Merge tag 'v4.16-rc7' into x86/mm, to fix up conflict

 Conflicts:
	arch/x86/mm/init_64.c

Signed-off-by: Ingo Molnar <mingo@kernel.org>

273 files changed, 2510 insertions, 1630 deletions

diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index 11b113f8e367..ebb626ffb5fa 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -74,10 +74,10 @@ void __init acpi_watchdog_init(void)
                 res.start = gas->address;
                 if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
                         res.flags = IORESOURCE_MEM;
-                        res.end = res.start + ALIGN(gas->access_width, 4);
+                        res.end = res.start + ALIGN(gas->access_width, 4) - 1;
                 } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
                         res.flags = IORESOURCE_IO;
-                        res.end = res.start + gas->access_width;
+                        res.end = res.start + gas->access_width - 1;
                 } else {
                         pr_warn("Unsupported address space: %u\n",
                                 gas->space_id);
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 7128488a3a72..f2eb6c37ea0a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -70,7 +70,6 @@ static async_cookie_t async_cookie;
 static bool battery_driver_registered;
 static int battery_bix_broken_package;
 static int battery_notification_delay_ms;
-static int battery_full_discharging;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -215,12 +214,9 @@ static int acpi_battery_get_property(struct power_supply *psy,
                 return -ENODEV;
         switch (psp) {
         case POWER_SUPPLY_PROP_STATUS:
-                if (battery->state & ACPI_BATTERY_STATE_DISCHARGING) {
-                        if (battery_full_discharging && battery->rate_now == 0)
-                                val->intval = POWER_SUPPLY_STATUS_FULL;
-                        else
-                                val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
-                } else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
+                if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
+                        val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+                else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
                         val->intval = POWER_SUPPLY_STATUS_CHARGING;
                 else if (acpi_battery_is_charged(battery))
                         val->intval = POWER_SUPPLY_STATUS_FULL;
@@ -1170,12 +1166,6 @@ battery_notification_delay_quirk(const struct dmi_system_id *d)
         return 0;
 }
 
-static int __init battery_full_discharging_quirk(const struct dmi_system_id *d)
-{
-        battery_full_discharging = 1;
-        return 0;
-}
-
 static const struct dmi_system_id bat_dmi_table[] __initconst = {
         {
                 .callback = battery_bix_broken_package_quirk,
@@ -1193,38 +1183,6 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-573G"),
                 },
         },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS GL502VSK",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "GL502VSK"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX305LA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX305LA"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX360UA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX360UA"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX410UAK",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX410UAK"),
-                },
-        },
         {},
 };
 
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index bbe48ad20886..eb09ef55c38a 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2675,10 +2675,14 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
         else
                 ndr_desc->numa_node = NUMA_NO_NODE;
 
-        if(acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_CACHE_FLUSH)
+        /*
+         * Persistence domain bits are hierarchical, if
+         * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then
+         * ACPI_NFIT_CAPABILITY_MEM_FLUSH is implied.
+         */
+        if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_CACHE_FLUSH)
                 set_bit(ND_REGION_PERSIST_CACHE, &ndr_desc->flags);
-
-        if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_MEM_FLUSH)
+        else if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_MEM_FLUSH)
                 set_bit(ND_REGION_PERSIST_MEMCTRL, &ndr_desc->flags);
 
         list_for_each_entry(nfit_memdev, &acpi_desc->memdevs, list) {
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 8ccaae3550d2..85167603b9c9 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm)
  */
 int acpi_map_pxm_to_online_node(int pxm)
 {
-        int node, n, dist, min_dist;
+        int node, min_node;
 
         node = acpi_map_pxm_to_node(pxm);
 
         if (node == NUMA_NO_NODE)
                 node = 0;
 
+        min_node = node;
         if (!node_online(node)) {
-                min_dist = INT_MAX;
+                int min_dist = INT_MAX, dist, n;
+
                 for_each_online_node(n) {
                         dist = node_distance(node, n);
                         if (dist < min_dist) {
                                 min_dist = dist;
-                                node = n;
+                                min_node = n;
                         }
                 }
         }
 
-        return node;
+        return min_node;
 }
 EXPORT_SYMBOL(acpi_map_pxm_to_online_node);
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 355a95a83a34..1ff17799769d 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -550,7 +550,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
           .driver_data = board_ahci_yes_fbs },
-        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642),
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */
+          .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */
           .driver_data = board_ahci_yes_fbs },
 
         /* Promise */
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index a0de7a38430c..7adcf3caabd0 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -665,6 +665,16 @@ int ahci_stop_engine(struct ata_port *ap)
         if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0)
                 return 0;
 
+        /*
+         * Don't try to issue commands but return with ENODEV if the
+         * AHCI controller not available anymore (e.g. due to PCIe hot
+         * unplugging). Otherwise a 500ms delay for each port is added.
+         */
+        if (tmp == 0xffffffff) {
+                dev_err(ap->host->dev, "AHCI controller unavailable!\n");
+                return -ENODEV;
+        }
+
         /* setting HBA to idle */
         tmp &= ~PORT_CMD_START;
         writel(tmp, port_mmio + PORT_CMD);
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 341d0ef82cbd..30cc8f1a31e1 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -340,7 +340,7 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port,
  * 2) regulator for controlling the targets power (optional)
  * 3) 0 - AHCI_MAX_CLKS clocks, as specified in the devs devicetree node,
  *    or for non devicetree enabled platforms a single clock
- *      4) phys (optional)
+ * 4) phys (optional)
  *
  * RETURNS:
  * The allocated ahci_host_priv on success, otherwise an ERR_PTR value
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3c09122bf038..7431ccd03316 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4530,6 +4530,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
+        /* Crucial BX100 SSD 500GB has broken LPM support */
+        { "CT500BX100SSD1",             NULL,   ATA_HORKAGE_NOLPM },
+
+        /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */
+        { "Crucial_CT512MX100*",        "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        /* 512GB MX100 with newer firmware has only LPM issues */
+        { "Crucial_CT512MX100*",        NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+
+        /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */
+        { "Crucial_CT480M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        { "Crucial_CT960M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500_*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4541,7 +4560,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Crucial_CT*MX100*",          "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Samsung SSD 8*",             NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Samsung SSD 840*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung SSD 850*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "FCCT*M500*",                 NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -5401,8 +5422,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
          * We guarantee to LLDs that they will have at least one
          * non-zero sg if the command is a data command.
          */
-        if (WARN_ON_ONCE(ata_is_data(prot) &&
-                         (!qc->sg || !qc->n_elem || !qc->nbytes)))
+        if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes))
                 goto sys_err;
 
         if (ata_is_dma(prot) || (ata_is_pio(prot) &&
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 11c3137d7b0a..c016829a38fd 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -815,7 +815,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
 
         if (ap->pflags & ATA_PFLAG_LOADING)
                 ap->pflags &= ~ATA_PFLAG_LOADING;
-        else if (ap->pflags & ATA_PFLAG_SCSI_HOTPLUG)
+        else if ((ap->pflags & ATA_PFLAG_SCSI_HOTPLUG) &&
+                !(ap->flags & ATA_FLAG_SAS_HOST))
                 schedule_delayed_work(&ap->hotplug_task, 0);
 
         if (ap->pflags & ATA_PFLAG_RECOVERED)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 66be961c93a4..89a9d4a2efc8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3316,6 +3316,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
                 goto invalid_fld;
         }
 
+        /* We may not issue NCQ commands to devices not supporting NCQ */
+        if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) {
+                fp = 1;
+                goto invalid_fld;
+        }
+
         /* sanity check for pio multi commands */
         if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
                 fp = 1;
@@ -4282,7 +4288,7 @@ static inline void ata_scsi_dump_cdb(struct ata_port *ap,
 #ifdef ATA_DEBUG
         struct scsi_device *scsidev = cmd->device;
 
-        DPRINTK("CDB (%u:%d,%d,%d) %9ph\n",
+        DPRINTK("CDB (%u:%d,%d,%lld) %9ph\n",
                 ap->print_id,
                 scsidev->channel, scsidev->id, scsidev->lun,
                 cmd->cmnd);
@@ -4309,7 +4315,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
                 if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
                         /* relay SCSI command to ATAPI device */
                         int len = COMMAND_SIZE(scsi_op);
-                        if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
+                        if (unlikely(len > scmd->cmd_len ||
+                                     len > dev->cdb_len ||
+                                     scmd->cmd_len > ATAPI_CDB_LEN))
                                 goto bad_cdb_len;
 
                         xlat_func = atapi_xlat;
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 80ee2f2a50d0..6456e07db72a 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
         RCAR_GEN1_SATA,
         RCAR_GEN2_SATA,
+        RCAR_GEN3_SATA,
         RCAR_R8A7790_ES1_SATA,
 };
 
@@ -784,26 +785,11 @@ static void sata_rcar_setup_port(struct ata_host *host)
         ioaddr->command_addr    = ioaddr->cmd_addr + (ATA_REG_CMD << 2);
 }
 
-static void sata_rcar_init_controller(struct ata_host *host)
+static void sata_rcar_init_module(struct sata_rcar_priv *priv)
 {
-        struct sata_rcar_priv *priv = host->private_data;
         void __iomem *base = priv->base;
         u32 val;
 
-        /* reset and setup phy */
-        switch (priv->type) {
-        case RCAR_GEN1_SATA:
-                sata_rcar_gen1_phy_init(priv);
-                break;
-        case RCAR_GEN2_SATA:
-        case RCAR_R8A7790_ES1_SATA:
-                sata_rcar_gen2_phy_init(priv);
-                break;
-        default:
-                dev_warn(host->dev, "SATA phy is not initialized\n");
-                break;
-        }
-
         /* SATA-IP reset state */
         val = ioread32(base + ATAPI_CONTROL1_REG);
         val |= ATAPI_CONTROL1_RESET;
@@ -824,10 +810,33 @@ static void sata_rcar_init_controller(struct ata_host *host)
         /* ack and mask */
         iowrite32(0, base + SATAINTSTAT_REG);
         iowrite32(0x7ff, base + SATAINTMASK_REG);
+
         /* enable interrupts */
         iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
 }
 
+static void sata_rcar_init_controller(struct ata_host *host)
+{
+        struct sata_rcar_priv *priv = host->private_data;
+
+        /* reset and setup phy */
+        switch (priv->type) {
+        case RCAR_GEN1_SATA:
+                sata_rcar_gen1_phy_init(priv);
+                break;
+        case RCAR_GEN2_SATA:
+        case RCAR_GEN3_SATA:
+        case RCAR_R8A7790_ES1_SATA:
+                sata_rcar_gen2_phy_init(priv);
+                break;
+        default:
+                dev_warn(host->dev, "SATA phy is not initialized\n");
+                break;
+        }
+
+        sata_rcar_init_module(priv);
+}
+
 static const struct of_device_id sata_rcar_match[] = {
         {
                 /* Deprecated by "renesas,sata-r8a7779" */
@@ -856,7 +865,7 @@ static const struct of_device_id sata_rcar_match[] = {
         },
         {
                 .compatible = "renesas,sata-r8a7795",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
         },
         {
                 .compatible = "renesas,rcar-gen2-sata",
@@ -864,7 +873,7 @@ static const struct of_device_id sata_rcar_match[] = {
         },
         {
                 .compatible = "renesas,rcar-gen3-sata",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
         },
         { },
 };
@@ -982,11 +991,18 @@ static int sata_rcar_resume(struct device *dev)
         if (ret)
                 return ret;
 
-        /* ack and mask */
-        iowrite32(0, base + SATAINTSTAT_REG);
-        iowrite32(0x7ff, base + SATAINTMASK_REG);
-        /* enable interrupts */
-        iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
+        if (priv->type == RCAR_GEN3_SATA) {
+                sata_rcar_gen2_phy_init(priv);
+                sata_rcar_init_module(priv);
+        } else {
+                /* ack and mask */
+                iowrite32(0, base + SATAINTSTAT_REG);
+                iowrite32(0x7ff, base + SATAINTMASK_REG);
+
+                /* enable interrupts */
+                iowrite32(ATAPI_INT_ENABLE_SATAINT,
+                          base + ATAPI_INT_ENABLE_REG);
+        }
 
         ata_host_resume(host);
 
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 9180b9bd5821..834509506ef6 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -97,7 +97,7 @@ static struct img_ascii_lcd_config boston_config = {
 static void malta_update(struct img_ascii_lcd_ctx *ctx)
 {
         unsigned int i;
-        int err;
+        int err = 0;
 
         for (i = 0; i < ctx->cfg->num_chars; i++) {
                 err = regmap_write(ctx->regmap,
@@ -180,7 +180,7 @@ static int sead3_wait_lcd_idle(struct img_ascii_lcd_ctx *ctx)
 static void sead3_update(struct img_ascii_lcd_ctx *ctx)
 {
         unsigned int i;
-        int err;
+        int err = 0;
 
         for (i = 0; i < ctx->cfg->num_chars; i++) {
                 err = sead3_wait_lcd_idle(ctx);
@@ -224,7 +224,7 @@ MODULE_DEVICE_TABLE(of, img_ascii_lcd_matches);
 
 /**
  * img_ascii_lcd_scroll() - scroll the display by a character
- * @arg: really a pointer to the private data structure
+ * @t: really a pointer to the private data structure
  *
  * Scroll the current message along the LCD by one character, rearming the
  * timer if required.
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index ea7869c0d7f9..ec5e8800f8ad 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1372,7 +1372,7 @@ static void panel_process_inputs(void)
                                 break;
                         input->rise_timer = 0;
                         input->state = INPUT_ST_RISING;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_RISING:
                         if ((phys_curr & input->mask) != input->value) {
                                 input->state = INPUT_ST_LOW;
@@ -1385,11 +1385,11 @@ static void panel_process_inputs(void)
                         }
                         input->high_timer = 0;
                         input->state = INPUT_ST_HIGH;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_HIGH:
                         if (input_state_high(input))
                                 break;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_FALLING:
                         input_state_falling(input);
                 }
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 60bf04b8f103..366a49c7c08f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -231,7 +231,6 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
-        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
@@ -264,6 +263,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 
         /* QCA ROME chipset */
+        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME },
         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
@@ -386,10 +386,10 @@ static const struct usb_device_id blacklist_table[] = {
  */
 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
         {
-                /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
+                /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
                 .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
                 },
         },
         {}
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 6314dfb02969..40b9fb247010 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -244,7 +244,9 @@ static irqreturn_t bcm_host_wake(int irq, void *data)
 
         bt_dev_dbg(bdev, "Host wake IRQ");
 
-        pm_request_resume(bdev->dev);
+        pm_runtime_get(bdev->dev);
+        pm_runtime_mark_last_busy(bdev->dev);
+        pm_runtime_put_autosuspend(bdev->dev);
 
         return IRQ_HANDLED;
 }
@@ -301,7 +303,7 @@ static const struct bcm_set_sleep_mode default_sleep_params = {
         .usb_auto_sleep = 0,
         .usb_resume_timeout = 0,
         .break_to_host = 0,
-        .pulsed_host_wake = 0,
+        .pulsed_host_wake = 1,
 };
 
 static int bcm_setup_sleep(struct hci_uart *hu)
@@ -586,8 +588,11 @@ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
         } else if (!bcm->rx_skb) {
                 /* Delay auto-suspend when receiving completed packet */
                 mutex_lock(&bcm_device_lock);
-                if (bcm->dev && bcm_device_exists(bcm->dev))
-                        pm_request_resume(bcm->dev->dev);
+                if (bcm->dev && bcm_device_exists(bcm->dev)) {
+                        pm_runtime_get(bcm->dev->dev);
+                        pm_runtime_mark_last_busy(bcm->dev->dev);
+                        pm_runtime_put_autosuspend(bcm->dev->dev);
+                }
                 mutex_unlock(&bcm_device_lock);
         }
 
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 44301a3d9963..a07f6451694a 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -449,17 +449,17 @@ struct bcm2835_pll_ana_bits {
 static const struct bcm2835_pll_ana_bits bcm2835_ana_default = {
         .mask0 = 0,
         .set0 = 0,
-        .mask1 = (u32)~(A2W_PLL_KI_MASK | A2W_PLL_KP_MASK),
+        .mask1 = A2W_PLL_KI_MASK | A2W_PLL_KP_MASK,
         .set1 = (2 << A2W_PLL_KI_SHIFT) | (8 << A2W_PLL_KP_SHIFT),
-        .mask3 = (u32)~A2W_PLL_KA_MASK,
+        .mask3 = A2W_PLL_KA_MASK,
         .set3 = (2 << A2W_PLL_KA_SHIFT),
         .fb_prediv_mask = BIT(14),
 };
 
 static const struct bcm2835_pll_ana_bits bcm2835_ana_pllh = {
-        .mask0 = (u32)~(A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK),
+        .mask0 = A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK,
         .set0 = (2 << A2W_PLLH_KA_SHIFT) | (2 << A2W_PLLH_KI_LOW_SHIFT),
-        .mask1 = (u32)~(A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK),
+        .mask1 = A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK,
         .set1 = (6 << A2W_PLLH_KP_SHIFT),
         .mask3 = 0,
         .set3 = 0,
@@ -623,8 +623,10 @@ static int bcm2835_pll_on(struct clk_hw *hw)
                      ~A2W_PLL_CTRL_PWRDN);
 
         /* Take the PLL out of reset. */
+        spin_lock(&cprman->regs_lock);
         cprman_write(cprman, data->cm_ctrl_reg,
                      cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST);
+        spin_unlock(&cprman->regs_lock);
 
         /* Wait for the PLL to lock. */
         timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
@@ -701,9 +703,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
         }
 
         /* Unmask the reference clock from the oscillator. */
+        spin_lock(&cprman->regs_lock);
         cprman_write(cprman, A2W_XOSC_CTRL,
                      cprman_read(cprman, A2W_XOSC_CTRL) |
                      data->reference_enable_mask);
+        spin_unlock(&cprman->regs_lock);
 
         if (do_ana_setup_first)
                 bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana);
diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c
index 9f7f931d6b2f..5eb50c31e455 100644
--- a/drivers/clk/clk-aspeed.c
+++ b/drivers/clk/clk-aspeed.c
@@ -205,6 +205,18 @@ static const struct aspeed_clk_soc_data ast2400_data = {
         .calc_pll = aspeed_ast2400_calc_pll,
 };
 
+static int aspeed_clk_is_enabled(struct clk_hw *hw)
+{
+        struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
+        u32 clk = BIT(gate->clock_idx);
+        u32 enval = (gate->flags & CLK_GATE_SET_TO_DISABLE) ? 0 : clk;
+        u32 reg;
+
+        regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
+
+        return ((reg & clk) == enval) ? 1 : 0;
+}
+
 static int aspeed_clk_enable(struct clk_hw *hw)
 {
         struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
@@ -215,6 +227,11 @@ static int aspeed_clk_enable(struct clk_hw *hw)
 
         spin_lock_irqsave(gate->lock, flags);
 
+        if (aspeed_clk_is_enabled(hw)) {
+                spin_unlock_irqrestore(gate->lock, flags);
+                return 0;
+        }
+
         if (gate->reset_idx >= 0) {
                 /* Put IP in reset */
                 regmap_update_bits(gate->map, ASPEED_RESET_CTRL, rst, rst);
@@ -255,17 +272,6 @@ static void aspeed_clk_disable(struct clk_hw *hw)
         spin_unlock_irqrestore(gate->lock, flags);
 }
 
-static int aspeed_clk_is_enabled(struct clk_hw *hw)
-{
-        struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
-        u32 clk = BIT(gate->clock_idx);
-        u32 reg;
-
-        regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
-
-        return (reg & clk) ? 0 : 1;
-}
-
 static const struct clk_ops aspeed_clk_gate_ops = {
         .enable = aspeed_clk_enable,
         .disable = aspeed_clk_disable,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 0f686a9dac3e..076d4244d672 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1125,8 +1125,10 @@ static int clk_core_round_rate_nolock(struct clk_core *core,
 {
         lockdep_assert_held(&prepare_lock);
 
-        if (!core)
+        if (!core) {
+                req->rate = 0;
                 return 0;
+        }
 
         clk_core_init_rate_req(core, req);
 
@@ -2309,8 +2311,11 @@ static int clk_core_set_phase_nolock(struct clk_core *core, int degrees)
 
         trace_clk_set_phase(core, degrees);
 
-        if (core->ops->set_phase)
+        if (core->ops->set_phase) {
                 ret = core->ops->set_phase(core->hw, degrees);
+                if (!ret)
+                        core->phase = degrees;
+        }
 
         trace_clk_set_phase_complete(core, degrees);
 
@@ -2968,22 +2973,37 @@ static int __clk_core_init(struct clk_core *core)
         core->rate = core->req_rate = rate;
 
         /*
+         * Enable CLK_IS_CRITICAL clocks so newly added critical clocks
+         * don't get accidentally disabled when walking the orphan tree and
+         * reparenting clocks
+         */
+        if (core->flags & CLK_IS_CRITICAL) {
+                unsigned long flags;
+
+                clk_core_prepare(core);
+
+                flags = clk_enable_lock();
+                clk_core_enable(core);
+                clk_enable_unlock(flags);
+        }
+
+        /*
          * walk the list of orphan clocks and reparent any that newly finds a
          * parent.
          */
         hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
                 struct clk_core *parent = __clk_init_parent(orphan);
-                unsigned long flags;
 
                 /*
-                 * we could call __clk_set_parent, but that would result in a
-                 * redundant call to the .set_rate op, if it exists
+                 * We need to use __clk_set_parent_before() and _after() to
+                 * to properly migrate any prepare/enable count of the orphan
+                 * clock. This is important for CLK_IS_CRITICAL clocks, which
+                 * are enabled during init but might not have a parent yet.
                  */
                 if (parent) {
                         /* update the clk tree topology */
-                        flags = clk_enable_lock();
-                        clk_reparent(orphan, parent);
-                        clk_enable_unlock(flags);
+                        __clk_set_parent_before(orphan, parent);
+                        __clk_set_parent_after(orphan, parent, NULL);
                         __clk_recalc_accuracies(orphan);
                         __clk_recalc_rates(orphan, 0);
                 }
@@ -3000,16 +3020,6 @@ static int __clk_core_init(struct clk_core *core)
         if (core->ops->init)
                 core->ops->init(core->hw);
 
-        if (core->flags & CLK_IS_CRITICAL) {
-                unsigned long flags;
-
-                clk_core_prepare(core);
-
-                flags = clk_enable_lock();
-                clk_core_enable(core);
-                clk_enable_unlock(flags);
-        }
-
         kref_init(&core->ref);
 out:
         clk_pm_runtime_put(core);
diff --git a/drivers/clk/hisilicon/clk-hi3660-stub.c b/drivers/clk/hisilicon/clk-hi3660-stub.c
index 9b6c72bbddf9..e8b2c43b1bb8 100644
--- a/drivers/clk/hisilicon/clk-hi3660-stub.c
+++ b/drivers/clk/hisilicon/clk-hi3660-stub.c
@@ -149,6 +149,8 @@ static int hi3660_stub_clk_probe(struct platform_device *pdev)
                 return PTR_ERR(stub_clk_chan.mbox);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
         freq_reg = devm_ioremap(dev, res->start, resource_size(res));
         if (!freq_reg)
                 return -ENOMEM;
diff --git a/drivers/clk/imx/clk-imx51-imx53.c b/drivers/clk/imx/clk-imx51-imx53.c
index c864992e6983..caa8bd40692c 100644
--- a/drivers/clk/imx/clk-imx51-imx53.c
+++ b/drivers/clk/imx/clk-imx51-imx53.c
@@ -131,7 +131,17 @@ static const char *ieee1588_sels[] = { "pll3_sw", "pll4_sw", "dummy" /* usbphy2_
 static struct clk *clk[IMX5_CLK_END];
 static struct clk_onecell_data clk_data;
 
-static struct clk ** const uart_clks[] __initconst = {
+static struct clk ** const uart_clks_mx51[] __initconst = {
+        &clk[IMX5_CLK_UART1_IPG_GATE],
+        &clk[IMX5_CLK_UART1_PER_GATE],
+        &clk[IMX5_CLK_UART2_IPG_GATE],
+        &clk[IMX5_CLK_UART2_PER_GATE],
+        &clk[IMX5_CLK_UART3_IPG_GATE],
+        &clk[IMX5_CLK_UART3_PER_GATE],
+        NULL
+};
+
+static struct clk ** const uart_clks_mx50_mx53[] __initconst = {
         &clk[IMX5_CLK_UART1_IPG_GATE],
         &clk[IMX5_CLK_UART1_PER_GATE],
         &clk[IMX5_CLK_UART2_IPG_GATE],
@@ -321,8 +331,6 @@ static void __init mx5_clocks_common_init(void __iomem *ccm_base)
         clk_prepare_enable(clk[IMX5_CLK_TMAX1]);
         clk_prepare_enable(clk[IMX5_CLK_TMAX2]); /* esdhc2, fec */
         clk_prepare_enable(clk[IMX5_CLK_TMAX3]); /* esdhc1, esdhc4 */
-
-        imx_register_uart_clocks(uart_clks);
 }
 
 static void __init mx50_clocks_init(struct device_node *np)
@@ -388,6 +396,8 @@ static void __init mx50_clocks_init(struct device_node *np)
 
         r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
         clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+
+        imx_register_uart_clocks(uart_clks_mx50_mx53);
 }
 CLK_OF_DECLARE(imx50_ccm, "fsl,imx50-ccm", mx50_clocks_init);
 
@@ -477,6 +487,8 @@ static void __init mx51_clocks_init(struct device_node *np)
         val = readl(MXC_CCM_CLPCR);
         val |= 1 << 23;
         writel(val, MXC_CCM_CLPCR);
+
+        imx_register_uart_clocks(uart_clks_mx51);
 }
 CLK_OF_DECLARE(imx51_ccm, "fsl,imx51-ccm", mx51_clocks_init);
 
@@ -606,5 +618,7 @@ static void __init mx53_clocks_init(struct device_node *np)
 
         r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
         clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+
+        imx_register_uart_clocks(uart_clks_mx50_mx53);
 }
 CLK_OF_DECLARE(imx53_ccm, "fsl,imx53-ccm", mx53_clocks_init);
diff --git a/drivers/clk/qcom/apcs-msm8916.c b/drivers/clk/qcom/apcs-msm8916.c
index 246957f1a413..b1cc8dbcd327 100644
--- a/drivers/clk/qcom/apcs-msm8916.c
+++ b/drivers/clk/qcom/apcs-msm8916.c
@@ -49,11 +49,10 @@ static int qcom_apcs_msm8916_clk_probe(struct platform_device *pdev)
         struct clk_regmap_mux_div *a53cc;
         struct regmap *regmap;
         struct clk_init_data init = { };
-        int ret;
+        int ret = -ENODEV;
 
         regmap = dev_get_regmap(parent, NULL);
-        if (IS_ERR(regmap)) {
-                ret = PTR_ERR(regmap);
+        if (!regmap) {
                 dev_err(dev, "failed to get regmap: %d\n", ret);
                 return ret;
         }
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 72b16ed1012b..3b97f60540ad 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -762,7 +762,7 @@ static struct ccu_mp out_a_clk = {
                 .features       = CCU_FEATURE_FIXED_PREDIV,
                 .hw.init        = CLK_HW_INIT_PARENTS("out-a",
                                                       clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                       0),
         },
 };
@@ -783,7 +783,7 @@ static struct ccu_mp out_b_clk = {
                 .features       = CCU_FEATURE_FIXED_PREDIV,
                 .hw.init        = CLK_HW_INIT_PARENTS("out-b",
                                                       clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                       0),
         },
 };
@@ -804,7 +804,7 @@ static struct ccu_mp out_c_clk = {
                 .features       = CCU_FEATURE_FIXED_PREDIV,
                 .hw.init        = CLK_HW_INIT_PARENTS("out-c",
                                                       clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                       0),
         },
 };
diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
index 612491a26070..12e0a2d19911 100644
--- a/drivers/clk/ti/clk-33xx.c
+++ b/drivers/clk/ti/clk-33xx.c
@@ -45,7 +45,7 @@ static const struct omap_clkctrl_bit_data am3_gpio4_bit_data[] __initconst = {
 
 static const struct omap_clkctrl_reg_data am3_l4_per_clkctrl_regs[] __initconst = {
         { AM3_CPGMAC0_CLKCTRL, NULL, CLKF_SW_SUP, "cpsw_125mhz_gclk", "cpsw_125mhz_clkdm" },
-        { AM3_LCDC_CLKCTRL, NULL, CLKF_SW_SUP, "lcd_gclk", "lcdc_clkdm" },
+        { AM3_LCDC_CLKCTRL, NULL, CLKF_SW_SUP | CLKF_SET_RATE_PARENT, "lcd_gclk", "lcdc_clkdm" },
         { AM3_USB_OTG_HS_CLKCTRL, NULL, CLKF_SW_SUP, "usbotg_fck", "l3s_clkdm" },
         { AM3_TPTC0_CLKCTRL, NULL, CLKF_SW_SUP, "l3_gclk", "l3_clkdm" },
         { AM3_EMIF_CLKCTRL, NULL, CLKF_SW_SUP, "dpll_ddr_m2_div2_ck", "l3_clkdm" },
diff --git a/drivers/clk/ti/clk-43xx.c b/drivers/clk/ti/clk-43xx.c
index 2b7c2e017665..63c5ddb50187 100644
--- a/drivers/clk/ti/clk-43xx.c
+++ b/drivers/clk/ti/clk-43xx.c
@@ -187,7 +187,7 @@ static const struct omap_clkctrl_reg_data am4_l4_per_clkctrl_regs[] __initconst
         { AM4_OCP2SCP0_CLKCTRL, NULL, CLKF_SW_SUP, "l4ls_gclk" },
         { AM4_OCP2SCP1_CLKCTRL, NULL, CLKF_SW_SUP, "l4ls_gclk" },
         { AM4_EMIF_CLKCTRL, NULL, CLKF_SW_SUP, "dpll_ddr_m2_ck", "emif_clkdm" },
-        { AM4_DSS_CORE_CLKCTRL, NULL, CLKF_SW_SUP, "disp_clk", "dss_clkdm" },
+        { AM4_DSS_CORE_CLKCTRL, NULL, CLKF_SW_SUP | CLKF_SET_RATE_PARENT, "disp_clk", "dss_clkdm" },
         { AM4_CPGMAC0_CLKCTRL, NULL, CLKF_SW_SUP, "cpsw_125mhz_gclk", "cpsw_125mhz_clkdm" },
         { 0 },
 };
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index afa0d6bfc5c1..421b05392220 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -537,6 +537,8 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
                 init.parent_names = &reg_data->parent;
                 init.num_parents = 1;
                 init.flags = 0;
+                if (reg_data->flags & CLKF_SET_RATE_PARENT)
+                        init.flags |= CLK_SET_RATE_PARENT;
                 init.name = kasprintf(GFP_KERNEL, "%s:%s:%04x:%d",
                                       node->parent->name, node->name,
                                       reg_data->offset, 0);
diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c
index 4dbb30cf94ac..b922db90939a 100644
--- a/drivers/dma/stm32-dmamux.c
+++ b/drivers/dma/stm32-dmamux.c
@@ -118,14 +118,15 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
         spin_lock_irqsave(&dmamux->lock, flags);
         mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
                                            dmamux->dma_requests);
-        set_bit(mux->chan_id, dmamux->dma_inuse);
-        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         if (mux->chan_id == dmamux->dma_requests) {
+                spin_unlock_irqrestore(&dmamux->lock, flags);
                 dev_err(&pdev->dev, "Run out of free DMA requests\n");
                 ret = -ENOMEM;
-                goto error;
+                goto error_chan_id;
         }
+        set_bit(mux->chan_id, dmamux->dma_inuse);
+        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         /* Look for DMA Master */
         for (i = 1, min = 0, max = dmamux->dma_reqs[i];
@@ -173,6 +174,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
 
 error:
         clear_bit(mux->chan_id, dmamux->dma_inuse);
+
+error_chan_id:
         kfree(mux);
         return ERR_PTR(ret);
 }
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index c16600f30611..0bdea60c65dd 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -639,7 +639,7 @@ static void __exit dcdbas_exit(void)
         platform_driver_unregister(&dcdbas_driver);
 }
 
-module_init(dcdbas_init);
+subsys_initcall_sync(dcdbas_init);
 module_exit(dcdbas_exit);
 
 MODULE_DESCRIPTION(DRIVER_DESCRIPTION " (version " DRIVER_VERSION ")");
diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index da661bf8cb96..13c1edd37e96 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -68,11 +68,11 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
         efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
         efi_status_t status;
         efi_physical_addr_t log_location, log_last_entry;
-        struct linux_efi_tpm_eventlog *log_tbl;
+        struct linux_efi_tpm_eventlog *log_tbl = NULL;
         unsigned long first_entry_addr, last_entry_addr;
         size_t log_size, last_entry_size;
         efi_bool_t truncated;
-        void *tcg2_protocol;
+        void *tcg2_protocol = NULL;
 
         status = efi_call_early(locate_protocol, &tcg2_guid, NULL,
                                 &tcg2_protocol);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 74d2efaec52f..7a073ac5f9c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector)
                 /* don't do anything if sink is not display port, i.e.,
                  * passive dp->(dvi|hdmi) adaptor
                  */
-                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
-                        int saved_dpms = connector->dpms;
-                        /* Only turn off the display if it's physically disconnected */
-                        if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) {
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
-                        } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
-                                /* Don't try to start link training before we
-                                 * have the dpcd */
-                                if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
-                                        return;
-
-                                /* set it to OFF so that drm_helper_connector_dpms()
-                                 * won't return immediately since the current state
-                                 * is ON at this point.
-                                 */
-                                connector->dpms = DRM_MODE_DPMS_OFF;
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                        }
-                        connector->dpms = saved_dpms;
+                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
+                    amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) &&
+                    amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
+                        /* Don't start link training before we have the DPCD */
+                        if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
+                                return;
+
+                        /* Turn the connector off and back on immediately, which
+                         * will trigger link training
+                         */
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 }
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index af1b879a9ee9..66cb10cdc7c3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2063,9 +2063,12 @@ void amdgpu_device_fini(struct amdgpu_device *adev)
 
         DRM_INFO("amdgpu: finishing device.\n");
         adev->shutdown = true;
-        if (adev->mode_info.mode_config_initialized)
-                drm_crtc_force_disable_all(adev->ddev);
-
+        if (adev->mode_info.mode_config_initialized){
+                if (!amdgpu_device_has_dc_support(adev))
+                        drm_crtc_force_disable_all(adev->ddev);
+                else
+                        drm_atomic_helper_shutdown(adev->ddev);
+        }
         amdgpu_ib_pool_fini(adev);
         amdgpu_fence_driver_fini(adev);
         amdgpu_fbdev_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index e48b4ec88c8c..ca6c931dabfa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -36,8 +36,6 @@ void amdgpu_gem_object_free(struct drm_gem_object *gobj)
         struct amdgpu_bo *robj = gem_to_amdgpu_bo(gobj);
 
         if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                 amdgpu_mn_unregister(robj);
                 amdgpu_bo_unref(&robj);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index 54f06c959340..2264c5c97009 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -352,6 +352,7 @@ struct amdgpu_mode_info {
         u16 firmware_flags;
         /* pointer to backlight encoder */
         struct amdgpu_encoder *bl_encoder;
+        u8 bl_level; /* saved backlight level */
         struct amdgpu_audio     audio; /* audio stuff */
         int                     num_crtc; /* number of crtcs */
         int                     num_hpd; /* number of hpd pins */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 5c4c3e0d527b..1220322c1680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -56,6 +56,8 @@ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo)
 
         amdgpu_bo_kunmap(bo);
 
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
         drm_gem_object_release(&bo->gem_base);
         amdgpu_bo_unref(&bo->parent);
         if (!list_empty(&bo->shadow_list)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
index 2af26d2da127..d702fb8e3427 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
@@ -34,7 +34,7 @@
 #include <linux/backlight.h>
 #include "bif/bif_4_1_d.h"
 
-static u8
+u8
 amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
 {
         u8 backlight_level;
@@ -48,7 +48,7 @@ amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
         return backlight_level;
 }
 
-static void
+void
 amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
                                             u8 backlight_level)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
index 2bdec40515ce..f77cbdef679e 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
@@ -25,6 +25,11 @@
 #define __ATOMBIOS_ENCODER_H__
 
 u8
+amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev);
+void
+amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
+                                                   u8 backlight_level);
+u8
 amdgpu_atombios_encoder_get_backlight_level(struct amdgpu_encoder *amdgpu_encoder);
 void
 amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encoder,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index f34bc68aadfb..022f303463fc 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2921,6 +2921,11 @@ static int dce_v10_0_hw_fini(void *handle)
 
 static int dce_v10_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v10_0_hw_fini(handle);
 }
 
@@ -2929,6 +2934,9 @@ static int dce_v10_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v10_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 26378bd6aba4..800a9f36ab4f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3047,6 +3047,11 @@ static int dce_v11_0_hw_fini(void *handle)
 
 static int dce_v11_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v11_0_hw_fini(handle);
 }
 
@@ -3055,6 +3060,9 @@ static int dce_v11_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v11_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index a712f4b285f6..b8368f69ce1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -2787,6 +2787,11 @@ static int dce_v6_0_hw_fini(void *handle)
 
 static int dce_v6_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v6_0_hw_fini(handle);
 }
 
@@ -2795,6 +2800,9 @@ static int dce_v6_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v6_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index c008dc030687..012e0a9ae0ff 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2819,6 +2819,11 @@ static int dce_v8_0_hw_fini(void *handle)
 
 static int dce_v8_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v8_0_hw_fini(handle);
 }
 
@@ -2827,6 +2832,9 @@ static int dce_v8_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v8_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c345e645f1d7..63c67346d316 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3134,8 +3134,6 @@ static int amdgpu_dm_plane_init(struct amdgpu_display_manager *dm,
 
         switch (aplane->base.type) {
         case DRM_PLANE_TYPE_PRIMARY:
-                aplane->base.format_default = true;
-
                 res = drm_universal_plane_init(
                                 dm->adev->ddev,
                                 &aplane->base,
@@ -4794,6 +4792,9 @@ static int dm_atomic_check_plane_state_fb(struct drm_atomic_state *state,
                         return -EDEADLK;
 
                 crtc_state = drm_atomic_get_crtc_state(plane_state->state, crtc);
+                if (IS_ERR(crtc_state))
+                        return PTR_ERR(crtc_state);
+
                 if (crtc->primary == plane && crtc_state->active) {
                         if (!plane_state->fb)
                                 return -EINVAL;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index 9bd142f65f9b..e1acc10e35a2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -109,7 +109,7 @@ enum dc_edid_status dm_helpers_parse_edid_caps(
                 struct cea_sad *sad = &sads[i];
 
                 edid_caps->audio_modes[i].format_code = sad->format;
-                edid_caps->audio_modes[i].channel_count = sad->channels;
+                edid_caps->audio_modes[i].channel_count = sad->channels + 1;
                 edid_caps->audio_modes[i].sample_rate = sad->freq;
                 edid_caps->audio_modes[i].sample_size = sad->byte2;
         }
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
index a993279a8f2d..f11f17fe08f9 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
@@ -496,6 +496,9 @@ struct dce_hwseq_registers {
         HWS_SF(, DOMAIN7_PG_STATUS, DOMAIN7_PGFSM_PWR_STATUS, mask_sh), \
         HWS_SF(, DC_IP_REQUEST_CNTL, IP_REQUEST_EN, mask_sh), \
         HWS_SF(, D1VGA_CONTROL, D1VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D2VGA_CONTROL, D2VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D3VGA_CONTROL, D3VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D4VGA_CONTROL, D4VGA_MODE_ENABLE, mask_sh),\
         HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_ENABLE, mask_sh),\
         HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_RENDER_START, mask_sh),\
         HWS_SF(, LVTMA_PWRSEQ_CNTL, LVTMA_BLON, mask_sh), \
@@ -591,7 +594,10 @@ struct dce_hwseq_registers {
         type DENTIST_DISPCLK_WDIVIDER; \
         type VGA_TEST_ENABLE; \
         type VGA_TEST_RENDER_START; \
-        type D1VGA_MODE_ENABLE;
+        type D1VGA_MODE_ENABLE; \
+        type D2VGA_MODE_ENABLE; \
+        type D3VGA_MODE_ENABLE; \
+        type D4VGA_MODE_ENABLE;
 
 struct dce_hwseq_shift {
         HWSEQ_REG_FIELD_LIST(uint8_t)
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c b/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
index 3931412ab6d3..87093894ea9e 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
@@ -128,23 +128,22 @@ static void set_truncation(
                 return;
         }
         /* on other format-to do */
-        if (params->flags.TRUNCATE_ENABLED == 0 ||
-                        params->flags.TRUNCATE_DEPTH == 2)
+        if (params->flags.TRUNCATE_ENABLED == 0)
                 return;
         /*Set truncation depth and Enable truncation*/
         REG_UPDATE_3(FMT_BIT_DEPTH_CONTROL,
                                 FMT_TRUNCATE_EN, 1,
                                 FMT_TRUNCATE_DEPTH,
-                                params->flags.TRUNCATE_MODE,
+                                params->flags.TRUNCATE_DEPTH,
                                 FMT_TRUNCATE_MODE,
-                                params->flags.TRUNCATE_DEPTH);
+                                params->flags.TRUNCATE_MODE);
 }
 
 
 /**
  *      set_spatial_dither
  *      1) set spatial dithering mode: pattern of seed
- *      2) set spatical dithering depth: 0 for 18bpp or 1 for 24bpp
+ *      2) set spatial dithering depth: 0 for 18bpp or 1 for 24bpp
  *      3) set random seed
  *      4) set random mode
  *              lfsr is reset every frame or not reset
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 072e4485e85e..dc1e010725c1 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -238,14 +238,24 @@ static void enable_power_gating_plane(
 static void disable_vga(
         struct dce_hwseq *hws)
 {
-        unsigned int in_vga_mode = 0;
-
-        REG_GET(D1VGA_CONTROL, D1VGA_MODE_ENABLE, &in_vga_mode);
-
-        if (in_vga_mode == 0)
+        unsigned int in_vga1_mode = 0;
+        unsigned int in_vga2_mode = 0;
+        unsigned int in_vga3_mode = 0;
+        unsigned int in_vga4_mode = 0;
+
+        REG_GET(D1VGA_CONTROL, D1VGA_MODE_ENABLE, &in_vga1_mode);
+        REG_GET(D2VGA_CONTROL, D2VGA_MODE_ENABLE, &in_vga2_mode);
+        REG_GET(D3VGA_CONTROL, D3VGA_MODE_ENABLE, &in_vga3_mode);
+        REG_GET(D4VGA_CONTROL, D4VGA_MODE_ENABLE, &in_vga4_mode);
+
+        if (in_vga1_mode == 0 && in_vga2_mode == 0 &&
+                        in_vga3_mode == 0 && in_vga4_mode == 0)
                 return;
 
