/smc_ism.h b/net/smc/smc_ism.h
index aee45b860b79..4da946cbfa29 100644
--- a/net/smc/smc_ism.h
+++ b/net/smc/smc_ism.h
@@ -45,4 +45,5 @@ int smc_ism_register_dmb(struct smc_link_group *lgr, int buf_size,
 int smc_ism_unregister_dmb(struct smcd_dev *dev, struct smc_buf_desc *dmb_desc);
 int smc_ism_write(struct smcd_dev *dev, const struct smc_ism_position *pos,
                   void *data, size_t len);
+int smc_ism_signal_shutdown(struct smc_link_group *lgr);
 #endif
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 3c458d279855..c2694750a6a8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
 
         pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
         if (pend->idx < link->wr_tx_cnt) {
+                u32 idx = pend->idx;
+
                 /* clear the full struct smc_wr_tx_pend including .priv */
                 memset(&link->wr_tx_pends[pend->idx], 0,
                        sizeof(link->wr_tx_pends[pend->idx]));
                 memset(&link->wr_tx_bufs[pend->idx], 0,
                        sizeof(link->wr_tx_bufs[pend->idx]));
-                test_and_clear_bit(pend->idx, link->wr_tx_mask);
+                test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
 
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f8d4a419f3af..467039b342b5 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         runtime->oss.channels = params_channels(params);
         runtime->oss.rate = params_rate(params);
 
-        vfree(runtime->oss.buffer);
-        runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
+        kvfree(runtime->oss.buffer);
+        runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
         if (!runtime->oss.buffer) {
                 err = -ENOMEM;
                 goto failure;
@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime;
         runtime = substream->runtime;
-        vfree(runtime->oss.buffer);
+        kvfree(runtime->oss.buffer);
         runtime->oss.buffer = NULL;
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 141c5f3a9575..31cb2acf8afc 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
                 return -ENXIO;
         size /= 8;
         if (plugin->buf_frames < frames) {
-                vfree(plugin->buf);
-                plugin->buf = vmalloc(size);
+                kvfree(plugin->buf);
+                plugin->buf = kvzalloc(size, GFP_KERNEL);
                 plugin->buf_frames = frames;
         }
         if (!plugin->buf) {
@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
         if (plugin->private_free)
                 plugin->private_free(plugin);
         kfree(plugin->buf_channels);
-        vfree(plugin->buf);
+        kvfree(plugin->buf);
         kfree(plugin);
         return 0;
 }
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 0a24037184c3..0a567634e5fa 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1177,6 +1177,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
         SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
         SND_PCI_QUIRK(0x1102, 0x0010, "Sound Blaster Z", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1102, 0x0023, "Sound Blaster Z", QUIRK_SBZ),
+        SND_PCI_QUIRK(0x1102, 0x0033, "Sound Blaster ZxR", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
@@ -8413,7 +8414,7 @@ static void ca0132_free(struct hda_codec *codec)
 
         snd_hda_power_down(codec);
         if (spec->mem_base)
-                iounmap(spec->mem_base);
+                pci_iounmap(codec->bus->pci, spec->mem_base);
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
@@ -8488,7 +8489,7 @@ static void ca0132_config(struct hda_codec *codec)
                 break;
         case QUIRK_AE5:
                 codec_dbg(codec, "%s: QUIRK_AE5 applied.\n", __func__);
-                snd_hda_apply_pincfgs(codec, r3di_pincfgs);
+                snd_hda_apply_pincfgs(codec, ae5_pincfgs);
                 break;
         }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fa61674a5605..970bc44a378b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6481,6 +6481,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
         SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
         SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 1dd5f4fcffd5..db66a952c173 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -129,7 +129,7 @@ WARNINGS += $(call cc-supports,-Wno-pointer-sign)
 WARNINGS += $(call cc-supports,-Wdeclaration-after-statement)
 WARNINGS += -Wshadow
 
-CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
+override CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
                 -DPACKAGE_BUGREPORT=\"$(PACKAGE_BUGREPORT)\" -D_GNU_SOURCE
 
 UTIL_OBJS =  utils/helpers/amd.o utils/helpers/msr.o \
@@ -156,12 +156,12 @@ LIB_SRC = 	lib/cpufreq.c lib/cpupower.c lib/cpuidle.c
 LIB_OBJS =      lib/cpufreq.o lib/cpupower.o lib/cpuidle.o
 LIB_OBJS :=     $(addprefix $(OUTPUT),$(LIB_OBJS))
 
-CFLAGS +=       -pipe
+override CFLAGS +=      -pipe
 
 ifeq ($(strip $(NLS)),true)
         INSTALL_NLS += install-gmo
         COMPILE_NLS += create-gmo
-        CFLAGS += -DNLS
+        override CFLAGS += -DNLS
 endif
 
 ifeq ($(strip $(CPUFREQ_BENCH)),true)
@@ -175,7 +175,7 @@ ifeq ($(strip $(STATIC)),true)
         UTIL_SRC += $(LIB_SRC)
 endif
 
-CFLAGS += $(WARNINGS)
+override CFLAGS += $(WARNINGS)
 
 ifeq ($(strip $(V)),false)
         QUIET=@
@@ -188,10 +188,10 @@ export QUIET ECHO
 
 # if DEBUG is enabled, then we do not strip or optimize
 ifeq ($(strip $(DEBUG)),true)
-        CFLAGS += -O1 -g -DDEBUG
+        override CFLAGS += -O1 -g -DDEBUG
         STRIPCMD = /bin/true -Since_we_are_debugging
 else
-        CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
+        override CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
         STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
 endif
 
diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
index d79ab161cc75..f68b4bc55273 100644
--- a/tools/power/cpupower/bench/Makefile
+++ b/tools/power/cpupower/bench/Makefile
@@ -9,7 +9,7 @@ endif
 ifeq ($(strip $(STATIC)),true)
 LIBS = -L../ -L$(OUTPUT) -lm
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
-       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
+       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
 else
 LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index 59af84b8ef45..b1b6c43644e7 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -13,10 +13,10 @@ INSTALL = /usr/bin/install
 default: all
 
 $(OUTPUT)centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 $(OUTPUT)powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 all: $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
 
diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
index 1b993fe1ce23..0c0f3e3f0d80 100644
--- a/tools/power/cpupower/lib/cpufreq.c
+++ b/tools/power/cpupower/lib/cpufreq.c
@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
                          cpu, fname);
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 /* helper function to write a new value to a /sys file */
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 9bd4c7655fdb..852d25462388 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
 
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 
diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
index 9c395ec924de..9711d628b0f4 100644
--- a/tools/power/cpupower/lib/cpupower.c
+++ b/tools/power/cpupower/lib/cpupower.c
@@ -15,7 +15,7 @@
 #include "cpupower.h"
 #include "cpupower_intern.h"
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
 {
         int fd;
         ssize_t numread;
@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
                          cpu, fname);
-        if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
+        if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
                 return -1;
         *result = strtol(linebuf, &endp, 0);
         if (endp == linebuf || errno == ERANGE)
diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
index 92affdfbe417..4887c76d23f8 100644
--- a/tools/power/cpupower/lib/cpupower_intern.h
+++ b/tools/power/cpupower/lib/cpupower_intern.h
@@ -3,4 +3,4 @@
 #define MAX_LINE_LEN 4096
 #define SYSFS_PATH_MAX 255
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);