         REG_WRITE(D1VGA_CONTROL, 0);
+        REG_WRITE(D2VGA_CONTROL, 0);
+        REG_WRITE(D3VGA_CONTROL, 0);
+        REG_WRITE(D4VGA_CONTROL, 0);
 
         /* HW Engineer's Notes:
          *  During switch from vga->extended, if we set the VGA_TEST_ENABLE and
diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h
index 5f4c2e833a65..d665dd5af5dd 100644
--- a/drivers/gpu/drm/ast/ast_tables.h
+++ b/drivers/gpu/drm/ast/ast_tables.h
@@ -97,7 +97,7 @@ static const struct ast_vbios_dclk_info dclk_table[] = {
         {0x67, 0x22, 0x00},                     /* 0E: VCLK157_5        */
         {0x6A, 0x22, 0x00},                     /* 0F: VCLK162          */
         {0x4d, 0x4c, 0x80},                     /* 10: VCLK154          */
-        {0xa7, 0x78, 0x80},                     /* 11: VCLK83.5         */
+        {0x68, 0x6f, 0x80},                     /* 11: VCLK83.5         */
         {0x28, 0x49, 0x80},                     /* 12: VCLK106.5        */
         {0x37, 0x49, 0x80},                     /* 13: VCLK146.25       */
         {0x1f, 0x45, 0x80},                     /* 14: VCLK148.5        */
@@ -127,7 +127,7 @@ static const struct ast_vbios_dclk_info dclk_table_ast2500[] = {
         {0x67, 0x22, 0x00},                     /* 0E: VCLK157_5        */
         {0x6A, 0x22, 0x00},                     /* 0F: VCLK162          */
         {0x4d, 0x4c, 0x80},                     /* 10: VCLK154          */
-        {0xa7, 0x78, 0x80},                     /* 11: VCLK83.5         */
+        {0x68, 0x6f, 0x80},                     /* 11: VCLK83.5         */
         {0x28, 0x49, 0x80},                     /* 12: VCLK106.5        */
         {0x37, 0x49, 0x80},                     /* 13: VCLK146.25       */
         {0x1f, 0x45, 0x80},                     /* 14: VCLK148.5        */
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index c0530a1af5e3..2dc5e8bed172 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -461,6 +461,12 @@ int drm_mode_getfb(struct drm_device *dev,
         if (!fb)
                 return -ENOENT;
 
+        /* Multi-planar framebuffers need getfb2. */
+        if (fb->format->num_planes > 1) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         r->height = fb->height;
         r->width = fb->width;
         r->depth = fb->format->depth;
@@ -484,6 +490,7 @@ int drm_mode_getfb(struct drm_device *dev,
                 ret = -ENODEV;
         }
 
+out:
         drm_framebuffer_put(fb);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index c8454ac43fae..db6b94dda5df 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -471,6 +471,7 @@ struct parser_exec_state {
          * used when ret from 2nd level batch buffer
          */
         int saved_buf_addr_type;
+        bool is_ctx_wa;
 
         struct cmd_info *info;
 
@@ -1715,6 +1716,11 @@ static int perform_bb_shadow(struct parser_exec_state *s)
         bb->accessing = true;
         bb->bb_start_cmd_va = s->ip_va;
 
+        if ((s->buf_type == BATCH_BUFFER_INSTRUCTION) && (!s->is_ctx_wa))
+                bb->bb_offset = s->ip_va - s->rb_va;
+        else
+                bb->bb_offset = 0;
+
         /*
          * ip_va saves the virtual address of the shadow batch buffer, while
          * ip_gma saves the graphics address of the original batch buffer.
@@ -2571,6 +2577,7 @@ static int scan_workload(struct intel_vgpu_workload *workload)
         s.ring_tail = gma_tail;
         s.rb_va = workload->shadow_ring_buffer_va;
         s.workload = workload;
+        s.is_ctx_wa = false;
 
         if ((bypass_scan_mask & (1 << workload->ring_id)) ||
                 gma_head == gma_tail)
@@ -2624,6 +2631,7 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         s.ring_tail = gma_tail;
         s.rb_va = wa_ctx->indirect_ctx.shadow_va;
         s.workload = workload;
+        s.is_ctx_wa = true;
 
         if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 256f1bb522b7..152df3d0291e 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -394,9 +394,11 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
          * performace for batch mmio read/write, so we need
          * handle forcewake mannually.
          */
+        intel_runtime_pm_get(dev_priv);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
         switch_mmio(pre, next, ring_id);
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
+        intel_runtime_pm_put(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index b55b3580ca1d..d74d6f05c62c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -52,6 +52,54 @@ static void set_context_pdp_root_pointer(
                 pdp_pair[i].val = pdp[7 - i];
 }
 
+/*
+ * when populating shadow ctx from guest, we should not overrride oa related
+ * registers, so that they will not be overlapped by guest oa configs. Thus
+ * made it possible to capture oa data from host for both host and guests.
+ */
+static void sr_oa_regs(struct intel_vgpu_workload *workload,
+                u32 *reg_state, bool save)
+{
+        struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        u32 ctx_oactxctrl = dev_priv->perf.oa.ctx_oactxctrl_offset;
+        u32 ctx_flexeu0 = dev_priv->perf.oa.ctx_flexeu0_offset;
+        int i = 0;
+        u32 flex_mmio[] = {
+                i915_mmio_reg_offset(EU_PERF_CNTL0),
+                i915_mmio_reg_offset(EU_PERF_CNTL1),
+                i915_mmio_reg_offset(EU_PERF_CNTL2),
+                i915_mmio_reg_offset(EU_PERF_CNTL3),
+                i915_mmio_reg_offset(EU_PERF_CNTL4),
+                i915_mmio_reg_offset(EU_PERF_CNTL5),
+                i915_mmio_reg_offset(EU_PERF_CNTL6),
+        };
+
+        if (!workload || !reg_state || workload->ring_id != RCS)
+                return;
+
+        if (save) {
+                workload->oactxctrl = reg_state[ctx_oactxctrl + 1];
+
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+
+                        workload->flex_mmio[i] = reg_state[state_offset + 1];
+                }
+        } else {
+                reg_state[ctx_oactxctrl] =
+                        i915_mmio_reg_offset(GEN8_OACTXCONTROL);
+                reg_state[ctx_oactxctrl + 1] = workload->oactxctrl;
+
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+                        u32 mmio = flex_mmio[i];
+
+                        reg_state[state_offset] = mmio;
+                        reg_state[state_offset + 1] = workload->flex_mmio[i];
+                }
+        }
+}
+
 static int populate_shadow_context(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
@@ -98,6 +146,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
         page = i915_gem_object_get_page(ctx_obj, LRC_STATE_PN);
         shadow_ring_context = kmap(page);
 
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, true);
 #define COPY_REG(name) \
         intel_gvt_hypervisor_read_gpa(vgpu, workload->ring_context_gpa \
                 + RING_CTX_OFF(name.val), &shadow_ring_context->name.val, 4)
@@ -122,6 +171,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                         sizeof(*shadow_ring_context),
                         I915_GTT_PAGE_SIZE - sizeof(*shadow_ring_context));
 
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, false);
         kunmap(page);
         return 0;
 }
@@ -376,6 +426,17 @@ static int prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
                         goto err;
                 }
 
+                /* For privilge batch buffer and not wa_ctx, the bb_start_cmd_va
+                 * is only updated into ring_scan_buffer, not real ring address
+                 * allocated in later copy_workload_to_ring_buffer. pls be noted
+                 * shadow_ring_buffer_va is now pointed to real ring buffer va
+                 * in copy_workload_to_ring_buffer.
+                 */
+
+                if (bb->bb_offset)
+                        bb->bb_start_cmd_va = workload->shadow_ring_buffer_va
+                                + bb->bb_offset;
+
                 /* relocate shadow batch buffer */
                 bb->bb_start_cmd_va[1] = i915_ggtt_offset(bb->vma);
                 if (gmadr_bytes == 8)
@@ -1044,10 +1105,12 @@ int intel_vgpu_setup_submission(struct intel_vgpu *vgpu)
 
         bitmap_zero(s->shadow_ctx_desc_updated, I915_NUM_ENGINES);
 
-        s->workloads = kmem_cache_create("gvt-g_vgpu_workload",
-                        sizeof(struct intel_vgpu_workload), 0,
-                        SLAB_HWCACHE_ALIGN,
-                        NULL);
+        s->workloads = kmem_cache_create_usercopy("gvt-g_vgpu_workload",
+                                                  sizeof(struct intel_vgpu_workload), 0,
+                                                  SLAB_HWCACHE_ALIGN,
+                                                  offsetof(struct intel_vgpu_workload, rb_tail),
+                                                  sizeof_field(struct intel_vgpu_workload, rb_tail),
+                                                  NULL);
 
         if (!s->workloads) {
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.h b/drivers/gpu/drm/i915/gvt/scheduler.h
index ff175a98b19e..a79a4f60637e 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.h
+++ b/drivers/gpu/drm/i915/gvt/scheduler.h
@@ -110,6 +110,10 @@ struct intel_vgpu_workload {
         /* shadow batch buffer */
         struct list_head shadow_bb;
         struct intel_shadow_wa_ctx wa_ctx;
+
+        /* oa registers */
+        u32 oactxctrl;
+        u32 flex_mmio[7];
 };
 
 struct intel_vgpu_shadow_bb {
@@ -120,6 +124,7 @@ struct intel_vgpu_shadow_bb {
         u32 *bb_start_cmd_va;
         unsigned int clflush;
         bool accessing;
+        unsigned long bb_offset;
 };
 
 #define workload_q_head(vgpu, ring_id) \
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 66ee9d888d16..6ff5d655c202 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -434,20 +434,28 @@ i915_gem_object_wait_reservation(struct reservation_object *resv,
                         dma_fence_put(shared[i]);
                 kfree(shared);
 
+                /*
+                 * If both shared fences and an exclusive fence exist,
+                 * then by construction the shared fences must be later
+                 * than the exclusive fence. If we successfully wait for
+                 * all the shared fences, we know that the exclusive fence
+                 * must all be signaled. If all the shared fences are
+                 * signaled, we can prune the array and recover the
+                 * floating references on the fences/requests.
+                 */
                 prune_fences = count && timeout >= 0;
         } else {
                 excl = reservation_object_get_excl_rcu(resv);
         }
 
-        if (excl && timeout >= 0) {
+        if (excl && timeout >= 0)
                 timeout = i915_gem_object_wait_fence(excl, flags, timeout,
                                                      rps_client);
-                prune_fences = timeout >= 0;
-        }
 
         dma_fence_put(excl);
 
-        /* Oportunistically prune the fences iff we know they have *all* been
+        /*
+         * Opportunistically prune the fences iff we know they have *all* been
          * signaled and that the reservation object has not been changed (i.e.
          * no new fences have been added).
          */
diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c
index b33d2158c234..e5e6f6bb2b05 100644
--- a/drivers/gpu/drm/i915/i915_sysfs.c
+++ b/drivers/gpu/drm/i915/i915_sysfs.c
@@ -304,8 +304,9 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
 {
         struct drm_i915_private *dev_priv = kdev_minor_to_i915(kdev);
         struct intel_rps *rps = &dev_priv->gt_pm.rps;
-        u32 val;
+        bool boost = false;
         ssize_t ret;
+        u32 val;
 
         ret = kstrtou32(buf, 0, &val);
         if (ret)
@@ -317,8 +318,13 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
                 return -EINVAL;
 
         mutex_lock(&dev_priv->pcu_lock);
-        rps->boost_freq = val;
+        if (val != rps->boost_freq) {
+                rps->boost_freq = val;
+                boost = atomic_read(&rps->num_waiters);
+        }
         mutex_unlock(&dev_priv->pcu_lock);
+        if (boost)
+                schedule_work(&rps->work);
 
         return count;
 }
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f51645a08dca..6aff9d096e13 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2175,8 +2175,7 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
                 intel_prepare_dp_ddi_buffers(encoder, crtc_state);
 
         intel_ddi_init_dp_buf_reg(encoder);
-        if (!is_mst)
-                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
         intel_dp_start_link_train(intel_dp);
         if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
                 intel_dp_stop_link_train(intel_dp);
@@ -2274,14 +2273,12 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_digital_port *dig_port = enc_to_dig_port(&encoder->base);
         struct intel_dp *intel_dp = &dig_port->dp;
-        bool is_mst = intel_crtc_has_type(old_crtc_state, INTEL_OUTPUT_DP_MST);
 
         /*
          * Power down sink before disabling the port, otherwise we end
          * up getting interrupts from the sink on detecting link loss.
          */
-        if (!is_mst)
-                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
 
         intel_disable_ddi_buf(encoder);
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 35c5299feab6..a29868cd30c7 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -620,19 +620,15 @@ static int
 bxt_power_sequencer_idx(struct intel_dp *intel_dp)
 {
         struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
+        int backlight_controller = dev_priv->vbt.backlight.controller;
 
         lockdep_assert_held(&dev_priv->pps_mutex);
 
         /* We should never land here with regular DP ports */
         WARN_ON(!intel_dp_is_edp(intel_dp));
 
-        /*
-         * TODO: BXT has 2 PPS instances. The correct port->PPS instance
-         * mapping needs to be retrieved from VBT, for now just hard-code to
-         * use instance #0 always.
-         */
         if (!intel_dp->pps_reset)
-                return 0;
+                return backlight_controller;
 
         intel_dp->pps_reset = false;
 
@@ -642,7 +638,7 @@ bxt_power_sequencer_idx(struct intel_dp *intel_dp)
          */
         intel_dp_init_panel_power_sequencer_registers(intel_dp, false);
 
-        return 0;
+        return backlight_controller;
 }
 
 typedef bool (*vlv_pipe_check)(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_hangcheck.c b/drivers/gpu/drm/i915/intel_hangcheck.c
index 348a4f7ffb67..53747318f4a7 100644
--- a/drivers/gpu/drm/i915/intel_hangcheck.c
+++ b/drivers/gpu/drm/i915/intel_hangcheck.c
@@ -246,7 +246,7 @@ engine_stuck(struct intel_engine_cs *engine, u64 acthd)
          */
         tmp = I915_READ_CTL(engine);
         if (tmp & RING_WAIT) {
-                i915_handle_error(dev_priv, 0,
+                i915_handle_error(dev_priv, BIT(engine->id),
                                   "Kicking stuck wait on %s",
                                   engine->name);
                 I915_WRITE_CTL(engine, tmp);
@@ -258,7 +258,7 @@ engine_stuck(struct intel_engine_cs *engine, u64 acthd)
                 default:
                         return ENGINE_DEAD;
                 case 1:
-                        i915_handle_error(dev_priv, 0,
+                        i915_handle_error(dev_priv, ALL_ENGINES,
                                           "Kicking stuck semaphore on %s",
                                           engine->name);
                         I915_WRITE_CTL(engine, tmp);
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 9a9961802f5c..e83af0f2be86 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -225,7 +225,11 @@ static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                   struct drm_crtc_state *old_crtc_state)
 {
         drm_crtc_vblank_on(crtc);
+}
 
+static void ipu_crtc_atomic_flush(struct drm_crtc *crtc,
+                                  struct drm_crtc_state *old_crtc_state)
+{
         spin_lock_irq(&crtc->dev->event_lock);
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc));
@@ -293,6 +297,7 @@ static const struct drm_crtc_helper_funcs ipu_helper_funcs = {
         .mode_set_nofb = ipu_crtc_mode_set_nofb,
         .atomic_check = ipu_crtc_atomic_check,
         .atomic_begin = ipu_crtc_atomic_begin,
+        .atomic_flush = ipu_crtc_atomic_flush,
         .atomic_disable = ipu_crtc_atomic_disable,
         .atomic_enable = ipu_crtc_atomic_enable,
 };
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 57ed56d8623f..d9113faaa62f 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -22,6 +22,7 @@
 #include <drm/drm_plane_helper.h>
 
 #include "video/imx-ipu-v3.h"
+#include "imx-drm.h"
 #include "ipuv3-plane.h"
 
 struct ipu_plane_state {
@@ -272,7 +273,7 @@ static void ipu_plane_destroy(struct drm_plane *plane)
         kfree(ipu_plane);
 }
 
-void ipu_plane_state_reset(struct drm_plane *plane)
+static void ipu_plane_state_reset(struct drm_plane *plane)
 {
         struct ipu_plane_state *ipu_state;
 
@@ -292,7 +293,8 @@ void ipu_plane_state_reset(struct drm_plane *plane)
         plane->state = &ipu_state->base;
 }
 
-struct drm_plane_state *ipu_plane_duplicate_state(struct drm_plane *plane)
+static struct drm_plane_state *
+ipu_plane_duplicate_state(struct drm_plane *plane)
 {
         struct ipu_plane_state *state;
 
@@ -306,8 +308,8 @@ struct drm_plane_state *ipu_plane_duplicate_state(struct drm_plane *plane)
         return &state->base;
 }
 
-void ipu_plane_destroy_state(struct drm_plane *plane,
-                             struct drm_plane_state *state)
+static void ipu_plane_destroy_state(struct drm_plane *plane,
+                                    struct drm_plane_state *state)
 {
         struct ipu_plane_state *ipu_state = to_ipu_plane_state(state);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index 380f340204e8..debbbf0fd4bd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -134,7 +134,7 @@ nv50_get_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div = 1025;
         u32 val;
 
@@ -149,7 +149,7 @@ nv50_set_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div = 1025;
         u32 val = (bd->props.brightness * div) / 100;
 
@@ -170,7 +170,7 @@ nva3_get_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div, val;
 
         div  = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -188,7 +188,7 @@ nva3_set_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div, val;
 
         div = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -228,7 +228,7 @@ nv50_backlight_init(struct drm_connector *connector)
                         return -ENODEV;
         }
 
-        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(nv_encoder->or)))
+        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1)))
                 return 0;
 
         if (drm->client.device.info.chipset <= 0xa0 ||
@@ -268,13 +268,13 @@ nouveau_backlight_init(struct drm_device *dev)
         struct nvif_device *device = &drm->client.device;
         struct drm_connector *connector;
 
+        INIT_LIST_HEAD(&drm->bl_connectors);
+
         if (apple_gmux_present()) {
                 NV_INFO(drm, "Apple GMUX detected: not registering Nouveau backlight interface\n");
                 return 0;
         }
 
-        INIT_LIST_HEAD(&drm->bl_connectors);
-
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
                     connector->connector_type != DRM_MODE_CONNECTOR_eDP)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index 93946dcee319..1c12e58f44c2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1354,7 +1354,7 @@ nvkm_vmm_get_locked(struct nvkm_vmm *vmm, bool getref, bool mapref, bool sparse,
 
                 tail = this->addr + this->size;
                 if (vmm->func->page_block && next && next->page != p)
-                        tail = ALIGN_DOWN(addr, vmm->func->page_block);
+                        tail = ALIGN_DOWN(tail, vmm->func->page_block);
 
                 if (addr <= tail && tail - addr >= size) {
                         rb_erase(&this->tree, &vmm->free);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2e2ca3c6b47d..df9469a8fdb1 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -90,25 +90,18 @@ void radeon_connector_hotplug(struct drm_connector *connector)
                 /* don't do anything if sink is not display port, i.e.,
                  * passive dp->(dvi|hdmi) adaptor
                  */
-                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
-                        int saved_dpms = connector->dpms;
-                        /* Only turn off the display if it's physically disconnected */
-                        if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
-                        } else if (radeon_dp_needs_link_train(radeon_connector)) {
-                                /* Don't try to start link training before we
-                                 * have the dpcd */
-                                if (!radeon_dp_getdpcd(radeon_connector))
-                                        return;
-
-                                /* set it to OFF so that drm_helper_connector_dpms()
-                                 * won't return immediately since the current state
-                                 * is ON at this point.
-                                 */
-                                connector->dpms = DRM_MODE_DPMS_OFF;
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                        }
-                        connector->dpms = saved_dpms;
+                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
+                    radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                    radeon_dp_needs_link_train(radeon_connector)) {
+                        /* Don't start link training before we have the DPCD */
+                        if (!radeon_dp_getdpcd(radeon_connector))
+                                return;
+
+                        /* Turn the connector off and back on immediately, which
+                         * will trigger link training
+                         */
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 }
         }
 }
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index a9962ffba720..27d8e7dd2d06 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -34,8 +34,6 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
         struct radeon_bo *robj = gem_to_radeon_bo(gobj);
 
         if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                 radeon_mn_unregister(robj);
                 radeon_bo_unref(&robj);
         }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 15404af9d740..31f5ad605e59 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -82,6 +82,8 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
         mutex_unlock(&bo->rdev->gem.mutex);
         radeon_bo_clear_surface_reg(bo);
         WARN_ON_ONCE(!list_empty(&bo->va));
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
         drm_gem_object_release(&bo->gem_base);
         kfree(bo);
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 4570da0227b4..d9a71f361b14 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -111,7 +111,7 @@ static int sun4i_drv_bind(struct device *dev)
         /* drm_vblank_init calls kcalloc, which can fail */
         ret = drm_vblank_init(drm, drm->mode_config.num_crtc);
         if (ret)
-                goto free_mem_region;
+                goto cleanup_mode_config;
 
         drm->irq_enabled = true;
 
@@ -139,7 +139,6 @@ finish_poll:
         sun4i_framebuffer_free(drm);
 cleanup_mode_config:
         drm_mode_config_cleanup(drm);
-free_mem_region:
         of_reserved_mem_device_release(dev);
 free_drm:
         drm_dev_unref(drm);
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 500b6fb3e028..fa4bcd092eaf 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -538,7 +538,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                                              &sun4i_hdmi_regmap_config);
         if (IS_ERR(hdmi->regmap)) {
                 dev_err(dev, "Couldn't create HDMI encoder regmap\n");
-                return PTR_ERR(hdmi->regmap);
+                ret = PTR_ERR(hdmi->regmap);
+                goto err_disable_mod_clk;
         }
 
         ret = sun4i_tmds_create(hdmi);
@@ -551,7 +552,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                 hdmi->ddc_parent_clk = devm_clk_get(dev, "ddc");
                 if (IS_ERR(hdmi->ddc_parent_clk)) {
                         dev_err(dev, "Couldn't get the HDMI DDC clock\n");
-                        return PTR_ERR(hdmi->ddc_parent_clk);
+                        ret = PTR_ERR(hdmi->ddc_parent_clk);
+                        goto err_disable_mod_clk;
                 }
         } else {
                 hdmi->ddc_parent_clk = hdmi->tmds_clk;
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 2de586b7c98b..a818ca491605 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -103,6 +103,7 @@ static void sun4i_tcon_channel_set_status(struct sun4i_tcon *tcon, int channel,
 
         if (enabled) {
                 clk_prepare_enable(clk);
+                clk_rate_exclusive_get(clk);
         } else {
                 clk_rate_exclusive_put(clk);
                 clk_disable_unprepare(clk);
@@ -262,7 +263,7 @@ static void sun4i_tcon0_mode_set_common(struct sun4i_tcon *tcon,
                                         const struct drm_display_mode *mode)
 {
         /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->dclk, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->dclk, mode->crtc_clock * 1000);
 
         /* Set the resolution */
         regmap_write(tcon->regs, SUN4I_TCON0_BASIC0_REG,
@@ -423,7 +424,7 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
         WARN_ON(!tcon->quirks->has_channel_1);
 
         /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->sclk1, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->sclk1, mode->crtc_clock * 1000);
 
         /* Adjust clock delay */
         clk_delay = sun4i_tcon_get_clk_delay(mode, 1);
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index b8403ed48285..fbffe1948b3b 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -1903,8 +1903,12 @@ cleanup:
         if (!IS_ERR(primary))
                 drm_plane_cleanup(primary);
 
-        if (group && tegra->domain) {
-                iommu_detach_group(tegra->domain, group);
+        if (group && dc->domain) {
+                if (group == tegra->group) {
+                        iommu_detach_group(dc->domain, group);
+                        tegra->group = NULL;
+                }
+
                 dc->domain = NULL;
         }
 
@@ -1913,8 +1917,10 @@ cleanup:
 
 static int tegra_dc_exit(struct host1x_client *client)
 {
+        struct drm_device *drm = dev_get_drvdata(client->parent);
         struct iommu_group *group = iommu_group_get(client->dev);
         struct tegra_dc *dc = host1x_client_to_dc(client);
+        struct tegra_drm *tegra = drm->dev_private;
         int err;
 
         devm_free_irq(dc->dev, dc->irq, dc);
@@ -1926,7 +1932,11 @@ static int tegra_dc_exit(struct host1x_client *client)
         }
 
         if (group && dc->domain) {
-                iommu_detach_group(dc->domain, group);
+                if (group == tegra->group) {
+                        iommu_detach_group(dc->domain, group);
+                        tegra->group = NULL;
+                }
+
                 dc->domain = NULL;
         }
 
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index d50bddb2e447..7fcf4a242840 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -250,6 +250,7 @@ static void tegra_drm_unload(struct drm_device *drm)
 
         drm_kms_helper_poll_fini(drm);
         tegra_drm_fb_exit(drm);
+        drm_atomic_helper_shutdown(drm);
         drm_mode_config_cleanup(drm);
 
         err = host1x_device_exit(device);
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 4d2ed966f9e3..87c5d89bc9ba 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -1072,7 +1072,6 @@ static int tegra_dsi_exit(struct host1x_client *client)
         struct tegra_dsi *dsi = host1x_client_to_dsi(client);
 
         tegra_output_exit(&dsi->output);
-        regulator_disable(dsi->vdd);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/tegra/plane.c b/drivers/gpu/drm/tegra/plane.c
index 36a06a993698..94dac79ac3c9 100644
--- a/drivers/gpu/drm/tegra/plane.c
+++ b/drivers/gpu/drm/tegra/plane.c
@@ -297,6 +297,10 @@ int tegra_plane_format_get_alpha(unsigned int opaque, unsigned int *alpha)
         case WIN_COLOR_DEPTH_B8G8R8X8:
                 *alpha = WIN_COLOR_DEPTH_B8G8R8A8;
                 return 0;
+
+        case WIN_COLOR_DEPTH_B5G6R5:
+                *alpha = opaque;
+                return 0;
         }
 
         return -EINVAL;
@@ -330,9 +334,6 @@ void tegra_plane_check_dependent(struct tegra_plane *tegra,
         unsigned int zpos[2];
         unsigned int i;
 
-        for (i = 0; i < 3; i++)
-                state->dependent[i] = false;
-
         for (i = 0; i < 2; i++)
                 zpos[i] = 0;
 
@@ -346,6 +347,8 @@ void tegra_plane_check_dependent(struct tegra_plane *tegra,
 
                 index = tegra_plane_get_overlap_index(tegra, p);
 
+                state->dependent[index] = false;
+
                 /*
                  * If any of the other planes is on top of this plane and uses
                  * a format with an alpha component, mark this plane as being
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index b5b335c9b2bb..2ebdc6d5a76e 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
         unsigned long start = vma->vm_start;
         unsigned long size = vma->vm_end - vma->vm_start;
-        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+        unsigned long offset;
         unsigned long page, pos;
 
-        if (offset + size > info->fix.smem_len)
+        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+                return -EINVAL;
+
+        offset = vma->vm_pgoff << PAGE_SHIFT;
+
+        if (offset > info->fix.smem_len || size > info->fix.smem_len - offset)
                 return -EINVAL;
 
         pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 184340d486c3..86d25f18aa99 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1337,6 +1337,19 @@ static void __vmw_svga_disable(struct vmw_private *dev_priv)
  */
 void vmw_svga_disable(struct vmw_private *dev_priv)
 {
+        /*
+         * Disabling SVGA will turn off device modesetting capabilities, so
+         * notify KMS about that so that it doesn't cache atomic state that
+         * isn't valid anymore, for example crtcs turned on.
+         * Strictly we'd want to do this under the SVGA lock (or an SVGA mutex),
+         * but vmw_kms_lost_device() takes the reservation sem and thus we'll
+         * end up with lock order reversal. Thus, a master may actually perform
+         * a new modeset just after we call vmw_kms_lost_device() and race with
+         * vmw_svga_disable(), but that should at worst cause atomic KMS state
+         * to be inconsistent with the device, causing modesetting problems.
+         *
+         */
+        vmw_kms_lost_device(dev_priv->dev);
         ttm_write_lock(&dev_priv->reservation_sem, false);
         spin_lock(&dev_priv->svga_lock);
         if (dev_priv->bdev.man[TTM_PL_VRAM].use_type) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index d08753e8fd94..9116fe8baebc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -938,6 +938,7 @@ int vmw_kms_present(struct vmw_private *dev_priv,
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
 void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv);
+void vmw_kms_lost_device(struct drm_device *dev);
 
 int vmw_dumb_create(struct drm_file *file_priv,
                     struct drm_device *dev,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ead61015cd79..3c824fd7cbf3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -31,7 +31,6 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_rect.h>
 
-
 /* Might need a hrtimer here? */
 #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1)
 
@@ -2517,9 +2516,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
  * Helper to be used if an error forces the caller to undo the actions of
  * vmw_kms_helper_resource_prepare.
  */
-void vmw_kms_helper_resource_revert(struct vmw_resource *res)
+void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx)
 {
-        vmw_kms_helper_buffer_revert(res->backup);
+        struct vmw_resource *res = ctx->res;
+
+        vmw_kms_helper_buffer_revert(ctx->buf);
+        vmw_dmabuf_unreference(&ctx->buf);
         vmw_resource_unreserve(res, false, NULL, 0);
         mutex_unlock(&res->dev_priv->cmdbuf_mutex);
 }
@@ -2536,10 +2538,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res)
  * interrupted by a signal.
  */
 int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
-                                    bool interruptible)
+                                    bool interruptible,
+                                    struct vmw_validation_ctx *ctx)
 {
         int ret = 0;
 
+        ctx->buf = NULL;
+        ctx->res = res;
+
         if (interruptible)
                 ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex);
         else
@@ -2558,6 +2564,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
                                                     res->dev_priv->has_mob);
                 if (ret)
                         goto out_unreserve;
+
+                ctx->buf = vmw_dmabuf_reference(res->backup);
         }
         ret = vmw_resource_validate(res);
         if (ret)
@@ -2565,7 +2573,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
         return 0;
 
 out_revert:
-        vmw_kms_helper_buffer_revert(res->backup);
+        vmw_kms_helper_buffer_revert(ctx->buf);
 out_unreserve:
         vmw_resource_unreserve(res, false, NULL, 0);
 out_unlock:
@@ -2581,11 +2589,13 @@ out_unlock:
  * @out_fence: Optional pointer to a fence pointer. If non-NULL, a
  * ref-counted fence pointer is returned here.
  */
-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
-                             struct vmw_fence_obj **out_fence)
+void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
+                                    struct vmw_fence_obj **out_fence)
 {
-        if (res->backup || out_fence)
-                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup,
+        struct vmw_resource *res = ctx->res;
+
+        if (ctx->buf || out_fence)
+                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf,
                                              out_fence, NULL);
 
         vmw_resource_unreserve(res, false, NULL, 0);
@@ -2851,3 +2861,14 @@ int vmw_kms_set_config(struct drm_mode_set *set,
 
         return drm_atomic_helper_set_config(set, ctx);
 }
+
+
+/**
+ * vmw_kms_lost_device - Notify kms that modesetting capabilities will be lost
+ *
+ * @dev: Pointer to the drm device
+ */
+void vmw_kms_lost_device(struct drm_device *dev)
+{
+        drm_atomic_helper_shutdown(dev);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index cd9da2dd79af..3d2ca280eaa7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -240,6 +240,11 @@ struct vmw_display_unit {
         int set_gui_y;
 };
 
+struct vmw_validation_ctx {
+        struct vmw_resource *res;
+        struct vmw_dma_buffer *buf;
+};
+
 #define vmw_crtc_to_du(x) \
         container_of(x, struct vmw_display_unit, crtc)
 #define vmw_connector_to_du(x) \
@@ -296,9 +301,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
                                   struct drm_vmw_fence_rep __user *
                                   user_fence_rep);
 int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
-                                    bool interruptible);
-void vmw_kms_helper_resource_revert(struct vmw_resource *res);
-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
+                                    bool interruptible,
+                                    struct vmw_validation_ctx *ctx);
+void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx);
+void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
                                     struct vmw_fence_obj **out_fence);
 int vmw_kms_readback(struct vmw_private *dev_priv,
                      struct drm_file *file_priv,
@@ -439,5 +445,4 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
 
 int vmw_kms_set_config(struct drm_mode_set *set,
                        struct drm_modeset_acquire_ctx *ctx);
-
 #endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 63a4cd794b73..3ec9eae831b8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -909,12 +909,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
         struct vmw_framebuffer_surface *vfbs =
                 container_of(framebuffer, typeof(*vfbs), base);
         struct vmw_kms_sou_surface_dirty sdirty;
+        struct vmw_validation_ctx ctx;
         int ret;
 
         if (!srf)
                 srf = &vfbs->surface->res;
 
-        ret = vmw_kms_helper_resource_prepare(srf, true);
+        ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
         if (ret)
                 return ret;
 
@@ -933,7 +934,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
         ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips,
                                    dest_x, dest_y, num_clips, inc,
                                    &sdirty.base);
-        vmw_kms_helper_resource_finish(srf, out_fence);
+        vmw_kms_helper_resource_finish(&ctx, out_fence);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index b68d74888ab1..6b969e5dea2a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -980,12 +980,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
         struct vmw_framebuffer_surface *vfbs =
                 container_of(framebuffer, typeof(*vfbs), base);
         struct vmw_stdu_dirty sdirty;
+        struct vmw_validation_ctx ctx;
         int ret;
 
         if (!srf)
                 srf = &vfbs->surface->res;
 
-        ret = vmw_kms_helper_resource_prepare(srf, true);
+        ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
         if (ret)
                 return ret;
 
@@ -1008,7 +1009,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
                                    dest_x, dest_y, num_clips, inc,
                                    &sdirty.base);
 out_finish:
-        vmw_kms_helper_resource_finish(srf, out_fence);
+        vmw_kms_helper_resource_finish(&ctx, out_fence);
 
         return ret;
 }
diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c
index 97b99500153d..83f9dd934a5d 100644
--- a/drivers/gpu/ipu-v3/ipu-prg.c
+++ b/drivers/gpu/ipu-v3/ipu-prg.c
@@ -250,10 +250,14 @@ void ipu_prg_channel_disable(struct ipuv3_channel *ipu_chan)
 {
         int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num);
         struct ipu_prg *prg = ipu_chan->ipu->prg_priv;
-        struct ipu_prg_channel *chan = &prg->chan[prg_chan];
+        struct ipu_prg_channel *chan;
         u32 val;
 
-        if (!chan->enabled || prg_chan < 0)
+        if (prg_chan < 0)
+                return;
+
+        chan = &prg->chan[prg_chan];
+        if (!chan->enabled)
                 return;
 
         pm_runtime_get_sync(prg->dev);
@@ -280,13 +284,15 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan,
 {
         int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num);
         struct ipu_prg *prg = ipu_chan->ipu->prg_priv;
-        struct ipu_prg_channel *chan = &prg->chan[prg_chan];
+        struct ipu_prg_channel *chan;
         u32 val;
         int ret;
 
         if (prg_chan < 0)
                 return prg_chan;
 
+        chan = &prg->chan[prg_chan];
+
         if (chan->enabled) {
                 ipu_pre_update(prg->pres[chan->used_pre], *eba);
                 return 0;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 50e071444a5c..8699bb969e7e 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -417,13 +417,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel,
 }
 EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);
 
+/* How many bytes were read in this iterator cycle */
+static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,
+                                        u32 start_read_index)
+{
+        if (rbi->priv_read_index >= start_read_index)
+                return rbi->priv_read_index - start_read_index;
+        else
+                return rbi->ring_datasize - start_read_index +
+                        rbi->priv_read_index;
+}
+
 /*
  * Update host ring buffer after iterating over packets.
  */
 void hv_pkt_iter_close(struct vmbus_channel *channel)
 {
         struct hv_ring_buffer_info *rbi = &channel->inbound;
-        u32 orig_write_sz = hv_get_bytes_to_write(rbi);
+        u32 curr_write_sz, pending_sz, bytes_read, start_read_index;
 
         /*
          * Make sure all reads are done before we update the read index since
@@ -431,8 +442,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          * is updated.
          */
         virt_rmb();
+        start_read_index = rbi->ring_buffer->read_index;
         rbi->ring_buffer->read_index = rbi->priv_read_index;
 
+        if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)
+                return;
+
         /*
          * Issue a full memory barrier before making the signaling decision.
          * Here is the reason for having this barrier:
@@ -446,26 +461,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          */
         virt_mb();
 
-        /* If host has disabled notifications then skip */
-        if (rbi->ring_buffer->interrupt_mask)
+        pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        if (!pending_sz)
                 return;
 
-        if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
-                u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        /*
+         * Ensure the read of write_index in hv_get_bytes_to_write()
+         * happens after the read of pending_send_sz.
+         */
+        virt_rmb();
+        curr_write_sz = hv_get_bytes_to_write(rbi);
+        bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);
 
-                /*
-                 * If there was space before we began iteration,
-                 * then host was not blocked. Also handles case where
-                 * pending_sz is zero then host has nothing pending
-                 * and does not need to be signaled.
-                 */
-                if (orig_write_sz > pending_sz)
-                        return;
+        /*
+         * If there was space before we began iteration,
+         * then host was not blocked.
+         */
 
-                /* If pending write will not fit, don't give false hope. */
-                if (hv_get_bytes_to_write(rbi) < pending_sz)
-                        return;
-        }
+        if (curr_write_sz - bytes_read > pending_sz)
+                return;
+
+        /* If pending write will not fit, don't give false hope. */
+        if (curr_write_sz <= pending_sz)
+                return;
 
         vmbus_setevent(channel);
 }
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 6fe995cf16a6..3e6fd5a8ac5b 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -920,6 +920,8 @@ static const struct iio_trigger_ops st_accel_trigger_ops = {
 int st_accel_common_probe(struct iio_dev *indio_dev)
 {
         struct st_sensor_data *adata = iio_priv(indio_dev);
+        struct st_sensors_platform_data *pdata =
+                (struct st_sensors_platform_data *)adata->dev->platform_data;
         int irq = adata->get_irq_data_ready(indio_dev);
         int err;
 
@@ -946,7 +948,10 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
                                         &adata->sensor_settings->fs.fs_avl[0];
         adata->odr = adata->sensor_settings->odr.odr_avl[0].hz;
 
-        err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data);
+        if (!pdata)
+                pdata = (struct st_sensors_platform_data *)&default_accel_pdata;
+
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_accel_power_off;
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 29fa7736d80c..ede955d9b2a4 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -462,8 +462,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev)
                         regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val);
                 } while (val & MESON_SAR_ADC_DELAY_BL30_BUSY && timeout--);
 
-                if (timeout < 0)
+                if (timeout < 0) {
+                        mutex_unlock(&indio_dev->mlock);
                         return -ETIMEDOUT;
+                }
         }
 
         return 0;
diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
index daa026d6a94f..01422d11753c 100644
--- a/drivers/iio/adc/stm32-dfsdm-adc.c
+++ b/drivers/iio/adc/stm32-dfsdm-adc.c
@@ -54,7 +54,6 @@ struct stm32_dfsdm_adc {
         struct stm32_dfsdm *dfsdm;
         const struct stm32_dfsdm_dev_data *dev_data;
         unsigned int fl_id;
-        unsigned int ch_id;
 
         /* ADC specific */
         unsigned int oversamp;
@@ -384,7 +383,7 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int sample_freq = adc->sample_freq;
         unsigned int spi_freq;
         int ret;
@@ -419,18 +418,20 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
         return len;
 }
 
-static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc, bool dma)
+static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan,
+                                  bool dma)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
         int ret;
         unsigned int dma_en = 0, cont_en = 0;
 
-        ret = stm32_dfsdm_start_channel(adc->dfsdm, adc->ch_id);
+        ret = stm32_dfsdm_start_channel(adc->dfsdm, chan->channel);
         if (ret < 0)
                 return ret;
 
         ret = stm32_dfsdm_filter_configure(adc->dfsdm, adc->fl_id,
-                                           adc->ch_id);
+                                           chan->channel);
         if (ret < 0)
                 goto stop_channels;
 
@@ -464,12 +465,13 @@ stop_channels:
 
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->fl_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 
         return ret;
 }
 
-static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
+static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
 
@@ -482,7 +484,7 @@ static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
 
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->ch_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 }
 
 static int stm32_dfsdm_set_watermark(struct iio_dev *indio_dev,
@@ -609,6 +611,7 @@ static int stm32_dfsdm_adc_dma_start(struct iio_dev *indio_dev)
 static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
         int ret;
 
         /* Reset adc buffer index */
@@ -618,7 +621,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         if (ret < 0)
                 return ret;
 
-        ret = stm32_dfsdm_start_conv(adc, true);
+        ret = stm32_dfsdm_start_conv(adc, chan, true);
         if (ret) {
                 dev_err(&indio_dev->dev, "Can't start conversion\n");
                 goto stop_dfsdm;
@@ -635,7 +638,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         return 0;
 
 err_stop_conv:
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -645,11 +648,12 @@ stop_dfsdm:
 static int stm32_dfsdm_predisable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
 
         if (adc->dma_chan)
                 dmaengine_terminate_all(adc->dma_chan);
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -730,7 +734,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         if (ret < 0)
                 goto stop_dfsdm;
 
-        ret = stm32_dfsdm_start_conv(adc, false);
+        ret = stm32_dfsdm_start_conv(adc, chan, false);
         if (ret < 0) {
                 regmap_update_bits(adc->dfsdm->regmap, DFSDM_CR2(adc->fl_id),
                                    DFSDM_CR2_REOCIE_MASK, DFSDM_CR2_REOCIE(0));
@@ -751,7 +755,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         else
                 ret = IIO_VAL_INT;
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
@@ -765,7 +769,7 @@ static int stm32_dfsdm_write_raw(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int spi_freq = adc->spi_freq;
         int ret = -EINVAL;
 
@@ -972,7 +976,6 @@ static int stm32_dfsdm_adc_chan_init_one(struct iio_dev *indio_dev,
         }
         ch->scan_type.realbits = 24;
         ch->scan_type.storagebits = 32;
-        adc->ch_id = ch->channel;
 
         return stm32_dfsdm_chan_configure(adc->dfsdm,
                                           &adc->dfsdm->ch_list[ch->channel]);
@@ -1001,7 +1004,7 @@ static int stm32_dfsdm_audio_init(struct iio_dev *indio_dev)
         }
         ch->info_mask_separate = BIT(IIO_CHAN_INFO_SAMP_FREQ);
 
-        d_ch = &adc->dfsdm->ch_list[adc->ch_id];
+        d_ch = &adc->dfsdm->ch_list[ch->channel];
         if (d_ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL)
                 adc->spi_freq = adc->dfsdm->spi_master_freq;
 
@@ -1042,8 +1045,8 @@ static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev)
                 return -ENOMEM;
 
         for (chan_idx = 0; chan_idx < num_ch; chan_idx++) {
-                ch->scan_index = chan_idx;
-                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, ch);
+                ch[chan_idx].scan_index = chan_idx;
+                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, &ch[chan_idx]);
                 if (ret < 0) {
                         dev_err(&indio_dev->dev, "Channels init failed\n");
                         return ret;
diff --git a/drivers/iio/adc/stm32-dfsdm-core.c b/drivers/iio/adc/stm32-dfsdm-core.c
index 6290332cfd3f..e50efdcc41ff 100644
--- a/drivers/iio/adc/stm32-dfsdm-core.c
+++ b/drivers/iio/adc/stm32-dfsdm-core.c
@@ -83,7 +83,7 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
 {
         struct dfsdm_priv *priv = container_of(dfsdm, struct dfsdm_priv, dfsdm);
         struct device *dev = &priv->pdev->dev;
-        unsigned int clk_div = priv->spi_clk_out_div;
+        unsigned int clk_div = priv->spi_clk_out_div, clk_src;
         int ret;
 
         if (atomic_inc_return(&priv->n_active_ch) == 1) {
@@ -100,6 +100,14 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
                         }
                 }
 
+                /* select clock source, e.g. 0 for "dfsdm" or 1 for "audio" */
+                clk_src = priv->aclk ? 1 : 0;
+                ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
+                                         DFSDM_CHCFGR1_CKOUTSRC_MASK,
+                                         DFSDM_CHCFGR1_CKOUTSRC(clk_src));
+                if (ret < 0)
+                        goto disable_aclk;
+
                 /* Output the SPI CLKOUT (if clk_div == 0 clock if OFF) */
                 ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
                                          DFSDM_CHCFGR1_CKOUTDIV_MASK,
@@ -274,7 +282,7 @@ static int stm32_dfsdm_probe(struct platform_device *pdev)
 
         dfsdm->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "dfsdm",
                                                   dfsdm->base,
-                                                  &stm32h7_dfsdm_regmap_cfg);
+                                                  dev_data->regmap_cfg);
         if (IS_ERR(dfsdm->regmap)) {
                 ret = PTR_ERR(dfsdm->regmap);
                 dev_err(&pdev->dev, "%s: Failed to allocate regmap: %d\n",
diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
index fbe2431f5b81..1ea9f5513b02 100644
--- a/drivers/iio/chemical/ccs811.c
+++ b/drivers/iio/chemical/ccs811.c
@@ -133,6 +133,9 @@ static int ccs811_start_sensor_application(struct i2c_client *client)
         if (ret < 0)
                 return ret;
 
+        if ((ret & CCS811_STATUS_FW_MODE_APPLICATION))
+                return 0;
+
         if ((ret & CCS811_STATUS_APP_VALID_MASK) !=
             CCS811_STATUS_APP_VALID_LOADED)
                 return -EIO;
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 349e5c713c03..4ddb6cf7d401 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -640,7 +640,7 @@ int st_press_common_probe(struct iio_dev *indio_dev)
                        press_data->sensor_settings->drdy_irq.int2.addr))
                 pdata = (struct st_sensors_platform_data *)&default_press_pdata;
 
-        err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data);
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_press_power_off;
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index e66963ca58bd..a5367c5efbe7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3069,7 +3069,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list,
                         continue;
 
                 /* different dest port -> unique */
-                if (!cma_any_port(cur_daddr) &&
+                if (!cma_any_port(daddr) &&
+                    !cma_any_port(cur_daddr) &&
                     (dport != cur_dport))
                         continue;
 
@@ -3080,7 +3081,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list,
                         continue;
 
                 /* different dst address -> unique */
-                if (!cma_any_addr(cur_daddr) &&
+                if (!cma_any_addr(daddr) &&
+                    !cma_any_addr(cur_daddr) &&
                     cma_addr_cmp(daddr, cur_daddr))
                         continue;
 
@@ -3378,13 +3380,13 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
                 }
 #endif
         }
+        daddr = cma_dst_addr(id_priv);
+        daddr->sa_family = addr->sa_family;
+
         ret = cma_get_port(id_priv);
         if (ret)
                 goto err2;
 
-        daddr = cma_dst_addr(id_priv);
-        daddr->sa_family = addr->sa_family;
-
         return 0;
 err2:
         if (id_priv->cma_dev)
@@ -4173,6 +4175,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr,
         struct cma_multicast *mc;
         int ret;
 
+        if (!id->device)
+                return -EINVAL;
+
         id_priv = container_of(id, struct rdma_id_private, id);
         if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) &&
             !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED))
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 3a9d0f5b5881..e5a1e7d81326 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id,
         ctx = idr_find(&ctx_idr, id);
         if (!ctx)
                 ctx = ERR_PTR(-ENOENT);
-        else if (ctx->file != file)
+        else if (ctx->file != file || !ctx->cm_id)
                 ctx = ERR_PTR(-EINVAL);
         return ctx;
 }
@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
         struct rdma_ucm_create_id cmd;
         struct rdma_ucm_create_id_resp resp;
         struct ucma_context *ctx;
+        struct rdma_cm_id *cm_id;
         enum ib_qp_type qp_type;
         int ret;
 
@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                 return -ENOMEM;
 
         ctx->uid = cmd.uid;
-        ctx->cm_id = rdma_create_id(current->nsproxy->net_ns,
-                                    ucma_event_handler, ctx, cmd.ps, qp_type);
-        if (IS_ERR(ctx->cm_id)) {
-                ret = PTR_ERR(ctx->cm_id);
+        cm_id = rdma_create_id(current->nsproxy->net_ns,
+                               ucma_event_handler, ctx, cmd.ps, qp_type);
+        if (IS_ERR(cm_id)) {
+                ret = PTR_ERR(cm_id);
                 goto err1;
         }
 
@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                 ret = -EFAULT;
                 goto err2;
         }
+
+        ctx->cm_id = cm_id;
         return 0;
 
 err2:
-        rdma_destroy_id(ctx->cm_id);
+        rdma_destroy_id(cm_id);
 err1:
         mutex_lock(&mut);
         idr_remove(&ctx_idr, ctx->id);
         mutex_unlock(&mut);
+        mutex_lock(&file->mut);
+        list_del(&ctx->list);
+        mutex_unlock(&file->mut);
         kfree(ctx);
         return ret;
 }
@@ -664,19 +670,23 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                                int in_len, int out_len)
 {
         struct rdma_ucm_resolve_ip cmd;
+        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        src = (struct sockaddr *) &cmd.src_addr;
+        dst = (struct sockaddr *) &cmd.dst_addr;
+        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
-                                (struct sockaddr *) &cmd.dst_addr,
-                                cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1349,7 +1359,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
                 return -ENOSPC;
 
         addr = (struct sockaddr *) &cmd->addr;
-        if (!cmd->addr_size || (cmd->addr_size != rdma_addr_size(addr)))
+        if (cmd->addr_size != rdma_addr_size(addr))
                 return -EINVAL;
 
         if (cmd->join_flags == RDMA_MC_JOIN_FLAG_FULLMEMBER)
@@ -1417,6 +1427,9 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
         join_cmd.uid = cmd.uid;
         join_cmd.id = cmd.id;
         join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        if (!join_cmd.addr_size)
+                return -EINVAL;
+
         join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER;
         memcpy(&join_cmd.addr, &cmd.addr, join_cmd.addr_size);
 
@@ -1432,6 +1445,9 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+                return -EINVAL;
+
         return ucma_process_join(file, &cmd, out_len);
 }
 
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index 3eb7a8387116..96f76896488d 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -57,8 +57,8 @@
 #define BNXT_RE_PAGE_SIZE_8M            BIT(BNXT_RE_PAGE_SHIFT_8M)
 #define BNXT_RE_PAGE_SIZE_1G            BIT(BNXT_RE_PAGE_SHIFT_1G)
 
-#define BNXT_RE_MAX_MR_SIZE_LOW         BIT(BNXT_RE_PAGE_SHIFT_1G)
-#define BNXT_RE_MAX_MR_SIZE_HIGH        BIT(39)
+#define BNXT_RE_MAX_MR_SIZE_LOW         BIT_ULL(BNXT_RE_PAGE_SHIFT_1G)
+#define BNXT_RE_MAX_MR_SIZE_HIGH        BIT_ULL(39)
 #define BNXT_RE_MAX_MR_SIZE             BNXT_RE_MAX_MR_SIZE_HIGH
 
 #define BNXT_RE_MAX_QPC_COUNT           (64 * 1024)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 0dd75f449872..8301d7e5fa8c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -3598,7 +3598,7 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
         int umem_pgs, page_shift, rc;
 
         if (length > BNXT_RE_MAX_MR_SIZE) {
-                dev_err(rdev_to_dev(rdev), "MR Size: %lld > Max supported:%ld\n",
+                dev_err(rdev_to_dev(rdev), "MR Size: %lld > Max supported:%lld\n",
                         length, BNXT_RE_MAX_MR_SIZE);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 06b42c880fd4..3a78faba8d91 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -243,7 +243,7 @@ static void bnxt_qplib_service_nq(unsigned long data)
         u32 sw_cons, raw_cons;
         u16 type;
         int budget = nq->budget;
-        u64 q_handle;
+        uintptr_t q_handle;
 
         /* Service the NQ until empty */
         raw_cons = hwq->cons;
@@ -526,7 +526,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
 
         /* Configure the request */
         req.dpi = cpu_to_le32(srq->dpi->dpi);
-        req.srq_handle = cpu_to_le64(srq);
+        req.srq_handle = cpu_to_le64((uintptr_t)srq);
 
         req.srq_size = cpu_to_le16((u16)srq->hwq.max_elements);
         pbl = &srq->hwq.pbl[PBL_LVL_0];
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 033b6af90de9..da091de4e69d 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4860,19 +4860,19 @@ static int mlx5_ib_stage_ib_reg_init(struct mlx5_ib_dev *dev)
         return ib_register_device(&dev->ib_dev, NULL);
 }
 
-static void mlx5_ib_stage_ib_reg_cleanup(struct mlx5_ib_dev *dev)
+static void mlx5_ib_stage_pre_ib_reg_umr_cleanup(struct mlx5_ib_dev *dev)
 {
-        ib_unregister_device(&dev->ib_dev);
+        destroy_umrc_res(dev);
 }
 
-static int mlx5_ib_stage_umr_res_init(struct mlx5_ib_dev *dev)
+static void mlx5_ib_stage_ib_reg_cleanup(struct mlx5_ib_dev *dev)
 {
-        return create_umr_res(dev);
+        ib_unregister_device(&dev->ib_dev);
 }
 
-static void mlx5_ib_stage_umr_res_cleanup(struct mlx5_ib_dev *dev)
+static int mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev)
 {
-        destroy_umrc_res(dev);
+        return create_umr_res(dev);
 }
 
 static int mlx5_ib_stage_delay_drop_init(struct mlx5_ib_dev *dev)
@@ -4982,12 +4982,15 @@ static const struct mlx5_ib_profile pf_profile = {
         STAGE_CREATE(MLX5_IB_STAGE_BFREG,
                      mlx5_ib_stage_bfrag_init,
                      mlx5_ib_stage_bfrag_cleanup),
+        STAGE_CREATE(MLX5_IB_STAGE_PRE_IB_REG_UMR,
+                     NULL,
+                     mlx5_ib_stage_pre_ib_reg_umr_cleanup),
         STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
                      mlx5_ib_stage_ib_reg_init,
                      mlx5_ib_stage_ib_reg_cleanup),
-        STAGE_CREATE(MLX5_IB_STAGE_UMR_RESOURCES,
-                     mlx5_ib_stage_umr_res_init,
-                     mlx5_ib_stage_umr_res_cleanup),
+        STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
+                     mlx5_ib_stage_post_ib_reg_umr_init,
+                     NULL),
         STAGE_CREATE(MLX5_IB_STAGE_DELAY_DROP,
                      mlx5_ib_stage_delay_drop_init,
                      mlx5_ib_stage_delay_drop_cleanup),
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 139385129973..a5272499b600 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -739,8 +739,9 @@ enum mlx5_ib_stages {
         MLX5_IB_STAGE_CONG_DEBUGFS,
         MLX5_IB_STAGE_UAR,
         MLX5_IB_STAGE_BFREG,
+        MLX5_IB_STAGE_PRE_IB_REG_UMR,
         MLX5_IB_STAGE_IB_REG,
-        MLX5_IB_STAGE_UMR_RESOURCES,
+        MLX5_IB_STAGE_POST_IB_REG_UMR,
         MLX5_IB_STAGE_DELAY_DROP,
         MLX5_IB_STAGE_CLASS_ATTR,
         MLX5_IB_STAGE_MAX,
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 1961c6a45437..c51c602f06d6 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -838,7 +838,8 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
         *umem = ib_umem_get(pd->uobject->context, start, length,
                             access_flags, 0);
         err = PTR_ERR_OR_ZERO(*umem);
-        if (err < 0) {
+        if (err) {
+                *umem = NULL;
                 mlx5_ib_err(dev, "umem get failed (%d)\n", err);
                 return err;
         }
@@ -1415,6 +1416,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 if (err) {
                         mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                         ib_umem_release(mr->umem);
+                        mr->umem = NULL;
                         clean_mr(dev, mr);
                         return err;
                 }
@@ -1498,14 +1500,11 @@ static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                 u32 key = mr->mmkey.key;
 
                 err = destroy_mkey(dev, mr);
-                kfree(mr);
                 if (err) {
                         mlx5_ib_warn(dev, "failed to destroy mkey 0x%x (%d)\n",
                                      key, err);
                         return err;
                 }
-        } else {
-                mlx5_mr_cache_free(dev, mr);
         }
 
         return 0;
@@ -1548,6 +1547,11 @@ static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                 atomic_sub(npages, &dev->mdev->priv.reg_pages);
         }
 
+        if (!mr->allocated_from_cache)
+                kfree(mr);
+        else
+                mlx5_mr_cache_free(dev, mr);
+
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 36197fbac63a..a2e1aa86e133 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1161,7 +1161,7 @@ static void destroy_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
         ib_umem_release(sq->ubuffer.umem);
 }
 
-static int get_rq_pas_size(void *qpc)
+static size_t get_rq_pas_size(void *qpc)
 {
         u32 log_page_size = MLX5_GET(qpc, qpc, log_page_size) + 12;
         u32 log_rq_stride = MLX5_GET(qpc, qpc, log_rq_stride);
@@ -1177,7 +1177,8 @@ static int get_rq_pas_size(void *qpc)
 }
 
 static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
-                                   struct mlx5_ib_rq *rq, void *qpin)
+                                   struct mlx5_ib_rq *rq, void *qpin,
+                                   size_t qpinlen)
 {
         struct mlx5_ib_qp *mqp = rq->base.container_mibqp;
         __be64 *pas;
@@ -1186,9 +1187,12 @@ static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
         void *rqc;
         void *wq;
         void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc);
-        int inlen;
+        size_t rq_pas_size = get_rq_pas_size(qpc);
+        size_t inlen;
         int err;
-        u32 rq_pas_size = get_rq_pas_size(qpc);
+
+        if (qpinlen < rq_pas_size + MLX5_BYTE_OFF(create_qp_in, pas))
+                return -EINVAL;
 
         inlen = MLX5_ST_SZ_BYTES(create_rq_in) + rq_pas_size;
         in = kvzalloc(inlen, GFP_KERNEL);
@@ -1277,7 +1281,7 @@ static void destroy_raw_packet_qp_tir(struct mlx5_ib_dev *dev,
 }
 
 static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
-                                u32 *in,
+                                u32 *in, size_t inlen,
                                 struct ib_pd *pd)
 {
         struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
@@ -1309,7 +1313,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                         rq->flags |= MLX5_IB_RQ_CVLAN_STRIPPING;
                 if (qp->flags & MLX5_IB_QP_PCI_WRITE_END_PADDING)
                         rq->flags |= MLX5_IB_RQ_PCI_WRITE_END_PADDING;
-                err = create_raw_packet_qp_rq(dev, rq, in);
+                err = create_raw_packet_qp_rq(dev, rq, in, inlen);
                 if (err)
                         goto err_destroy_sq;
 
@@ -1872,11 +1876,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
         }
 
+        if (inlen < 0) {
+                err = -EINVAL;
+                goto err;
+        }
+
         if (init_attr->qp_type == IB_QPT_RAW_PACKET ||
             qp->flags & MLX5_IB_QP_UNDERLAY) {
                 qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd.sq_buf_addr;
                 raw_packet_qp_copy_info(qp, &qp->raw_packet_qp);
-                err = create_raw_packet_qp(dev, qp, in, pd);
+                err = create_raw_packet_qp(dev, qp, in, inlen, pd);
         } else {
                 err = mlx5_core_create_qp(dev->mdev, &base->mqp, in, inlen);
         }
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 6d5fadad9090..3c7522d025f2 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -241,8 +241,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 {
         struct mlx5_ib_dev *dev = to_mdev(pd->device);
         struct mlx5_ib_srq *srq;
-        int desc_size;
-        int buf_size;
+        size_t desc_size;
+        size_t buf_size;
         int err;
         struct mlx5_srq_attr in = {0};
         __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz);
@@ -266,15 +266,18 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 
         desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
                     srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
+        if (desc_size == 0 || srq->msrq.max_gs > desc_size)
+                return ERR_PTR(-EINVAL);
         desc_size = roundup_pow_of_two(desc_size);
-        desc_size = max_t(int, 32, desc_size);
+        desc_size = max_t(size_t, 32, desc_size);
+        if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
+                return ERR_PTR(-EINVAL);
         srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
                 sizeof(struct mlx5_wqe_data_seg);
         srq->msrq.wqe_shift = ilog2(desc_size);
         buf_size = srq->msrq.max * desc_size;
-        mlx5_ib_dbg(dev, "desc_size 0x%x, req wr 0x%x, srq size 0x%x, max_gs 0x%x, max_avail_gather 0x%x\n",
-                    desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs,
-                    srq->msrq.max_avail_gather);
+        if (buf_size < desc_size)
+                return ERR_PTR(-EINVAL);
         in.type = init_attr->srq_type;
 
         if (pd->uobject)
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 1b2e5362a3ff..cc429b567d0a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -489,11 +489,13 @@ static int rvt_check_refs(struct rvt_mregion *mr, const char *t)
         unsigned long timeout;
         struct rvt_dev_info *rdi = ib_to_rvt(mr->pd->device);
 
-        if (percpu_ref_is_zero(&mr->refcount))
-                return 0;
-        /* avoid dma mr */
-        if (mr->lkey)
+        if (mr->lkey) {
+                /* avoid dma mr */
                 rvt_dereg_clean_qps(mr);
+                /* @mr was indexed on rcu protected @lkey_table */
+                synchronize_rcu();
+        }
+
         timeout = wait_for_completion_timeout(&mr->comp, 5 * HZ);
         if (!timeout) {
                 rvt_pr_err(rdi,
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 1d3056f53747..2cbb19cddbf8 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1412,7 +1412,7 @@ static struct irq_chip its_irq_chip = {
  * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations.
  */
 #define IRQS_PER_CHUNK_SHIFT    5
-#define IRQS_PER_CHUNK          (1 << IRQS_PER_CHUNK_SHIFT)
+#define IRQS_PER_CHUNK          (1UL << IRQS_PER_CHUNK_SHIFT)
 #define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
 static unsigned long *lpi_bitmap;
@@ -2119,11 +2119,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         /*
-         * At least one bit of EventID is being used, hence a minimum
-         * of two entries. No, the architecture doesn't let you
-         * express an ITT with a single entry.
+         * We allocate at least one chunk worth of LPIs bet device,
+         * and thus that many ITEs. The device may require less though.
          */
-        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
+        nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs));
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
         itt = kzalloc(sz, GFP_KERNEL);
@@ -2495,7 +2494,7 @@ static int its_vpe_set_affinity(struct irq_data *d,
 
 static void its_vpe_schedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
         u64 val;
 
         /* Schedule the VPE */
@@ -2527,7 +2526,7 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
         u32 count = 1000000;    /* 1s! */
         bool clean;
         u64 val;
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 675eda5ff2b8..4760307ab43f 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -28,20 +28,6 @@ struct gpcv2_irqchip_data {
 
 static struct gpcv2_irqchip_data *imx_gpcv2_instance;
 
-/*
- * Interface for the low level wakeup code.
- */
-u32 imx_gpcv2_get_wakeup_source(u32 **sources)
-{
-        if (!imx_gpcv2_instance)
-                return 0;
-
-        if (sources)
-                *sources = imx_gpcv2_instance->wakeup_sources;
-
-        return IMR_NUM;
-}
-
 static int gpcv2_wakeup_source_save(void)
 {
         struct gpcv2_irqchip_data *cd;
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 3fde9e9faddd..a05a560d3cba 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -22,7 +22,6 @@
 #include <linux/time.h>
 #include <linux/workqueue.h>
 #include <linux/delay.h>
-#include <scsi/scsi_device.h>
 #include <scsi/scsi_dh.h>
 #include <linux/atomic.h>
 #include <linux/blk-mq.h>
@@ -223,6 +222,16 @@ static int alloc_multipath_stage2(struct dm_target *ti, struct multipath *m)
 
         dm_table_set_type(ti->table, m->queue_mode);
 
+        /*
+         * Init fields that are only used when a scsi_dh is attached
+         * - must do this unconditionally (really doesn't hurt non-SCSI uses)
+         */
+        set_bit(MPATHF_QUEUE_IO, &m->flags);
+        atomic_set(&m->pg_init_in_progress, 0);
+        atomic_set(&m->pg_init_count, 0);
+        m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
+        init_waitqueue_head(&m->pg_init_wait);
+
         return 0;
 }
 
@@ -331,7 +340,6 @@ static void __switch_pg(struct multipath *m, struct priority_group *pg)
                 set_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
                 set_bit(MPATHF_QUEUE_IO, &m->flags);
         } else {
-                /* FIXME: not needed if no scsi_dh is attached */
                 clear_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
                 clear_bit(MPATHF_QUEUE_IO, &m->flags);
         }
@@ -796,15 +804,14 @@ static int parse_path_selector(struct dm_arg_set *as, struct priority_group *pg,
         return 0;
 }
 
-static int setup_scsi_dh(struct block_device *bdev, struct multipath *m, char **error)
+static int setup_scsi_dh(struct block_device *bdev, struct multipath *m,
+                         const char *attached_handler_name, char **error)
 {
         struct request_queue *q = bdev_get_queue(bdev);
-        const char *attached_handler_name;
         int r;
 
         if (test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
 retain:
-                attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                 if (attached_handler_name) {
                         /*
                          * Clear any hw_handler_params associated with a
@@ -823,16 +830,6 @@ retain:
                          */
                         kfree(m->hw_handler_name);
                         m->hw_handler_name = attached_handler_name;
-
-                        /*
-                         * Init fields that are only used when a scsi_dh is attached
-                         */
-                        if (!test_and_set_bit(MPATHF_QUEUE_IO, &m->flags)) {
-                                atomic_set(&m->pg_init_in_progress, 0);
-                                atomic_set(&m->pg_init_count, 0);
-                                m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
-                                init_waitqueue_head(&m->pg_init_wait);
-                        }
                 }
         }
 
@@ -868,7 +865,8 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
         int r;
         struct pgpath *p;
         struct multipath *m = ti->private;
-        struct scsi_device *sdev;
+        struct request_queue *q;
+        const char *attached_handler_name;
 
         /* we need at least a path arg */
         if (as->argc < 1) {
@@ -887,11 +885,11 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                 goto bad;
         }
 
-        sdev = scsi_device_from_queue(bdev_get_queue(p->path.dev->bdev));
-        if (sdev) {
-                put_device(&sdev->sdev_gendev);
+        q = bdev_get_queue(p->path.dev->bdev);
+        attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
+        if (attached_handler_name) {
                 INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
-                r = setup_scsi_dh(p->path.dev->bdev, m, &ti->error);
+                r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                 if (r) {
                         dm_put_device(ti, p->path.dev);
                         goto bad;
@@ -2022,8 +2020,9 @@ static int multipath_busy(struct dm_target *ti)
  *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
         .name = "multipath",
-        .version = {1, 12, 0},
-        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
+        .version = {1, 13, 0},
+        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE |
+                    DM_TARGET_PASSES_INTEGRITY,
         .module = THIS_MODULE,
         .ctr = multipath_ctr,
         .dtr = multipath_dtr,
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 372c074bb1b9..86c1a190d946 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -151,7 +151,7 @@ config DVB_MMAP
         select VIDEOBUF2_VMALLOC
         default n
         help
-          This option enables DVB experimental memory-mapped API, with
+          This option enables DVB experimental memory-mapped API, which
           reduces the number of context switches to read DVB buffers, as
           the buffers can use mmap() syscalls.
 
diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c
index 92f93a880015..aba488cd0e64 100644
--- a/drivers/media/platform/tegra-cec/tegra_cec.c
+++ b/drivers/media/platform/tegra-cec/tegra_cec.c
@@ -172,16 +172,13 @@ static irqreturn_t tegra_cec_irq_handler(int irq, void *data)
                 }
         }
 
-        if (status & (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED)) {
+        if (status & TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED) {
                 cec_write(cec, TEGRA_CEC_INT_STAT,
-                          (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED));
-        } else if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
+                          TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED);
+                cec->rx_done = false;
+                cec->rx_buf_cnt = 0;
+        }
+        if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
                 u32 v;
 
                 cec_write(cec, TEGRA_CEC_INT_STAT,
@@ -255,7 +252,7 @@ static int tegra_cec_adap_enable(struct cec_adapter *adap, bool enable)
                   TEGRA_CEC_INT_MASK_TX_BUS_ANOMALY_DETECTED |
                   TEGRA_CEC_INT_MASK_TX_FRAME_TRANSMITTED |
                   TEGRA_CEC_INT_MASK_RX_REGISTER_FULL |
-                  TEGRA_CEC_INT_MASK_RX_REGISTER_OVERRUN);
+                  TEGRA_CEC_INT_MASK_RX_START_BIT_DETECTED);
 
         cec_write(cec, TEGRA_CEC_HW_CONTROL, TEGRA_CEC_HWCTRL_TX_RX_MODE);
         return 0;
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 20135a5de748..2cfb963d9f37 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -72,6 +72,7 @@ MODULE_ALIAS("mmc:block");
 #define MMC_BLK_TIMEOUT_MS  (10 * 1000)
 #define MMC_SANITIZE_REQ_TIMEOUT 240000
 #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
+#define MMC_EXTRACT_VALUE_FROM_ARG(x) ((x & 0x0000FF00) >> 8)
 
 #define mmc_req_rel_wr(req)     ((req->cmd_flags & REQ_FUA) && \
                                   (rq_data_dir(req) == WRITE))
@@ -587,6 +588,24 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
         }
 
         /*
+         * Make sure the cache of the PARTITION_CONFIG register and
+         * PARTITION_ACCESS bits is updated in case the ioctl ext_csd write
+         * changed it successfully.
+         */
+        if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_PART_CONFIG) &&
+            (cmd.opcode == MMC_SWITCH)) {
+                struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
+                u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg);
+
+                /*
+                 * Update cache so the next mmc_blk_part_switch call operates
+                 * on up-to-date data.
+                 */
+                card->ext_csd.part_config = value;
+                main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK;
+        }
+
+        /*
          * According to the SD specs, some commands require a delay after
          * issuing the command.
          */
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index 79a5b985ccf5..9c821eedd156 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -82,6 +82,7 @@ struct mmc_fixup {
 #define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX        0x90
+#define CID_MANFID_NUMONYX      0xFE
 
 #define END_FIXUP { NULL }
 
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index 75d317623852..5153577754f0 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -109,6 +109,12 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
          */
         MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_HYNIX,
                               0x014a, add_quirk, MMC_QUIRK_BROKEN_HPI, 5),
+        /*
+         * Certain Micron (Numonyx) eMMC 4.5 cards might get broken when HPI
+         * feature is used so disable the HPI feature for such buggy cards.
+         */
+        MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_NUMONYX,
+                              0x014e, add_quirk, MMC_QUIRK_BROKEN_HPI, 6),
 
         END_FIXUP
 };
diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index fa41d9422d57..a84aa3f1ae85 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -165,9 +165,15 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing)
 static int dw_mci_exynos_runtime_resume(struct device *dev)
 {
         struct dw_mci *host = dev_get_drvdata(dev);
+        int ret;
+
+        ret = dw_mci_runtime_resume(dev);
+        if (ret)
+                return ret;
 
         dw_mci_exynos_config_smu(host);
-        return dw_mci_runtime_resume(dev);
+
+        return ret;
 }
 
 /**
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index d9b4acefed31..06d47414d0c1 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -413,7 +413,9 @@ static inline void dw_mci_set_cto(struct dw_mci *host)
         cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
         if (cto_div == 0)
                 cto_div = 1;
-        cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz);
+
+        cto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * cto_clks * cto_div,
+                                  host->bus_hz);
 
         /* add a bit spare time */
         cto_ms += 10;
@@ -562,6 +564,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
                                         (sizeof(struct idmac_desc_64addr) *
                                                         (i + 1))) >> 32;
                         /* Initialize reserved and buffer size fields to "0" */
+                        p->des0 = 0;
                         p->des1 = 0;
                         p->des2 = 0;
                         p->des3 = 0;
@@ -584,6 +587,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
                      i++, p++) {
                         p->des3 = cpu_to_le32(host->sg_dma +
                                         (sizeof(struct idmac_desc) * (i + 1)));
+                        p->des0 = 0;
                         p->des1 = 0;
                 }
 
@@ -1799,8 +1803,8 @@ static bool dw_mci_reset(struct dw_mci *host)
         }
 
         if (host->use_dma == TRANS_MODE_IDMAC)
-                /* It is also recommended that we reset and reprogram idmac */
-                dw_mci_idmac_reset(host);
+                /* It is also required that we reinit idmac */
+                dw_mci_idmac_init(host);
 
         ret = true;
 
@@ -1948,8 +1952,9 @@ static void dw_mci_set_drto(struct dw_mci *host)
         drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
         if (drto_div == 0)
                 drto_div = 1;
-        drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
-                               host->bus_hz);
+
+        drto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * drto_clks * drto_div,
+                                   host->bus_hz);
 
         /* add a bit spare time */
         drto_ms += 10;
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index 4065da58789d..32321bd596d8 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -680,7 +680,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
         host->hw_name   = "ACPI";
         host->ops       = &sdhci_acpi_ops_dflt;
         host->irq       = platform_get_irq(pdev, 0);
-        if (host->irq <= 0) {
+        if (host->irq < 0) {
                 err = -EINVAL;
                 goto err_free;
         }
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index de8c902059b8..7d80a8bb96fe 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -479,7 +479,7 @@ static int shrink_ecclayout(struct mtd_info *mtd,
         for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
@@ -526,7 +526,7 @@ static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to)
         for (i = 0; i < ARRAY_SIZE(to->eccpos);) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
index 4872a7ba6503..5a9c2f0020c2 100644
--- a/drivers/mtd/nand/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/fsl_ifc_nand.c
@@ -173,14 +173,9 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr, int oob)
 
 /* returns nonzero if entire page is blank */
 static int check_read_ecc(struct mtd_info *mtd, struct fsl_ifc_ctrl *ctrl,
-                          u32 *eccstat, unsigned int bufnum)
+                          u32 eccstat, unsigned int bufnum)
 {
-        u32 reg = eccstat[bufnum / 4];
-        int errors;
-
-        errors = (reg >> ((3 - bufnum % 4) * 8)) & 15;
-
-        return errors;
+        return  (eccstat >> ((3 - bufnum % 4) * 8)) & 15;
 }
 
 /*
@@ -193,7 +188,7 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_nand_ctrl *nctrl = ifc_nand_ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
-        u32 eccstat[4];
+        u32 eccstat;
         int i;
 
         /* set the chip select for NAND Transaction */
@@ -228,19 +223,17 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         if (nctrl->eccread) {
                 int errors;
                 int bufnum = nctrl->page & priv->bufnum_mask;
-                int sector = bufnum * chip->ecc.steps;
-                int sector_end = sector + chip->ecc.steps - 1;
+                int sector_start = bufnum * chip->ecc.steps;
+                int sector_end = sector_start + chip->ecc.steps - 1;
                 __be32 *eccstat_regs;
 
-                if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
-                        eccstat_regs = ifc->ifc_nand.v2_nand_eccstat;
-                else
-                        eccstat_regs = ifc->ifc_nand.v1_nand_eccstat;
+                eccstat_regs = ifc->ifc_nand.nand_eccstat;
+                eccstat = ifc_in32(&eccstat_regs[sector_start / 4]);
 
-                for (i = sector / 4; i <= sector_end / 4; i++)
-                        eccstat[i] = ifc_in32(&eccstat_regs[i]);
+                for (i = sector_start; i <= sector_end; i++) {
+                        if (i != sector_start && !(i % 4))
+                                eccstat = ifc_in32(&eccstat_regs[i / 4]);
 
-                for (i = sector; i <= sector_end; i++) {
                         errors = check_read_ecc(mtd, ctrl, eccstat, i);
 
                         if (errors == 15) {
@@ -626,6 +619,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
         u32 nand_fsr;
+        int status;
 
         /* Use READ_STATUS command, but wait for the device to be ready */
         ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
@@ -640,12 +634,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         fsl_ifc_run_command(mtd);
 
         nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr);
-
+        status = nand_fsr >> 24;
         /*
          * The chip always seems to report that it is
          * write-protected, even when it is not.
          */
-        return nand_fsr | NAND_STATUS_WP;
+        return status | NAND_STATUS_WP;
 }
 
 /*
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
index 1e37313054f3..6da69af103e6 100644
--- a/drivers/net/can/cc770/cc770.c
+++ b/drivers/net/can/cc770/cc770.c
@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev,
         return 0;
 }
 
-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static void cc770_tx(struct net_device *dev, int mo)
 {
         struct cc770_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        unsigned int mo = obj2msgobj(CC770_OBJ_TX);
+        struct can_frame *cf = (struct can_frame *)priv->tx_skb->data;
         u8 dlc, rtr;
         u32 id;
         int i;
 
-        if (can_dropped_invalid_skb(dev, skb))
-                return NETDEV_TX_OK;
-
-        if ((cc770_read_reg(priv,
-                            msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
-                netdev_err(dev, "TX register is still occupied!\n");
-                return NETDEV_TX_BUSY;
-        }
-
-        netif_stop_queue(dev);
-
         dlc = cf->can_dlc;
         id = cf->can_id;
-        if (cf->can_id & CAN_RTR_FLAG)
-                rtr = 0;
-        else
-                rtr = MSGCFG_DIR;
+        rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR;
+
+        cc770_write_reg(priv, msgobj[mo].ctrl0,
+                        MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
         cc770_write_reg(priv, msgobj[mo].ctrl1,
                         RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES);
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
-                        MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES);
+
         if (id & CAN_EFF_FLAG) {
                 id &= CAN_EFF_MASK;
                 cc770_write_reg(priv, msgobj[mo].config,
@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
         for (i = 0; i < dlc; i++)
                 cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]);
 
-        /* Store echo skb before starting the transfer */
-        can_put_echo_skb(skb, dev, 0);
-
         cc770_write_reg(priv, msgobj[mo].ctrl1,
-                        RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
+                        RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
+        cc770_write_reg(priv, msgobj[mo].ctrl0,
+                        MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC);
+}
 
-        stats->tx_bytes += dlc;
+static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct cc770_priv *priv = netdev_priv(dev);
+        unsigned int mo = obj2msgobj(CC770_OBJ_TX);
 
+        if (can_dropped_invalid_skb(dev, skb))
+                return NETDEV_TX_OK;
 
-        /*
-         * HM: We had some cases of repeated IRQs so make sure the
-         * INT is acknowledged I know it's already further up, but
-         * doing again fixed the issue
-         */
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
-                        MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
+        netif_stop_queue(dev);
+
+        if ((cc770_read_reg(priv,
+                            msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
+                netdev_err(dev, "TX register is still occupied!\n");
+                return NETDEV_TX_BUSY;
+        }
+
+        priv->tx_skb = skb;
+        cc770_tx(dev, mo);
 
         return NETDEV_TX_OK;
 }
@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o)
         struct cc770_priv *priv = netdev_priv(dev);
         struct net_device_stats *stats = &dev->stats;
         unsigned int mo = obj2msgobj(o);
+        struct can_frame *cf;
+        u8 ctrl1;
+
+        ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1);
 
-        /* Nothing more to send, switch off interrupts */
         cc770_write_reg(priv, msgobj[mo].ctrl0,
                         MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
-        /*
-         * We had some cases of repeated IRQ so make sure the
-         * INT is acknowledged
+        cc770_write_reg(priv, msgobj[mo].ctrl1,
+                        RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES);
+
+        if (unlikely(!priv->tx_skb)) {
+                netdev_err(dev, "missing tx skb in tx interrupt\n");
+                return;
+        }
+
+        if (unlikely(ctrl1 & MSGLST_SET)) {
+                stats->rx_over_errors++;
+                stats->rx_errors++;
+        }
+
+        /* When the CC770 is sending an RTR message and it receives a regular
+         * message that matches the id of the RTR message, it will overwrite the
+         * outgoing message in the TX register. When this happens we must
+         * process the received message and try to transmit the outgoing skb
+         * again.
          */
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
-                        MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
+        if (unlikely(ctrl1 & NEWDAT_SET)) {
+                cc770_rx(dev, mo, ctrl1);
+                cc770_tx(dev, mo);
+                return;
+        }
 
+        cf = (struct can_frame *)priv->tx_skb->data;
+        stats->tx_bytes += cf->can_dlc;
         stats->tx_packets++;
+
+        can_put_echo_skb(priv->tx_skb, dev, 0);
         can_get_echo_skb(dev, 0);
+        priv->tx_skb = NULL;
+
         netif_wake_queue(dev);
 }
 
@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv)
         priv->can.do_set_bittiming = cc770_set_bittiming;
         priv->can.do_set_mode = cc770_set_mode;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+        priv->tx_skb = NULL;
 
         memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags));
 
diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h
index a1739db98d91..95752e1d1283 100644
--- a/drivers/net/can/cc770/cc770.h
+++ b/drivers/net/can/cc770/cc770.h
@@ -193,6 +193,8 @@ struct cc770_priv {
         u8 cpu_interface;       /* CPU interface register */
         u8 clkout;              /* Clock out register */
         u8 bus_config;          /* Bus conffiguration register */
+
+        struct sk_buff *tx_skb;
 };
 
 struct net_device *alloc_cc770dev(int sizeof_priv);
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 2772d05ff11c..fedd927ba6ed 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -30,6 +30,7 @@
 #define IFI_CANFD_STCMD_ERROR_ACTIVE            BIT(2)
 #define IFI_CANFD_STCMD_ERROR_PASSIVE           BIT(3)
 #define IFI_CANFD_STCMD_BUSOFF                  BIT(4)
+#define IFI_CANFD_STCMD_ERROR_WARNING           BIT(5)
 #define IFI_CANFD_STCMD_BUSMONITOR              BIT(16)
 #define IFI_CANFD_STCMD_LOOPBACK                BIT(18)
 #define IFI_CANFD_STCMD_DISABLE_CANFD           BIT(24)
@@ -52,7 +53,10 @@
 #define IFI_CANFD_TXSTCMD_OVERFLOW              BIT(13)
 
 #define IFI_CANFD_INTERRUPT                     0xc
+#define IFI_CANFD_INTERRUPT_ERROR_BUSOFF        BIT(0)
 #define IFI_CANFD_INTERRUPT_ERROR_WARNING       BIT(1)
+#define IFI_CANFD_INTERRUPT_ERROR_STATE_CHG     BIT(2)
+#define IFI_CANFD_INTERRUPT_ERROR_REC_TEC_INC   BIT(3)
 #define IFI_CANFD_INTERRUPT_ERROR_COUNTER       BIT(10)
 #define IFI_CANFD_INTERRUPT_TXFIFO_EMPTY        BIT(16)
 #define IFI_CANFD_INTERRUPT_TXFIFO_REMOVE       BIT(22)
@@ -61,6 +65,10 @@
 #define IFI_CANFD_INTERRUPT_SET_IRQ             ((u32)BIT(31))
 
 #define IFI_CANFD_IRQMASK                       0x10
+#define IFI_CANFD_IRQMASK_ERROR_BUSOFF          BIT(0)
+#define IFI_CANFD_IRQMASK_ERROR_WARNING         BIT(1)
+#define IFI_CANFD_IRQMASK_ERROR_STATE_CHG       BIT(2)
+#define IFI_CANFD_IRQMASK_ERROR_REC_TEC_INC     BIT(3)
 #define IFI_CANFD_IRQMASK_SET_ERR               BIT(7)
 #define IFI_CANFD_IRQMASK_SET_TS                BIT(15)
 #define IFI_CANFD_IRQMASK_TXFIFO_EMPTY          BIT(16)
@@ -136,6 +144,8 @@
 #define IFI_CANFD_SYSCLOCK                      0x50
 
 #define IFI_CANFD_VER                           0x54
+#define IFI_CANFD_VER_REV_MASK                  0xff
+#define IFI_CANFD_VER_REV_MIN_SUPPORTED         0x15
 
 #define IFI_CANFD_IP_ID                         0x58
 #define IFI_CANFD_IP_ID_VALUE                   0xD073CAFD
@@ -220,7 +230,10 @@ static void ifi_canfd_irq_enable(struct net_device *ndev, bool enable)
 
         if (enable) {
                 enirq = IFI_CANFD_IRQMASK_TXFIFO_EMPTY |
-                        IFI_CANFD_IRQMASK_RXFIFO_NEMPTY;
+                        IFI_CANFD_IRQMASK_RXFIFO_NEMPTY |
+                        IFI_CANFD_IRQMASK_ERROR_STATE_CHG |
+                        IFI_CANFD_IRQMASK_ERROR_WARNING |
+                        IFI_CANFD_IRQMASK_ERROR_BUSOFF;
                 if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
                         enirq |= IFI_CANFD_INTERRUPT_ERROR_COUNTER;
         }
@@ -361,12 +374,13 @@ static int ifi_canfd_handle_lost_msg(struct net_device *ndev)
         return 1;
 }
 
-static int ifi_canfd_handle_lec_err(struct net_device *ndev, const u32 errctr)
+static int ifi_canfd_handle_lec_err(struct net_device *ndev)
 {
         struct ifi_canfd_priv *priv = netdev_priv(ndev);
         struct net_device_stats *stats = &ndev->stats;
         struct can_frame *cf;
         struct sk_buff *skb;
+        u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
         const u32 errmask = IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST |
                             IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST |
                             IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST |
@@ -449,6 +463,11 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
 
         switch (new_state) {
         case CAN_STATE_ERROR_ACTIVE:
+                /* error active state */
+                priv->can.can_stats.error_warning++;
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                break;
+        case CAN_STATE_ERROR_WARNING:
                 /* error warning state */
                 priv->can.can_stats.error_warning++;
                 priv->can.state = CAN_STATE_ERROR_WARNING;
@@ -477,7 +496,7 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
         ifi_canfd_get_berr_counter(ndev, &bec);
 
         switch (new_state) {
-        case CAN_STATE_ERROR_ACTIVE:
+        case CAN_STATE_ERROR_WARNING:
                 /* error warning state */
                 cf->can_id |= CAN_ERR_CRTL;
                 cf->data[1] = (bec.txerr > bec.rxerr) ?
@@ -510,22 +529,21 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
         return 1;
 }
 
-static int ifi_canfd_handle_state_errors(struct net_device *ndev, u32 stcmd)
+static int ifi_canfd_handle_state_errors(struct net_device *ndev)
 {
         struct ifi_canfd_priv *priv = netdev_priv(ndev);
+        u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
         int work_done = 0;
-        u32 isr;
 
-        /*
-         * The ErrWarn condition is a little special, since the bit is
-         * located in the INTERRUPT register instead of STCMD register.
-         */
-        isr = readl(priv->base + IFI_CANFD_INTERRUPT);
-        if ((isr & IFI_CANFD_INTERRUPT_ERROR_WARNING) &&
+        if ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) &&
+            (priv->can.state != CAN_STATE_ERROR_ACTIVE)) {
+                netdev_dbg(ndev, "Error, entered active state\n");
+                work_done += ifi_canfd_handle_state_change(ndev,
+                                                CAN_STATE_ERROR_ACTIVE);
+        }
+
+        if ((stcmd & IFI_CANFD_STCMD_ERROR_WARNING) &&
             (priv->can.state != CAN_STATE_ERROR_WARNING)) {
-                /* Clear the interrupt */
-                writel(IFI_CANFD_INTERRUPT_ERROR_WARNING,
-                       priv->base + IFI_CANFD_INTERRUPT);
                 netdev_dbg(ndev, "Error, entered warning state\n");
                 work_done += ifi_canfd_handle_state_change(ndev,
                                                 CAN_STATE_ERROR_WARNING);
@@ -552,18 +570,11 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
 {
         struct net_device *ndev = napi->dev;
         struct ifi_canfd_priv *priv = netdev_priv(ndev);
-        const u32 stcmd_state_mask = IFI_CANFD_STCMD_ERROR_PASSIVE |
-                                     IFI_CANFD_STCMD_BUSOFF;
-        int work_done = 0;
-
-        u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
         u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
-        u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
+        int work_done = 0;
 
         /* Handle bus state changes */
-        if ((stcmd & stcmd_state_mask) ||
-            ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) == 0))
-                work_done += ifi_canfd_handle_state_errors(ndev, stcmd);
+        work_done += ifi_canfd_handle_state_errors(ndev);
 
         /* Handle lost messages on RX */
         if (rxstcmd & IFI_CANFD_RXSTCMD_OVERFLOW)
@@ -571,7 +582,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
 
         /* Handle lec errors on the bus */
         if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
-                work_done += ifi_canfd_handle_lec_err(ndev, errctr);
+                work_done += ifi_canfd_handle_lec_err(ndev);
 
         /* Handle normal messages on RX */
         if (!(rxstcmd & IFI_CANFD_RXSTCMD_EMPTY))
@@ -592,12 +603,13 @@ static irqreturn_t ifi_canfd_isr(int irq, void *dev_id)
         struct net_device_stats *stats = &ndev->stats;
         const u32 rx_irq_mask = IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY |
                                 IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY_PER |
+                                IFI_CANFD_INTERRUPT_ERROR_COUNTER |
+                                IFI_CANFD_INTERRUPT_ERROR_STATE_CHG |
                                 IFI_CANFD_INTERRUPT_ERROR_WARNING |
-                                IFI_CANFD_INTERRUPT_ERROR_COUNTER;
+                                IFI_CANFD_INTERRUPT_ERROR_BUSOFF;
         const u32 tx_irq_mask = IFI_CANFD_INTERRUPT_TXFIFO_EMPTY |
                                 IFI_CANFD_INTERRUPT_TXFIFO_REMOVE;
-        const u32 clr_irq_mask = ~((u32)(IFI_CANFD_INTERRUPT_SET_IRQ |
-                                         IFI_CANFD_INTERRUPT_ERROR_WARNING));
+        const u32 clr_irq_mask = ~((u32)IFI_CANFD_INTERRUPT_SET_IRQ);
         u32 isr;
 
         isr = readl(priv->base + IFI_CANFD_INTERRUPT);
@@ -933,7 +945,7 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *addr;
         int irq, ret;
-        u32 id;
+        u32 id, rev;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         addr = devm_ioremap_resource(dev, res);
@@ -947,6 +959,13 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
+        rev = readl(addr + IFI_CANFD_VER) & IFI_CANFD_VER_REV_MASK;
+        if (rev < IFI_CANFD_VER_REV_MIN_SUPPORTED) {
+                dev_err(dev, "This block is too old (rev %i), minimum supported is rev %i\n",
+                        rev, IFI_CANFD_VER_REV_MIN_SUPPORTED);
+                return -EINVAL;
+        }
+
         ndev = alloc_candev(sizeof(*priv), 1);
         if (!ndev)
                 return -ENOMEM;
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 2594f7779c6f..b397a33f3d32 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -26,6 +26,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/iopoll.h>
 #include <linux/can/dev.h>
+#include <linux/pinctrl/consumer.h>
 
 /* napi related */
 #define M_CAN_NAPI_WEIGHT       64
@@ -253,7 +254,7 @@ enum m_can_mram_cfg {
 
 /* Rx FIFO 0/1 Configuration (RXF0C/RXF1C) */
 #define RXFC_FWM_SHIFT  24
-#define RXFC_FWM_MASK   (0x7f < RXFC_FWM_SHIFT)
+#define RXFC_FWM_MASK   (0x7f << RXFC_FWM_SHIFT)
 #define RXFC_FS_SHIFT   16
 #define RXFC_FS_MASK    (0x7f << RXFC_FS_SHIFT)
 
@@ -1700,6 +1701,8 @@ static __maybe_unused int m_can_suspend(struct device *dev)
                 m_can_clk_stop(priv);
         }
 
+        pinctrl_pm_select_sleep_state(dev);
+
         priv->can.state = CAN_STATE_SLEEPING;
 
         return 0;
@@ -1710,6 +1713,8 @@ static __maybe_unused int m_can_resume(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct m_can_priv *priv = netdev_priv(ndev);
 
+        pinctrl_pm_select_default_state(dev);
+
         m_can_init_ram(priv);
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 55513411a82e..ed8561d4a90f 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -262,7 +262,6 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
 
                 spin_lock_irqsave(&priv->echo_lock, flags);
                 can_get_echo_skb(priv->ndev, msg->client);
-                spin_unlock_irqrestore(&priv->echo_lock, flags);
 
                 /* count bytes of the echo instead of skb */
                 stats->tx_bytes += cf_len;
@@ -271,6 +270,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
                 /* restart tx queue (a slot is free) */
                 netif_wake_queue(priv->ndev);
 
+                spin_unlock_irqrestore(&priv->echo_lock, flags);
                 return 0;
         }
 
@@ -333,7 +333,6 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
 
         /* this STATUS is the CNF of the RX_BARRIER: Tx path can be setup */
         if (pucan_status_is_rx_barrier(msg)) {
-                unsigned long flags;
 
                 if (priv->enable_tx_path) {
                         int err = priv->enable_tx_path(priv);
@@ -342,16 +341,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
                                 return err;
                 }
 
-                /* restart network queue only if echo skb array is free */
-                spin_lock_irqsave(&priv->echo_lock, flags);
-
-                if (!priv->can.echo_skb[priv->echo_idx]) {
-                        spin_unlock_irqrestore(&priv->echo_lock, flags);
-
-                        netif_wake_queue(ndev);
-                } else {
-                        spin_unlock_irqrestore(&priv->echo_lock, flags);
-                }
+                /* start network queue (echo_skb array is empty) */
+                netif_start_queue(ndev);
 
                 return 0;
         }
@@ -726,11 +717,6 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
          */
         should_stop_tx_queue = !!(priv->can.echo_skb[priv->echo_idx]);
 
-        spin_unlock_irqrestore(&priv->echo_lock, flags);
-
-        /* write the skb on the interface */
-        priv->write_tx_msg(priv, msg);
-
         /* stop network tx queue if not enough room to save one more msg too */
         if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
                 should_stop_tx_queue |= (room_left <
@@ -742,6 +728,11 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
         if (should_stop_tx_queue)
                 netif_stop_queue(ndev);
 
+        spin_unlock_irqrestore(&priv->echo_lock, flags);
+
+        /* write the skb on the interface */
+        priv->write_tx_msg(priv, msg);
+
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
index 788c3464a3b0..3c51a884db87 100644
--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
+++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
@@ -349,8 +349,12 @@ static irqreturn_t pciefd_irq_handler(int irq, void *arg)
                 priv->tx_pages_free++;
                 spin_unlock_irqrestore(&priv->tx_lock, flags);
 
-                /* wake producer up */
-                netif_wake_queue(priv->ucan.ndev);
+                /* wake producer up (only if enough room in echo_skb array) */
+                spin_lock_irqsave(&priv->ucan.echo_lock, flags);
+                if (!priv->ucan.can.echo_skb[priv->ucan.echo_idx])
+                        netif_wake_queue(priv->ucan.ndev);
+
+                spin_unlock_irqrestore(&priv->ucan.echo_lock, flags);
         }
 
         /* re-enable Rx DMA transfer for this CAN */
diff --git a/drivers/net/dsa/Makefile b/drivers/net/dsa/Makefile
index d040aeb45172..15c2a831edf1 100644
--- a/drivers/net/dsa/Makefile
+++ b/drivers/net/dsa/Makefile
@@ -1,7 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_NET_DSA_BCM_SF2)   += bcm-sf2.o
 bcm-sf2-objs                    := bcm_sf2.o bcm_sf2_cfp.o
-obj-$(CONFIG_NET_DSA_LOOP)      += dsa_loop.o dsa_loop_bdinfo.o
+obj-$(CONFIG_NET_DSA_LOOP)      += dsa_loop.o
+ifdef CONFIG_NET_DSA_LOOP
+obj-$(CONFIG_FIXED_PHY)         += dsa_loop_bdinfo.o
+endif
 obj-$(CONFIG_NET_DSA_MT7530)    += mt7530.o
 obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
 obj-$(CONFIG_NET_DSA_QCA8K)     += qca8k.o
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index db830a1141d9..63e02a54d537 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -814,8 +814,8 @@ void b53_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
         unsigned int i;
 
         for (i = 0; i < mib_size; i++)
-                memcpy(data + i * ETH_GSTRING_LEN,
-                       mibs[i].name, ETH_GSTRING_LEN);
+                strlcpy(data + i * ETH_GSTRING_LEN,
+                        mibs[i].name, ETH_GSTRING_LEN);
 }
 EXPORT_SYMBOL(b53_get_strings);
 
diff --git a/drivers/net/ethernet/8390/Kconfig b/drivers/net/ethernet/8390/Kconfig
index 29c3075bfb05..fdc673484add 100644
--- a/drivers/net/ethernet/8390/Kconfig
+++ b/drivers/net/ethernet/8390/Kconfig
@@ -3,7 +3,7 @@
 #
 
 config NET_VENDOR_8390
-        bool "National Semi-conductor 8390 devices"
+        bool "National Semiconductor 8390 devices"
         default y
         depends on NET_VENDOR_NATSEMI
         ---help---
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 0b49f1aeebd3..fc7383106946 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -36,6 +36,8 @@
 #define AQ_CFG_TX_FRAME_MAX  (16U * 1024U)
 #define AQ_CFG_RX_FRAME_MAX  (4U * 1024U)
 
+#define AQ_CFG_TX_CLEAN_BUDGET 256U
+
 /* LRO */
 #define AQ_CFG_IS_LRO_DEF           1U
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index ebbaf63eaf47..c96a92118b8b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -247,6 +247,8 @@ void aq_nic_ndev_init(struct aq_nic_s *self)
         self->ndev->hw_features |= aq_hw_caps->hw_features;
         self->ndev->features = aq_hw_caps->hw_features;
         self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
+        self->ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+
         self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
         self->ndev->max_mtu = aq_hw_caps->mtu - ETH_FCS_LEN - ETH_HLEN;
 
@@ -937,3 +939,23 @@ err_exit:
 out:
         return err;
 }
+
+void aq_nic_shutdown(struct aq_nic_s *self)
+{
+        int err = 0;
+
+        if (!self->ndev)
+                return;
+
+        rtnl_lock();
+
+        netif_device_detach(self->ndev);
+
+        err = aq_nic_stop(self);
+        if (err < 0)
+                goto err_exit;
+        aq_nic_deinit(self);
+
+err_exit:
+        rtnl_unlock();
+}
\ No newline at end of file
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index d16b0f1a95aa..219b550d1665 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -118,5 +118,6 @@ struct aq_nic_cfg_s *aq_nic_get_cfg(struct aq_nic_s *self);
 u32 aq_nic_get_fw_version(struct aq_nic_s *self);
 int aq_nic_change_pm_state(struct aq_nic_s *self, pm_message_t *pm_msg);
 int aq_nic_update_interrupt_moderation_settings(struct aq_nic_s *self);
+void aq_nic_shutdown(struct aq_nic_s *self);
 
 #endif /* AQ_NIC_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 87c4308b52a7..ecc6306f940f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -323,6 +323,20 @@ static void aq_pci_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
+static void aq_pci_shutdown(struct pci_dev *pdev)
+{
+        struct aq_nic_s *self = pci_get_drvdata(pdev);
+
+        aq_nic_shutdown(self);
+
+        pci_disable_device(pdev);
+
+        if (system_state == SYSTEM_POWER_OFF) {
+                pci_wake_from_d3(pdev, false);
+                pci_set_power_state(pdev, PCI_D3hot);
+        }
+}
+
 static int aq_pci_suspend(struct pci_dev *pdev, pm_message_t pm_msg)
 {
         struct aq_nic_s *self = pci_get_drvdata(pdev);
@@ -345,6 +359,7 @@ static struct pci_driver aq_pci_ops = {
         .remove = aq_pci_remove,
         .suspend = aq_pci_suspend,
         .resume = aq_pci_resume,
+        .shutdown = aq_pci_shutdown,
 };
 
 module_pci_driver(aq_pci_ops);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 0be6a11370bb..b5f1f62e8e25 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -136,11 +136,12 @@ void aq_ring_queue_stop(struct aq_ring_s *ring)
                 netif_stop_subqueue(ndev, ring->idx);
 }
 
-void aq_ring_tx_clean(struct aq_ring_s *self)
+bool aq_ring_tx_clean(struct aq_ring_s *self)
 {
         struct device *dev = aq_nic_get_dev(self->aq_nic);
+        unsigned int budget = AQ_CFG_TX_CLEAN_BUDGET;
 
-        for (; self->sw_head != self->hw_head;
+        for (; self->sw_head != self->hw_head && budget--;
                 self->sw_head = aq_ring_next_dx(self, self->sw_head)) {
                 struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
 
@@ -167,6 +168,8 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                 buff->pa = 0U;
                 buff->eop_index = 0xffffU;
         }
+
+        return !!budget;
 }
 
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 965fae0fb6e0..ac1329f4051d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -153,7 +153,7 @@ void aq_ring_free(struct aq_ring_s *self);
 void aq_ring_update_queue_state(struct aq_ring_s *ring);
 void aq_ring_queue_wake(struct aq_ring_s *ring);
 void aq_ring_queue_stop(struct aq_ring_s *ring);
-void aq_ring_tx_clean(struct aq_ring_s *self);
+bool aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                      struct napi_struct *napi,
                      int *work_done,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index f890b8a5a862..d335c334fa56 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -35,12 +35,12 @@ struct aq_vec_s {
 static int aq_vec_poll(struct napi_struct *napi, int budget)
 {
         struct aq_vec_s *self = container_of(napi, struct aq_vec_s, napi);
+        unsigned int sw_tail_old = 0U;
         struct aq_ring_s *ring = NULL;
+        bool was_tx_cleaned = true;
+        unsigned int i = 0U;
         int work_done = 0;
         int err = 0;
-        unsigned int i = 0U;
-        unsigned int sw_tail_old = 0U;
-        bool was_tx_cleaned = false;
 
         if (!self) {
                 err = -EINVAL;
@@ -57,9 +57,8 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
 
                         if (ring[AQ_VEC_TX_ID].sw_head !=
                             ring[AQ_VEC_TX_ID].hw_head) {
-                                aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
+                                was_tx_cleaned = aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
                                 aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
-                                was_tx_cleaned = true;
                         }
 
                         err = self->aq_hw_ops->hw_ring_rx_receive(self->aq_hw,
@@ -90,7 +89,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                         }
                 }
 
-                if (was_tx_cleaned)
+                if (!was_tx_cleaned)
                         work_done = budget;
 
                 if (work_done < budget) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 967f0fd07fcf..d3b847ec7465 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -21,6 +21,10 @@
 
 #define HW_ATL_UCP_0X370_REG    0x0370U
 
+#define HW_ATL_MIF_CMD          0x0200U
+#define HW_ATL_MIF_ADDR         0x0208U
+#define HW_ATL_MIF_VAL          0x020CU
+
 #define HW_ATL_FW_SM_RAM        0x2U
 #define HW_ATL_MPI_FW_VERSION   0x18
 #define HW_ATL_MPI_CONTROL_ADR  0x0368U
@@ -79,16 +83,15 @@ int hw_atl_utils_initfw(struct aq_hw_s *self, const struct aq_fw_ops **fw_ops)
 
 static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
 {
+        u32 gsr, val;
         int k = 0;
-        u32 gsr;
 
         aq_hw_write_reg(self, 0x404, 0x40e1);
         AQ_HW_SLEEP(50);
 
         /* Cleanup SPI */
-        aq_hw_write_reg(self, 0x534, 0xA0);
-        aq_hw_write_reg(self, 0x100, 0x9F);
-        aq_hw_write_reg(self, 0x100, 0x809F);
+        val = aq_hw_read_reg(self, 0x53C);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
 
         gsr = aq_hw_read_reg(self, HW_ATL_GLB_SOFT_RES_ADR);
         aq_hw_write_reg(self, HW_ATL_GLB_SOFT_RES_ADR, (gsr & 0xBFFF) | 0x8000);
@@ -97,7 +100,14 @@ static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
         aq_hw_write_reg(self, 0x404, 0x80e0);
         aq_hw_write_reg(self, 0x32a8, 0x0);
         aq_hw_write_reg(self, 0x520, 0x1);
+
+        /* Reset SPI again because of possible interrupted SPI burst */
+        val = aq_hw_read_reg(self, 0x53C);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
         AQ_HW_SLEEP(10);
+        /* Clear SPI reset state */
+        aq_hw_write_reg(self, 0x53C, val & ~0x10);
+
         aq_hw_write_reg(self, 0x404, 0x180e0);
 
         for (k = 0; k < 1000; k++) {
@@ -141,13 +151,15 @@ static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
                 aq_pr_err("FW kickstart failed\n");
                 return -EIO;
         }
+        /* Old FW requires fixed delay after init */
+        AQ_HW_SLEEP(15);
 
         return 0;
 }
 
 static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
 {
-        u32 gsr, rbl_status;
+        u32 gsr, val, rbl_status;
         int k;
 
         aq_hw_write_reg(self, 0x404, 0x40e1);
@@ -157,6 +169,10 @@ static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
         /* Alter RBL status */
         aq_hw_write_reg(self, 0x388, 0xDEAD);
 
+        /* Cleanup SPI */
+        val = aq_hw_read_reg(self, 0x53C);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
+
         /* Global software reset*/
         hw_atl_rx_rx_reg_res_dis_set(self, 0U);
         hw_atl_tx_tx_reg_res_dis_set(self, 0U);
@@ -204,6 +220,8 @@ static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
                 aq_pr_err("FW kickstart failed\n");
                 return -EIO;
         }
+        /* Old FW requires fixed delay after init */
+        AQ_HW_SLEEP(15);
 
         return 0;
 }
@@ -255,18 +273,22 @@ int hw_atl_utils_fw_downld_dwords(struct aq_hw_s *self, u32 a,
                 }
         }
 
-        aq_hw_write_reg(self, 0x00000208U, a);
-
-        for (++cnt; --cnt;) {
-                u32 i = 0U;
+        aq_hw_write_reg(self, HW_ATL_MIF_ADDR, a);
 
-                aq_hw_write_reg(self, 0x00000200U, 0x00008000U);
+        for (++cnt; --cnt && !err;) {
+                aq_hw_write_reg(self, HW_ATL_MIF_CMD, 0x00008000U);
 
-                for (i = 1024U;
-                        (0x100U & aq_hw_read_reg(self, 0x00000200U)) && --i;) {
-                }
+                if (IS_CHIP_FEATURE(REVISION_B1))
+                        AQ_HW_WAIT_FOR(a != aq_hw_read_reg(self,
+                                                           HW_ATL_MIF_ADDR),
+                                       1, 1000U);
+                else
+                        AQ_HW_WAIT_FOR(!(0x100 & aq_hw_read_reg(self,
+                                                           HW_ATL_MIF_CMD)),
+                                       1, 1000U);
 
-                *(p++) = aq_hw_read_reg(self, 0x0000020CU);
+                *(p++) = aq_hw_read_reg(self, HW_ATL_MIF_VAL);
+                a += 4;
         }
 
         hw_atl_reg_glb_cpu_sem_set(self, 1U, HW_ATL_FW_SM_RAM);
@@ -662,14 +684,18 @@ void hw_atl_utils_hw_chip_features_init(struct aq_hw_s *self, u32 *p)
         u32 val = hw_atl_reg_glb_mif_id_get(self);
         u32 mif_rev = val & 0xFFU;
 
-        if ((3U & mif_rev) == 1U) {
-                chip_features |=
-                        HAL_ATLANTIC_UTILS_CHIP_REVISION_A0 |
+        if ((0xFU & mif_rev) == 1U) {
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_A0 |
                         HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
                         HAL_ATLANTIC_UTILS_CHIP_MIPS;
-        } else if ((3U & mif_rev) == 2U) {
-                chip_features |=
-                        HAL_ATLANTIC_UTILS_CHIP_REVISION_B0 |
+        } else if ((0xFU & mif_rev) == 2U) {
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_B0 |
+                        HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
+                        HAL_ATLANTIC_UTILS_CHIP_MIPS |
+                        HAL_ATLANTIC_UTILS_CHIP_TPO2 |
+                        HAL_ATLANTIC_UTILS_CHIP_RPF2;
+        } else if ((0xFU & mif_rev) == 0xAU) {
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_B1 |
                         HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
                         HAL_ATLANTIC_UTILS_CHIP_MIPS |
                         HAL_ATLANTIC_UTILS_CHIP_TPO2 |
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index 2c690947910a..cd8f18f39c61 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -161,6 +161,7 @@ struct __packed hw_aq_atl_utils_mbox {
 #define HAL_ATLANTIC_UTILS_CHIP_MPI_AQ       0x00000010U
 #define HAL_ATLANTIC_UTILS_CHIP_REVISION_A0  0x01000000U
 #define HAL_ATLANTIC_UTILS_CHIP_REVISION_B0  0x02000000U
+#define HAL_ATLANTIC_UTILS_CHIP_REVISION_B1  0x04000000U
 
 #define IS_CHIP_FEATURE(_F_) (HAL_ATLANTIC_UTILS_CHIP_##_F_ & \
         self->chip_features)
diff --git a/drivers/net/ethernet/aquantia/atlantic/ver.h b/drivers/net/ethernet/aquantia/atlantic/ver.h
index 5265b937677b..a445de6837a6 100644
--- a/drivers/net/ethernet/aquantia/atlantic/ver.h
+++ b/drivers/net/ethernet/aquantia/atlantic/ver.h
@@ -13,7 +13,7 @@
 #define NIC_MAJOR_DRIVER_VERSION           2
 #define NIC_MINOR_DRIVER_VERSION           0
 #define NIC_BUILD_DRIVER_VERSION           2
-#define NIC_REVISION_DRIVER_VERSION        0
+#define NIC_REVISION_DRIVER_VERSION        1
 
 #define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
 
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index 16f9bee992fe..0f6576802607 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -169,8 +169,10 @@ static int emac_rockchip_probe(struct platform_device *pdev)
         /* Optional regulator for PHY */
         priv->regulator = devm_regulator_get_optional(dev, "phy");
         if (IS_ERR(priv->regulator)) {
-                if (PTR_ERR(priv->regulator) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
+                if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) {
+                        err = -EPROBE_DEFER;
+                        goto out_clk_disable;
+                }
                 dev_err(dev, "no regulator found\n");
                 priv->regulator = NULL;
         }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f15a8fc6dfc9..3fc549b88c43 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -855,10 +855,12 @@ static void bcm_sysport_tx_reclaim_one(struct bcm_sysport_tx_ring *ring,
 static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
                                              struct bcm_sysport_tx_ring *ring)
 {
-        unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs;
         unsigned int pkts_compl = 0, bytes_compl = 0;
         struct net_device *ndev = priv->netdev;
+        unsigned int txbds_processed = 0;
         struct bcm_sysport_cb *cb;
+        unsigned int txbds_ready;
+        unsigned int c_index;
         u32 hw_ind;
 
         /* Clear status before servicing to reduce spurious interrupts */
@@ -871,29 +873,23 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
         /* Compute how many descriptors have been processed since last call */
         hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));
         c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK;
-        ring->p_index = (hw_ind & RING_PROD_INDEX_MASK);
-
-        last_c_index = ring->c_index;
-        num_tx_cbs = ring->size;
-
-        c_index &= (num_tx_cbs - 1);
-
-        if (c_index >= last_c_index)
-                last_tx_cn = c_index - last_c_index;
-        else
-                last_tx_cn = num_tx_cbs - last_c_index + c_index;
+        txbds_ready = (c_index - ring->c_index) & RING_CONS_INDEX_MASK;
 
         netif_dbg(priv, tx_done, ndev,
-                  "ring=%d c_index=%d last_tx_cn=%d last_c_index=%d\n",
-                  ring->index, c_index, last_tx_cn, last_c_index);
+                  "ring=%d old_c_index=%u c_index=%u txbds_ready=%u\n",
+                  ring->index, ring->c_index, c_index, txbds_ready);
 
-        while (last_tx_cn-- > 0) {
-                cb = ring->cbs + last_c_index;
+        while (txbds_processed < txbds_ready) {
+                cb = &ring->cbs[ring->clean_index];
                 bcm_sysport_tx_reclaim_one(ring, cb, &bytes_compl, &pkts_compl);
 
                 ring->desc_count++;
-                last_c_index++;
-                last_c_index &= (num_tx_cbs - 1);
+                txbds_processed++;
+
+                if (likely(ring->clean_index < ring->size - 1))
+                        ring->clean_index++;
+                else
+                        ring->clean_index = 0;
         }
 
         u64_stats_update_begin(&priv->syncp);
@@ -1394,6 +1390,7 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
         netif_tx_napi_add(priv->netdev, &ring->napi, bcm_sysport_tx_poll, 64);
         ring->index = index;
         ring->size = size;
+        ring->clean_index = 0;
         ring->alloc_size = ring->size;
         ring->desc_cpu = p;
         ring->desc_count = ring->size;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index f5a984c1c986..19c91c76e327 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -706,7 +706,7 @@ struct bcm_sysport_tx_ring {
         unsigned int    desc_count;     /* Number of descriptors */
         unsigned int    curr_desc;      /* Current descriptor */
         unsigned int    c_index;        /* Last consumer index */
-        unsigned int    p_index;        /* Current producer index */
+        unsigned int    clean_index;    /* Current clean index */
         struct bcm_sysport_cb *cbs;     /* Transmit control blocks */
         struct dma_desc *desc_cpu;      /* CPU view of the descriptor */
         struct bcm_sysport_priv *priv;  /* private context backpointer */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 74fc9af4aadb..b8388e93520a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13913,7 +13913,7 @@ static void bnx2x_register_phc(struct bnx2x *bp)
         bp->ptp_clock = ptp_clock_register(&bp->ptp_clock_info, &bp->pdev->dev);
         if (IS_ERR(bp->ptp_clock)) {
                 bp->ptp_clock = NULL;
-                BNX2X_ERR("PTP clock registeration failed\n");
+                BNX2X_ERR("PTP clock registration failed\n");
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 1500243b9886..c7e5e6f09647 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1439,7 +1439,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
             (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u16 vlan_proto = tpa_info->metadata >>
                         RX_CMP_FLAGS2_METADATA_TPID_SFT;
-                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_VID_MASK;
+                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_TCI_MASK;
 
                 __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
         }
@@ -1623,7 +1623,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
              cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) &&
             (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u32 meta_data = le32_to_cpu(rxcmp1->rx_cmp_meta_data);
-                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_VID_MASK;
+                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_TCI_MASK;
                 u16 vlan_proto = meta_data >> RX_CMP_FLAGS2_METADATA_TPID_SFT;
 
                 __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
@@ -3847,6 +3847,9 @@ static int bnxt_hwrm_vnic_set_tpa(struct bnxt *bp, u16 vnic_id, u32 tpa_flags)
         struct bnxt_vnic_info *vnic = &bp->vnic_info[vnic_id];
         struct hwrm_vnic_tpa_cfg_input req = {0};
 
+        if (vnic->fw_vnic_id == INVALID_HW_RING_ID)
+                return 0;
+
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_VNIC_TPA_CFG, -1, -1);
 
         if (tpa_flags) {
@@ -4558,18 +4561,17 @@ int __bnxt_hwrm_get_tx_rings(struct bnxt *bp, u16 fid, int *tx_rings)
         return rc;
 }
 
-static int
-bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                           int ring_grps, int cp_rings, int vnics)
+static void
+__bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, struct hwrm_func_cfg_input *req,
+                             int tx_rings, int rx_rings, int ring_grps,
+                             int cp_rings, int vnics)
 {
-        struct hwrm_func_cfg_input req = {0};
         u32 enables = 0;
-        int rc;
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
-        req.fid = cpu_to_le16(0xffff);
+        bnxt_hwrm_cmd_hdr_init(bp, req, HWRM_FUNC_CFG, -1, -1);
+        req->fid = cpu_to_le16(0xffff);
         enables |= tx_rings ? FUNC_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
-        req.num_tx_rings = cpu_to_le16(tx_rings);
+        req->num_tx_rings = cpu_to_le16(tx_rings);
         if (bp->flags & BNXT_FLAG_NEW_RM) {
                 enables |= rx_rings ? FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
                 enables |= cp_rings ? FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
@@ -4578,16 +4580,53 @@ bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                            FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
                 enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
 
-                req.num_rx_rings = cpu_to_le16(rx_rings);
-                req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-                req.num_cmpl_rings = cpu_to_le16(cp_rings);
-                req.num_stat_ctxs = req.num_cmpl_rings;
-                req.num_vnics = cpu_to_le16(vnics);
+                req->num_rx_rings = cpu_to_le16(rx_rings);
+                req->num_hw_ring_grps = cpu_to_le16(ring_grps);
+                req->num_cmpl_rings = cpu_to_le16(cp_rings);
+                req->num_stat_ctxs = req->num_cmpl_rings;
+                req->num_vnics = cpu_to_le16(vnics);
         }
-        if (!enables)
+        req->enables = cpu_to_le32(enables);
+}
+
+static void
+__bnxt_hwrm_reserve_vf_rings(struct bnxt *bp,
+                             struct hwrm_func_vf_cfg_input *req, int tx_rings,
+                             int rx_rings, int ring_grps, int cp_rings,
+                             int vnics)
+{
+        u32 enables = 0;
+
+        bnxt_hwrm_cmd_hdr_init(bp, req, HWRM_FUNC_VF_CFG, -1, -1);
+        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
+        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
+        enables |= cp_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                              FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
+        enables |= ring_grps ? FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
+        enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
+
+        req->num_tx_rings = cpu_to_le16(tx_rings);
+        req->num_rx_rings = cpu_to_le16(rx_rings);
+        req->num_hw_ring_grps = cpu_to_le16(ring_grps);
+        req->num_cmpl_rings = cpu_to_le16(cp_rings);
+        req->num_stat_ctxs = req->num_cmpl_rings;
+        req->num_vnics = cpu_to_le16(vnics);
+
+        req->enables = cpu_to_le32(enables);
+}
+
+static int
+bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
+                           int ring_grps, int cp_rings, int vnics)
+{
+        struct hwrm_func_cfg_input req = {0};
+        int rc;
+
+        __bnxt_hwrm_reserve_pf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
+        if (!req.enables)
                 return 0;
 
-        req.enables = cpu_to_le32(enables);
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 return -ENOMEM;
@@ -4604,7 +4643,6 @@ bnxt_hwrm_reserve_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                            int ring_grps, int cp_rings, int vnics)
 {
         struct hwrm_func_vf_cfg_input req = {0};
-        u32 enables = 0;
         int rc;
 
         if (!(bp->flags & BNXT_FLAG_NEW_RM)) {
@@ -4612,22 +4650,8 @@ bnxt_hwrm_reserve_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                 return 0;
         }
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_CFG, -1, -1);
-        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
-        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
-        enables |= cp_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                              FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
-        enables |= ring_grps ? FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
-        enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
-
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        req.num_rx_rings = cpu_to_le16(rx_rings);
-        req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-        req.num_cmpl_rings = cpu_to_le16(cp_rings);
-        req.num_stat_ctxs = req.num_cmpl_rings;
-        req.num_vnics = cpu_to_le16(vnics);
-
-        req.enables = cpu_to_le32(enables);
+        __bnxt_hwrm_reserve_vf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 return -ENOMEM;
@@ -4743,39 +4767,25 @@ static bool bnxt_need_reserve_rings(struct bnxt *bp)
 }
 
 static int bnxt_hwrm_check_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                    int ring_grps, int cp_rings)
+                                    int ring_grps, int cp_rings, int vnics)
 {
         struct hwrm_func_vf_cfg_input req = {0};
-        u32 flags, enables;
+        u32 flags;
         int rc;
 
         if (!(bp->flags & BNXT_FLAG_NEW_RM))
                 return 0;
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_CFG, -1, -1);
+        __bnxt_hwrm_reserve_vf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
         flags = FUNC_VF_CFG_REQ_FLAGS_TX_ASSETS_TEST |
                 FUNC_VF_CFG_REQ_FLAGS_RX_ASSETS_TEST |
                 FUNC_VF_CFG_REQ_FLAGS_CMPL_ASSETS_TEST |
                 FUNC_VF_CFG_REQ_FLAGS_RING_GRP_ASSETS_TEST |
                 FUNC_VF_CFG_REQ_FLAGS_STAT_CTX_ASSETS_TEST |
                 FUNC_VF_CFG_REQ_FLAGS_VNIC_ASSETS_TEST;
-        enables = FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS;
 
         req.flags = cpu_to_le32(flags);
-        req.enables = cpu_to_le32(enables);
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        req.num_rx_rings = cpu_to_le16(rx_rings);
-        req.num_cmpl_rings = cpu_to_le16(cp_rings);
-        req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-        req.num_stat_ctxs = cpu_to_le16(cp_rings);
-        req.num_vnics = cpu_to_le16(1);
-        if (bp->flags & BNXT_FLAG_RFS)
-                req.num_vnics = cpu_to_le16(rx_rings + 1);
         rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 return -ENOMEM;
@@ -4783,38 +4793,23 @@ static int bnxt_hwrm_check_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
 }
 
 static int bnxt_hwrm_check_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                    int ring_grps, int cp_rings)
+                                    int ring_grps, int cp_rings, int vnics)
 {
         struct hwrm_func_cfg_input req = {0};
-        u32 flags, enables;
+        u32 flags;
         int rc;
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
-        req.fid = cpu_to_le16(0xffff);
+        __bnxt_hwrm_reserve_pf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
         flags = FUNC_CFG_REQ_FLAGS_TX_ASSETS_TEST;
-        enables = FUNC_CFG_REQ_ENABLES_NUM_TX_RINGS;
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        if (bp->flags & BNXT_FLAG_NEW_RM) {
+        if (bp->flags & BNXT_FLAG_NEW_RM)
                 flags |= FUNC_CFG_REQ_FLAGS_RX_ASSETS_TEST |
                          FUNC_CFG_REQ_FLAGS_CMPL_ASSETS_TEST |
                          FUNC_CFG_REQ_FLAGS_RING_GRP_ASSETS_TEST |
                          FUNC_CFG_REQ_FLAGS_STAT_CTX_ASSETS_TEST |
                          FUNC_CFG_REQ_FLAGS_VNIC_ASSETS_TEST;
-                enables |= FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS |
-                           FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                           FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
-                           FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS |
-                           FUNC_CFG_REQ_ENABLES_NUM_VNICS;
-                req.num_rx_rings = cpu_to_le16(rx_rings);
-                req.num_cmpl_rings = cpu_to_le16(cp_rings);
-                req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-                req.num_stat_ctxs = cpu_to_le16(cp_rings);
-                req.num_vnics = cpu_to_le16(1);
-                if (bp->flags & BNXT_FLAG_RFS)
-                        req.num_vnics = cpu_to_le16(rx_rings + 1);
-        }
+
         req.flags = cpu_to_le32(flags);
-        req.enables = cpu_to_le32(enables);
         rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 return -ENOMEM;
@@ -4822,17 +4817,17 @@ static int bnxt_hwrm_check_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
 }
 
 static int bnxt_hwrm_check_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                 int ring_grps, int cp_rings)
+                                 int ring_grps, int cp_rings, int vnics)
 {
         if (bp->hwrm_spec_code < 0x10801)
                 return 0;
 
         if (BNXT_PF(bp))
                 return bnxt_hwrm_check_pf_rings(bp, tx_rings, rx_rings,
-                                                ring_grps, cp_rings);
+                                                ring_grps, cp_rings, vnics);
 
         return bnxt_hwrm_check_vf_rings(bp, tx_rings, rx_rings, ring_grps,
-                                        cp_rings);
+                                        cp_rings, vnics);
 }
 
 static void bnxt_hwrm_set_coal_params(struct bnxt_coal *hw_coal,
@@ -5865,7 +5860,6 @@ static int bnxt_init_msix(struct bnxt *bp)
                 if (rc)
                         goto msix_setup_exit;
 
-                bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
                 bp->cp_nr_rings = (min == 1) ?
                                   max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
                                   bp->tx_nr_rings + bp->rx_nr_rings;
@@ -5897,7 +5891,6 @@ static int bnxt_init_inta(struct bnxt *bp)
         bp->rx_nr_rings = 1;
         bp->tx_nr_rings = 1;
         bp->cp_nr_rings = 1;
-        bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
         bp->flags |= BNXT_FLAG_SHARED_RINGS;
         bp->irq_tbl[0].vector = bp->pdev->irq;
         return 0;
@@ -7531,7 +7524,7 @@ int bnxt_check_rings(struct bnxt *bp, int tx, int rx, bool sh, int tcs,
         int max_rx, max_tx, tx_sets = 1;
         int tx_rings_needed;
         int rx_rings = rx;
-        int cp, rc;
+        int cp, vnics, rc;
 
         if (tcs)
                 tx_sets = tcs;
@@ -7547,10 +7540,15 @@ int bnxt_check_rings(struct bnxt *bp, int tx, int rx, bool sh, int tcs,
         if (max_tx < tx_rings_needed)
                 return -ENOMEM;
 
+        vnics = 1;
+        if (bp->flags & BNXT_FLAG_RFS)
+                vnics += rx_rings;
+
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 rx_rings <<= 1;
         cp = sh ? max_t(int, tx_rings_needed, rx) : tx_rings_needed + rx;
-        return bnxt_hwrm_check_rings(bp, tx_rings_needed, rx_rings, rx, cp);
+        return bnxt_hwrm_check_rings(bp, tx_rings_needed, rx_rings, rx, cp,
+                                     vnics);
 }
 
 static void bnxt_unmap_bars(struct bnxt *bp, struct pci_dev *pdev)
@@ -8437,13 +8435,20 @@ int bnxt_restore_pf_fw_resources(struct bnxt *bp)
                 return 0;
 
         bnxt_hwrm_func_qcaps(bp);
-        __bnxt_close_nic(bp, true, false);
+
+        if (netif_running(bp->dev))
+                __bnxt_close_nic(bp, true, false);
+
         bnxt_clear_int_mode(bp);
         rc = bnxt_init_int_mode(bp);
-        if (rc)
-                dev_close(bp->dev);
-        else
-                rc = bnxt_open_nic(bp, true, false);
+
+        if (netif_running(bp->dev)) {
+                if (rc)
+                        dev_close(bp->dev);
+                else
+                        rc = bnxt_open_nic(bp, true, false);
+        }
+
         return rc;
 }
 
@@ -8664,6 +8669,11 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto init_err_pci_clean;
 
+        /* No TC has been set yet and rings may have been trimmed due to
+         * limited MSIX, so we re-initialize the TX rings per TC.
+         */
+        bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
+
         bnxt_get_wol_settings(bp);
         if (bp->flags & BNXT_FLAG_WOL_CAP)
                 device_set_wakeup_enable(&pdev->dev, bp->wol);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 1989c470172c..5e3d62189cab 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -189,6 +189,7 @@ struct rx_cmp_ext {
         #define RX_CMP_FLAGS2_T_L4_CS_CALC                      (0x1 << 3)
         #define RX_CMP_FLAGS2_META_FORMAT_VLAN                  (0x1 << 4)
         __le32 rx_cmp_meta_data;
+        #define RX_CMP_FLAGS2_METADATA_TCI_MASK                 0xffff
         #define RX_CMP_FLAGS2_METADATA_VID_MASK                 0xfff
         #define RX_CMP_FLAGS2_METADATA_TPID_MASK                0xffff0000
          #define RX_CMP_FLAGS2_METADATA_TPID_SFT                 16
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index fbe6e208e17b..65c2cee35766 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -349,6 +349,9 @@ static int bnxt_hwrm_cfa_flow_free(struct bnxt *bp, __le16 flow_handle)
         if (rc)
                 netdev_info(bp->dev, "Error: %s: flow_handle=0x%x rc=%d",
                             __func__, flow_handle, rc);
+
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -484,13 +487,15 @@ static int bnxt_hwrm_cfa_flow_alloc(struct bnxt *bp, struct bnxt_tc_flow *flow,
         req.action_flags = cpu_to_le16(action_flags);
 
         mutex_lock(&bp->hwrm_cmd_lock);
-
         rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (!rc)
                 *flow_handle = resp->flow_handle;
-
         mutex_unlock(&bp->hwrm_cmd_lock);
 
+        if (rc == HWRM_ERR_CODE_RESOURCE_ALLOC_ERROR)
+                rc = -ENOSPC;
+        else if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -561,6 +566,8 @@ static int hwrm_cfa_decap_filter_alloc(struct bnxt *bp,
                 netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
         mutex_unlock(&bp->hwrm_cmd_lock);
 
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -576,6 +583,9 @@ static int hwrm_cfa_decap_filter_free(struct bnxt *bp,
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
+
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -624,6 +634,8 @@ static int hwrm_cfa_encap_record_alloc(struct bnxt *bp,
                 netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
         mutex_unlock(&bp->hwrm_cmd_lock);
 
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -639,6 +651,9 @@ static int hwrm_cfa_encap_record_free(struct bnxt *bp,
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
+
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
@@ -1269,11 +1284,8 @@ static int bnxt_tc_del_flow(struct bnxt *bp,
         flow_node = rhashtable_lookup_fast(&tc_info->flow_table,
                                            &tc_flow_cmd->cookie,
                                            tc_info->flow_ht_params);
-        if (!flow_node) {
-                netdev_info(bp->dev, "ERROR: no flow_node for cookie %lx",
-                            tc_flow_cmd->cookie);
+        if (!flow_node)
                 return -EINVAL;
-        }
 
         return __bnxt_tc_del_flow(bp, flow_node);
 }
@@ -1290,11 +1302,8 @@ static int bnxt_tc_get_flow_stats(struct bnxt *bp,
         flow_node = rhashtable_lookup_fast(&tc_info->flow_table,
                                            &tc_flow_cmd->cookie,
                                            tc_info->flow_ht_params);
-        if (!flow_node) {
-                netdev_info(bp->dev, "Error: no flow_node for cookie %lx",
-                            tc_flow_cmd->cookie);
+        if (!flow_node)
                 return -1;
-        }
 
         flow = &flow_node->flow;
         curr_stats = &flow->stats;
@@ -1344,8 +1353,10 @@ bnxt_hwrm_cfa_flow_stats_get(struct bnxt *bp, int num_flows,
         } else {
                 netdev_info(bp->dev, "error rc=%d", rc);
         }
-
         mutex_unlock(&bp->hwrm_cmd_lock);
+
+        if (rc)
+                rc = -EIO;
         return rc;
 }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index c1841db1b500..f2593978ae75 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
 
                 tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
 
-                usleep_range(10, 20);
+                udelay(10);
                 timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
         }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 7b452e85de2a..61022b5f6743 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4970,7 +4970,6 @@ static void cxgb4_mgmt_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &cxgb4_mgmt_netdev_ops;
         dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops;
-        dev->needs_free_netdev = true;
 }
 
 static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
@@ -5181,6 +5180,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->name = pci_name(pdev);
         adapter->mbox = func;
         adapter->pf = func;
+        adapter->params.chip = chip;
+        adapter->adap_idx = adap_idx;
         adapter->msg_enable = DFLT_MSG_ENABLE;
         adapter->mbox_log = kzalloc(sizeof(*adapter->mbox_log) +
                                     (sizeof(struct mbox_cmd) *
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 5eb999af2c40..bd3f6e4d1341 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -540,6 +540,7 @@ static int gmac_setup_txqs(struct net_device *netdev)
 
         if (port->txq_dma_base & ~DMA_Q_BASE_MASK) {
                 dev_warn(geth->dev, "TX queue base it not aligned\n");
+                kfree(skb_tab);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 7caa8da48421..e4ec32a9ca15 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2008,7 +2008,6 @@ static inline int dpaa_xmit(struct dpaa_priv *priv,
         }
 
         if (unlikely(err < 0)) {
-                percpu_stats->tx_errors++;
                 percpu_stats->tx_fifo_errors++;
                 return err;
         }
@@ -2278,7 +2277,6 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
         vaddr = phys_to_virt(addr);
         prefetch(vaddr + qm_fd_get_offset(fd));
 
-        fd_format = qm_fd_get_format(fd);
         /* The only FD types that we may receive are contig and S/G */
         WARN_ON((fd_format != qm_fd_contig) && (fd_format != qm_fd_sg));
 
@@ -2311,8 +2309,10 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
 
         skb_len = skb->len;
 
-        if (unlikely(netif_receive_skb(skb) == NET_RX_DROP))
+        if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) {
+                percpu_stats->rx_dropped++;
                 return qman_cb_dqrr_consume;
+        }
 
         percpu_stats->rx_packets++;
         percpu_stats->rx_bytes += skb_len;
@@ -2860,7 +2860,7 @@ static int dpaa_remove(struct platform_device *pdev)
         struct device *dev;
         int err;
 
-        dev = &pdev->dev;
+        dev = pdev->dev.parent;
         net_dev = dev_get_drvdata(dev);
 
         priv = netdev_priv(net_dev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 7a7f3a42b2aa..d4604bc8eb5b 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3600,6 +3600,8 @@ fec_drv_remove(struct platform_device *pdev)
         fec_enet_mii_remove(fep);
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
+        pm_runtime_put(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
         if (of_phy_is_fixed_link(np))
                 of_phy_deregister_fixed_link(np);
         of_node_put(fep->phy_node);
diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
index ea43b4974149..7af31ddd093f 100644
--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
@@ -1100,7 +1100,7 @@ int dtsec_add_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
         set_bucket(dtsec->regs, bucket, true);
 
         /* Create element to be added to the driver hash table */
-        hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
+        hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
         if (!hash_entry)
                 return -ENOMEM;
         hash_entry->addr = addr;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 86944bc3b273..74bd260ca02a 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data)
 
 static int hns_gmac_get_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                 return ARRAY_SIZE(g_gmac_stats_string);
 
         return 0;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index b62816c1574e..93e71e27401b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb)
 
 int hns_ppe_get_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                 return ETH_PPE_STATIC_NUM;
         return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 6f3570cfb501..e2e28532e4dc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data)
  */
 int hns_rcb_get_ring_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                 return HNS_RING_STATIC_REG_NUM;
 
         return 0;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 7ea7f8a4aa2a..2e14a3ae1d8b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset)
                         cnt--;
 
                 return cnt;
-        } else {
+        } else if (stringset == ETH_SS_STATS) {
                 return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset));
+        } else {
+                return -EOPNOTSUPP;
         }
 }
 
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index afb7ebe20b24..824fd44e25f0 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -400,6 +400,10 @@
 #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
 #define E1000_ICR_RXO           0x00000040 /* Receiver Overrun */
 #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_MDAC          0x00000200 /* MDIO Access Complete */
+#define E1000_ICR_SRPD          0x00010000 /* Small Receive Packet Detected */
+#define E1000_ICR_ACK           0x00020000 /* Receive ACK Frame Detected */
+#define E1000_ICR_MNG           0x00040000 /* Manageability Event Detected */
 #define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
 /* If this bit asserted, the driver should claim the interrupt */
 #define E1000_ICR_INT_ASSERTED  0x80000000
@@ -407,7 +411,7 @@
 #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
 #define E1000_ICR_TXQ0          0x00400000 /* Tx Queue 0 Interrupt */
 #define E1000_ICR_TXQ1          0x00800000 /* Tx Queue 1 Interrupt */
-#define E1000_ICR_OTHER         0x01000000 /* Other Interrupts */
+#define E1000_ICR_OTHER         0x01000000 /* Other Interrupt */
 
 /* PBA ECC Register */
 #define E1000_PBA_ECC_COUNTER_MASK  0xFFF00000 /* ECC counter mask */
@@ -431,12 +435,27 @@
         E1000_IMS_RXSEQ  |    \
         E1000_IMS_LSC)
 
+/* These are all of the events related to the OTHER interrupt.
+ */
+#define IMS_OTHER_MASK ( \
+        E1000_IMS_LSC  | \
+        E1000_IMS_RXO  | \
+        E1000_IMS_MDAC | \
+        E1000_IMS_SRPD | \
+        E1000_IMS_ACK  | \
+        E1000_IMS_MNG)
+
 /* Interrupt Mask Set */
 #define E1000_IMS_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
 #define E1000_IMS_LSC       E1000_ICR_LSC       /* Link Status Change */
 #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
 #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
+#define E1000_IMS_RXO       E1000_ICR_RXO       /* Receiver Overrun */
 #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
+#define E1000_IMS_MDAC      E1000_ICR_MDAC      /* MDIO Access Complete */
+#define E1000_IMS_SRPD      E1000_ICR_SRPD      /* Small Receive Packet */
+#define E1000_IMS_ACK       E1000_ICR_ACK       /* Receive ACK Frame Detected */
+#define E1000_IMS_MNG       E1000_ICR_MNG       /* Manageability Event */
 #define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
 #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
 #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 31277d3bb7dc..1dddfb7b2de6 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1367,9 +1367,6 @@ out:
  *  Checks to see of the link status of the hardware has changed.  If a
  *  change in link status has been detected, then we read the PHY registers
  *  to get the current speed/duplex if link exists.
- *
- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
- *  up).
  **/
 static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 {
@@ -1385,7 +1382,8 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
          * Change or Rx Sequence Error interrupt.
          */
         if (!mac->get_link_status)
-                return 1;
+                return 0;
+        mac->get_link_status = false;
 
         /* First we want to see if the MII Status Register reports
          * link.  If so, then we want to get the current speed/duplex
@@ -1393,12 +1391,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
          */
         ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
         if (ret_val)
-                return ret_val;
+                goto out;
 
         if (hw->mac.type == e1000_pchlan) {
                 ret_val = e1000_k1_gig_workaround_hv(hw, link);
                 if (ret_val)
-                        return ret_val;
+                        goto out;
         }
 
         /* When connected at 10Mbps half-duplex, some parts are excessively
@@ -1431,7 +1429,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 
                 ret_val = hw->phy.ops.acquire(hw);
                 if (ret_val)
-                        return ret_val;
+                        goto out;
 
                 if (hw->mac.type == e1000_pch2lan)
                         emi_addr = I82579_RX_CONFIG;
@@ -1453,7 +1451,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                 hw->phy.ops.release(hw);
 
                 if (ret_val)
-                        return ret_val;
+                        goto out;
 
                 if (hw->mac.type >= e1000_pch_spt) {
                         u16 data;
@@ -1462,14 +1460,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                         if (speed == SPEED_1000) {
                                 ret_val = hw->phy.ops.acquire(hw);
                                 if (ret_val)
-                                        return ret_val;
+                                        goto out;
 
                                 ret_val = e1e_rphy_locked(hw,
                                                           PHY_REG(776, 20),
                                                           &data);
                                 if (ret_val) {
                                         hw->phy.ops.release(hw);
-                                        return ret_val;
+                                        goto out;
                                 }
 
                                 ptr_gap = (data & (0x3FF << 2)) >> 2;
@@ -1483,18 +1481,18 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                                 }
                                 hw->phy.ops.release(hw);
                                 if (ret_val)
-                                        return ret_val;
+                                        goto out;
                         } else {
                                 ret_val = hw->phy.ops.acquire(hw);
                                 if (ret_val)
-                                        return ret_val;
+                                        goto out;
 
                                 ret_val = e1e_wphy_locked(hw,
                                                           PHY_REG(776, 20),
                                                           0xC023);
                                 hw->phy.ops.release(hw);
                                 if (ret_val)
-                                        return ret_val;
+                                        goto out;
 
                         }
                 }
@@ -1521,7 +1519,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
             (hw->adapter->pdev->device == E1000_DEV_ID_PCH_I218_V3)) {
                 ret_val = e1000_k1_workaround_lpt_lp(hw, link);
                 if (ret_val)
-                        return ret_val;
+                        goto out;
         }
         if (hw->mac.type >= e1000_pch_lpt) {
                 /* Set platform power management values for
@@ -1529,7 +1527,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                  */
                 ret_val = e1000_platform_pm_pch_lpt(hw, link);
                 if (ret_val)
-                        return ret_val;
+                        goto out;
         }
 
         /* Clear link partner's EEE ability */
@@ -1552,9 +1550,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         }
 
         if (!link)
-                return 0;       /* No link detected */
-
-        mac->get_link_status = false;
+                goto out;
 
         switch (hw->mac.type) {
         case e1000_pch2lan:
@@ -1616,12 +1612,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
          * different link partner.
          */
         ret_val = e1000e_config_fc_after_link_up(hw);
-        if (ret_val) {
+        if (ret_val)
                 e_dbg("Error configuring flow control\n");
-                return ret_val;
-        }
 
-        return 1;
+        return ret_val;
+
+out:
+        mac->get_link_status = true;
+        return ret_val;
 }
 
 static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
index f457c5703d0c..5bdc3a2d4fd7 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -410,9 +410,6 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw)
  *  Checks to see of the link status of the hardware has changed.  If a
  *  change in link status has been detected, then we read the PHY registers
  *  to get the current speed/duplex if link exists.
- *
- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
- *  up).
  **/
 s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
 {
@@ -426,20 +423,16 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
          * Change or Rx Sequence Error interrupt.
          */
         if (!mac->get_link_status)
-                return 1;
+                return 0;
+        mac->get_link_status = false;
 
         /* First we want to see if the MII Status Register reports
          * link.  If so, then we want to get the current speed/duplex
          * of the PHY.
          */
         ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
-        if (ret_val)
-                return ret_val;
-
-        if (!link)
-                return 0;       /* No link detected */
-
-        mac->get_link_status = false;
+        if (ret_val || !link)
+                goto out;
 
         /* Check if there was DownShift, must be checked
          * immediately after link-up
@@ -464,12 +457,14 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
          * different link partner.
          */
         ret_val = e1000e_config_fc_after_link_up(hw);
-        if (ret_val) {
+        if (ret_val)
                 e_dbg("Error configuring flow control\n");
-                return ret_val;
-        }
 
-        return 1;
+        return ret_val;
+
+out:
+        mac->get_link_status = true;
+        return ret_val;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 1298b69f990b..dc853b0863af 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1914,30 +1914,20 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data)
         struct net_device *netdev = data;
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
-        u32 icr;
-        bool enable = true;
-
-        icr = er32(ICR);
-        if (icr & E1000_ICR_RXO) {
-                ew32(ICR, E1000_ICR_RXO);
-                enable = false;
-                /* napi poll will re-enable Other, make sure it runs */
-                if (napi_schedule_prep(&adapter->napi)) {
-                        adapter->total_rx_bytes = 0;
-                        adapter->total_rx_packets = 0;
-                        __napi_schedule(&adapter->napi);
-                }
-        }
+        u32 icr = er32(ICR);
+
+        if (icr & adapter->eiac_mask)
+                ew32(ICS, (icr & adapter->eiac_mask));
+
         if (icr & E1000_ICR_LSC) {
-                ew32(ICR, E1000_ICR_LSC);
                 hw->mac.get_link_status = true;
                 /* guard against interrupt when we're going down */
                 if (!test_bit(__E1000_DOWN, &adapter->state))
                         mod_timer(&adapter->watchdog_timer, jiffies + 1);
         }
 
-        if (enable && !test_bit(__E1000_DOWN, &adapter->state))
-                ew32(IMS, E1000_IMS_OTHER);
+        if (!test_bit(__E1000_DOWN, &adapter->state))
+                ew32(IMS, E1000_IMS_OTHER | IMS_OTHER_MASK);
 
         return IRQ_HANDLED;
 }
@@ -2040,7 +2030,6 @@ static void e1000_configure_msix(struct e1000_adapter *adapter)
                        hw->hw_addr + E1000_EITR_82574(vector));
         else
                 writel(1, hw->hw_addr + E1000_EITR_82574(vector));
-        adapter->eiac_mask |= E1000_IMS_OTHER;
 
         /* Cause Tx interrupts on every write back */
         ivar |= BIT(31);
@@ -2265,7 +2254,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
 
         if (adapter->msix_entries) {
                 ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
-                ew32(IMS, adapter->eiac_mask | E1000_IMS_LSC);
+                ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER |
+                     IMS_OTHER_MASK);
         } else if (hw->mac.type >= e1000_pch_lpt) {
                 ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
         } else {
@@ -2333,8 +2323,8 @@ static int e1000_alloc_ring_dma(struct e1000_adapter *adapter,
 {
         struct pci_dev *pdev = adapter->pdev;
 
-        ring->desc = dma_alloc_coherent(&pdev->dev, ring->size, &ring->dma,
-                                        GFP_KERNEL);
+        ring->desc = dma_zalloc_coherent(&pdev->dev, ring->size, &ring->dma,
+                                         GFP_KERNEL);
         if (!ring->desc)
                 return -ENOMEM;
 
@@ -2707,8 +2697,7 @@ static int e1000e_poll(struct napi_struct *napi, int weight)
                 napi_complete_done(napi, work_done);
                 if (!test_bit(__E1000_DOWN, &adapter->state)) {
                         if (adapter->msix_entries)
-                                ew32(IMS, adapter->rx_ring->ims_val |
-                                     E1000_IMS_OTHER);
+                                ew32(IMS, adapter->rx_ring->ims_val);
                         else
                                 e1000_irq_enable(adapter);
                 }
@@ -5101,7 +5090,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
         case e1000_media_type_copper:
                 if (hw->mac.get_link_status) {
                         ret_val = hw->mac.ops.check_for_link(hw);
-                        link_active = ret_val > 0;
+                        link_active = !hw->mac.get_link_status;
                 } else {
                         link_active = true;
                 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
index b698fb481b2e..996dc099cd58 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
@@ -443,6 +443,17 @@ int mlxsw_afa_block_jump(struct mlxsw_afa_block *block, u16 group_id)
 }
 EXPORT_SYMBOL(mlxsw_afa_block_jump);
 
+int mlxsw_afa_block_terminate(struct mlxsw_afa_block *block)
+{
+        if (block->finished)
+                return -EINVAL;
+        mlxsw_afa_set_goto_set(block->cur_set,
+                               MLXSW_AFA_SET_GOTO_BINDING_CMD_TERM, 0);
+        block->finished = true;
+        return 0;
+}
+EXPORT_SYMBOL(mlxsw_afa_block_terminate);
+
 static struct mlxsw_afa_fwd_entry *
 mlxsw_afa_fwd_entry_create(struct mlxsw_afa *mlxsw_afa, u8 local_port)
 {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
index 43132293475c..b91f2b0829b0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
@@ -65,6 +65,7 @@ char *mlxsw_afa_block_first_set(struct mlxsw_afa_block *block);
 u32 mlxsw_afa_block_first_set_kvdl_index(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_continue(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_jump(struct mlxsw_afa_block *block, u16 group_id);
+int mlxsw_afa_block_terminate(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_append_drop(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_append_trap(struct mlxsw_afa_block *block, u16 trap_id);
 int mlxsw_afa_block_append_trap_and_forward(struct mlxsw_afa_block *block,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index c7e941aecc2a..bf400c75fcc8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -655,13 +655,17 @@ static int mlxsw_sp_span_port_mtu_update(struct mlxsw_sp_port *port, u16 mtu)
 }
 
 static struct mlxsw_sp_span_inspected_port *
-mlxsw_sp_span_entry_bound_port_find(struct mlxsw_sp_port *port,
-                                    struct mlxsw_sp_span_entry *span_entry)
+mlxsw_sp_span_entry_bound_port_find(struct mlxsw_sp_span_entry *span_entry,
+                                    enum mlxsw_sp_span_type type,
+                                    struct mlxsw_sp_port *port,
+                                    bool bind)
 {
         struct mlxsw_sp_span_inspected_port *p;
 
         list_for_each_entry(p, &span_entry->bound_ports_list, list)
-                if (port->local_port == p->local_port)
+                if (type == p->type &&
+                    port->local_port == p->local_port &&
+                    bind == p->bound)
                         return p;
         return NULL;
 }
@@ -691,8 +695,22 @@ mlxsw_sp_span_inspected_port_add(struct mlxsw_sp_port *port,
         struct mlxsw_sp_span_inspected_port *inspected_port;
         struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
         char sbib_pl[MLXSW_REG_SBIB_LEN];
+        int i;
         int err;
 
+        /* A given (source port, direction) can only be bound to one analyzer,
+         * so if a binding is requested, check for conflicts.
+         */
+        if (bind)
+                for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
+                        struct mlxsw_sp_span_entry *curr =
+                                &mlxsw_sp->span.entries[i];
+
+                        if (mlxsw_sp_span_entry_bound_port_find(curr, type,
+                                                                port, bind))
+                                return -EEXIST;
+                }
+
         /* if it is an egress SPAN, bind a shared buffer to it */
         if (type == MLXSW_SP_SPAN_EGRESS) {
                 u32 buffsize = mlxsw_sp_span_mtu_to_buffsize(mlxsw_sp,
@@ -720,6 +738,7 @@ mlxsw_sp_span_inspected_port_add(struct mlxsw_sp_port *port,
         }
         inspected_port->local_port = port->local_port;
         inspected_port->type = type;
+        inspected_port->bound = bind;
         list_add_tail(&inspected_port->list, &span_entry->bound_ports_list);
 
         return 0;
@@ -746,7 +765,8 @@ mlxsw_sp_span_inspected_port_del(struct mlxsw_sp_port *port,
         struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
         char sbib_pl[MLXSW_REG_SBIB_LEN];
 
-        inspected_port = mlxsw_sp_span_entry_bound_port_find(port, span_entry);
+        inspected_port = mlxsw_sp_span_entry_bound_port_find(span_entry, type,
+                                                             port, bind);
         if (!inspected_port)
                 return;
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 4ec1ca3c96c8..92064db2ae44 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -120,6 +120,9 @@ struct mlxsw_sp_span_inspected_port {
         struct list_head list;
         enum mlxsw_sp_span_type type;
         u8 local_port;
+
+        /* Whether this is a directly bound mirror (port-to-port) or an ACL. */
+        bool bound;
 };
 
 struct mlxsw_sp_span_entry {
@@ -553,6 +556,7 @@ void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
                                 u16 group_id);
+int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
index 0897a5435cc2..92d90ed7207e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
@@ -528,6 +528,11 @@ int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
         return mlxsw_afa_block_jump(rulei->act_block, group_id);
 }
 
+int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
+{
+        return mlxsw_afa_block_terminate(rulei->act_block);
+}
+
 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei)
 {
         return mlxsw_afa_block_append_drop(rulei->act_block);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 93728c694e6d..0a9adc5962fb 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -385,13 +385,13 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_sb_cms_egress[] = {
 
 static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = {
         MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
         MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_SB_CM(10000, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 6ce00e28d4ea..89dbf569dff5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -65,7 +65,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
         tcf_exts_to_list(exts, &actions);
         list_for_each_entry(a, &actions, list) {
                 if (is_tcf_gact_ok(a)) {
-                        err = mlxsw_sp_acl_rulei_act_continue(rulei);
+                        err = mlxsw_sp_acl_rulei_act_terminate(rulei);
                         if (err)
                                 return err;
                 } else if (is_tcf_gact_shot(a)) {
diff --git a/drivers/net/ethernet/natsemi/Kconfig b/drivers/net/ethernet/natsemi/Kconfig
index a10ef50e4f12..017fb2322589 100644
--- a/drivers/net/ethernet/natsemi/Kconfig
+++ b/drivers/net/ethernet/natsemi/Kconfig
@@ -1,16 +1,16 @@
 #
-# National Semi-conductor device configuration
+# National Semiconductor device configuration
 #
 
 config NET_VENDOR_NATSEMI
-        bool "National Semi-conductor devices"
+        bool "National Semiconductor devices"
         default y
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y.
 
           Note that the answer to this question doesn't directly affect the
           kernel: saying N will just cause the configurator to skip all
-          the questions about National Semi-conductor devices. If you say Y,
+          the questions about National Semiconductor devices. If you say Y,
           you will be asked for your specific card in the following questions.
 
 if NET_VENDOR_NATSEMI
diff --git a/drivers/net/ethernet/natsemi/Makefile b/drivers/net/ethernet/natsemi/Makefile
index cc664977596e..a759aa09ef59 100644
--- a/drivers/net/ethernet/natsemi/Makefile
+++ b/drivers/net/ethernet/natsemi/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 #
-# Makefile for the National Semi-conductor Sonic devices.
+# Makefile for the National Semiconductor Sonic devices.
 #
 
 obj-$(CONFIG_MACSONIC) += macsonic.o
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index 6f546e869d8d..00f41c145d4d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -2480,7 +2480,10 @@ int qed_cxt_free_proto_ilt(struct qed_hwfn *p_hwfn, enum protocol_type proto)
         if (rc)
                 return rc;
 
-        /* Free Task CXT */
+        /* Free Task CXT ( Intentionally RoCE as task-id is shared between
+         * RoCE and iWARP )
+         */
+        proto = PROTOCOLID_ROCE;
         rc = qed_cxt_free_ilt_range(p_hwfn, QED_ELEM_TASK, 0,
                                     qed_cxt_get_proto_tid_count(p_hwfn, proto));
         if (rc)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index ca4a81dc1ace..d5d02be72947 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1703,6 +1703,13 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
         iph = (struct iphdr *)((u8 *)(ethh) + eth_hlen);
 
         if (eth_type == ETH_P_IP) {
+                if (iph->protocol != IPPROTO_TCP) {
+                        DP_NOTICE(p_hwfn,
+                                  "Unexpected ip protocol on ll2 %x\n",
+                                  iph->protocol);
+                        return -EINVAL;
+                }
+
                 cm_info->local_ip[0] = ntohl(iph->daddr);
                 cm_info->remote_ip[0] = ntohl(iph->saddr);
                 cm_info->ip_version = TCP_IPV4;
@@ -1711,6 +1718,14 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
                 *payload_len = ntohs(iph->tot_len) - ip_hlen;
         } else if (eth_type == ETH_P_IPV6) {
                 ip6h = (struct ipv6hdr *)iph;
+
+                if (ip6h->nexthdr != IPPROTO_TCP) {
+                        DP_NOTICE(p_hwfn,
+                                  "Unexpected ip protocol on ll2 %x\n",
+                                  iph->protocol);
+                        return -EINVAL;
+                }
+
                 for (i = 0; i < 4; i++) {
                         cm_info->local_ip[i] =
                             ntohl(ip6h->daddr.in6_u.u6_addr32[i]);
@@ -1928,8 +1943,8 @@ qed_iwarp_update_fpdu_length(struct qed_hwfn *p_hwfn,
                 /* Missing lower byte is now available */
                 mpa_len = fpdu->fpdu_length | *mpa_data;
                 fpdu->fpdu_length = QED_IWARP_FPDU_LEN_WITH_PAD(mpa_len);
-                fpdu->mpa_frag_len = fpdu->fpdu_length;
                 /* one byte of hdr */
+                fpdu->mpa_frag_len = 1;
                 fpdu->incomplete_bytes = fpdu->fpdu_length - 1;
                 DP_VERBOSE(p_hwfn,
                            QED_MSG_RDMA,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 5d040b873137..a411f9c702a1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -379,6 +379,7 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)
         DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
         qed_rdma_free_reserved_lkey(p_hwfn);
+        qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
         qed_rdma_resc_free(p_hwfn);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 2db70eabddfe..a01e7d6e5442 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -288,7 +288,7 @@ int __init qede_init(void)
         }
 
         /* Must register notifier before pci ops, since we might miss
-         * interface rename after pci probe and netdev registeration.
+         * interface rename after pci probe and netdev registration.
          */
         ret = register_netdevice_notifier(&qede_netdev_notifier);
         if (ret) {
@@ -988,7 +988,7 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
         if (rc)
                 goto err3;
 
-        /* Prepare the lock prior to the registeration of the netdev,
+        /* Prepare the lock prior to the registration of the netdev,
          * as once it's registered we might reach flows requiring it
          * [it's even possible to reach a flow needing it directly
          * from there, although it's unlikely].
@@ -2067,8 +2067,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode,
         link_params.link_up = true;
         edev->ops->common->set_link(edev->cdev, &link_params);
 
-        qede_rdma_dev_event_open(edev);
-
         edev->state = QEDE_STATE_OPEN;
 
         DP_INFO(edev, "Ending successfully qede load\n");
@@ -2169,12 +2167,14 @@ static void qede_link_update(void *dev, struct qed_link_output *link)
                         DP_NOTICE(edev, "Link is up\n");
                         netif_tx_start_all_queues(edev->ndev);
                         netif_carrier_on(edev->ndev);
+                        qede_rdma_dev_event_open(edev);
                 }
         } else {
                 if (netif_carrier_ok(edev->ndev)) {
                         DP_NOTICE(edev, "Link is down\n");
                         netif_tx_disable(edev->ndev);
                         netif_carrier_off(edev->ndev);
+                        qede_rdma_dev_event_close(edev);
                 }
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
index 9b2280badaf7..02adb513f475 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
@@ -485,7 +485,7 @@ int qede_ptp_enable(struct qede_dev *edev, bool init_tc)
         ptp->clock = ptp_clock_register(&ptp->clock_info, &edev->pdev->dev);
         if (IS_ERR(ptp->clock)) {
                 rc = -EINVAL;
-                DP_ERR(edev, "PTP clock registeration failed\n");
+                DP_ERR(edev, "PTP clock registration failed\n");
                 goto err2;
         }
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 9cbb27263742..d5a32b7c7dc5 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -1194,9 +1194,9 @@ void emac_mac_tx_process(struct emac_adapter *adpt, struct emac_tx_queue *tx_q)
         while (tx_q->tpd.consume_idx != hw_consume_idx) {
                 tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.consume_idx);
                 if (tpbuf->dma_addr) {
-                        dma_unmap_single(adpt->netdev->dev.parent,
-                                         tpbuf->dma_addr, tpbuf->length,
-                                         DMA_TO_DEVICE);
+                        dma_unmap_page(adpt->netdev->dev.parent,
+                                       tpbuf->dma_addr, tpbuf->length,
+                                       DMA_TO_DEVICE);
                         tpbuf->dma_addr = 0;
                 }
 
@@ -1353,9 +1353,11 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
 
                 tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
                 tpbuf->length = mapped_len;
-                tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
-                                                 skb->data, tpbuf->length,
-                                                 DMA_TO_DEVICE);
+                tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
+                                               virt_to_page(skb->data),
+                                               offset_in_page(skb->data),
+                                               tpbuf->length,
+                                               DMA_TO_DEVICE);
                 ret = dma_mapping_error(adpt->netdev->dev.parent,
                                         tpbuf->dma_addr);
                 if (ret)
@@ -1371,9 +1373,12 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
         if (mapped_len < len) {
                 tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
                 tpbuf->length = len - mapped_len;
-                tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
-                                                 skb->data + mapped_len,
-                                                 tpbuf->length, DMA_TO_DEVICE);
+                tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
+                                               virt_to_page(skb->data +
+                                                            mapped_len),
+                                               offset_in_page(skb->data +
+                                                              mapped_len),
+                                               tpbuf->length, DMA_TO_DEVICE);
                 ret = dma_mapping_error(adpt->netdev->dev.parent,
                                         tpbuf->dma_addr);
                 if (ret)
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 012fb66eed8d..f0afb88d7bc2 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
         pdata = netdev_priv(dev);
         BUG_ON(!pdata);
         BUG_ON(!pdata->ioaddr);
-        WARN_ON(dev->phydev);
 
         SMSC_TRACE(pdata, ifdown, "Stopping driver");
 
+        unregister_netdev(dev);
+
         mdiobus_unregister(pdata->mii_bus);
         mdiobus_free(pdata->mii_bus);
 
-        unregister_netdev(dev);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "smsc911x-memory");
         if (!res)
diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
index 111e7ca9df56..f5c5984afefb 100644
--- a/drivers/net/ethernet/socionext/sni_ave.c
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -1295,7 +1295,7 @@ static int ave_open(struct net_device *ndev)
         val |= AVE_IIRQC_EN0 | (AVE_INTM_COUNT << 16);
         writel(val, priv->base + AVE_IIRQC);
 
-        val = AVE_GI_RXIINT | AVE_GI_RXOVF | AVE_GI_TX;
+        val = AVE_GI_RXIINT | AVE_GI_RXOVF | AVE_GI_TX | AVE_GI_RXDROP;
         ave_irq_restore(ndev, val);
 
         napi_enable(&priv->napi_rx);
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 63d3d6b215f3..a94f50442613 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -312,7 +312,7 @@ static struct vnet *vnet_new(const u64 *local_mac,
         dev->ethtool_ops = &vnet_ethtool_ops;
         dev->watchdog_timeo = VNET_TX_TIMEOUT;
 
-        dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_GSO_SOFTWARE |
+        dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_ALL_TSO |
                            NETIF_F_HW_CSUM | NETIF_F_SG;
         dev->features = dev->hw_features;
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 1b1b78fdc138..b2b30c9df037 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1014,7 +1014,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                 /* set speed_in input in case RMII mode is used in 100Mbps */
                 if (phy->speed == 100)
                         mac_control |= BIT(15);
-                else if (phy->speed == 10)
+                /* in band mode only works in 10Mbps RGMII mode */
+                else if ((phy->speed == 10) && phy_interface_is_rgmii(phy))
                         mac_control |= BIT(18); /* In Band mode */
 
                 if (priv->rx_pause)
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 0db3bd1ea06f..32861036c3fc 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -173,6 +173,7 @@ struct rndis_device {
         struct list_head req_list;
 
         struct work_struct mcast_work;
+        u32 filter;
 
         bool link_state;        /* 0 - link up, 1 - link down */
 
@@ -211,7 +212,6 @@ void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
 
 void rndis_set_subchannel(struct work_struct *w);
-bool rndis_filter_opened(const struct netvsc_device *nvdev);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 0265d703eb03..7472172823f3 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -90,6 +90,11 @@ static void free_netvsc_device(struct rcu_head *head)
                 = container_of(head, struct netvsc_device, rcu);
         int i;
 
+        kfree(nvdev->extension);
+        vfree(nvdev->recv_buf);
+        vfree(nvdev->send_buf);
+        kfree(nvdev->send_section_map);
+
         for (i = 0; i < VRSS_CHANNEL_MAX; i++)
                 vfree(nvdev->chan_table[i].mrc.slots);
 
@@ -211,12 +216,6 @@ static void netvsc_teardown_gpadl(struct hv_device *device,
                 net_device->recv_buf_gpadl_handle = 0;
         }
 
-        if (net_device->recv_buf) {
-                /* Free up the receive buffer */
-                vfree(net_device->recv_buf);
-                net_device->recv_buf = NULL;
-        }
-
         if (net_device->send_buf_gpadl_handle) {
                 ret = vmbus_teardown_gpadl(device->channel,
                                            net_device->send_buf_gpadl_handle);
@@ -231,12 +230,6 @@ static void netvsc_teardown_gpadl(struct hv_device *device,
                 }
                 net_device->send_buf_gpadl_handle = 0;
         }
-        if (net_device->send_buf) {
-                /* Free up the send buffer */
-                vfree(net_device->send_buf);
-                net_device->send_buf = NULL;
-        }
-        kfree(net_device->send_section_map);
 }
 
 int netvsc_alloc_recv_comp_ring(struct netvsc_device *net_device, u32 q_idx)
@@ -562,26 +555,29 @@ void netvsc_device_remove(struct hv_device *device)
                 = rtnl_dereference(net_device_ctx->nvdev);
         int i;
 
-        cancel_work_sync(&net_device->subchan_work);
-
         netvsc_revoke_buf(device, net_device);
 
         RCU_INIT_POINTER(net_device_ctx->nvdev, NULL);
 
+        /* And disassociate NAPI context from device */
+        for (i = 0; i < net_device->num_chn; i++)
+                netif_napi_del(&net_device->chan_table[i].napi);
+
         /*
          * At this point, no one should be accessing net_device
          * except in here
          */
         netdev_dbg(ndev, "net device safe to remove\n");
 
+        /* older versions require that buffer be revoked before close */
+        if (net_device->nvsp_version < NVSP_PROTOCOL_VERSION_4)
+                netvsc_teardown_gpadl(device, net_device);
+
         /* Now, we can close the channel safely */
         vmbus_close(device->channel);
 
-        netvsc_teardown_gpadl(device, net_device);
-
-        /* And dissassociate NAPI context from device */
-        for (i = 0; i < net_device->num_chn; i++)
-                netif_napi_del(&net_device->chan_table[i].napi);
+        if (net_device->nvsp_version >= NVSP_PROTOCOL_VERSION_4)
+                netvsc_teardown_gpadl(device, net_device);
 
         /* Release all resources */
         free_netvsc_device_rcu(net_device);
@@ -645,14 +641,18 @@ static void netvsc_send_tx_complete(struct netvsc_device *net_device,
         queue_sends =
                 atomic_dec_return(&net_device->chan_table[q_idx].queue_sends);
 
-        if (net_device->destroy && queue_sends == 0)
-                wake_up(&net_device->wait_drain);
+        if (unlikely(net_device->destroy)) {
+                if (queue_sends == 0)
+                        wake_up(&net_device->wait_drain);
+        } else {
+                struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
 
-        if (netif_tx_queue_stopped(netdev_get_tx_queue(ndev, q_idx)) &&
-            (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER ||
-             queue_sends < 1)) {
-                netif_tx_wake_queue(netdev_get_tx_queue(ndev, q_idx));
-                ndev_ctx->eth_stats.wake_queue++;
+                if (netif_tx_queue_stopped(txq) &&
+                    (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER ||
+                     queue_sends < 1)) {
+                        netif_tx_wake_queue(txq);
+                        ndev_ctx->eth_stats.wake_queue++;
+                }
         }
 }
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index cdb78eefab67..f28c85d212ce 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -46,7 +46,10 @@
 
 #include "hyperv_net.h"
 
-#define RING_SIZE_MIN           64
+#define RING_SIZE_MIN   64
+#define RETRY_US_LO     5000
+#define RETRY_US_HI     10000
+#define RETRY_MAX       2000    /* >10 sec */
 
 #define LINKCHANGE_INT (2 * HZ)
 #define VF_TAKEOVER_INT (HZ / 10)
@@ -89,15 +92,20 @@ static void netvsc_change_rx_flags(struct net_device *net, int change)
 static void netvsc_set_rx_mode(struct net_device *net)
 {
         struct net_device_context *ndev_ctx = netdev_priv(net);
-        struct net_device *vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
-        struct netvsc_device *nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        struct net_device *vf_netdev;
+        struct netvsc_device *nvdev;
 
+        rcu_read_lock();
+        vf_netdev = rcu_dereference(ndev_ctx->vf_netdev);
         if (vf_netdev) {
                 dev_uc_sync(vf_netdev, net);
                 dev_mc_sync(vf_netdev, net);
         }
 
-        rndis_filter_update(nvdev);
+        nvdev = rcu_dereference(ndev_ctx->nvdev);
+        if (nvdev)
+                rndis_filter_update(nvdev);
+        rcu_read_unlock();
 }
 
 static int netvsc_open(struct net_device *net)
@@ -118,10 +126,8 @@ static int netvsc_open(struct net_device *net)
         }
 
         rdev = nvdev->extension;
-        if (!rdev->link_state) {
+        if (!rdev->link_state)
                 netif_carrier_on(net);
-                netif_tx_wake_all_queues(net);
-        }
 
         if (vf_netdev) {
                 /* Setting synthetic device up transparently sets
@@ -137,36 +143,25 @@ static int netvsc_open(struct net_device *net)
         return 0;
 }
 
-static int netvsc_close(struct net_device *net)
+static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
 {
-        struct net_device_context *net_device_ctx = netdev_priv(net);
-        struct net_device *vf_netdev
-                = rtnl_dereference(net_device_ctx->vf_netdev);
-        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
-        int ret = 0;
-        u32 aread, i, msec = 10, retry = 0, retry_max = 20;
-        struct vmbus_channel *chn;
-
-        netif_tx_disable(net);
-
-        /* No need to close rndis filter if it is removed already */
-        if (!nvdev)
-                goto out;
-
-        ret = rndis_filter_close(nvdev);
-        if (ret != 0) {
-                netdev_err(net, "unable to close device (ret %d).\n", ret);
-                return ret;
-        }
+        unsigned int retry = 0;
+        int i;
 
         /* Ensure pending bytes in ring are read */
-        while (true) {
-                aread = 0;
+        for (;;) {
+                u32 aread = 0;
+
                 for (i = 0; i < nvdev->num_chn; i++) {
-                        chn = nvdev->chan_table[i].channel;
+                        struct vmbus_channel *chn
+                                = nvdev->chan_table[i].channel;
+
                         if (!chn)
                                 continue;
 
+                        /* make sure receive not running now */
+                        napi_synchronize(&nvdev->chan_table[i].napi);
+
                         aread = hv_get_bytes_to_read(&chn->inbound);
                         if (aread)
                                 break;
@@ -176,22 +171,40 @@ static int netvsc_close(struct net_device *net)
                                 break;
                 }
 
-                retry++;
-                if (retry > retry_max || aread == 0)
-                        break;
+                if (aread == 0)
+                        return 0;
 
-                msleep(msec);
+                if (++retry > RETRY_MAX)
+                        return -ETIMEDOUT;
 
-                if (msec < 1000)
-                        msec *= 2;
+                usleep_range(RETRY_US_LO, RETRY_US_HI);
         }
+}
 
-        if (aread) {
-                netdev_err(net, "Ring buffer not empty after closing rndis\n");
-                ret = -ETIMEDOUT;
+static int netvsc_close(struct net_device *net)
+{
+        struct net_device_context *net_device_ctx = netdev_priv(net);
+        struct net_device *vf_netdev
+                = rtnl_dereference(net_device_ctx->vf_netdev);
+        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+        int ret;
+
+        netif_tx_disable(net);
+
+        /* No need to close rndis filter if it is removed already */
+        if (!nvdev)
+                return 0;
+
+        ret = rndis_filter_close(nvdev);
+        if (ret != 0) {
+                netdev_err(net, "unable to close device (ret %d).\n", ret);
+                return ret;
         }
 
-out:
+        ret = netvsc_wait_until_empty(nvdev);
+        if (ret)
+                netdev_err(net, "Ring buffer not empty after closing rndis\n");
+
         if (vf_netdev)
                 dev_close(vf_netdev);
 
@@ -840,16 +853,81 @@ static void netvsc_get_channels(struct net_device *net,
         }
 }
 
+static int netvsc_detach(struct net_device *ndev,
+                         struct netvsc_device *nvdev)
+{
+        struct net_device_context *ndev_ctx = netdev_priv(ndev);
+        struct hv_device *hdev = ndev_ctx->device_ctx;
+        int ret;
+
+        /* Don't try continuing to try and setup sub channels */
+        if (cancel_work_sync(&nvdev->subchan_work))
+                nvdev->num_chn = 1;
+
+        /* If device was up (receiving) then shutdown */
+        if (netif_running(ndev)) {
+                netif_tx_disable(ndev);
+
+                ret = rndis_filter_close(nvdev);
+                if (ret) {
+                        netdev_err(ndev,
+                                   "unable to close device (ret %d).\n", ret);
+                        return ret;
+                }
+
+                ret = netvsc_wait_until_empty(nvdev);
+                if (ret) {
+                        netdev_err(ndev,
+                                   "Ring buffer not empty after closing rndis\n");
+                        return ret;
+                }
+        }
+
+        netif_device_detach(ndev);
+
+        rndis_filter_device_remove(hdev, nvdev);
+
+        return 0;
+}
+
+static int netvsc_attach(struct net_device *ndev,
+                         struct netvsc_device_info *dev_info)
+{
+        struct net_device_context *ndev_ctx = netdev_priv(ndev);
+        struct hv_device *hdev = ndev_ctx->device_ctx;
+        struct netvsc_device *nvdev;
+        struct rndis_device *rdev;
+        int ret;
+
+        nvdev = rndis_filter_device_add(hdev, dev_info);
+        if (IS_ERR(nvdev))
+                return PTR_ERR(nvdev);
+
+        /* Note: enable and attach happen when sub-channels setup */
+
+        netif_carrier_off(ndev);
+
+        if (netif_running(ndev)) {
+                ret = rndis_filter_open(nvdev);
+                if (ret)
+                        return ret;
+
+                rdev = nvdev->extension;
+                if (!rdev->link_state)
+                        netif_carrier_on(ndev);
+        }
+
+        return 0;
+}
+
 static int netvsc_set_channels(struct net_device *net,
                                struct ethtool_channels *channels)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
-        struct hv_device *dev = net_device_ctx->device_ctx;
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         unsigned int orig, count = channels->combined_count;
         struct netvsc_device_info device_info;
-        bool was_opened;
-        int ret = 0;
+        int ret;
 
         /* We do not support separate count for rx, tx, or other */
         if (count == 0 ||
@@ -866,9 +944,6 @@ static int netvsc_set_channels(struct net_device *net,
                 return -EINVAL;
 
         orig = nvdev->num_chn;
-        was_opened = rndis_filter_opened(nvdev);
-        if (was_opened)
-                rndis_filter_close(nvdev);
 
         memset(&device_info, 0, sizeof(device_info));
         device_info.num_chn = count;
@@ -877,28 +952,17 @@ static int netvsc_set_channels(struct net_device *net,
         device_info.recv_sections = nvdev->recv_section_cnt;
         device_info.recv_section_size = nvdev->recv_section_size;
 
-        rndis_filter_device_remove(dev, nvdev);
+        ret = netvsc_detach(net, nvdev);
+        if (ret)
+                return ret;
 
-        nvdev = rndis_filter_device_add(dev, &device_info);
-        if (IS_ERR(nvdev)) {
-                ret = PTR_ERR(nvdev);
+        ret = netvsc_attach(net, &device_info);
+        if (ret) {
                 device_info.num_chn = orig;
-                nvdev = rndis_filter_device_add(dev, &device_info);
-
-                if (IS_ERR(nvdev)) {
-                        netdev_err(net, "restoring channel setting failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
+                if (netvsc_attach(net, &device_info))
+                        netdev_err(net, "restoring channel setting failed\n");
         }
 
-        if (was_opened)
-                rndis_filter_open(nvdev);
-
-        /* We may have missed link change notifications */
-        net_device_ctx->last_reconfig = 0;
-        schedule_delayed_work(&net_device_ctx->dwork, 0);
-
         return ret;
 }
 
@@ -964,10 +1028,8 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct hv_device *hdev = ndevctx->device_ctx;
         int orig_mtu = ndev->mtu;
         struct netvsc_device_info device_info;
-        bool was_opened;
         int ret = 0;
 
         if (!nvdev || nvdev->destroy)
@@ -980,11 +1042,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                         return ret;
         }
 
-        netif_device_detach(ndev);
-        was_opened = rndis_filter_opened(nvdev);
-        if (was_opened)
-                rndis_filter_close(nvdev);
-
         memset(&device_info, 0, sizeof(device_info));
         device_info.num_chn = nvdev->num_chn;
         device_info.send_sections = nvdev->send_section_cnt;
@@ -992,35 +1049,27 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         device_info.recv_sections = nvdev->recv_section_cnt;
         device_info.recv_section_size = nvdev->recv_section_size;
 
-        rndis_filter_device_remove(hdev, nvdev);
+        ret = netvsc_detach(ndev, nvdev);
+        if (ret)
+                goto rollback_vf;
 
         ndev->mtu = mtu;
 
-        nvdev = rndis_filter_device_add(hdev, &device_info);
-        if (IS_ERR(nvdev)) {
-                ret = PTR_ERR(nvdev);
-
-                /* Attempt rollback to original MTU */
-                ndev->mtu = orig_mtu;
-                nvdev = rndis_filter_device_add(hdev, &device_info);
-
-                if (vf_netdev)
-                        dev_set_mtu(vf_netdev, orig_mtu);
-
-                if (IS_ERR(nvdev)) {
-                        netdev_err(ndev, "restoring mtu failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
-        }
+        ret = netvsc_attach(ndev, &device_info);
+        if (ret)
+                goto rollback;
 
-        if (was_opened)
-                rndis_filter_open(nvdev);
+        return 0;
 
-        netif_device_attach(ndev);
+rollback:
+        /* Attempt rollback to original MTU */
+        ndev->mtu = orig_mtu;
 
-        /* We may have missed link change notifications */
-        schedule_delayed_work(&ndevctx->dwork, 0);
+        if (netvsc_attach(ndev, &device_info))
+                netdev_err(ndev, "restoring mtu failed\n");
+rollback_vf:
+        if (vf_netdev)
+                dev_set_mtu(vf_netdev, orig_mtu);
 
         return ret;
 }
@@ -1526,11 +1575,9 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct hv_device *hdev = ndevctx->device_ctx;
         struct netvsc_device_info device_info;
         struct ethtool_ringparam orig;
         u32 new_tx, new_rx;
-        bool was_opened;
         int ret = 0;
 
         if (!nvdev || nvdev->destroy)
@@ -1555,34 +1602,18 @@ static int netvsc_set_ringparam(struct net_device *ndev,
         device_info.recv_sections = new_rx;
         device_info.recv_section_size = nvdev->recv_section_size;
 
-        netif_device_detach(ndev);
-        was_opened = rndis_filter_opened(nvdev);
-        if (was_opened)
-                rndis_filter_close(nvdev);
-
-        rndis_filter_device_remove(hdev, nvdev);
-
-        nvdev = rndis_filter_device_add(hdev, &device_info);
-        if (IS_ERR(nvdev)) {
-                ret = PTR_ERR(nvdev);
+        ret = netvsc_detach(ndev, nvdev);
+        if (ret)
+                return ret;
 
+        ret = netvsc_attach(ndev, &device_info);
+        if (ret) {
                 device_info.send_sections = orig.tx_pending;
                 device_info.recv_sections = orig.rx_pending;
-                nvdev = rndis_filter_device_add(hdev, &device_info);
-                if (IS_ERR(nvdev)) {
-                        netdev_err(ndev, "restoring ringparam failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
-        }
-
-        if (was_opened)
-                rndis_filter_open(nvdev);
-        netif_device_attach(ndev);
 
-        /* We may have missed link change notifications */
-        ndevctx->last_reconfig = 0;
-        schedule_delayed_work(&ndevctx->dwork, 0);
+                if (netvsc_attach(ndev, &device_info))
+                        netdev_err(ndev, "restoring ringparam failed");
+        }
 
         return ret;
 }
@@ -1846,8 +1877,12 @@ static void __netvsc_vf_setup(struct net_device *ndev,
 
         /* set multicast etc flags on VF */
         dev_change_flags(vf_netdev, ndev->flags | IFF_SLAVE);
+
+        /* sync address list from ndev to VF */
+        netif_addr_lock_bh(ndev);
         dev_uc_sync(vf_netdev, ndev);
         dev_mc_sync(vf_netdev, ndev);
+        netif_addr_unlock_bh(ndev);
 
         if (netif_running(ndev)) {
                 ret = dev_open(vf_netdev);
@@ -2063,8 +2098,8 @@ no_net:
 static int netvsc_remove(struct hv_device *dev)
 {
         struct net_device_context *ndev_ctx;
-        struct net_device *vf_netdev;
-        struct net_device *net;
+        struct net_device *vf_netdev, *net;
+        struct netvsc_device *nvdev;
 
         net = hv_get_drvdata(dev);
         if (net == NULL) {
@@ -2074,10 +2109,14 @@ static int netvsc_remove(struct hv_device *dev)
 
         ndev_ctx = netdev_priv(net);
 
-        netif_device_detach(net);
-
         cancel_delayed_work_sync(&ndev_ctx->dwork);
 
+        rcu_read_lock();
+        nvdev = rcu_dereference(ndev_ctx->nvdev);
+
+        if  (nvdev)
+                cancel_work_sync(&nvdev->subchan_work);
+
         /*
          * Call to the vsc driver to let it know that the device is being
          * removed. Also blocks mtu and channel changes.
@@ -2087,11 +2126,13 @@ static int netvsc_remove(struct hv_device *dev)
         if (vf_netdev)
                 netvsc_unregister_vf(vf_netdev);
 
+        if (nvdev)
+                rndis_filter_device_remove(dev, nvdev);
+
         unregister_netdevice(net);
 
-        rndis_filter_device_remove(dev,
-                                   rtnl_dereference(ndev_ctx->nvdev));
         rtnl_unlock();
+        rcu_read_unlock();
 
         hv_set_drvdata(dev, NULL);
 
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 8927c483c217..a6ec41c399d6 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -264,13 +264,23 @@ static void rndis_set_link_state(struct rndis_device *rdev,
         }
 }
 
-static void rndis_filter_receive_response(struct rndis_device *dev,
-                                       struct rndis_message *resp)
+static void rndis_filter_receive_response(struct net_device *ndev,
+                                          struct netvsc_device *nvdev,
+                                          const struct rndis_message *resp)
 {
+        struct rndis_device *dev = nvdev->extension;
         struct rndis_request *request = NULL;
         bool found = false;
         unsigned long flags;
-        struct net_device *ndev = dev->ndev;
+
+        /* This should never happen, it means control message
+         * response received after device removed.
+         */
+        if (dev->state == RNDIS_DEV_UNINITIALIZED) {
+                netdev_err(ndev,
+                           "got rndis message uninitialized\n");
+                return;
+        }
 
         spin_lock_irqsave(&dev->request_lock, flags);
         list_for_each_entry(request, &dev->req_list, list_ent) {
@@ -352,7 +362,6 @@ static inline void *rndis_get_ppi(struct rndis_packet *rpkt, u32 type)
 
 static int rndis_filter_receive_data(struct net_device *ndev,
                                      struct netvsc_device *nvdev,
-                                     struct rndis_device *dev,
                                      struct rndis_message *msg,
                                      struct vmbus_channel *channel,
                                      void *data, u32 data_buflen)
@@ -372,7 +381,7 @@ static int rndis_filter_receive_data(struct net_device *ndev,
          * should be the data packet size plus the trailer padding size
          */
         if (unlikely(data_buflen < rndis_pkt->data_len)) {
-                netdev_err(dev->ndev, "rndis message buffer "
+                netdev_err(ndev, "rndis message buffer "
                            "overflow detected (got %u, min %u)"
                            "...dropping this message!\n",
                            data_buflen, rndis_pkt->data_len);
@@ -400,35 +409,20 @@ int rndis_filter_receive(struct net_device *ndev,
                          void *data, u32 buflen)
 {
         struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        struct rndis_device *rndis_dev = net_dev->extension;
         struct rndis_message *rndis_msg = data;
 
-        /* Make sure the rndis device state is initialized */
-        if (unlikely(!rndis_dev)) {
-                netif_dbg(net_device_ctx, rx_err, ndev,
-                          "got rndis message but no rndis device!\n");
-                return NVSP_STAT_FAIL;
-        }
-
-        if (unlikely(rndis_dev->state == RNDIS_DEV_UNINITIALIZED)) {
-                netif_dbg(net_device_ctx, rx_err, ndev,
-                          "got rndis message uninitialized\n");
-                return NVSP_STAT_FAIL;
-        }
-
         if (netif_msg_rx_status(net_device_ctx))
                 dump_rndis_message(ndev, rndis_msg);
 
         switch (rndis_msg->ndis_msg_type) {
         case RNDIS_MSG_PACKET:
-                return rndis_filter_receive_data(ndev, net_dev,
-                                                 rndis_dev, rndis_msg,
+                return rndis_filter_receive_data(ndev, net_dev, rndis_msg,
                                                  channel, data, buflen);
         case RNDIS_MSG_INIT_C:
         case RNDIS_MSG_QUERY_C:
         case RNDIS_MSG_SET_C:
                 /* completion msgs */
-                rndis_filter_receive_response(rndis_dev, rndis_msg);
+                rndis_filter_receive_response(ndev, net_dev, rndis_msg);
                 break;
 
         case RNDIS_MSG_INDICATE:
@@ -825,13 +819,15 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev,
         struct rndis_set_request *set;
         int ret;
 
+        if (dev->filter == new_filter)
+                return 0;
+
         request = get_rndis_request(dev, RNDIS_MSG_SET,
                         RNDIS_MESSAGE_SIZE(struct rndis_set_request) +
                         sizeof(u32));
         if (!request)
                 return -ENOMEM;
 
-
         /* Setup the rndis set */
         set = &request->request_msg.msg.set_req;
         set->oid = RNDIS_OID_GEN_CURRENT_PACKET_FILTER;
@@ -842,8 +838,10 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev,
                &new_filter, sizeof(u32));
 
         ret = rndis_filter_send_request(dev, request);
-        if (ret == 0)
+        if (ret == 0) {
                 wait_for_completion(&request->wait_event);
+                dev->filter = new_filter;
+        }
 
         put_rndis_request(dev, request);
 
@@ -861,9 +859,9 @@ static void rndis_set_multicast(struct work_struct *w)
                 filter = NDIS_PACKET_TYPE_PROMISCUOUS;
         } else {
                 if (flags & IFF_ALLMULTI)
-                        flags |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+                        filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
                 if (flags & IFF_BROADCAST)
-                        flags |= NDIS_PACKET_TYPE_BROADCAST;
+                        filter |= NDIS_PACKET_TYPE_BROADCAST;
         }
 
         rndis_filter_set_packet_filter(rdev, filter);
@@ -1120,6 +1118,7 @@ void rndis_set_subchannel(struct work_struct *w)
         for (i = 0; i < VRSS_SEND_TAB_SIZE; i++)
                 ndev_ctx->tx_table[i] = i % nvdev->num_chn;
 
+        netif_device_attach(ndev);
         rtnl_unlock();
         return;
 
@@ -1130,6 +1129,8 @@ failed:
 
         nvdev->max_chn = 1;
         nvdev->num_chn = 1;
+
+        netif_device_attach(ndev);
 unlock:
         rtnl_unlock();
 }
@@ -1332,6 +1333,10 @@ out:
                 net_device->num_chn = 1;
         }
 
+        /* No sub channels, device is ready */
+        if (net_device->num_chn == 1)
+                netif_device_attach(net);
+
         return net_device;
 
 err_dev_remv:
@@ -1344,16 +1349,12 @@ void rndis_filter_device_remove(struct hv_device *dev,
 {
         struct rndis_device *rndis_dev = net_dev->extension;
 
-        /* Don't try and setup sub channels if about to halt */
-        cancel_work_sync(&net_dev->subchan_work);
-
         /* Halt and release the rndis device */
         rndis_filter_halt_device(rndis_dev);
 
         net_dev->extension = NULL;
 
         netvsc_device_remove(dev);
-        kfree(rndis_dev);
 }
 
 int rndis_filter_open(struct netvsc_device *nvdev)
@@ -1371,10 +1372,3 @@ int rndis_filter_close(struct netvsc_device *nvdev)
 
         return rndis_filter_close_device(nvdev->extension);
 }
-
-bool rndis_filter_opened(const struct netvsc_device *nvdev)
-{
-        const struct rndis_device *dev = nvdev->extension;
-
-        return dev->state == RNDIS_DEV_DATAINITIALIZED;
-}
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 7de88b33d5b9..9cbb0c8a896a 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         err = netdev_upper_dev_link(real_dev, dev, extack);
         if (err < 0)
-                goto unregister;
+                goto put_dev;
 
         /* need to be already registered so that ->init has run and
          * the MAC addr is set
@@ -3316,7 +3316,8 @@ del_dev:
         macsec_del_dev(macsec);
 unlink:
         netdev_upper_dev_unlink(real_dev, dev);
-unregister:
+put_dev:
+        dev_put(real_dev);
         unregister_netdevice(dev);
         return err;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 8fc02d9db3d0..725f4b4afc6d 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1036,7 +1036,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
         lowerdev_features &= (features | ~NETIF_F_LRO);
         features = netdev_increment_features(lowerdev_features, features, mask);
         features |= ALWAYS_ON_FEATURES;
-        features &= ~NETIF_F_NETNS_LOCAL;
+        features &= (ALWAYS_ON_FEATURES | MACVLAN_FEATURES);
 
         return features;
 }
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index 171010eb4d9c..5ad130c3da43 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -341,8 +341,8 @@ void bcm_phy_get_strings(struct phy_device *phydev, u8 *data)
         unsigned int i;
 
         for (i = 0; i < ARRAY_SIZE(bcm_phy_hw_stats); i++)
-                memcpy(data + i * ETH_GSTRING_LEN,
-                       bcm_phy_hw_stats[i].string, ETH_GSTRING_LEN);
+                strlcpy(data + i * ETH_GSTRING_LEN,
+                        bcm_phy_hw_stats[i].string, ETH_GSTRING_LEN);
 }
 EXPORT_SYMBOL_GPL(bcm_phy_get_strings);
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 22d9bc9c33a4..0e0978d8a0eb 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1452,8 +1452,8 @@ static void marvell_get_strings(struct phy_device *phydev, u8 *data)
         int i;
 
         for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
-                memcpy(data + i * ETH_GSTRING_LEN,
-                       marvell_hw_stats[i].string, ETH_GSTRING_LEN);
+                strlcpy(data + i * ETH_GSTRING_LEN,
+                        marvell_hw_stats[i].string, ETH_GSTRING_LEN);
         }
 }
 
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 0f45310300f6..f41b224a9cdb 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -635,25 +635,6 @@ static int ksz8873mll_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
-/* This routine returns -1 as an indication to the caller that the
- * Micrel ksz9021 10/100/1000 PHY does not support standard IEEE
- * MMD extended PHY registers.
- */
-static int
-ksz9021_rd_mmd_phyreg(struct phy_device *phydev, int devad, u16 regnum)
-{
-        return -1;
-}
-
-/* This routine does nothing since the Micrel ksz9021 does not support
- * standard IEEE MMD extended PHY registers.
- */
-static int
-ksz9021_wr_mmd_phyreg(struct phy_device *phydev, int devad, u16 regnum, u16 val)
-{
-        return -1;
-}
-
 static int kszphy_get_sset_count(struct phy_device *phydev)
 {
         return ARRAY_SIZE(kszphy_hw_stats);
@@ -664,8 +645,8 @@ static void kszphy_get_strings(struct phy_device *phydev, u8 *data)
         int i;
 
         for (i = 0; i < ARRAY_SIZE(kszphy_hw_stats); i++) {
-                memcpy(data + i * ETH_GSTRING_LEN,
-                       kszphy_hw_stats[i].string, ETH_GSTRING_LEN);
+                strlcpy(data + i * ETH_GSTRING_LEN,
+                        kszphy_hw_stats[i].string, ETH_GSTRING_LEN);
         }
 }
 
@@ -946,8 +927,8 @@ static struct phy_driver ksphy_driver[] = {
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
-        .read_mmd       = ksz9021_rd_mmd_phyreg,
-        .write_mmd      = ksz9021_wr_mmd_phyreg,
+        .read_mmd       = genphy_read_mmd_unsupported,
+        .write_mmd      = genphy_write_mmd_unsupported,
 }, {
         .phy_id         = PHY_ID_KSZ9031,
         .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index a6f924fee584..9aabfa1a455a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -618,6 +618,77 @@ static void phy_error(struct phy_device *phydev)
 }
 
 /**
+ * phy_disable_interrupts - Disable the PHY interrupts from the PHY side
+ * @phydev: target phy_device struct
+ */
+static int phy_disable_interrupts(struct phy_device *phydev)
+{
+        int err;
+
+        /* Disable PHY interrupts */
+        err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
+        if (err)
+                goto phy_err;
+
+        /* Clear the interrupt */
+        err = phy_clear_interrupt(phydev);
+        if (err)
+                goto phy_err;
+
+        return 0;
+
+phy_err:
+        phy_error(phydev);
+
+        return err;
+}
+
+/**
+ * phy_change - Called by the phy_interrupt to handle PHY changes
+ * @phydev: phy_device struct that interrupted
+ */
+static irqreturn_t phy_change(struct phy_device *phydev)
+{
+        if (phy_interrupt_is_valid(phydev)) {
+                if (phydev->drv->did_interrupt &&
+                    !phydev->drv->did_interrupt(phydev))
+                        return IRQ_NONE;
+
+                if (phydev->state == PHY_HALTED)
+                        if (phy_disable_interrupts(phydev))
+                                goto phy_err;
+        }
+
+        mutex_lock(&phydev->lock);
+        if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
+                phydev->state = PHY_CHANGELINK;
+        mutex_unlock(&phydev->lock);
+
+        /* reschedule state queue work to run as soon as possible */
+        phy_trigger_machine(phydev, true);
+
+        if (phy_interrupt_is_valid(phydev) && phy_clear_interrupt(phydev))
+                goto phy_err;
+        return IRQ_HANDLED;
+
+phy_err:
+        phy_error(phydev);
+        return IRQ_NONE;
+}
+
+/**
+ * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes
+ * @work: work_struct that describes the work to be done
+ */
+void phy_change_work(struct work_struct *work)
+{
+        struct phy_device *phydev =
+                container_of(work, struct phy_device, phy_queue);
+
+        phy_change(phydev);
+}
+
+/**
  * phy_interrupt - PHY interrupt handler
  * @irq: interrupt line
  * @phy_dat: phy_device pointer
@@ -632,9 +703,7 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
         if (PHY_HALTED == phydev->state)
                 return IRQ_NONE;                /* It can't be ours.  */
 
-        phy_change(phydev);
-
-        return IRQ_HANDLED;
+        return phy_change(phydev);
 }
 
 /**
@@ -652,32 +721,6 @@ static int phy_enable_interrupts(struct phy_device *phydev)
 }
 
 /**
- * phy_disable_interrupts - Disable the PHY interrupts from the PHY side
- * @phydev: target phy_device struct
- */
-static int phy_disable_interrupts(struct phy_device *phydev)
-{
-        int err;
-
-        /* Disable PHY interrupts */
-        err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
-        if (err)
-                goto phy_err;
-
-        /* Clear the interrupt */
-        err = phy_clear_interrupt(phydev);
-        if (err)
-                goto phy_err;
-
-        return 0;
-
-phy_err:
-        phy_error(phydev);
-
-        return err;
-}
-
-/**
  * phy_start_interrupts - request and enable interrupts for a PHY device
  * @phydev: target phy_device struct
  *
@@ -720,50 +763,6 @@ int phy_stop_interrupts(struct phy_device *phydev)
 EXPORT_SYMBOL(phy_stop_interrupts);
 
 /**
- * phy_change - Called by the phy_interrupt to handle PHY changes
- * @phydev: phy_device struct that interrupted
- */
-void phy_change(struct phy_device *phydev)
-{
-        if (phy_interrupt_is_valid(phydev)) {
-                if (phydev->drv->did_interrupt &&
-                    !phydev->drv->did_interrupt(phydev))
-                        return;
-
-                if (phydev->state == PHY_HALTED)
-                        if (phy_disable_interrupts(phydev))
-                                goto phy_err;
-        }
-
-        mutex_lock(&phydev->lock);
-        if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
-                phydev->state = PHY_CHANGELINK;
-        mutex_unlock(&phydev->lock);
-
-        /* reschedule state queue work to run as soon as possible */
-        phy_trigger_machine(phydev, true);
-
-        if (phy_interrupt_is_valid(phydev) && phy_clear_interrupt(phydev))
-                goto phy_err;
-        return;
-
-phy_err:
-        phy_error(phydev);
-}
-
-/**
- * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes
- * @work: work_struct that describes the work to be done
- */
-void phy_change_work(struct work_struct *work)
-{
-        struct phy_device *phydev =
-                container_of(work, struct phy_device, phy_queue);
-
-        phy_change(phydev);
-}
-
-/**
  * phy_stop - Bring down the PHY link, and stop checking the status
  * @phydev: target phy_device struct
  */
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 478405e544cc..74664a6c0cdc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1012,10 +1012,17 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         err = sysfs_create_link(&phydev->mdio.dev.kobj, &dev->dev.kobj,
                                 "attached_dev");
         if (!err) {
-                err = sysfs_create_link(&dev->dev.kobj, &phydev->mdio.dev.kobj,
-                                        "phydev");
-                if (err)
-                        goto error;
+                err = sysfs_create_link_nowarn(&dev->dev.kobj,
+                                               &phydev->mdio.dev.kobj,
+                                               "phydev");
+                if (err) {
+                        dev_err(&dev->dev, "could not add device link to %s err %d\n",
+                                kobject_name(&phydev->mdio.dev.kobj),
+                                err);
+                        /* non-fatal - some net drivers can use one netdevice
+                         * with more then one phy
+                         */
+                }
 
                 phydev->sysfs_links = true;
         }
@@ -1666,6 +1673,23 @@ int genphy_config_init(struct phy_device *phydev)
 }
 EXPORT_SYMBOL(genphy_config_init);
 
+/* This is used for the phy device which doesn't support the MMD extended
+ * register access, but it does have side effect when we are trying to access
+ * the MMD register via indirect method.
+ */
+int genphy_read_mmd_unsupported(struct phy_device *phdev, int devad, u16 regnum)
+{
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(genphy_read_mmd_unsupported);
+
+int genphy_write_mmd_unsupported(struct phy_device *phdev, int devnum,
+                                 u16 regnum, u16 val)
+{
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(genphy_write_mmd_unsupported);
+
 int genphy_suspend(struct phy_device *phydev)
 {
         return phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN);
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index ee3ca4a2f12b..9f48ecf9c627 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -172,6 +172,8 @@ static struct phy_driver realtek_drvs[] = {
                 .flags          = PHY_HAS_INTERRUPT,
                 .ack_interrupt  = &rtl821x_ack_interrupt,
                 .config_intr    = &rtl8211b_config_intr,
+                .read_mmd       = &genphy_read_mmd_unsupported,
+                .write_mmd      = &genphy_write_mmd_unsupported,
         }, {
                 .phy_id         = 0x001cc914,
                 .name           = "RTL8211DN Gigabit Ethernet",
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index fa2a9bdd1866..da1937832c99 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -257,7 +257,7 @@ struct ppp_net {
 /* Prototypes. */
 static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
                         struct file *file, unsigned int cmd, unsigned long arg);
-static void ppp_xmit_process(struct ppp *ppp);
+static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb);
 static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);
 static void ppp_push(struct ppp *ppp);
 static void ppp_channel_push(struct channel *pch);
@@ -513,13 +513,12 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,
                 goto out;
         }
 
-        skb_queue_tail(&pf->xq, skb);
-
         switch (pf->kind) {
         case INTERFACE:
-                ppp_xmit_process(PF_TO_PPP(pf));
+                ppp_xmit_process(PF_TO_PPP(pf), skb);
                 break;
         case CHANNEL:
+                skb_queue_tail(&pf->xq, skb);
                 ppp_channel_push(PF_TO_CHANNEL(pf));
                 break;
         }
@@ -1267,8 +1266,8 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
         put_unaligned_be16(proto, pp);
 
         skb_scrub_packet(skb, !net_eq(ppp->ppp_net, dev_net(dev)));
-        skb_queue_tail(&ppp->file.xq, skb);
-        ppp_xmit_process(ppp);
+        ppp_xmit_process(ppp, skb);
+
         return NETDEV_TX_OK;
 
  outf:
@@ -1420,13 +1419,14 @@ static void ppp_setup(struct net_device *dev)
  */
 
 /* Called to do any work queued up on the transmit side that can now be done */
-static void __ppp_xmit_process(struct ppp *ppp)
+static void __ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)
 {
-        struct sk_buff *skb;
-
         ppp_xmit_lock(ppp);
         if (!ppp->closing) {
                 ppp_push(ppp);
+
+                if (skb)
+                        skb_queue_tail(&ppp->file.xq, skb);
                 while (!ppp->xmit_pending &&
                        (skb = skb_dequeue(&ppp->file.xq)))
                         ppp_send_frame(ppp, skb);
@@ -1440,7 +1440,7 @@ static void __ppp_xmit_process(struct ppp *ppp)
         ppp_xmit_unlock(ppp);
 }
 
-static void ppp_xmit_process(struct ppp *ppp)
+static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)
 {
         local_bh_disable();
 
@@ -1448,7 +1448,7 @@ static void ppp_xmit_process(struct ppp *ppp)
                 goto err;
 
         (*this_cpu_ptr(ppp->xmit_recursion))++;
-        __ppp_xmit_process(ppp);
+        __ppp_xmit_process(ppp, skb);
         (*this_cpu_ptr(ppp->xmit_recursion))--;
 
         local_bh_enable();
@@ -1458,6 +1458,8 @@ static void ppp_xmit_process(struct ppp *ppp)
 err:
         local_bh_enable();
 
+        kfree_skb(skb);
+
         if (net_ratelimit())
                 netdev_err(ppp->dev, "recursion detected\n");
 }
@@ -1942,7 +1944,7 @@ static void __ppp_channel_push(struct channel *pch)
         if (skb_queue_empty(&pch->file.xq)) {
                 ppp = pch->ppp;
                 if (ppp)
-                        __ppp_xmit_process(ppp);
+                        __ppp_xmit_process(ppp, NULL);
         }
 }
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a468439969df..56c701b73c12 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2395,7 +2395,7 @@ send_done:
         if (!nlh) {
                 err = __send_and_alloc_skb(&skb, team, portid, send_func);
                 if (err)
-                        goto errout;
+                        return err;
                 goto send_done;
         }
 
@@ -2681,7 +2681,7 @@ send_done:
         if (!nlh) {
                 err = __send_and_alloc_skb(&skb, team, portid, send_func);
                 if (err)
-                        goto errout;
+                        return err;
                 goto send_done;
         }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7433bb2e4451..28cfa642e39a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -655,7 +655,7 @@ static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
         return tun;
 }
 
-static void tun_ptr_free(void *ptr)
+void tun_ptr_free(void *ptr)
 {
         if (!ptr)
                 return;
@@ -667,6 +667,7 @@ static void tun_ptr_free(void *ptr)
                 __skb_array_destroy_skb(ptr);
         }
 }
+EXPORT_SYMBOL_GPL(tun_ptr_free);
 
 static void tun_queue_purge(struct tun_file *tfile)
 {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8a22ff67b026..d9eea8cfe6cb 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -315,6 +315,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev)
 void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
 {
         struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
+        unsigned long flags;
         int     status;
 
         if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
@@ -326,10 +327,10 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
         if (skb->protocol == 0)
                 skb->protocol = eth_type_trans (skb, dev->net);
 
-        u64_stats_update_begin(&stats64->syncp);
+        flags = u64_stats_update_begin_irqsave(&stats64->syncp);
         stats64->rx_packets++;
         stats64->rx_bytes += skb->len;
-        u64_stats_update_end(&stats64->syncp);
+        u64_stats_update_end_irqrestore(&stats64->syncp, flags);
 
         netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n",
                   skb->len + sizeof (struct ethhdr), skb->protocol);
@@ -1248,11 +1249,12 @@ static void tx_complete (struct urb *urb)
 
         if (urb->status == 0) {
                 struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
+                unsigned long flags;
 
-                u64_stats_update_begin(&stats64->syncp);
+                flags = u64_stats_update_begin_irqsave(&stats64->syncp);
                 stats64->tx_packets += entry->packets;
                 stats64->tx_bytes += entry->length;
-                u64_stats_update_end(&stats64->syncp);
+                u64_stats_update_end_irqrestore(&stats64->syncp, flags);
         } else {
                 dev->net->stats.tx_errors++;
 
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 8b39c160743d..e04937f44f33 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -977,6 +977,8 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
         int ret;
         u32 count;
+        int num_pkts;
+        int tx_num_deferred;
         unsigned long flags;
         struct vmxnet3_tx_ctx ctx;
         union Vmxnet3_GenericDesc *gdesc;
@@ -1075,12 +1077,12 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 #else
         gdesc = ctx.sop_txd;
 #endif
+        tx_num_deferred = le32_to_cpu(tq->shared->txNumDeferred);
         if (ctx.mss) {
                 gdesc->txd.hlen = ctx.eth_ip_hdr_size + ctx.l4_hdr_size;
                 gdesc->txd.om = VMXNET3_OM_TSO;
                 gdesc->txd.msscof = ctx.mss;
-                le32_add_cpu(&tq->shared->txNumDeferred, (skb->len -
-                             gdesc->txd.hlen + ctx.mss - 1) / ctx.mss);
+                num_pkts = (skb->len - gdesc->txd.hlen + ctx.mss - 1) / ctx.mss;
         } else {
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         gdesc->txd.hlen = ctx.eth_ip_hdr_size;
@@ -1091,8 +1093,10 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                         gdesc->txd.om = 0;
                         gdesc->txd.msscof = 0;
                 }
-                le32_add_cpu(&tq->shared->txNumDeferred, 1);
+                num_pkts = 1;
         }
+        le32_add_cpu(&tq->shared->txNumDeferred, num_pkts);
+        tx_num_deferred += num_pkts;
 
         if (skb_vlan_tag_present(skb)) {
                 gdesc->txd.ti = 1;
@@ -1118,8 +1122,7 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 
         spin_unlock_irqrestore(&tq->tx_lock, flags);
 
-        if (le32_to_cpu(tq->shared->txNumDeferred) >=
-                                        le32_to_cpu(tq->shared->txThreshold)) {
+        if (tx_num_deferred >= le32_to_cpu(tq->shared->txThreshold)) {
                 tq->shared->txNumDeferred = 0;
                 VMXNET3_WRITE_BAR0_REG(adapter,
                                        VMXNET3_REG_TXPROD + tq->qid * 8,
@@ -1470,7 +1473,8 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                         vmxnet3_rx_csum(adapter, skb,
                                         (union Vmxnet3_GenericDesc *)rcd);
                         skb->protocol = eth_type_trans(skb, adapter->netdev);
-                        if (!rcd->tcp || !adapter->lro)
+                        if (!rcd->tcp ||
+                            !(adapter->netdev->features & NETIF_F_LRO))
                                 goto not_lro;
 
                         if (segCnt != 0 && mss != 0) {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 5ba222920e80..59ec34052a65 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.11.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040b00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
@@ -342,9 +342,6 @@ struct vmxnet3_adapter {
         u8                      __iomem *hw_addr1; /* for BAR 1 */
         u8                              version;
 
-        bool                            rxcsum;
-        bool                            lro;
-
 #ifdef VMXNET3_RSS
         struct UPT1_RSSConf             *rss_conf;
         bool                            rss;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index e89e5ef2c2a4..f246e9ed4a81 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -729,6 +729,7 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
         ieee80211_hw_set(hw, SPECTRUM_MGMT);
         ieee80211_hw_set(hw, SIGNAL_DBM);
         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+        ieee80211_hw_set(hw, DOESNT_SUPPORT_QOS_NDP);
 
         if (ath9k_ps_enable)
                 ieee80211_hw_set(hw, SUPPORTS_PS);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
index df8a1ecb9924..232dcbb83311 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
  * @pend_8021x_wait: used for signalling change in count.
+ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
  */
 struct brcmf_if {
         struct brcmf_pub *drvr;
@@ -198,6 +199,7 @@ struct brcmf_if {
         wait_queue_head_t pend_8021x_wait;
         struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
         u8 ipv6addr_idx;
+        bool fwil_fwerr;
 };
 
 int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index 47de35a33853..bede7b7fd996 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
         u32 data;
         int err;
 
+        /* we need to know firmware error */
+        ifp->fwil_fwerr = true;
+
         err = brcmf_fil_iovar_int_get(ifp, name, &data);
         if (err == 0) {
                 brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
                 brcmf_dbg(TRACE, "%s feature check failed: %d\n",
                           brcmf_feat_names[id], err);
         }
+
+        ifp->fwil_fwerr = false;
 }
 
 static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
 {
         int err;
 
+        /* we need to know firmware error */
+        ifp->fwil_fwerr = true;
+
         err = brcmf_fil_iovar_data_set(ifp, name, data, len);
         if (err != -BRCMF_FW_UNSUPPORTED) {
                 brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
                 brcmf_dbg(TRACE, "%s feature check failed: %d\n",
                           brcmf_feat_names[id], err);
         }
+
+        ifp->fwil_fwerr = false;
 }
 
 #define MAX_CAPS_BUFFER_SIZE    512
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
index f2cfdd3b2bf1..fc5751116d99 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
                           brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
                 err = -EBADE;
         }
+        if (ifp->fwil_fwerr)
+                return fwerr;
+
         return err;
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 2ee54133efa1..82064e909784 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
  * @dev_addr: optional device address.
  *
  * P2P needs mac addresses for P2P device and interface. If no device
- * address it specified, these are derived from the primary net device, ie.
- * the permanent ethernet address of the device.
+ * address it specified, these are derived from a random ethernet
+ * address.
  */
 static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
 {
-        struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-        bool local_admin = false;
+        bool random_addr = false;
 
-        if (!dev_addr || is_zero_ether_addr(dev_addr)) {
-                dev_addr = pri_ifp->mac_addr;
-                local_admin = true;
-        }
+        if (!dev_addr || is_zero_ether_addr(dev_addr))
+                random_addr = true;
 
-        /* Generate the P2P Device Address.  This consists of the device's
-         * primary MAC address with the locally administered bit set.
+        /* Generate the P2P Device Address obtaining a random ethernet
+         * address with the locally administered bit set.
          */
-        memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
-        if (local_admin)
-                p2p->dev_addr[0] |= 0x02;
+        if (random_addr)
+                eth_random_addr(p2p->dev_addr);
+        else
+                memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
 
         /* Generate the P2P Interface Address.  If the discovery and connection
          * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index c5f2ddf9b0fe..e5a2fc738ac3 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -91,7 +91,6 @@ config IWLWIFI_BCAST_FILTERING
 config IWLWIFI_PCIE_RTPM
        bool "Enable runtime power management mode for PCIe devices"
        depends on IWLMVM && PM && EXPERT
-       default false
        help
          Say Y here to enable runtime power management for PCIe
          devices.  If enabled, the device will go into low power mode
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
index 3721a3ed358b..f824bebceb06 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
@@ -211,7 +211,7 @@ enum {
  * @TE_V2_NOTIF_HOST_FRAG_END:request/receive notification on frag end
  * @TE_V2_NOTIF_INTERNAL_FRAG_START: internal FW use.
  * @TE_V2_NOTIF_INTERNAL_FRAG_END: internal FW use.
- * @T2_V2_START_IMMEDIATELY: start time event immediately
+ * @TE_V2_START_IMMEDIATELY: start time event immediately
  * @TE_V2_DEP_OTHER: depends on another time event
  * @TE_V2_DEP_TSF: depends on a specific time
  * @TE_V2_EVENT_SOCIOPATHIC: can't co-exist with other events of tha same MAC
@@ -230,7 +230,7 @@ enum iwl_time_event_policy {
         TE_V2_NOTIF_HOST_FRAG_END = BIT(5),
         TE_V2_NOTIF_INTERNAL_FRAG_START = BIT(6),
         TE_V2_NOTIF_INTERNAL_FRAG_END = BIT(7),
-        T2_V2_START_IMMEDIATELY = BIT(11),
+        TE_V2_START_IMMEDIATELY = BIT(11),
 
         /* placement characteristics */
         TE_V2_DEP_OTHER = BIT(TE_V2_PLACEMENT_POS),
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 67aefc8fc9ac..7bd704a3e640 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -942,7 +944,6 @@ dump_trans_data:
 
 out:
         iwl_fw_free_dump_desc(fwrt);
-        fwrt->dump.trig = NULL;
         clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status);
         IWL_DEBUG_INFO(fwrt, "WRT dump done\n");
 }
@@ -1112,6 +1113,14 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
             fwrt->ops->dump_start(fwrt->ops_ctx))
                 return;
 
+        if (fwrt->ops && fwrt->ops->fw_running &&
+            !fwrt->ops->fw_running(fwrt->ops_ctx)) {
+                IWL_ERR(fwrt, "Firmware not running - cannot dump error\n");
+                iwl_fw_free_dump_desc(fwrt);
+                clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status);
+                goto out;
+        }
+
         if (fwrt->trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
                 /* stop recording */
                 iwl_fw_dbg_stop_recording(fwrt);
@@ -1145,7 +1154,7 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
                         iwl_write_prph(fwrt->trans, DBGC_OUT_CTRL, out_ctrl);
                 }
         }
-
+out:
         if (fwrt->ops && fwrt->ops->dump_end)
                 fwrt->ops->dump_end(fwrt->ops_ctx);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 223fb77a3aa9..72259bff9922 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -91,6 +93,7 @@ static inline void iwl_fw_free_dump_desc(struct iwl_fw_runtime *fwrt)
         if (fwrt->dump.desc != &iwl_dump_desc_assert)
                 kfree(fwrt->dump.desc);
         fwrt->dump.desc = NULL;
+        fwrt->dump.trig = NULL;
 }
 
 void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
index e57ff92a68ae..3da468d2cc92 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
@@ -75,6 +75,20 @@ static inline void iwl_fw_cancel_timestamp(struct iwl_fw_runtime *fwrt)
         cancel_delayed_work_sync(&fwrt->timestamp.wk);
 }
 
+static inline void iwl_fw_suspend_timestamp(struct iwl_fw_runtime *fwrt)
+{
+        cancel_delayed_work_sync(&fwrt->timestamp.wk);
+}
+
+static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt)
+{
+        if (!fwrt->timestamp.delay)
+                return;
+
+        schedule_delayed_work(&fwrt->timestamp.wk,
+                              round_jiffies_relative(fwrt->timestamp.delay));
+}
+
 #else
 static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                                           struct dentry *dbgfs_dir)
@@ -84,4 +98,8 @@ static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
 
 static inline void iwl_fw_cancel_timestamp(struct iwl_fw_runtime *fwrt) {}
 
+static inline void iwl_fw_suspend_timestamp(struct iwl_fw_runtime *fwrt) {}
+
+static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt) {}
+
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index c39fe84bb4c4..2efac307909e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -77,8 +77,14 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
 
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt)
+void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt)
 {
-        iwl_fw_cancel_timestamp(fwrt);
+        iwl_fw_suspend_timestamp(fwrt);
 }
-IWL_EXPORT_SYMBOL(iwl_fw_runtime_exit);
+IWL_EXPORT_SYMBOL(iwl_fw_runtime_suspend);
+
+void iwl_fw_runtime_resume(struct iwl_fw_runtime *fwrt)
+{
+        iwl_fw_resume_timestamp(fwrt);
+}
+IWL_EXPORT_SYMBOL(iwl_fw_runtime_resume);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index e25c049f980f..3fb940ebd74a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -68,6 +70,7 @@
 struct iwl_fw_runtime_ops {
         int (*dump_start)(void *ctx);
         void (*dump_end)(void *ctx);
+        bool (*fw_running)(void *ctx);
 };
 
 #define MAX_NUM_LMAC 2
@@ -150,6 +153,10 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 
 void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
 
+void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
+
+void iwl_fw_runtime_resume(struct iwl_fw_runtime *fwrt);
+
 static inline void iwl_fw_set_current_image(struct iwl_fw_runtime *fwrt,
                                             enum iwl_ucode_type cur_fw_img)
 {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 0e6cf39285f4..2efe9b099556 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1098,6 +1098,8 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         /* make sure the d0i3 exit work is not pending */
         flush_work(&mvm->d0i3_exit_work);
 
+        iwl_fw_runtime_suspend(&mvm->fwrt);
+
         ret = iwl_trans_suspend(trans);
         if (ret)
                 return ret;
@@ -2012,6 +2014,8 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 
         mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
 
+        iwl_fw_runtime_resume(&mvm->fwrt);
+
         return ret;
 }
 
@@ -2038,6 +2042,8 @@ static int iwl_mvm_d3_test_open(struct inode *inode, struct file *file)
 
         mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_D3;
 
+        iwl_fw_runtime_suspend(&mvm->fwrt);
+
         /* start pseudo D3 */
         rtnl_lock();
         err = __iwl_mvm_suspend(mvm->hw, mvm->hw->wiphy->wowlan_config, true);
@@ -2098,6 +2104,8 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         __iwl_mvm_resume(mvm, true);
         rtnl_unlock();
 
+        iwl_fw_runtime_resume(&mvm->fwrt);
+
         mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
 
         iwl_abort_notification_waits(&mvm->notif_wait);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index a7892c1254a2..9c436d8d001d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +36,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1281,9 +1283,6 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 {
         int ret;
 
-        if (!iwl_mvm_firmware_running(mvm))
-                return -EIO;
-
         ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE);
         if (ret)
                 return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 2f22e14e00fe..8ba16fc24e3a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -438,7 +438,8 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         }
 
         /* Allocate the CAB queue for softAP and GO interfaces */
-        if (vif->type == NL80211_IFTYPE_AP) {
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC) {
                 /*
                  * For TVQM this will be overwritten later with the FW assigned
                  * queue value (when queue is enabled).
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 8aed40a8bc38..ebf511150f4d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -2106,15 +2107,40 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (ret)
                 goto out_remove;
 
-        ret = iwl_mvm_add_mcast_sta(mvm, vif);
-        if (ret)
-                goto out_unbind;
-
-        /* Send the bcast station. At this stage the TBTT and DTIM time events
-         * are added and applied to the scheduler */
-        ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
-        if (ret)
-                goto out_rm_mcast;
+        /*
+         * This is not very nice, but the simplest:
+         * For older FWs adding the mcast sta before the bcast station may
+         * cause assert 0x2b00.
+         * This is fixed in later FW so make the order of removal depend on
+         * the TLV
+         */
+        if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
+                ret = iwl_mvm_add_mcast_sta(mvm, vif);
+                if (ret)
+                        goto out_unbind;
+                /*
+                 * Send the bcast station. At this stage the TBTT and DTIM time
+                 * events are added and applied to the scheduler
+                 */
+                ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
+                if (ret) {
+                        iwl_mvm_rm_mcast_sta(mvm, vif);
+                        goto out_unbind;
+                }
+        } else {
+                /*
+                 * Send the bcast station. At this stage the TBTT and DTIM time
+                 * events are added and applied to the scheduler
+                 */
+                iwl_mvm_send_add_bcast_sta(mvm, vif);
+                if (ret)
+                        goto out_unbind;
+                iwl_mvm_add_mcast_sta(mvm, vif);
+                if (ret) {
+                        iwl_mvm_send_rm_bcast_sta(mvm, vif);
+                        goto out_unbind;
+                }
+        }
 
         /* must be set before quota calculations */
         mvmvif->ap_ibss_active = true;
@@ -2144,7 +2170,6 @@ out_quota_failed:
         iwl_mvm_power_update_mac(mvm);
         mvmvif->ap_ibss_active = false;
         iwl_mvm_send_rm_bcast_sta(mvm, vif);
-out_rm_mcast:
         iwl_mvm_rm_mcast_sta(mvm, vif);
 out_unbind:
         iwl_mvm_binding_remove_vif(mvm, vif);
@@ -2682,6 +2707,10 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
 
                 /* enable beacon filtering */
                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
+
+                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+                                     false);
+
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 2d28e0804218..89ff02d7c876 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -90,6 +90,7 @@
 #include "fw/runtime.h"
 #include "fw/dbg.h"
 #include "fw/acpi.h"
+#include "fw/debugfs.h"
 
 #define IWL_MVM_MAX_ADDRESSES           5
 /* RSSI offset for WkP */
@@ -1783,6 +1784,7 @@ static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 
 static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
 {
+        iwl_fw_cancel_timestamp(&mvm->fwrt);
         iwl_free_fw_paging(&mvm->fwrt);
         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
         iwl_fw_dump_conf_clear(&mvm->fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 5d525a0023dc..ab7fb5aad984 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +36,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -552,9 +554,15 @@ static void iwl_mvm_fwrt_dump_end(void *ctx)
         iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT);
 }
 
+static bool iwl_mvm_fwrt_fw_running(void *ctx)
+{
+        return iwl_mvm_firmware_running(ctx);
+}
+
 static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = {
         .dump_start = iwl_mvm_fwrt_dump_start,
         .dump_end = iwl_mvm_fwrt_dump_end,
+        .fw_running = iwl_mvm_fwrt_fw_running,
 };
 
 static struct iwl_op_mode *
@@ -802,7 +810,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_mvm_leds_exit(mvm);
         iwl_mvm_thermal_exit(mvm);
  out_free:
-        iwl_fw_runtime_exit(&mvm->fwrt);
         iwl_fw_flush_dump(&mvm->fwrt);
 
         if (iwlmvm_mod_params.init_dbg)
@@ -843,7 +850,6 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
         kfree(mvm->d3_resume_sram);
 #endif
-        iwl_fw_runtime_exit(&mvm->fwrt);
         iwl_trans_op_mode_leave(mvm->trans);
 
         iwl_phy_db_free(mvm->phy_db);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 60abb0084ee5..47f4c7a1d80d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2684,7 +2684,8 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
                                 struct ieee80211_sta *sta,
                                 struct iwl_lq_sta *lq_sta,
                                 enum nl80211_band band,
-                                struct rs_rate *rate)
+                                struct rs_rate *rate,
+                                bool init)
 {
         int i, nentries;
         unsigned long active_rate;
@@ -2738,14 +2739,25 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
          */
         if (sta->vht_cap.vht_supported &&
             best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
-                switch (sta->bandwidth) {
-                case IEEE80211_STA_RX_BW_160:
-                case IEEE80211_STA_RX_BW_80:
-                case IEEE80211_STA_RX_BW_40:
+                /*
+                 * In AP mode, when a new station associates, rs is initialized
+                 * immediately upon association completion, before the phy
+                 * context is updated with the association parameters, so the
+                 * sta bandwidth might be wider than the phy context allows.
+                 * To avoid this issue, always initialize rs with 20mhz
+                 * bandwidth rate, and after authorization, when the phy context
+                 * is already up-to-date, re-init rs with the correct bw.
+                 */
+                u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
+
+                switch (bw) {
+                case RATE_MCS_CHAN_WIDTH_40:
+                case RATE_MCS_CHAN_WIDTH_80:
+                case RATE_MCS_CHAN_WIDTH_160:
                         initial_rates = rs_optimal_rates_vht;
                         nentries = ARRAY_SIZE(rs_optimal_rates_vht);
                         break;
-                case IEEE80211_STA_RX_BW_20:
+                case RATE_MCS_CHAN_WIDTH_20:
                         initial_rates = rs_optimal_rates_vht_20mhz;
                         nentries = ARRAY_SIZE(rs_optimal_rates_vht_20mhz);
                         break;
@@ -2756,7 +2768,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
 
                 active_rate = lq_sta->active_siso_rate;
                 rate->type = LQ_VHT_SISO;
-                rate->bw = rs_bw_from_sta_bw(sta);
+                rate->bw = bw;
         } else if (sta->ht_cap.ht_supported &&
                    best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
                 initial_rates = rs_optimal_rates_ht;
@@ -2839,7 +2851,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
         tbl = &(lq_sta->lq_info[active_tbl]);
         rate = &tbl->rate;
 
-        rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
+        rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
         rs_init_optimal_rate(mvm, sta, lq_sta);
 
         WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a3f7c1bf3cc8..580de5851fc7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -71,6 +71,7 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
         struct iwl_mvm_key_pn *ptk_pn;
+        int res;
         u8 tid, keyidx;
         u8 pn[IEEE80211_CCMP_PN_LEN];
         u8 *extiv;
@@ -127,12 +128,13 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
         pn[4] = extiv[1];
         pn[5] = extiv[0];
 
-        if (memcmp(pn, ptk_pn->q[queue].pn[tid],
-                   IEEE80211_CCMP_PN_LEN) <= 0)
+        res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
+        if (res < 0)
+                return -1;
+        if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
                 return -1;
 
-        if (!(stats->flag & RX_FLAG_AMSDU_MORE))
-                memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
+        memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
         stats->flag |= RX_FLAG_PN_VALIDATED;
 
         return 0;
@@ -314,28 +316,21 @@ static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
 }
 
 /*
- * returns true if a packet outside BA session is a duplicate and
- * should be dropped
+ * returns true if a packet is a duplicate and should be dropped.
+ * Updates AMSDU PN tracking info
  */
-static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
-                                  struct ieee80211_rx_status *rx_status,
-                                  struct ieee80211_hdr *hdr,
-                                  struct iwl_rx_mpdu_desc *desc)
+static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
+                           struct ieee80211_rx_status *rx_status,
+                           struct ieee80211_hdr *hdr,
+                           struct iwl_rx_mpdu_desc *desc)
 {
         struct iwl_mvm_sta *mvm_sta;
         struct iwl_mvm_rxq_dup_data *dup_data;
-        u8 baid, tid, sub_frame_idx;
+        u8 tid, sub_frame_idx;
 
         if (WARN_ON(IS_ERR_OR_NULL(sta)))
                 return false;
 
-        baid = (le32_to_cpu(desc->reorder_data) &
-                IWL_RX_MPDU_REORDER_BAID_MASK) >>
-                IWL_RX_MPDU_REORDER_BAID_SHIFT;
-
-        if (baid != IWL_RX_REORDER_DATA_INVALID_BAID)
-                return false;
-
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         dup_data = &mvm_sta->dup_data[queue];
 
@@ -365,6 +360,12 @@ static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
                      dup_data->last_sub_frame[tid] >= sub_frame_idx))
                 return true;
 
+        /* Allow same PN as the first subframe for following sub frames */
+        if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
+            sub_frame_idx > dup_data->last_sub_frame[tid] &&
+            desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
+                rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
+
         dup_data->last_seq[tid] = hdr->seq_ctrl;
         dup_data->last_sub_frame[tid] = sub_frame_idx;
 
@@ -971,7 +972,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                 if (ieee80211_is_data(hdr->frame_control))
                         iwl_mvm_rx_csum(sta, skb, desc);
 
-                if (iwl_mvm_is_nonagg_dup(sta, queue, rx_status, hdr, desc)) {
+                if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
                         kfree_skb(skb);
                         goto out;
                 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 6b2674e02606..630e23cb0ffb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2039,7 +2039,7 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = IWL_MVM_TX_FIFO_MCAST,
                 .sta_id = msta->sta_id,
-                .tid = IWL_MAX_TID_COUNT,
+                .tid = 0,
                 .aggregate = false,
                 .frame_limit = IWL_FRAME_LIMIT,
         };
@@ -2053,6 +2053,17 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 return -ENOTSUPP;
 
         /*
+         * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+         * invalid, so make sure we use the queue we want.
+         * Note that this is done here as we want to avoid making DQA
+         * changes in mac80211 layer.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC) {
+                vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                mvmvif->cab_queue = vif->cab_queue;
+        }
+
+        /*
          * While in previous FWs we had to exclude cab queue from TFD queue
          * mask, now it is needed as any other queue.
          */
@@ -2079,24 +2090,13 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (iwl_mvm_has_new_tx_api(mvm)) {
                 int queue = iwl_mvm_tvqm_enable_txq(mvm, vif->cab_queue,
                                                     msta->sta_id,
-                                                    IWL_MAX_TID_COUNT,
+                                                    0,
                                                     timeout);
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
-                               IWL_UCODE_TLV_API_STA_TYPE)) {
-                /*
-                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
-                 * invalid, so make sure we use the queue we want.
-                 * Note that this is done here as we want to avoid making DQA
-                 * changes in mac80211 layer.
-                 */
-                if (vif->type == NL80211_IFTYPE_ADHOC) {
-                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
-                        mvmvif->cab_queue = vif->cab_queue;
-                }
+                               IWL_UCODE_TLV_API_STA_TYPE))
                 iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                    &cfg, timeout);
-        }
 
         return 0;
 }
@@ -2115,7 +2115,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true, 0);
 
         iwl_mvm_disable_txq(mvm, mvmvif->cab_queue, vif->cab_queue,
-                            IWL_MAX_TID_COUNT, 0);
+                            0, 0);
 
         ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
         if (ret)
@@ -3170,8 +3170,9 @@ static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
         int ret, size;
         u32 status;
 
+        /* This is a valid situation for GTK removal */
         if (sta_id == IWL_MVM_INVALID_STA)
-                return -EINVAL;
+                return 0;
 
         key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
                                  STA_KEY_FLG_KEYID_MSK);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 200ab50ec86b..acb217e666db 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -616,7 +616,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
         time_cmd.repeat = 1;
         time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                       TE_V2_NOTIF_HOST_EVENT_END |
-                                      T2_V2_START_IMMEDIATELY);
+                                      TE_V2_START_IMMEDIATELY);
 
         if (!wait_for_notif) {
                 iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
@@ -803,7 +803,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         time_cmd.repeat = 1;
         time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                       TE_V2_NOTIF_HOST_EVENT_END |
-                                      T2_V2_START_IMMEDIATELY);
+                                      TE_V2_START_IMMEDIATELY);
 
         return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
@@ -913,6 +913,8 @@ int iwl_mvm_schedule_csa_period(struct iwl_mvm *mvm,
         time_cmd.interval = cpu_to_le32(1);
         time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                       TE_V2_ABSENCE);
+        if (!apply_time)
+                time_cmd.policy |= cpu_to_le16(TE_V2_START_IMMEDIATELY);
 
         return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dda77b327c98..af6dfceab6b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -419,11 +419,11 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
 {
         struct ieee80211_key_conf *keyconf = info->control.hw_key;
         u8 *crypto_hdr = skb_frag->data + hdrlen;
+        enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM;
         u64 pn;
 
         switch (keyconf->cipher) {
         case WLAN_CIPHER_SUITE_CCMP:
-        case WLAN_CIPHER_SUITE_CCMP_256:
                 iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd);
                 iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
                 break;
@@ -447,13 +447,16 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
                 break;
         case WLAN_CIPHER_SUITE_GCMP:
         case WLAN_CIPHER_SUITE_GCMP_256:
+                type = TX_CMD_SEC_GCMP;
+                /* Fall through */
+        case WLAN_CIPHER_SUITE_CCMP_256:
                 /* TODO: Taking the key from the table might introduce a race
                  * when PTK rekeying is done, having an old packets with a PN
                  * based on the old key but the message encrypted with a new
                  * one.
                  * Need to handle this.
                  */
-                tx_cmd->sec_ctl |= TX_CMD_SEC_GCMP | TX_CMD_SEC_KEY_FROM_TABLE;
+                tx_cmd->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE;
                 tx_cmd->key[0] = keyconf->hw_key_idx;
                 iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
                 break;
@@ -645,7 +648,11 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                 if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
                     info.control.vif->type == NL80211_IFTYPE_AP ||
                     info.control.vif->type == NL80211_IFTYPE_ADHOC) {
-                        sta_id = mvmvif->bcast_sta.sta_id;
+                        if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE)
+                                sta_id = mvmvif->bcast_sta.sta_id;
+                        else
+                                sta_id = mvmvif->mcast_sta.sta_id;
+
                         queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info,
                                                            hdr->frame_control);
                         if (queue < 0)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 6d0a907d5ba5..fabae0f60683 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -147,7 +147,7 @@ static void iwl_pcie_gen2_tfd_unmap(struct iwl_trans *trans,
         /* Sanity check on number of chunks */
         num_tbs = iwl_pcie_gen2_get_num_tbs(trans, tfd);
 
-        if (num_tbs >= trans_pcie->max_tbs) {
+        if (num_tbs > trans_pcie->max_tbs) {
                 IWL_ERR(trans, "Too many chunks: %i\n", num_tbs);
                 return;
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 3f85713c41dc..1a566287993d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -378,7 +378,7 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
         /* Sanity check on number of chunks */
         num_tbs = iwl_pcie_tfd_get_num_tbs(trans, tfd);
 
-        if (num_tbs >= trans_pcie->max_tbs) {
+        if (num_tbs > trans_pcie->max_tbs) {
                 IWL_ERR(trans, "Too many chunks: %i\n", num_tbs);
                 /* @todo issue fatal error, it is quite serious situation */
                 return;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 6e0af815f25e..35b21f8152bb 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2727,6 +2727,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
         mutex_init(&data->mutex);
 
         data->netgroup = hwsim_net_get_netgroup(net);
+        data->wmediumd = hwsim_net_get_wmediumd(net);
 
         /* Enable frame retransmissions for lossy channels */
         hw->max_rates = 4;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index f9ccd13c79f9..e7bbbc95cdb1 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -1125,7 +1125,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw)
 
         /* Configuration Space offset 0x70f BIT7 is used to control L0S */
         tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f);
-        _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7));
+        _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) |
+                             ASPM_L1_LATENCY << 3);
 
         /* Configuration Space offset 0x719 Bit3 is for L1
          * BIT4 is for clock request
diff --git a/drivers/nvdimm/blk.c b/drivers/nvdimm/blk.c
index 345acca576b3..1bd7b3734751 100644
--- a/drivers/nvdimm/blk.c
+++ b/drivers/nvdimm/blk.c
@@ -278,8 +278,6 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
         disk->queue             = q;
         disk->flags             = GENHD_FL_EXT_DEVT;
         nvdimm_namespace_disk_name(&nsblk->common, disk->disk_name);
-        set_capacity(disk, 0);
-        device_add_disk(dev, disk);
 
         if (devm_add_action_or_reset(dev, nd_blk_release_disk, disk))
                 return -ENOMEM;
@@ -292,6 +290,7 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
         }
 
         set_capacity(disk, available_disk_size >> SECTOR_SHIFT);
+        device_add_disk(dev, disk);
         revalidate_disk(disk);
         return 0;
 }
diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index 2ef544f10ec8..4b95ac513de2 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1545,8 +1545,6 @@ static int btt_blk_init(struct btt *btt)
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, btt->btt_queue);
         btt->btt_queue->queuedata = btt;
 
-        set_capacity(btt->btt_disk, 0);
-        device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
         if (btt_meta_size(btt)) {
                 int rc = nd_integrity_init(btt->btt_disk, btt_meta_size(btt));
 
@@ -1558,6 +1556,7 @@ static int btt_blk_init(struct btt *btt)
                 }
         }
         set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9);
+        device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
         btt->nd_btt->size = btt->nlba * (u64)btt->sector_size;
         revalidate_disk(btt->btt_disk);
 
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index f5c4e8c6e29d..2f4d18752c97 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -304,7 +304,7 @@ static const struct attribute_group *nd_pfn_attribute_groups[] = {
 struct device *nd_pfn_devinit(struct nd_pfn *nd_pfn,
                 struct nd_namespace_common *ndns)
 {
-        struct device *dev = &nd_pfn->dev;
+        struct device *dev;
 
         if (!nd_pfn)
                 return NULL;
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index e6d01911e092..1593e1806b16 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -532,11 +532,13 @@ static ssize_t persistence_domain_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
         struct nd_region *nd_region = to_nd_region(dev);
-        unsigned long flags = nd_region->flags;
 
-        return sprintf(buf, "%s%s\n",
-                        flags & BIT(ND_REGION_PERSIST_CACHE) ? "cpu_cache " : "",
-                        flags & BIT(ND_REGION_PERSIST_MEMCTRL) ? "memory_controller " : "");
+        if (test_bit(ND_REGION_PERSIST_CACHE, &nd_region->flags))
+                return sprintf(buf, "cpu_cache\n");
+        else if (test_bit(ND_REGION_PERSIST_MEMCTRL, &nd_region->flags))
+                return sprintf(buf, "memory_controller\n");
+        else
+                return sprintf(buf, "\n");
 }
 static DEVICE_ATTR_RO(persistence_domain);
 
@@ -593,6 +595,13 @@ static umode_t region_visible(struct kobject *kobj, struct attribute *a, int n)
                         return 0;
         }
 
+        if (a == &dev_attr_persistence_domain.attr) {
+                if ((nd_region->flags & (BIT(ND_REGION_PERSIST_CACHE)
+                                        | BIT(ND_REGION_PERSIST_MEMCTRL))) == 0)
+                        return 0;
+                return a->mode;
+        }
+
         if (a != &dev_attr_set_cookie.attr
                         && a != &dev_attr_available_size.attr)
                 return a->mode;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8b14bd326d4a..46d47bd6ca1f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3908,6 +3908,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
                          quirk_dma_func1_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642,
                          quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645,
+                         quirk_dma_func1_alias);
 /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON,
                          PCI_DEVICE_ID_JMICRON_JMB388_ESD,
diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c
index c5ff4525edef..c5493ea51282 100644
--- a/drivers/phy/qualcomm/phy-qcom-ufs.c
+++ b/drivers/phy/qualcomm/phy-qcom-ufs.c
@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy)
         return 0;
 }
 EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off);
+
+MODULE_AUTHOR("Yaniv Gardi <ygardi@codeaurora.org>");
+MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
+MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
index c32399faff57..90c274490181 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
@@ -124,7 +124,7 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0xc60, "gph3", 0x0c),
 };
 
-const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = s5pv210_pin_bank,
@@ -137,6 +137,11 @@ const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s5pv210_of_data __initconst = {
+        .ctrl           = s5pv210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s5pv210_pin_ctrl),
+};
+
 /* Pad retention control code for accessing PMU regmap */
 static atomic_t exynos_shared_retention_refcnt;
 
@@ -199,7 +204,7 @@ static const struct samsung_retention_data exynos3250_retention_data __initconst
  * Samsung pinctrl driver data for Exynos3250 SoC. Exynos3250 SoC includes
  * two gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos3250_pin_banks0,
@@ -220,6 +225,11 @@ const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos3250_of_data __initconst = {
+        .ctrl           = exynos3250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos3250_pin_ctrl),
+};
+
 /* pin banks of exynos4210 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4210_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -303,7 +313,7 @@ static const struct samsung_retention_data exynos4_audio_retention_data __initco
  * Samsung pinctrl driver data for Exynos4210 SoC. Exynos4210 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4210_pin_banks0,
@@ -329,6 +339,11 @@ const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4210_of_data __initconst = {
+        .ctrl           = exynos4210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4210_pin_ctrl),
+};
+
 /* pin banks of exynos4x12 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4x12_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -391,7 +406,7 @@ static const struct samsung_pin_bank_data exynos4x12_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos4x12 SoC. Exynos4x12 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4x12_pin_banks0,
@@ -427,6 +442,11 @@ const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4x12_of_data __initconst = {
+        .ctrl           = exynos4x12_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4x12_pin_ctrl),
+};
+
 /* pin banks of exynos5250 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5250_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -487,7 +507,7 @@ static const struct samsung_pin_bank_data exynos5250_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5250 SoC. Exynos5250 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5250_pin_banks0,
@@ -523,6 +543,11 @@ const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5250_of_data __initconst = {
+        .ctrl           = exynos5250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5250_pin_ctrl),
+};
+
 /* pin banks of exynos5260 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5260_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpa0", 0x00),
@@ -567,7 +592,7 @@ static const struct samsung_pin_bank_data exynos5260_pin_banks2[] __initconst =
  * Samsung pinctrl driver data for Exynos5260 SoC. Exynos5260 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5260_pin_banks0,
@@ -587,6 +612,11 @@ const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5260_of_data __initconst = {
+        .ctrl           = exynos5260_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5260_pin_ctrl),
+};
+
 /* pin banks of exynos5410 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -657,7 +687,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5410 SoC. Exynos5410 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5410_pin_banks0,
@@ -690,6 +720,11 @@ const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5410_of_data __initconst = {
+        .ctrl           = exynos5410_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5410_pin_ctrl),
+};
+
 /* pin banks of exynos5420 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5420_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpy7", 0x00),
@@ -774,7 +809,7 @@ static const struct samsung_retention_data exynos5420_retention_data __initconst
  * Samsung pinctrl driver data for Exynos5420 SoC. Exynos5420 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5420_pin_banks0,
@@ -808,3 +843,8 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
                 .retention_data = &exynos4_audio_retention_data,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos5420_of_data __initconst = {
+        .ctrl           = exynos5420_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5420_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
index fc8f7833bec0..71c9d1d9f345 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
@@ -175,7 +175,7 @@ static const struct samsung_retention_data exynos5433_fsys_retention_data __init
  * Samsung pinctrl driver data for Exynos5433 SoC. Exynos5433 SoC includes
  * ten gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5433_pin_banks0,
@@ -260,6 +260,11 @@ const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5433_of_data __initconst = {
+        .ctrl           = exynos5433_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5433_pin_ctrl),
+};
+
 /* pin banks of exynos7 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos7_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
@@ -339,7 +344,7 @@ static const struct samsung_pin_bank_data exynos7_pin_banks9[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
-const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 Alive data */
                 .pin_banks      = exynos7_pin_banks0,
@@ -392,3 +397,8 @@ const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
                 .eint_gpio_init = exynos_eint_gpio_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos7_of_data __initconst = {
+        .ctrl           = exynos7_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos7_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
index 10187cb0e9b9..7e824e4d20f4 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
@@ -565,7 +565,7 @@ static const struct samsung_pin_bank_data s3c2412_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x080, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2412_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2412_pin_banks),
@@ -573,6 +573,11 @@ const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2412_of_data __initconst = {
+        .ctrl           = s3c2412_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2412_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_A(27, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -587,7 +592,7 @@ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2416_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2416_pin_banks),
@@ -595,6 +600,11 @@ const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2416_of_data __initconst = {
+        .ctrl           = s3c2416_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2416_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_A(25, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -607,7 +617,7 @@ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x0d0, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2440_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2440_pin_banks),
@@ -615,6 +625,11 @@ const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2440_of_data __initconst = {
+        .ctrl           = s3c2440_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2440_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_A(28, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -630,10 +645,15 @@ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2450_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2450_pin_banks),
                 .eint_wkup_init = s3c24xx_eint_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c2450_of_data __initconst = {
+        .ctrl           = s3c2450_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2450_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
index 679628ac4b31..288e6567ceb1 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
@@ -789,7 +789,7 @@ static const struct samsung_pin_bank_data s3c64xx_pin_banks0[] __initconst = {
  * Samsung pinctrl driver data for S3C64xx SoC. S3C64xx SoC includes
  * one gpio/pin-mux/pinconfig controller.
  */
-const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 1 data */
                 .pin_banks      = s3c64xx_pin_banks0,
@@ -798,3 +798,8 @@ const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
                 .eint_wkup_init = s3c64xx_eint_eint0_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c64xx_of_data __initconst = {
+        .ctrl           = s3c64xx_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c64xx_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index da58e4554137..336e88d7bdb9 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -942,12 +942,33 @@ static int samsung_gpiolib_register(struct platform_device *pdev,
         return 0;
 }
 
+static const struct samsung_pin_ctrl *
+samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev)
+{
+        struct device_node *node = pdev->dev.of_node;
+        const struct samsung_pinctrl_of_match_data *of_data;
+        int id;
+
+        id = of_alias_get_id(node, "pinctrl");
+        if (id < 0) {
+                dev_err(&pdev->dev, "failed to get alias id\n");
+                return NULL;
+        }
+
+        of_data = of_device_get_match_data(&pdev->dev);
+        if (id >= of_data->num_ctrl) {
+                dev_err(&pdev->dev, "invalid alias id %d\n", id);
+                return NULL;
+        }
+
+        return &(of_data->ctrl[id]);
+}
+
 /* retrieve the soc specific data */
 static const struct samsung_pin_ctrl *
 samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
                              struct platform_device *pdev)
 {
-        int id;
         struct device_node *node = pdev->dev.of_node;
         struct device_node *np;
         const struct samsung_pin_bank_data *bdata;
@@ -957,13 +978,9 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
         void __iomem *virt_base[SAMSUNG_PINCTRL_NUM_RESOURCES];
         unsigned int i;
 
-        id = of_alias_get_id(node, "pinctrl");
-        if (id < 0) {
-                dev_err(&pdev->dev, "failed to get alias id\n");
+        ctrl = samsung_pinctrl_get_soc_data_for_of_alias(pdev);
+        if (!ctrl)
                 return ERR_PTR(-ENOENT);
-        }
-        ctrl = of_device_get_match_data(&pdev->dev);
-        ctrl += id;
 
         d->suspend = ctrl->suspend;
         d->resume = ctrl->resume;
@@ -1188,41 +1205,41 @@ static int __maybe_unused samsung_pinctrl_resume(struct device *dev)
 static const struct of_device_id samsung_pinctrl_dt_match[] = {
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM
         { .compatible = "samsung,exynos3250-pinctrl",
-                .data = exynos3250_pin_ctrl },
+                .data = &exynos3250_of_data },
         { .compatible = "samsung,exynos4210-pinctrl",
-                .data = exynos4210_pin_ctrl },
+                .data = &exynos4210_of_data },
         { .compatible = "samsung,exynos4x12-pinctrl",
-                .data = exynos4x12_pin_ctrl },
+                .data = &exynos4x12_of_data },
         { .compatible = "samsung,exynos5250-pinctrl",
-                .data = exynos5250_pin_ctrl },
+                .data = &exynos5250_of_data },
         { .compatible = "samsung,exynos5260-pinctrl",
-                .data = exynos5260_pin_ctrl },
+                .data = &exynos5260_of_data },
         { .compatible = "samsung,exynos5410-pinctrl",
-                .data = exynos5410_pin_ctrl },
+                .data = &exynos5410_of_data },
         { .compatible = "samsung,exynos5420-pinctrl",
-                .data = exynos5420_pin_ctrl },
+                .data = &exynos5420_of_data },
         { .compatible = "samsung,s5pv210-pinctrl",
-                .data = s5pv210_pin_ctrl },
+                .data = &s5pv210_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM64
         { .compatible = "samsung,exynos5433-pinctrl",
-                .data = exynos5433_pin_ctrl },
+                .data = &exynos5433_of_data },
         { .compatible = "samsung,exynos7-pinctrl",
-                .data = exynos7_pin_ctrl },
+                .data = &exynos7_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C64XX
         { .compatible = "samsung,s3c64xx-pinctrl",
-                .data = s3c64xx_pin_ctrl },
+                .data = &s3c64xx_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C24XX
         { .compatible = "samsung,s3c2412-pinctrl",
-                .data = s3c2412_pin_ctrl },
+                .data = &s3c2412_of_data },
         { .compatible = "samsung,s3c2416-pinctrl",
-                .data = s3c2416_pin_ctrl },
+                .data = &s3c2416_of_data },
         { .compatible = "samsung,s3c2440-pinctrl",
-                .data = s3c2440_pin_ctrl },
+                .data = &s3c2440_of_data },
         { .compatible = "samsung,s3c2450-pinctrl",
-                .data = s3c2450_pin_ctrl },
+                .data = &s3c2450_of_data },
 #endif
         {},
 };
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h
index e204f609823b..f0cda9424dfe 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.h
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.h
@@ -282,6 +282,16 @@ struct samsung_pinctrl_drv_data {
 };
 
 /**
+ * struct samsung_pinctrl_of_match_data: OF match device specific configuration data.
+ * @ctrl: array of pin controller data.
+ * @num_ctrl: size of array @ctrl.
+ */
+struct samsung_pinctrl_of_match_data {
+        const struct samsung_pin_ctrl   *ctrl;
+        unsigned int                    num_ctrl;
+};
+
+/**
  * struct samsung_pin_group: represent group of pins of a pinmux function.
  * @name: name of the pin group, used to lookup the group.
  * @pins: the pins included in this group.
@@ -309,20 +319,20 @@ struct samsung_pmx_func {
 };
 
 /* list of all exported SoC specific data */
-extern const struct samsung_pin_ctrl exynos3250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4210_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4x12_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5260_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5410_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5420_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5433_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos7_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c64xx_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2412_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2416_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2440_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2450_pin_ctrl[];
-extern const struct samsung_pin_ctrl s5pv210_pin_ctrl[];
+extern const struct samsung_pinctrl_of_match_data exynos3250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4210_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4x12_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5260_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5410_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5420_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5433_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos7_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2412_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2416_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2440_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2450_of_data;
+extern const struct samsung_pinctrl_of_match_data s5pv210_of_data;
 
 #endif /* __PINCTRL_SAMSUNG_H */
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
index 18aeee592fdc..35951e7b89d2 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
@@ -1538,7 +1538,6 @@ static const struct sh_pfc_pin pinmux_pins[] = {
         SH_PFC_PIN_NAMED_CFG('B', 18, AVB_TD1, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('B', 19, AVB_RXC, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('C',  1, PRESETOUT#, CFG_FLAGS),
-        SH_PFC_PIN_NAMED_CFG('F',  1, CLKOUT, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('H', 37, MLB_REF, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  3, QSPI1_SPCLK, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  5, QSPI1_SSL, CFG_FLAGS),
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index d10ffe51da24..51ebc5a6053f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -106,13 +106,14 @@ config ASUS_LAPTOP
           If you have an ACPI-compatible ASUS laptop, say Y or M here.
 
 #
-# If the DELL_SMBIOS_SMM feature is enabled, the DELL_SMBIOS driver
-# becomes dependent on the DCDBAS driver. The "depends" line prevents a
-# configuration where DELL_SMBIOS=y while DCDBAS=m.
+# The DELL_SMBIOS driver depends on ACPI_WMI and/or DCDBAS if those
+# backends are selected. The "depends" line prevents a configuration
+# where DELL_SMBIOS=y while either of those dependencies =m.
 #
 config DELL_SMBIOS
         tristate "Dell SMBIOS driver"
         depends on DCDBAS || DCDBAS=n
+        depends on ACPI_WMI || ACPI_WMI=n
         ---help---
         This provides support for the Dell SMBIOS calling interface.
         If you have a Dell computer you should enable this option.
diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
index 5bcf8a18f785..2485c80a9fdd 100644
--- a/drivers/platform/x86/dell-smbios-base.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -637,7 +637,7 @@ static void __exit dell_smbios_exit(void)
         mutex_unlock(&smbios_mutex);
 }
 
-subsys_initcall(dell_smbios_init);
+module_init(dell_smbios_init);
 module_exit(dell_smbios_exit);
 
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 2c9927430d85..8d102195a392 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -714,7 +714,7 @@ static int __init dell_wmi_init(void)
 
         return wmi_driver_register(&dell_wmi_driver);
 }
-module_init(dell_wmi_init);
+late_initcall(dell_wmi_init);
 
 static void __exit dell_wmi_exit(void)
 {
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index c8b308cfabf1..3653bea38470 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -527,8 +527,7 @@ static inline int qeth_is_cq(struct qeth_card *card, unsigned int queue)
             queue == card->qdio.no_in_queues - 1;
 }
 
-
-static int qeth_issue_next_read(struct qeth_card *card)
+static int __qeth_issue_next_read(struct qeth_card *card)
 {
         int rc;
         struct qeth_cmd_buffer *iob;
@@ -559,6 +558,17 @@ static int qeth_issue_next_read(struct qeth_card *card)
         return rc;
 }
 
+static int qeth_issue_next_read(struct qeth_card *card)
+{
+        int ret;
+
+        spin_lock_irq(get_ccwdev_lock(CARD_RDEV(card)));
+        ret = __qeth_issue_next_read(card);
+        spin_unlock_irq(get_ccwdev_lock(CARD_RDEV(card)));
+
+        return ret;
+}
+
 static struct qeth_reply *qeth_alloc_reply(struct qeth_card *card)
 {
         struct qeth_reply *reply;
@@ -960,7 +970,7 @@ void qeth_clear_thread_running_bit(struct qeth_card *card, unsigned long thread)
         spin_lock_irqsave(&card->thread_mask_lock, flags);
         card->thread_running_mask &= ~thread;
         spin_unlock_irqrestore(&card->thread_mask_lock, flags);
-        wake_up(&card->wait_q);
+        wake_up_all(&card->wait_q);
 }
 EXPORT_SYMBOL_GPL(qeth_clear_thread_running_bit);
 
@@ -1164,6 +1174,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 }
                 rc = qeth_get_problem(cdev, irb);
                 if (rc) {
+                        card->read_or_write_problem = 1;
                         qeth_clear_ipacmd_list(card);
                         qeth_schedule_recovery(card);
                         goto out;
@@ -1182,7 +1193,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 return;
         if (channel == &card->read &&
             channel->state == CH_STATE_UP)
-                qeth_issue_next_read(card);
+                __qeth_issue_next_read(card);
 
         iob = channel->iob;
         index = channel->buf_no;
@@ -5087,8 +5098,6 @@ static void qeth_core_free_card(struct qeth_card *card)
         QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
         qeth_clean_channel(&card->read);
         qeth_clean_channel(&card->write);
-        if (card->dev)
-                free_netdev(card->dev);
         qeth_free_qdio_buffers(card);
         unregister_service_level(&card->qeth_service_level);
         kfree(card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 7f236440483f..5ef4c978ad19 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -915,8 +915,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
                 qeth_l2_set_offline(cgdev);
 
         if (card->dev) {
-                netif_napi_del(&card->napi);
                 unregister_netdev(card->dev);
+                free_netdev(card->dev);
                 card->dev = NULL;
         }
         return;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 962a04b68dd2..b6b12220da71 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2865,8 +2865,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
                 qeth_l3_set_offline(cgdev);
 
         if (card->dev) {
-                netif_napi_del(&card->napi);
                 unregister_netdev(card->dev);
+                free_netdev(card->dev);
                 card->dev = NULL;
         }
 
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 6de9681ace82..ceab5e5c41c2 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -223,6 +223,7 @@ out_done:
 static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
 {
         struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host);
+        struct domain_device *dev = cmd_to_domain_dev(cmd);
         struct sas_task *task = TO_SAS_TASK(cmd);
 
         /* At this point, we only get called following an actual abort
@@ -231,6 +232,14 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
          */
         sas_end_task(cmd, task);
 
+        if (dev_is_sata(dev)) {
+                /* defer commands to libata so that libata EH can
+                 * handle ata qcs correctly
+                 */
+                list_move_tail(&cmd->eh_entry, &sas_ha->eh_ata_q);
+                return;
+        }
+
         /* now finish the command and move it on to the error
          * handler done list, this also takes it off the
          * error handler pending list.
@@ -238,22 +247,6 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
         scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q);
 }
 
-static void sas_eh_defer_cmd(struct scsi_cmnd *cmd)
-{
-        struct domain_device *dev = cmd_to_domain_dev(cmd);
-        struct sas_ha_struct *ha = dev->port->ha;
-        struct sas_task *task = TO_SAS_TASK(cmd);
-
-        if (!dev_is_sata(dev)) {
-                sas_eh_finish_cmd(cmd);
-                return;
-        }
-
-        /* report the timeout to libata */
-        sas_end_task(cmd, task);
-        list_move_tail(&cmd->eh_entry, &ha->eh_ata_q);
-}
-
 static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd *my_cmd)
 {
         struct scsi_cmnd *cmd, *n;
@@ -261,7 +254,7 @@ static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd
         list_for_each_entry_safe(cmd, n, error_q, eh_entry) {
                 if (cmd->device->sdev_target == my_cmd->device->sdev_target &&
                     cmd->device->lun == my_cmd->device->lun)
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
         }
 }
 
@@ -631,12 +624,12 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
                 case TASK_IS_DONE:
                         SAS_DPRINTK("%s: task 0x%p is done\n", __func__,
                                     task);
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
                         continue;
                 case TASK_IS_ABORTED:
                         SAS_DPRINTK("%s: task 0x%p is aborted\n",
                                     __func__, task);
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
                         continue;
                 case TASK_IS_AT_LU:
                         SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task);
@@ -647,7 +640,7 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
                                             "recovered\n",
                                             SAS_ADDR(task->dev),
                                             cmd->device->lun);
-                                sas_eh_defer_cmd(cmd);
+                                sas_eh_finish_cmd(cmd);
                                 sas_scsi_clear_queue_lu(work_q, cmd);
                                 goto Again;
                         }
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index c2ea13c7e37e..a1cb0236c550 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -10558,7 +10558,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
             "fw_event_%s%d", ioc->driver_name, ioc->id);
         ioc->firmware_event_thread = alloc_ordered_workqueue(
-            ioc->firmware_event_name, WQ_MEM_RECLAIM);
+            ioc->firmware_event_name, 0);
         if (!ioc->firmware_event_thread) {
                 pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 00329dda6179..8d7fab3cd01d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1719,7 +1719,6 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
 
                         set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
                         spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
-                        ea->fcport->loop_id = FC_NO_LOOP_ID;
                         ea->fcport->chip_reset = vha->hw->base_qpair->chip_reset;
                         ea->fcport->logout_on_delete = 1;
                         ea->fcport->send_els_logo = 0;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 285911e81728..5c5dcca4d1da 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -454,7 +454,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
         ha->req_q_map[0] = req;
         set_bit(0, ha->rsp_qid_map);
         set_bit(0, ha->req_qid_map);
-        return 1;
+        return 0;
 
 fail_qpair_map:
         kfree(ha->base_qpair);
@@ -471,6 +471,9 @@ fail_req_map:
 
 static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
 {
+        if (!ha->req_q_map)
+                return;
+
         if (IS_QLAFX00(ha)) {
                 if (req && req->ring_fx00)
                         dma_free_coherent(&ha->pdev->dev,
@@ -481,14 +484,17 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
                 (req->length + 1) * sizeof(request_t),
                 req->ring, req->dma);
 
-        if (req)
+        if (req) {
                 kfree(req->outstanding_cmds);
-
-        kfree(req);
+                kfree(req);
+        }
 }
 
 static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
+        if (!ha->rsp_q_map)
+                return;
+
         if (IS_QLAFX00(ha)) {
                 if (rsp && rsp->ring)
                         dma_free_coherent(&ha->pdev->dev,
@@ -499,7 +505,8 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
                 (rsp->length + 1) * sizeof(response_t),
                 rsp->ring, rsp->dma);
         }
-        kfree(rsp);
+        if (rsp)
+                kfree(rsp);
 }
 
 static void qla2x00_free_queues(struct qla_hw_data *ha)
@@ -1723,6 +1730,8 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
         struct qla_tgt_cmd *cmd;
         uint8_t trace = 0;
 
+        if (!ha->req_q_map)
+                return;
         spin_lock_irqsave(qp->qp_lock_ptr, flags);
         req = qp->req;
         for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
@@ -3095,14 +3104,14 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* Set up the irqs */
         ret = qla2x00_request_irqs(ha, rsp);
         if (ret)
-                goto probe_hw_failed;
+                goto probe_failed;
 
         /* Alloc arrays of request and response ring ptrs */
-        if (!qla2x00_alloc_queues(ha, req, rsp)) {
+        if (qla2x00_alloc_queues(ha, req, rsp)) {
                 ql_log(ql_log_fatal, base_vha, 0x003d,
                     "Failed to allocate memory for queue pointers..."
                     "aborting.\n");
-                goto probe_init_failed;
+                goto probe_failed;
         }
 
         if (ha->mqenable && shost_use_blk_mq(host)) {
@@ -3387,15 +3396,6 @@ skip_dpc:
 
         return 0;
 
-probe_init_failed:
-        qla2x00_free_req_que(ha, req);
-        ha->req_q_map[0] = NULL;
-        clear_bit(0, ha->req_qid_map);
-        qla2x00_free_rsp_que(ha, rsp);
-        ha->rsp_q_map[0] = NULL;
-        clear_bit(0, ha->rsp_qid_map);
-        ha->max_req_queues = ha->max_rsp_queues = 0;
-
 probe_failed:
         if (base_vha->timer_active)
                 qla2x00_stop_timer(base_vha);
@@ -4508,11 +4508,17 @@ qla2x00_mem_free(struct qla_hw_data *ha)
         if (ha->init_cb)
                 dma_free_coherent(&ha->pdev->dev, ha->init_cb_size,
                         ha->init_cb, ha->init_cb_dma);
-        vfree(ha->optrom_buffer);
-        kfree(ha->nvram);
-        kfree(ha->npiv_info);
-        kfree(ha->swl);
-        kfree(ha->loop_id_map);
+
+        if (ha->optrom_buffer)
+                vfree(ha->optrom_buffer);
+        if (ha->nvram)
+                kfree(ha->nvram);
+        if (ha->npiv_info)
+                kfree(ha->npiv_info);
+        if (ha->swl)
+                kfree(ha->swl);
+        if (ha->loop_id_map)
+                kfree(ha->loop_id_map);
 
         ha->srb_mempool = NULL;
         ha->ctx_mempool = NULL;
@@ -4528,6 +4534,15 @@ qla2x00_mem_free(struct qla_hw_data *ha)
         ha->ex_init_cb_dma = 0;
         ha->async_pd = NULL;
         ha->async_pd_dma = 0;
+        ha->loop_id_map = NULL;
+        ha->npiv_info = NULL;
+        ha->optrom_buffer = NULL;
+        ha->swl = NULL;
+        ha->nvram = NULL;
+        ha->mctp_dump = NULL;
+        ha->dcbx_tlv = NULL;
+        ha->xgmac_data = NULL;
+        ha->sfp_data = NULL;
 
         ha->s_dma_pool = NULL;
         ha->dl_dma_pool = NULL;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bff21e636ddd..3541caf3fceb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2595,6 +2595,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
         int res;
         struct scsi_device *sdp = sdkp->device;
         struct scsi_mode_data data;
+        int disk_ro = get_disk_ro(sdkp->disk);
         int old_wp = sdkp->write_prot;
 
         set_disk_ro(sdkp->disk, 0);
@@ -2635,7 +2636,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
                           "Test WP failed, assume Write Enabled\n");
         } else {
                 sdkp->write_prot = ((data.device_specific & 0x80) != 0);
-                set_disk_ro(sdkp->disk, sdkp->write_prot);
+                set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
                 if (sdkp->first_scan || old_wp != sdkp->write_prot) {
                         sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
                                   sdkp->write_prot ? "on" : "off");
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 6c348a211ebb..89cf4498f535 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -403,7 +403,7 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  */
 static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
-        u64 zone_blocks;
+        u64 zone_blocks = 0;
         sector_t block = 0;
         unsigned char *buf;
         unsigned char *rec;
@@ -421,10 +421,8 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
         /* Do a report zone to get the same field */
         ret = sd_zbc_report_zones(sdkp, buf, SD_ZBC_BUF_SIZE, 0);
-        if (ret) {
-                zone_blocks = 0;
-                goto out;
-        }
+        if (ret)
+                goto out_free;
 
         same = buf[4] & 0x0f;
         if (same > 0) {
@@ -464,7 +462,7 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                         ret = sd_zbc_report_zones(sdkp, buf,
                                                   SD_ZBC_BUF_SIZE, block);
                         if (ret)
-                                return ret;
+                                goto out_free;
                 }
 
         } while (block < sdkp->capacity);
@@ -472,35 +470,32 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         zone_blocks = sdkp->zone_blocks;
 
 out:
-        kfree(buf);
-
         if (!zone_blocks) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Devices with non constant zone "
                                   "size are not supported\n");
-                return -ENODEV;
-        }
-
-        if (!is_power_of_2(zone_blocks)) {
+                ret = -ENODEV;
+        } else if (!is_power_of_2(zone_blocks)) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Devices with non power of 2 zone "
                                   "size are not supported\n");
-                return -ENODEV;
-        }
-
-        if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
+                ret = -ENODEV;
+        } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Zone size too large\n");
-                return -ENODEV;
+                ret = -ENODEV;
+        } else {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->zone_shift = ilog2(zone_blocks);
         }
 
-        sdkp->zone_blocks = zone_blocks;
-        sdkp->zone_shift = ilog2(zone_blocks);
+out_free:
+        kfree(buf);
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index e4f5bb056fd2..ba3cfa8e279b 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -2443,39 +2443,21 @@ struct cgr_comp {
         struct completion completion;
 };
 
-static int qman_delete_cgr_thread(void *p)
+static void qman_delete_cgr_smp_call(void *p)
 {
-        struct cgr_comp *cgr_comp = (struct cgr_comp *)p;
-        int ret;
-
-        ret = qman_delete_cgr(cgr_comp->cgr);
-        complete(&cgr_comp->completion);
-
-        return ret;
+        qman_delete_cgr((struct qman_cgr *)p);
 }
 
 void qman_delete_cgr_safe(struct qman_cgr *cgr)
 {
-        struct task_struct *thread;
-        struct cgr_comp cgr_comp;
-
         preempt_disable();
         if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id()) {
-                init_completion(&cgr_comp.completion);
-                cgr_comp.cgr = cgr;
-                thread = kthread_create(qman_delete_cgr_thread, &cgr_comp,
-                                        "cgr_del");
-
-                if (IS_ERR(thread))
-                        goto out;
-
-                kthread_bind(thread, qman_cgr_cpus[cgr->cgrid]);
-                wake_up_process(thread);
-                wait_for_completion(&cgr_comp.completion);
+                smp_call_function_single(qman_cgr_cpus[cgr->cgrid],
+                                         qman_delete_cgr_smp_call, cgr, true);
                 preempt_enable();
                 return;
         }
-out:
+
         qman_delete_cgr(cgr);
         preempt_enable();
 }
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6dbba5aff191..86580b6df33d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
         mutex_lock(&ashmem_mutex);
 
         if (asma->size == 0) {
-                ret = -EINVAL;
-                goto out;
+                mutex_unlock(&ashmem_mutex);
+                return -EINVAL;
         }
 
         if (!asma->file) {
-                ret = -EBADF;
-                goto out;
+                mutex_unlock(&ashmem_mutex);
+                return -EBADF;
         }
 
+        mutex_unlock(&ashmem_mutex);
+
         ret = vfs_llseek(asma->file, offset, origin);
         if (ret < 0)
-                goto out;
+                return ret;
 
         /** Copy f_pos from backing file, since f_ops->llseek() sets it */
         file->f_pos = asma->file->f_pos;
-
-out:
-        mutex_unlock(&ashmem_mutex);
         return ret;
 }
 
@@ -702,16 +701,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
         size_t pgstart, pgend;
         int ret = -EINVAL;
 
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+                return -EFAULT;
+
         mutex_lock(&ashmem_mutex);
 
         if (unlikely(!asma->file))
                 goto out_unlock;
 
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
-                ret = -EFAULT;
-                goto out_unlock;
-        }
-
         /* per custom, you can pass zero for len to mean "everything onward" */
         if (!pin.len)
                 pin.len = PAGE_ALIGN(asma->size) - pin.offset;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e618a87521a3..9d733471ca2e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -475,8 +475,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s,
         struct comedi_cmd *cmd = &async->cmd;
 
         if (cmd->stop_src == TRIG_COUNT) {
-                unsigned int nscans = nsamples / cmd->scan_end_arg;
-                unsigned int scans_left = __comedi_nscans_left(s, nscans);
+                unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg);
                 unsigned int scan_pos =
                     comedi_bytes_to_samples(s, async->scan_progress);
                 unsigned long long samples_left = 0;
diff --git a/drivers/staging/ncpfs/ncplib_kernel.c b/drivers/staging/ncpfs/ncplib_kernel.c
index 804adfebba2f..3e047eb4cc7c 100644
--- a/drivers/staging/ncpfs/ncplib_kernel.c
+++ b/drivers/staging/ncpfs/ncplib_kernel.c
@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id,
                 goto out;
         }
         *bytes_read = ncp_reply_be16(server, 0);
+        if (*bytes_read > to_read) {
+                result = -EINVAL;
+                goto out;
+        }
         source = ncp_reply_data(server, 2 + (offset & 1));
 
         memcpy(target, source, *bytes_read);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 5c0e59e8fe46..cbe98bc2b998 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2180,6 +2180,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                                 }
                                 if (tty_hung_up_p(file))
                                         break;
+                                /*
+                                 * Abort readers for ttys which never actually
+                                 * get hung up.  See __tty_hangup().
+                                 */
+                                if (test_bit(TTY_HUPPING, &tty->flags))
+                                        break;
                                 if (!timeout)
                                         break;
                                 if (file->f_flags & O_NONBLOCK) {
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 54adf8d56350..a93f77ab3da0 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3387,11 +3387,9 @@ static int serial_pci_is_class_communication(struct pci_dev *dev)
         /*
          * If it is not a communications device or the programming
          * interface is greater than 6, give up.
-         *
-         * (Should we try to make guesses for multiport serial devices
-         * later?)
          */
         if ((((dev->class >> 8) != PCI_CLASS_COMMUNICATION_SERIAL) &&
+             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MULTISERIAL) &&
              ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MODEM)) ||
             (dev->class & 0xff) > 6)
                 return -ENODEV;
@@ -3428,6 +3426,12 @@ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
 
+        /*
+         * Should we try to make guesses for multiport serial devices later?
+         */
+        if ((dev->class >> 8) == PCI_CLASS_COMMUNICATION_MULTISERIAL)
+                return -ENODEV;
+
         num_iomem = num_port = 0;
         for (i = 0; i < PCI_NUM_BAR_RESOURCES; i++) {
                 if (pci_resource_flags(dev, i) & IORESOURCE_IO) {
@@ -4699,6 +4703,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
                 pbn_b2_4_115200 },
         /*
+         * BrainBoxes UC-260
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+                PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+                PCI_ANY_ID, PCI_ANY_ID,
+                 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        /*
          * Perle PCI-RAS cards
          */
         {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030,
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index df46a9e88c34..e287fe8f10fc 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1734,6 +1734,7 @@ static void atmel_get_ip_name(struct uart_port *port)
                 switch (version) {
                 case 0x302:
                 case 0x10213:
+                case 0x10302:
                         dev_dbg(port->dev, "This version is usart\n");
                         atmel_port->has_frac_baudrate = true;
                         atmel_port->has_hw_timer = true;
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 870e84fb6e39..a24278380fec 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -245,11 +245,12 @@ int __init of_setup_earlycon(const struct earlycon_id *match,
         }
         port->mapbase = addr;
         port->uartclk = BASE_BAUD * 16;
-        port->membase = earlycon_map(port->mapbase, SZ_4K);
 
         val = of_get_flat_dt_prop(node, "reg-offset", NULL);
         if (val)
                 port->mapbase += be32_to_cpu(*val);
+        port->membase = earlycon_map(port->mapbase, SZ_4K);
+
         val = of_get_flat_dt_prop(node, "reg-shift", NULL);
         if (val)
                 port->regshift = be32_to_cpu(*val);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 1d7ca382bc12..a33c685af990 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2093,7 +2093,7 @@ static int serial_imx_probe(struct platform_device *pdev)
         uart_get_rs485_mode(&pdev->dev, &sport->port.rs485);
 
         if (sport->port.rs485.flags & SER_RS485_ENABLED &&
-            (!sport->have_rtscts || !sport->have_rtsgpio))
+            (!sport->have_rtscts && !sport->have_rtsgpio))
                 dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
 
         imx_rs485_config(&sport->port, &sport->port.rs485);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index c8dde56b532b..35b9201db3b4 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1144,6 +1144,8 @@ static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state)
                 uport->ops->config_port(uport, flags);
 
                 ret = uart_startup(tty, state, 1);
+                if (ret == 0)
+                        tty_port_set_initialized(port, true);
                 if (ret > 0)
                         ret = 0;
         }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 7257c078e155..44adf9db38f8 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -885,6 +885,8 @@ static void sci_receive_chars(struct uart_port *port)
                 /* Tell the rest of the system the news. New characters! */
                 tty_flip_buffer_push(tport);
         } else {
+                /* TTY buffers full; read from RX reg to prevent lockup */
+                serial_port_in(port, SCxRDR);
                 serial_port_in(port, SCxSR); /* dummy read */
                 sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port));
         }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index eb9133b472f4..63114ea35ec1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -586,6 +586,14 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
                 return;
         }
 
+        /*
+         * Some console devices aren't actually hung up for technical and
+         * historical reasons, which can lead to indefinite interruptible
+         * sleep in n_tty_read().  The following explicitly tells
+         * n_tty_read() to abort readers.
+         */
+        set_bit(TTY_HUPPING, &tty->flags);
+
         /* inuse_filps is protected by the single tty lock,
            this really needs to change if we want to flush the
            workqueue with the lock held */
@@ -640,6 +648,7 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
          * from the ldisc side, which is now guaranteed.
          */
         set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
         tty_unlock(tty);
 
         if (f)
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 88b902c525d7..b4e57c5a8bba 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1727,7 +1727,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
         default_attr(vc);
         update_attr(vc);
 
-        vc->vc_tab_stop[0]      = 0x01010100;
+        vc->vc_tab_stop[0]      =
         vc->vc_tab_stop[1]      =
         vc->vc_tab_stop[2]      =
         vc->vc_tab_stop[3]      =
@@ -1771,7 +1771,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                 vc->vc_pos -= (vc->vc_x << 1);
                 while (vc->vc_x < vc->vc_cols - 1) {
                         vc->vc_x++;
-                        if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31)))
+                        if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31)))
                                 break;
                 }
                 vc->vc_pos += (vc->vc_x << 1);
@@ -1831,7 +1831,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         lf(vc);
                         return;
                 case 'H':
-                        vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31));
+                        vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31));
                         return;
                 case 'Z':
                         respond_ID(tty);
@@ -2024,7 +2024,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         return;
                 case 'g':
                         if (!vc->vc_par[0])
-                                vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31));
+                                vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31));
                         else if (vc->vc_par[0] == 3) {
                                 vc->vc_tab_stop[0] =
                                         vc->vc_tab_stop[1] =
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index c64cf6c4a83d..0c11d40a12bc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -151,6 +151,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
 
         ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
 
+        /* Linger a bit, prior to the next control message. */
+        if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+                msleep(200);
+
         kfree(dr);
 
         return ret;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f4a548471f0f..54b019e267c5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,7 +230,8 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
         /* Corsair Strafe RGB */
-        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+          USB_QUIRK_DELAY_CTRL_MSG },
 
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 03fd20f0b496..c4a47496d2fb 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -137,7 +137,7 @@ static void dwc2_set_stm32f4x9_fsotg_params(struct dwc2_hsotg *hsotg)
         p->activate_stm_fs_transceiver = true;
 }
 
-static void dwc2_set_stm32f7xx_hsotg_params(struct dwc2_hsotg *hsotg)
+static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg)
 {
         struct dwc2_core_params *p = &hsotg->params;
 
@@ -164,8 +164,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "st,stm32f4x9-fsotg",
           .data = dwc2_set_stm32f4x9_fsotg_params },
         { .compatible = "st,stm32f4x9-hsotg" },
-        { .compatible = "st,stm32f7xx-hsotg",
-          .data = dwc2_set_stm32f7xx_hsotg_params },
+        { .compatible = "st,stm32f7-hsotg",
+          .data = dwc2_set_stm32f7_hsotg_params },
         {},
 };
 MODULE_DEVICE_TABLE(of, dwc2_of_match_table);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index f1d838a4acd6..e94bf91cc58a 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -175,7 +175,7 @@ void dwc3_set_mode(struct dwc3 *dwc, u32 mode)
         dwc->desired_dr_role = mode;
         spin_unlock_irqrestore(&dwc->lock, flags);
 
-        queue_work(system_power_efficient_wq, &dwc->drd_work);
+        queue_work(system_freezable_wq, &dwc->drd_work);
 }
 
 u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index c2592d883f67..d2428a9e8900 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1538,7 +1538,6 @@ ffs_fs_kill_sb(struct super_block *sb)
         if (sb->s_fs_info) {
                 ffs_release_dev(sb->s_fs_info);
                 ffs_data_closed(sb->s_fs_info);
-                ffs_data_put(sb->s_fs_info);
         }
 }
 
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 84f88fa411cd..d088c340e4d0 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -447,7 +447,8 @@ static int ohci_init (struct ohci_hcd *ohci)
         struct usb_hcd *hcd = ohci_to_hcd(ohci);
 
         /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        if (!(hcd->driver->flags & HCD_LOCAL_MEM))
+                hcd->self.sg_tablesize = ~0;
 
         if (distrust_firmware)
                 ohci->flags |= OHCI_QUIRK_HUB_POWER;
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index a1ab8acf39ba..c359bae7b754 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -328,13 +328,14 @@ dbc_ep_do_queue(struct dbc_ep *dep, struct dbc_request *req)
 int dbc_ep_queue(struct dbc_ep *dep, struct dbc_request *req,
                  gfp_t gfp_flags)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = dep->dbc;
         int                     ret = -ESHUTDOWN;
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         if (dbc->state == DS_CONFIGURED)
                 ret = dbc_ep_do_queue(dep, req);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         mod_delayed_work(system_wq, &dbc->event_work, 0);
 
@@ -521,15 +522,16 @@ static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
 static int xhci_dbc_start(struct xhci_hcd *xhci)
 {
         int                     ret;
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
 
         WARN_ON(!dbc);
 
         pm_runtime_get_sync(xhci_to_hcd(xhci)->self.controller);
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         ret = xhci_do_dbc_start(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         if (ret) {
                 pm_runtime_put(xhci_to_hcd(xhci)->self.controller);
@@ -541,6 +543,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
 
 static void xhci_dbc_stop(struct xhci_hcd *xhci)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
@@ -551,9 +554,9 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
         if (port->registered)
                 xhci_dbc_tty_unregister_device(xhci);
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         xhci_do_dbc_stop(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
 }
@@ -779,14 +782,15 @@ static void xhci_dbc_handle_events(struct work_struct *work)
         int                     ret;
         enum evtreturn          evtr;
         struct xhci_dbc         *dbc;
+        unsigned long           flags;
         struct xhci_hcd         *xhci;
 
         dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
         xhci = dbc->xhci;
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         evtr = xhci_dbc_do_handle_events(dbc);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         switch (evtr) {
         case EVT_GSER:
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 8d47b6fbf973..75f0b92694ba 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -92,21 +92,23 @@ static void dbc_start_rx(struct dbc_port *port)
 static void
 dbc_read_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         list_add_tail(&req->list_pool, &port->read_queue);
         tasklet_schedule(&port->push);
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         list_add(&req->list_pool, &port->write_pool);
         switch (req->status) {
         case 0:
@@ -119,7 +121,7 @@ static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
                           req->status);
                 break;
         }
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
@@ -327,12 +329,13 @@ static void dbc_rx_push(unsigned long _port)
 {
         struct dbc_request      *req;
         struct tty_struct       *tty;
+        unsigned long           flags;
         bool                    do_push = false;
         bool                    disconnect = false;
         struct dbc_port         *port = (void *)_port;
         struct list_head        *queue = &port->read_queue;
 
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         tty = port->port.tty;
         while (!list_empty(queue)) {
                 req = list_first_entry(queue, struct dbc_request, list_pool);
@@ -392,16 +395,17 @@ static void dbc_rx_push(unsigned long _port)
         if (!disconnect)
                 dbc_start_rx(port);
 
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static int dbc_port_activate(struct tty_port *_port, struct tty_struct *tty)
 {
+        unsigned long   flags;
         struct dbc_port *port = container_of(_port, struct dbc_port, port);
 
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 
         return 0;
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5262fa571a5d..d9f831b67e57 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,6 +126,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
 
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+                xhci->quirks |= XHCI_SUSPEND_DELAY;
+
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6f038306c14d..6652e2d5bd2e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -360,7 +360,6 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
 {
         struct usb_hcd  *hcd = dev_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        int ret;
 
         /*
          * xhci_suspend() needs `do_wakeup` to know whether host is allowed
@@ -370,12 +369,7 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
          * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
          * also applies to runtime suspend.
          */
-        ret = xhci_suspend(xhci, device_may_wakeup(dev));
-
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_disable_unprepare(xhci->clk);
-
-        return ret;
+        return xhci_suspend(xhci, device_may_wakeup(dev));
 }
 
 static int __maybe_unused xhci_plat_resume(struct device *dev)
@@ -384,9 +378,6 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         int ret;
 
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_prepare_enable(xhci->clk);
-
         ret = xhci_priv_resume_quirk(hcd);
         if (ret)
                 return ret;
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index f0b559660007..f33ffc2bc4ed 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -83,6 +83,10 @@ static const struct soc_device_attribute rcar_quirks_match[]  = {
                 .soc_id = "r8a7796",
                 .data = (void *)RCAR_XHCI_FIRMWARE_V3,
         },
+        {
+                .soc_id = "r8a77965",
+                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
+        },
         { /* sentinel */ },
 };
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 25d4b748a56f..5d37700ae4b0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -877,6 +877,9 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
         clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
         del_timer_sync(&xhci->shared_hcd->rh_timer);
 
+        if (xhci->quirks & XHCI_SUSPEND_DELAY)
+                usleep_range(1000, 1500);
+
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e4d7d3d06a75..866e141d4972 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -718,11 +718,12 @@ struct xhci_ep_ctx {
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)          (((p) & 0xff) << 16)
-#define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
-#define CTX_TO_EP_INTERVAL(p)   (((p) >> 16) & 0xff)
-#define EP_MAXPSTREAMS_MASK     (0x1f << 10)
-#define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define EP_INTERVAL(p)                  (((p) & 0xff) << 16)
+#define EP_INTERVAL_TO_UFRAMES(p)       (1 << (((p) >> 16) & 0xff))
+#define CTX_TO_EP_INTERVAL(p)           (((p) >> 16) & 0xff)
+#define EP_MAXPSTREAMS_MASK             (0x1f << 10)
+#define EP_MAXPSTREAMS(p)               (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define CTX_TO_EP_MAXPSTREAMS(p)        (((p) & EP_MAXPSTREAMS_MASK) >> 10)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
 /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
@@ -1825,6 +1826,7 @@ struct xhci_hcd {
 #define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
+#define XHCI_SUSPEND_DELAY      (1 << 30)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
@@ -2549,21 +2551,22 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
         u8 burst;
         u8 cerr;
         u8 mult;
-        u8 lsa;
-        u8 hid;
+
+        bool lsa;
+        bool hid;
 
         esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
                 CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
 
         ep_state = info & EP_STATE_MASK;
-        max_pstr = info & EP_MAXPSTREAMS_MASK;
+        max_pstr = CTX_TO_EP_MAXPSTREAMS(info);
         interval = CTX_TO_EP_INTERVAL(info);
         mult = CTX_TO_EP_MULT(info) + 1;
-        lsa = info & EP_HAS_LSA;
+        lsa = !!(info & EP_HAS_LSA);
 
         cerr = (info2 & (3 << 1)) >> 1;
         ep_type = CTX_TO_EP_TYPE(info2);
-        hid = info2 & (1 << 7);
+        hid = !!(info2 & (1 << 7));
         burst = CTX_TO_MAX_BURST(info2);
         maxp = MAX_PACKET_DECODED(info2);
 
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index f5e1bb5e5217..984f7e12a6a5 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -85,6 +85,8 @@ struct mon_reader_text {
 
         wait_queue_head_t wait;
         int printf_size;
+        size_t printf_offset;
+        size_t printf_togo;
         char *printf_buf;
         struct mutex printf_lock;
 
@@ -376,75 +378,103 @@ err_alloc:
         return rc;
 }
 
-/*
- * For simplicity, we read one record in one system call and throw out
- * what does not fit. This means that the following does not work:
- *   dd if=/dbg/usbmon/0t bs=10
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
+    char __user * const buf, const size_t nbytes)
+{
+        const size_t togo = min(nbytes, rp->printf_togo);
+
+        if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+                return -EFAULT;
+        rp->printf_togo -= togo;
+        rp->printf_offset += togo;
+        return togo;
+}
+
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_t(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
         struct mon_reader_text *rp = file->private_data;
         struct mon_event_text *ep;
         struct mon_text_ptr ptr;
+        ssize_t ret;
 
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
         mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
-
-        mon_text_read_head_t(rp, &ptr, ep);
-        mon_text_read_statset(rp, &ptr, ep);
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
-
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-                ptr.cnt = -EFAULT;
+
+        if (rp->printf_togo == 0) {
+
+                ep = mon_text_read_wait(rp, file);
+                if (IS_ERR(ep)) {
+                        mutex_unlock(&rp->printf_lock);
+                        return PTR_ERR(ep);
+                }
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
+                ptr.limit = rp->printf_size;
+
+                mon_text_read_head_t(rp, &ptr, ep);
+                mon_text_read_statset(rp, &ptr, ep);
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+
+                kmem_cache_free(rp->e_slab, ep);
+        }
+
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
         mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
-        return ptr.cnt;
+        return ret;
 }
 
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_u(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
         struct mon_reader_text *rp = file->private_data;
         struct mon_event_text *ep;
         struct mon_text_ptr ptr;
+        ssize_t ret;
 
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
         mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
 
-        mon_text_read_head_u(rp, &ptr, ep);
-        if (ep->type == 'E') {
-                mon_text_read_statset(rp, &ptr, ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
-                mon_text_read_isostat(rp, &ptr, ep);
-                mon_text_read_isodesc(rp, &ptr, ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
-                mon_text_read_intstat(rp, &ptr, ep);
-        } else {
-                mon_text_read_statset(rp, &ptr, ep);
+        if (rp->printf_togo == 0) {
+
+                ep = mon_text_read_wait(rp, file);
+                if (IS_ERR(ep)) {
+                        mutex_unlock(&rp->printf_lock);
+                        return PTR_ERR(ep);
+                }
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
+                ptr.limit = rp->printf_size;
+
+                mon_text_read_head_u(rp, &ptr, ep);
+                if (ep->type == 'E') {
+                        mon_text_read_statset(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                        mon_text_read_isostat(rp, &ptr, ep);
+                        mon_text_read_isodesc(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                        mon_text_read_intstat(rp, &ptr, ep);
+                } else {
+                        mon_text_read_statset(rp, &ptr, ep);
+                }
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+
+                kmem_cache_free(rp->e_slab, ep);
         }
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
 
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-                ptr.cnt = -EFAULT;
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
         mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
-        return ptr.cnt;
+        return ret;
 }
 
 static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index eef4ad578b31..4d723077be2b 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1756,6 +1756,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
         int             vbus;
         u8              devctl;
 
+        pm_runtime_get_sync(dev);
         spin_lock_irqsave(&musb->lock, flags);
         val = musb->a_wait_bcon;
         vbus = musb_platform_get_vbus_status(musb);
@@ -1769,6 +1770,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
                         vbus = 0;
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_put_sync(dev);
 
         return sprintf(buf, "Vbus %s, timeout %lu msec\n",
                         vbus ? "on" : "off", val);
@@ -2471,11 +2473,11 @@ static int musb_remove(struct platform_device *pdev)
         musb_disable_interrupts(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         spin_unlock_irqrestore(&musb->lock, flags);
+        musb_platform_exit(musb);
 
         pm_runtime_dont_use_autosuspend(musb->controller);
         pm_runtime_put_sync(musb->controller);
         pm_runtime_disable(musb->controller);
-        musb_platform_exit(musb);
         musb_phy_callback = NULL;
         if (musb->dma_controller)
                 musb_dma_controller_destroy(musb->dma_controller);
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 3b1b9695177a..6034c39b67d1 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -1076,7 +1076,7 @@ static int uas_post_reset(struct usb_interface *intf)
                 return 0;
 
         err = uas_configure_endpoints(devinfo);
-        if (err && err != ENODEV)
+        if (err && err != -ENODEV)
                 shost_printk(KERN_ERR, shost,
                              "%s: alloc streams error %d after reset",
                              __func__, err);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 264af199aec8..747d3a9596d9 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2118,6 +2118,13 @@ UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA ),
 
+/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */
+UNUSUAL_DEV(  0x152d, 0x2567, 0x0117, 0x0117,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
+
 /* Reported-by George Cherian <george.cherian@cavium.com> */
 UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
index 9ce4756adad6..dcd8ef085b30 100644
--- a/drivers/usb/typec/fusb302/fusb302.c
+++ b/drivers/usb/typec/fusb302/fusb302.c
@@ -1857,7 +1857,8 @@ static int fusb302_probe(struct i2c_client *client,
         chip->tcpm_port = tcpm_register_port(&client->dev, &chip->tcpc_dev);
         if (IS_ERR(chip->tcpm_port)) {
                 ret = PTR_ERR(chip->tcpm_port);
-                dev_err(dev, "cannot register tcpm port, ret=%d", ret);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "cannot register tcpm port, ret=%d", ret);
                 goto destroy_workqueue;
         }
 
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index f4d563ee7690..8b637a4b474b 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -252,9 +252,6 @@ struct tcpm_port {
         unsigned int nr_src_pdo;
         u32 snk_pdo[PDO_MAX_OBJECTS];
         unsigned int nr_snk_pdo;
-        unsigned int nr_fixed; /* number of fixed sink PDOs */
-        unsigned int nr_var; /* number of variable sink PDOs */
-        unsigned int nr_batt; /* number of battery sink PDOs */
         u32 snk_vdo[VDO_MAX_OBJECTS];
         unsigned int nr_snk_vdo;
 
@@ -1770,90 +1767,39 @@ static int tcpm_pd_check_request(struct tcpm_port *port)
         return 0;
 }
 
-#define min_power(x, y) min(pdo_max_power(x), pdo_max_power(y))
-#define min_current(x, y) min(pdo_max_current(x), pdo_max_current(y))
-
-static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo,
-                              int *src_pdo)
+static int tcpm_pd_select_pdo(struct tcpm_port *port)
 {
-        unsigned int i, j, max_mw = 0, max_mv = 0, mw = 0, mv = 0, ma = 0;
+        unsigned int i, max_mw = 0, max_mv = 0;
         int ret = -EINVAL;
 
         /*
-         * Select the source PDO providing the most power which has a
-         * matchig sink cap.
+         * Select the source PDO providing the most power while staying within
+         * the board's voltage limits. Prefer PDO providing exp
          */
         for (i = 0; i < port->nr_source_caps; i++) {
                 u32 pdo = port->source_caps[i];
                 enum pd_pdo_type type = pdo_type(pdo);
+                unsigned int mv, ma, mw;
 
-                if (type == PDO_TYPE_FIXED) {
-                        for (j = 0; j < port->nr_fixed; j++) {
-                                if (pdo_fixed_voltage(pdo) ==
-                                    pdo_fixed_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_fixed_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                        /* There could only be one fixed pdo
-                                         * at a specific voltage level.
-                                         * So breaking here.
-                                         */
-                                        break;
-                                }
-                        }
-                } else if (type == PDO_TYPE_BATT) {
-                        for (j = port->nr_fixed;
-                             j < port->nr_fixed +
-                                 port->nr_batt;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        mw = min_power(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
-                } else if (type == PDO_TYPE_VAR) {
-                        for (j = port->nr_fixed +
-                                 port->nr_batt;
-                             j < port->nr_fixed +
-                                 port->nr_batt +
-                                 port->nr_var;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
+                if (type == PDO_TYPE_FIXED)
+                        mv = pdo_fixed_voltage(pdo);
+                else
+                        mv = pdo_min_voltage(pdo);
+
+                if (type == PDO_TYPE_BATT) {
+                        mw = pdo_max_power(pdo);
+                } else {
+                        ma = min(pdo_max_current(pdo),
+                                 port->max_snk_ma);
+                        mw = ma * mv / 1000;
+                }
+
+                /* Perfer higher voltages if available */
+                if ((mw > max_mw || (mw == max_mw && mv > max_mv)) &&
+                    mv <= port->max_snk_mv) {
+                        ret = i;
+                        max_mw = mw;
+                        max_mv = mv;
                 }
         }
 
@@ -1865,14 +1811,13 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         unsigned int mv, ma, mw, flags;
         unsigned int max_ma, max_mw;
         enum pd_pdo_type type;
-        int src_pdo_index, snk_pdo_index;
-        u32 pdo, matching_snk_pdo;
+        int index;
+        u32 pdo;
 
-        if (tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index) < 0)
+        index = tcpm_pd_select_pdo(port);
+        if (index < 0)
                 return -EINVAL;
-
-        pdo = port->source_caps[src_pdo_index];
-        matching_snk_pdo = port->snk_pdo[snk_pdo_index];
+        pdo = port->source_caps[index];
         type = pdo_type(pdo);
 
         if (type == PDO_TYPE_FIXED)
@@ -1880,28 +1825,26 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         else
                 mv = pdo_min_voltage(pdo);
 
-        /* Select maximum available current within the sink pdo's limit */
+        /* Select maximum available current within the board's power limit */
         if (type == PDO_TYPE_BATT) {
-                mw = min_power(pdo, matching_snk_pdo);
-                ma = 1000 * mw / mv;
+                mw = pdo_max_power(pdo);
+                ma = 1000 * min(mw, port->max_snk_mw) / mv;
         } else {
-                ma = min_current(pdo, matching_snk_pdo);
-                mw = ma * mv / 1000;
+                ma = min(pdo_max_current(pdo),
+                         1000 * port->max_snk_mw / mv);
         }
+        ma = min(ma, port->max_snk_ma);
 
         flags = RDO_USB_COMM | RDO_NO_SUSPEND;
 
         /* Set mismatch bit if offered power is less than operating power */
+        mw = ma * mv / 1000;
         max_ma = ma;
         max_mw = mw;
         if (mw < port->operating_snk_mw) {
                 flags |= RDO_CAP_MISMATCH;
-                if (type == PDO_TYPE_BATT &&
-                    (pdo_max_power(matching_snk_pdo) > pdo_max_power(pdo)))
-                        max_mw = pdo_max_power(matching_snk_pdo);
-                else if (pdo_max_current(matching_snk_pdo) >
-                         pdo_max_current(pdo))
-                        max_ma = pdo_max_current(matching_snk_pdo);
+                max_mw = port->operating_snk_mw;
+                max_ma = max_mw * 1000 / mv;
         }
 
         tcpm_log(port, "cc=%d cc1=%d cc2=%d vbus=%d vconn=%s polarity=%d",
@@ -1910,16 +1853,16 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
                  port->polarity);
 
         if (type == PDO_TYPE_BATT) {
-                *rdo = RDO_BATT(src_pdo_index + 1, mw, max_mw, flags);
+                *rdo = RDO_BATT(index + 1, mw, max_mw, flags);
 
                 tcpm_log(port, "Requesting PDO %d: %u mV, %u mW%s",
-                         src_pdo_index, mv, mw,
+                         index, mv, mw,
                          flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
         } else {
-                *rdo = RDO_FIXED(src_pdo_index + 1, ma, max_ma, flags);
+                *rdo = RDO_FIXED(index + 1, ma, max_ma, flags);
 
                 tcpm_log(port, "Requesting PDO %d: %u mV, %u mA%s",
-                         src_pdo_index, mv, ma,
+                         index, mv, ma,
                          flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
         }
 
@@ -3650,19 +3593,6 @@ int tcpm_update_sink_capabilities(struct tcpm_port *port, const u32 *pdo,
 }
 EXPORT_SYMBOL_GPL(tcpm_update_sink_capabilities);
 
-static int nr_type_pdos(const u32 *pdo, unsigned int nr_pdo,
-                        enum pd_pdo_type type)
-{
-        int count = 0;
-        int i;
-
-        for (i = 0; i < nr_pdo; i++) {
-                if (pdo_type(pdo[i]) == type)
-                        count++;
-        }
-        return count;
-}
-
 struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
 {
         struct tcpm_port *port;
@@ -3708,15 +3638,6 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                           tcpc->config->nr_src_pdo);
         port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                           tcpc->config->nr_snk_pdo);
-        port->nr_fixed =  nr_type_pdos(port->snk_pdo,
-                                       port->nr_snk_pdo,
-                                       PDO_TYPE_FIXED);
-        port->nr_var = nr_type_pdos(port->snk_pdo,
-                                    port->nr_snk_pdo,
-                                    PDO_TYPE_VAR);
-        port->nr_batt = nr_type_pdos(port->snk_pdo,
-                                     port->nr_snk_pdo,
-                                     PDO_TYPE_BATT);
         port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
                                           tcpc->config->nr_snk_vdo);
 
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index d86f72bbbb91..6dcd3ff655c3 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -105,10 +105,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
         if (rv != 0)
                 return -EINVAL;
 
+        if (!udc) {
+                dev_err(dev, "no device");
+                return -ENODEV;
+        }
         spin_lock_irqsave(&udc->lock, flags);
         /* Don't export what we don't have */
-        if (!udc || !udc->driver || !udc->pullup) {
-                dev_err(dev, "no device or gadget not bound");
+        if (!udc->driver || !udc->pullup) {
+                dev_err(dev, "gadget not bound");
                 ret = -ENODEV;
                 goto unlock;
         }
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b0f759476900..8a1508a8e481 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -207,9 +207,6 @@ static bool vfio_pci_nointx(struct pci_dev *pdev)
                 }
         }
 
-        if (!pdev->irq)
-                return true;
-
         return false;
 }
 
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 610cba276d47..8139bc70ad7d 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -170,7 +170,7 @@ static void vhost_net_buf_unproduce(struct vhost_net_virtqueue *nvq)
         if (nvq->rx_ring && !vhost_net_buf_is_empty(rxq)) {
                 ptr_ring_unconsume(nvq->rx_ring, rxq->queue + rxq->head,
                                    vhost_net_buf_get_size(rxq),
-                                   __skb_array_destroy_skb);
+                                   tun_ptr_free);
                 rxq->head = rxq->tail = 0;
         }
 }
@@ -948,6 +948,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                 n->vqs[i].done_idx = 0;
                 n->vqs[i].vhost_hlen = 0;
                 n->vqs[i].sock_hlen = 0;
+                n->vqs[i].rx_ring = NULL;
                 vhost_net_buf_init(&n->vqs[i].rxq);
         }
         vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
@@ -972,6 +973,7 @@ static struct socket *vhost_net_stop_vq(struct vhost_net *n,
         vhost_net_disable_vq(n, vq);
         vq->private_data = NULL;
         vhost_net_buf_unproduce(nvq);
+        nvq->rx_ring = NULL;
         mutex_unlock(&vq->mutex);
         return sock;
 }
@@ -1161,14 +1163,14 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                 vhost_net_disable_vq(n, vq);
                 vq->private_data = sock;
                 vhost_net_buf_unproduce(nvq);
-                if (index == VHOST_NET_VQ_RX)
-                        nvq->rx_ring = get_tap_ptr_ring(fd);
                 r = vhost_vq_init_access(vq);
                 if (r)
                         goto err_used;
                 r = vhost_net_enable_vq(n, vq);
                 if (r)
                         goto err_used;
+                if (index == VHOST_NET_VQ_RX)
+                        nvq->rx_ring = get_tap_ptr_ring(fd);
 
                 oldubufs = nvq->ubufs;
                 nvq->ubufs = ubufs;
diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
index 6d1fbda0f461..0da9943d405f 100644
--- a/drivers/watchdog/wdat_wdt.c
+++ b/drivers/watchdog/wdat_wdt.c
@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
 
                 memset(&r, 0, sizeof(r));
                 r.start = gas->address;
-                r.end = r.start + gas->access_width;
+                r.end = r.start + gas->access_width - 1;
                 if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
                         r.flags = IORESOURCE_MEM;
                 } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {