Merge branch 'linus' into locking/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2017-08-25 05:04:51 -0400
committer: Ingo Molnar <mingo@kernel.org> 2017-08-25 05:04:51 -0400
commit: 10c9850cb2ced2ce528e5b692c639974213a64ec (patch)
tree: f8063beac0ba1dab069d25661845c5b7ef9a67c7 /drivers
parent: 0c2364791343e4b04cd1f097ff2abc2799062448 (diff)
parent: 90a6cd503982bfd33ce8c70eb49bd2dd33bc6325 (diff)
173 files changed, 1502 insertions, 570 deletions
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 538c61677c10..783f4c838aee 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -100,9 +100,13 @@ acpi_evaluate_object_typed(acpi_handle handle,
                free_buffer_on_error = TRUE;
        }
-        status = acpi_get_handle(handle, pathname, &target_handle);
+        if (pathname) {
-        if (ACPI_FAILURE(status)) {
+                status = acpi_get_handle(handle, pathname, &target_handle);
-                return_ACPI_STATUS(status);
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        } else {
+                target_handle = handle;
        }
        full_pathname = acpi_ns_get_external_pathname(target_handle);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 62068a5e814f..ae3d6d152633 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1741,7 +1741,7 @@ error:
 * functioning ECDT EC first in order to handle the events.
 * https://bugzilla.kernel.org/show_bug.cgi?id=115021
 */
-int __init acpi_ec_ecdt_start(void)
+static int __init acpi_ec_ecdt_start(void)
 {
        acpi_handle handle;
@@ -2003,20 +2003,17 @@ static inline void acpi_ec_query_exit(void)
 int __init acpi_ec_init(void)
 {
        int result;
+        int ecdt_fail, dsdt_fail;
        /* register workqueue for _Qxx evaluations */
        result = acpi_ec_query_init();
        if (result)
-                goto err_exit;
+                return result;
-        /* Now register the driver for the EC */
-        result = acpi_bus_register_driver(&acpi_ec_driver);
-        if (result)
-                goto err_exit;
-err_exit:
+        /* Drivers must be started after acpi_ec_query_init() */
-        if (result)
+        ecdt_fail = acpi_ec_ecdt_start();
-                acpi_ec_query_exit();
+        dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
-        return result;
+        return ecdt_fail && dsdt_fail ? -ENODEV : 0;
 }
 /* EC driver currently not unloadable */
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 58dd7ab3c653..3f5af4d7a739 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -185,7 +185,6 @@ typedef int (*acpi_ec_query_func) (void *data);
 int acpi_ec_init(void);
 int acpi_ec_ecdt_probe(void);
 int acpi_ec_dsdt_probe(void);
-int acpi_ec_ecdt_start(void);
 void acpi_ec_block_transactions(void);
 void acpi_ec_unblock_transactions(void);
 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 917c789f953d..476a52c60cf3 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1047,7 +1047,7 @@ static struct fwnode_handle *acpi_graph_get_child_prop_value(
        fwnode_for_each_child_node(fwnode, child) {
                u32 nr;
-                if (!fwnode_property_read_u32(fwnode, prop_name, &nr))
+                if (fwnode_property_read_u32(child, prop_name, &nr))
                        continue;
                if (val == nr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 33897298f03e..70fd5502c284 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2084,7 +2084,6 @@ int __init acpi_scan_init(void)
        acpi_gpe_apply_masked_gpes();
        acpi_update_all_gpes();
-        acpi_ec_ecdt_start();
        acpi_scan_initialized = true;
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 4ac3e06b41d8..98aa8c808a33 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -17,6 +17,16 @@
 #include <linux/serial_core.h>
 /*
+ * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
+ * occasionally getting stuck as 1. To avoid the potential for a hang, check
+ * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
+ * implementations, so only do so if an affected platform is detected in
+ * parse_spcr().
+ */
+bool qdf2400_e44_present;
+EXPORT_SYMBOL(qdf2400_e44_present);
+/*
 * Some Qualcomm Datacenter Technologies SoCs have a defective UART BUSY bit.
 * Detect them by examining the OEM fields in the SPCR header, similiar to PCI
 * quirk detection in pci_mcfg.c.
@@ -147,8 +157,30 @@ int __init parse_spcr(bool earlycon)
                goto done;
        }
-        if (qdf2400_erratum_44_present(&table->header))
+        /*
-                uart = "qdf2400_e44";
+         * If the E44 erratum is required, then we need to tell the pl011
+         * driver to implement the work-around.
+         *
+         * The global variable is used by the probe function when it
+         * creates the UARTs, whether or not they're used as a console.
+         *
+         * If the user specifies "traditional" earlycon, the qdf2400_e44
+         * console name matches the EARLYCON_DECLARE() statement, and
+         * SPCR is not used.  Parameter "earlycon" is false.
+         *
+         * If the user specifies "SPCR" earlycon, then we need to update
+         * the console name so that it also says "qdf2400_e44".  Parameter
+         * "earlycon" is true.
+         *
+         * For consistency, if we change the console name, then we do it
+         * for everyone, not just earlycon.
+         */
+        if (qdf2400_erratum_44_present(&table->header)) {
+                qdf2400_e44_present = true;
+                if (earlycon)
+                        uart = "qdf2400_e44";
+        }
        if (xgene_8250_erratum_present(table))
                iotype = "mmio32";
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b9f907eedbf7..bfbe1e154128 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -30,7 +30,6 @@
 #include <linux/syscore_ops.h>
 #include <linux/reboot.h>
 #include <linux/security.h>
-#include <linux/swait.h>
 #include <generated/utsrelease.h>
@@ -112,13 +111,13 @@ static inline long firmware_loading_timeout(void)
 * state of the firmware loading.
 */
 struct fw_state {
-        struct swait_queue_head wq;
+        struct completion completion;
        enum fw_status status;
 };
 static void fw_state_init(struct fw_state *fw_st)
 {
-        init_swait_queue_head(&fw_st->wq);
+        init_completion(&fw_st->completion);
        fw_st->status = FW_STATUS_UNKNOWN;
 }
@@ -131,9 +130,7 @@ static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
 {
        long ret;
-        ret = swait_event_interruptible_timeout(fw_st->wq,
+        ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
-                                __fw_state_is_done(READ_ONCE(fw_st->status)),
-                                timeout);
        if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
                return -ENOENT;
        if (!ret)
@@ -148,35 +145,34 @@ static void __fw_state_set(struct fw_state *fw_st,
        WRITE_ONCE(fw_st->status, status);
        if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
-                swake_up(&fw_st->wq);
+                complete_all(&fw_st->completion);
 }
 #define fw_state_start(fw_st)                                   \
        __fw_state_set(fw_st, FW_STATUS_LOADING)
 #define fw_state_done(fw_st)                                    \
        __fw_state_set(fw_st, FW_STATUS_DONE)
+#define fw_state_aborted(fw_st)                                 \
+        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait(fw_st)                                    \
        __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
-#ifndef CONFIG_FW_LOADER_USER_HELPER
-#define fw_state_is_aborted(fw_st)      false
-#else /* CONFIG_FW_LOADER_USER_HELPER */
 static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
 {
        return fw_st->status == status;
 }
+#define fw_state_is_aborted(fw_st)                              \
+        __fw_state_check(fw_st, FW_STATUS_ABORTED)
+#ifdef CONFIG_FW_LOADER_USER_HELPER
 #define fw_state_aborted(fw_st)                                 \
        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_is_done(fw_st)                                 \
        __fw_state_check(fw_st, FW_STATUS_DONE)
 #define fw_state_is_loading(fw_st)                              \
        __fw_state_check(fw_st, FW_STATUS_LOADING)
-#define fw_state_is_aborted(fw_st)                              \
-        __fw_state_check(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait_timeout(fw_st, timeout)                   \
        __fw_state_wait_common(fw_st, timeout)
@@ -1200,6 +1196,28 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
        return 1; /* need to load */
 }
+/*
+ * Batched requests need only one wake, we need to do this step last due to the
+ * fallback mechanism. The buf is protected with kref_get(), and it won't be
+ * released until the last user calls release_firmware().
+ *
+ * Failed batched requests are possible as well, in such cases we just share
+ * the struct firmware_buf and won't release it until all requests are woken
+ * and have gone through this same path.
+ */
+static void fw_abort_batch_reqs(struct firmware *fw)
+{
+        struct firmware_buf *buf;
+        /* Loaded directly? */
+        if (!fw || !fw->priv)
+                return;
+        buf = fw->priv;
+        if (!fw_state_is_aborted(&buf->fw_st))
+                fw_state_aborted(&buf->fw_st);
+}
 /* called from request_firmware() and request_firmware_work_func() */
 static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -1243,6 +1261,7 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
 out:
        if (ret < 0) {
+                fw_abort_batch_reqs(fw);
                release_firmware(fw);
                fw = NULL;
        }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                        /*
                         * Get the bios in the request so we can re-queue them.
                         */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                            shadow[j].request->cmd_flags & REQ_FUA) {
                                /*
                                 * Flush operations don't contain bios, so
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 config CLKSRC_PISTACHIO
        bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
        select TIMER_OF
        help
          Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index c62e71614c75..fd4b7f684bd0 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1444,7 +1444,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
         * While unlikely, it's theoretically possible that none of the frames
         * in a timer expose the combination of feature we want.
         */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                timer = &timers[i];
                frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        if (irq < 0) {
                dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
        }
        /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
        if (IS_ERR(p->base))
                return PTR_ERR(p->base);
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
        }
        /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
        const char *name = of_base->name ? of_base->name : np->full_name;
        of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
        }
        return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0566455f233e..65ee4fcace1f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
 }
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 37b0698b7193..42896a67aeae 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -235,6 +235,7 @@ static inline int validate_dt_prop_sizes(const char *prop1, int prop1_len,
        return -1;
 }
+extern u32 pnv_get_supported_cpuidle_states(void);
 static int powernv_add_idle_states(void)
 {
        struct device_node *power_mgt;
@@ -248,6 +249,8 @@ static int powernv_add_idle_states(void)
        const char *names[CPUIDLE_STATE_MAX];
        u32 has_stop_states = 0;
        int i, rc;
+        u32 supported_flags = pnv_get_supported_cpuidle_states();
        /* Currently we have snooze statically defined */
@@ -362,6 +365,13 @@ static int powernv_add_idle_states(void)
        for (i = 0; i < dt_idle_states; i++) {
                unsigned int exit_latency, target_residency;
                bool stops_timebase = false;
+                /*
+                 * Skip the platform idle state whose flag isn't in
+                 * the supported_cpuidle_states flag mask.
+                 */
+                if ((flags[i] & supported_flags) != flags[i])
+                        continue;
                /*
                 * If an idle state has exit latency beyond
                 * POWERNV_THRESHOLD_LATENCY_NS then don't use it
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                &crypt->icv_rev_aes);
                if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                if (!encrypt) {
                        scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
        BUG_ON(qmgr_stat_overflow(SEND_QID));
        return -EINPROGRESS;
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
        free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
        crypt->ctl_flags = CTL_FLAG_UNUSED;
        return -ENOMEM;
 }
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index e338c3743562..45c65f805fd6 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -557,7 +557,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
        edge_cause = mvebu_gpio_read_edge_cause(mvchip);
        edge_mask  = mvebu_gpio_read_edge_mask(mvchip);
-        cause = (data_in ^ level_mask) | (edge_cause & edge_mask);
+        cause = (data_in & level_mask) | (edge_cause & edge_mask);
        for (i = 0; i < mvchip->chip.ngpio; i++) {
                int irq;
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index 16fe9742597b..fc80add5fedb 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -2,6 +2,7 @@
 #include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/sysfs.h>
+#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <linux/gpio/driver.h>
 #include <linux/interrupt.h>
@@ -432,6 +433,11 @@ static struct attribute *gpiochip_attrs[] = {
 };
 ATTRIBUTE_GROUPS(gpiochip);
+static struct gpio_desc *gpio_to_valid_desc(int gpio)
+{
+        return gpio_is_valid(gpio) ? gpio_to_desc(gpio) : NULL;
+}
 /*
 * /sys/class/gpio/export ... write-only
 *      integer N ... number of GPIO to export (full access)
@@ -450,7 +456,7 @@ static ssize_t export_store(struct class *class,
        if (status < 0)
                goto done;
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
        /* reject invalid GPIOs */
        if (!desc) {
                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
@@ -493,7 +499,7 @@ static ssize_t unexport_store(struct class *class,
        if (status < 0)
                goto done;
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
        /* reject bogus commands (gpio_unexport ignores them) */
        if (!desc) {
                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                struct dma_fence *f = e->fence;
                struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                if (ring && s_fence) {
                        /* For fences from the same ring it is sufficient
                         * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                        }
                }
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
                return f;
        }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 0511fce5c947..e3a81ed66bc2 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4581,7 +4581,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
                sseu->slice_mask |= BIT(s);
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                        sseu->subslice_mask =
                                INTEL_INFO(dev_priv)->sseu.subslice_mask;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
        if (!ppgtt)
                return false;
        /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                return true;
        /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
            !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                return false;
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
        if (skip_rcs_switch(ppgtt, engine, to))
                return 0;
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                /* Older GENs and non render rings still want the load first,
                 * "PP_DCLV followed by PP_DIR_BASE register through Load
                 * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                struct i915_hw_ppgtt *ppgtt =
                        to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                        int ret;
                        trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                        ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                }
+                engine->legacy_active_context = to;
                return 0;
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                        goto err_unpin;
        }
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
        ret = req->engine->emit_bb_start(req,
                                         so->batch_offset, so->batch_size,
                                         I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 9edeaaef77ad..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
        if (dev_priv->vbt.edp.low_vswing) {
                if (voltage == VOLTAGE_INFO_0_85V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                } else if (voltage == VOLTAGE_INFO_0_95V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                        return cnl_ddi_translations_edp_0_95V;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9471c88d449e..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3485,6 +3485,13 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
            !gpu_reset_clobbers_display(dev_priv))
                return;
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
        /*
         * Need mode_config.mutex so that we don't
         * trample ongoing ->detect() and whatnot.
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 6b5d3be283c4..807299dd45eb 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -193,7 +193,6 @@ struct bmc150_accel_data {
        struct regmap *regmap;
        int irq;
        struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
-        atomic_t active_intr;
        struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
        struct mutex mutex;
        u8 fifo_mode, watermark;
@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i,
                goto out_fix_power_state;
        }
-        if (state)
-                atomic_inc(&data->active_intr);
-        else
-                atomic_dec(&data->active_intr);
        return 0;
 out_fix_power_state:
@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct device *dev)
        struct bmc150_accel_data *data = iio_priv(indio_dev);
        mutex_lock(&data->mutex);
-        if (atomic_read(&data->active_intr))
+        bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
-                bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
        bmc150_accel_fifo_set_mode(data);
        mutex_unlock(&data->mutex);
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 07d1489cd457..e44f62bf9caa 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -166,6 +166,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_ihl = 0x02,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -234,6 +238,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -316,6 +324,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                                .en_mask = 0x08,
                        },
                },
+                .sim = {
+                        .addr = 0x24,
+                        .value = BIT(0),
+                },
                .multi_read_bit = false,
                .bootime = 2,
        },
@@ -379,6 +391,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_int1 = 0x04,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                .multi_read_bit = true,
                .bootime = 2, /* guess */
        },
@@ -437,6 +453,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(7),
+                },
                .multi_read_bit = false,
                .bootime = 2, /* guess */
        },
@@ -499,6 +519,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .addr_ihl = 0x22,
                        .mask_ihl = 0x80,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -547,6 +571,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_int1 = 0x04,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                .multi_read_bit = false,
                .bootime = 2,
        },
@@ -614,6 +642,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_ihl = 0x02,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index e0ea411a0b2d..c02b23d675cb 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -22,6 +22,7 @@
 #include <linux/iio/iio.h>
 #include <linux/iio/driver.h>
+#include <linux/iopoll.h>
 #define ASPEED_RESOLUTION_BITS          10
 #define ASPEED_CLOCKS_PER_SAMPLE        12
@@ -38,11 +39,17 @@
 #define ASPEED_ENGINE_ENABLE            BIT(0)
+#define ASPEED_ADC_CTRL_INIT_RDY        BIT(8)
+#define ASPEED_ADC_INIT_POLLING_TIME    500
+#define ASPEED_ADC_INIT_TIMEOUT         500000
 struct aspeed_adc_model_data {
        const char *model_name;
        unsigned int min_sampling_rate; // Hz
        unsigned int max_sampling_rate; // Hz
        unsigned int vref_voltage;      // mV
+        bool wait_init_sequence;
 };
 struct aspeed_adc_data {
@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                goto scaler_error;
        }
+        model_data = of_device_get_match_data(&pdev->dev);
+        if (model_data->wait_init_sequence) {
+                /* Enable engine in normal mode. */
+                writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE,
+                       data->base + ASPEED_REG_ENGINE_CONTROL);
+                /* Wait for initial sequence complete. */
+                ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL,
+                                         adc_engine_control_reg_val,
+                                         adc_engine_control_reg_val &
+                                         ASPEED_ADC_CTRL_INIT_RDY,
+                                         ASPEED_ADC_INIT_POLLING_TIME,
+                                         ASPEED_ADC_INIT_TIMEOUT);
+                if (ret)
+                        goto scaler_error;
+        }
        /* Start all channels in normal mode. */
        ret = clk_prepare_enable(data->clk_scaler->clk);
        if (ret)
@@ -274,6 +299,7 @@ static const struct aspeed_adc_model_data ast2500_model_data = {
        .vref_voltage = 1800, // mV
        .min_sampling_rate = 1,
        .max_sampling_rate = 1000000,
+        .wait_init_sequence = true,
 };
 static const struct of_device_id aspeed_adc_matches[] = {
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 64799ad7ebad..462a99c13e7a 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -28,6 +28,8 @@
 #include <linux/iio/driver.h>
 #define AXP288_ADC_EN_MASK              0xF1
+#define AXP288_ADC_TS_PIN_GPADC         0xF2
+#define AXP288_ADC_TS_PIN_ON            0xF3
 enum axp288_adc_id {
        AXP288_ADC_TS,
@@ -121,6 +123,26 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
        return IIO_VAL_INT;
 }
+static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+                                unsigned long address)
+{
+        int ret;
+        /* channels other than GPADC do not need to switch TS pin */
+        if (address != AXP288_GP_ADC_H)
+                return 0;
+        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        if (ret)
+                return ret;
+        /* When switching to the GPADC pin give things some time to settle */
+        if (mode == AXP288_ADC_TS_PIN_GPADC)
+                usleep_range(6000, 10000);
+        return 0;
+}
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
                        struct iio_chan_spec const *chan,
                        int *val, int *val2, long mask)
@@ -131,7 +153,16 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
        mutex_lock(&indio_dev->mlock);
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                                        chan->address)) {
+                        dev_err(&indio_dev->dev, "GPADC mode\n");
+                        ret = -EINVAL;
+                        break;
+                }
                ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                                                chan->address))
+                        dev_err(&indio_dev->dev, "TS pin restore\n");
                break;
        default:
                ret = -EINVAL;
@@ -141,6 +172,15 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
        return ret;
 }
+static int axp288_adc_set_state(struct regmap *regmap)
+{
+        /* ADC should be always enabled for internal FG to function */
+        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+                return -EIO;
+        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+}
 static const struct iio_info axp288_adc_iio_info = {
        .read_raw = &axp288_adc_read_raw,
        .driver_module = THIS_MODULE,
@@ -169,7 +209,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
         * Set ADC to enabled state at all time, including system suspend.
         * otherwise internal fuel gauge functionality may be affected.
         */
-        ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        ret = axp288_adc_set_state(axp20x->regmap);
        if (ret) {
                dev_err(&pdev->dev, "unable to enable ADC device\n");
                return ret;
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index 81d4c39e414a..137f577d9432 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -256,6 +256,7 @@ static int sun4i_gpadc_read(struct iio_dev *indio_dev, int channel, int *val,
 err:
        pm_runtime_put_autosuspend(indio_dev->dev.parent);
+        disable_irq(irq);
        mutex_unlock(&info->mutex);
        return ret;
@@ -365,7 +366,6 @@ static irqreturn_t sun4i_gpadc_temp_data_irq_handler(int irq, void *dev_id)
                complete(&info->completion);
 out:
-        disable_irq_nosync(info->temp_data_irq);
        return IRQ_HANDLED;
 }
@@ -380,7 +380,6 @@ static irqreturn_t sun4i_gpadc_fifo_data_irq_handler(int irq, void *dev_id)
                complete(&info->completion);
 out:
-        disable_irq_nosync(info->fifo_data_irq);
        return IRQ_HANDLED;
 }
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 01fc76f7d660..c168e0db329a 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -77,7 +77,7 @@
 #define VF610_ADC_ADSTS_MASK            0x300
 #define VF610_ADC_ADLPC_EN              0x80
 #define VF610_ADC_ADHSC_EN              0x400
-#define VF610_ADC_REFSEL_VALT           0x100
+#define VF610_ADC_REFSEL_VALT           0x800
 #define VF610_ADC_REFSEL_VBG            0x1000
 #define VF610_ADC_ADTRG_HARD            0x2000
 #define VF610_ADC_AVGS_8                0x4000
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 79c8c7cd70d5..6e6a1ecc99dd 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -550,6 +550,31 @@ out:
 }
 EXPORT_SYMBOL(st_sensors_read_info_raw);
+static int st_sensors_init_interface_mode(struct iio_dev *indio_dev,
+                        const struct st_sensor_settings *sensor_settings)
+{
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+        struct device_node *np = sdata->dev->of_node;
+        struct st_sensors_platform_data *pdata;
+        pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data;
+        if (((np && of_property_read_bool(np, "spi-3wire")) ||
+             (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) {
+                int err;
+                err = sdata->tf->write_byte(&sdata->tb, sdata->dev,
+                                            sensor_settings->sim.addr,
+                                            sensor_settings->sim.value);
+                if (err < 0) {
+                        dev_err(&indio_dev->dev,
+                                "failed to init interface mode\n");
+                        return err;
+                }
+        }
+        return 0;
+}
 int st_sensors_check_device_support(struct iio_dev *indio_dev,
                        int num_sensors_list,
                        const struct st_sensor_settings *sensor_settings)
@@ -574,6 +599,10 @@ int st_sensors_check_device_support(struct iio_dev *indio_dev,
                return -ENODEV;
        }
+        err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]);
+        if (err < 0)
+                return err;
        if (sensor_settings[i].wai_addr) {
                err = sdata->tf->read_byte(&sdata->tb, sdata->dev,
                                           sensor_settings[i].wai_addr, &wai);
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index e7d4ea75e007..7599693f7fe9 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler(int irq, void *private)
        struct tsl2563_chip *chip = iio_priv(dev_info);
        iio_push_event(dev_info,
-                       IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+                       IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
                                            0,
                                            IIO_EV_TYPE_THRESH,
                                            IIO_EV_DIR_EITHER),
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index aa61ec15c139..f1bce05ffa13 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -456,7 +456,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
-                .multi_read_bit = true,
+                .multi_read_bit = false,
                .bootime = 2,
        },
 };
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
        }
        up_read(&lists_rwsem);
-        mutex_unlock(&device_mutex);
        ib_device_unregister_rdmacg(device);
        ib_device_unregister_sysfs(device);
+        mutex_unlock(&device_mutex);
        ib_cache_cleanup_one(device);
        ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index c551d2b275fd..739bd69ef1d4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1015,7 +1015,7 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
        cq->uobject       = &obj->uobject;
        cq->comp_handler  = ib_uverbs_comp_handler;
        cq->event_handler = ib_uverbs_cq_event_handler;
-        cq->cq_context    = &ev_file->ev_queue;
+        cq->cq_context    = ev_file ? &ev_file->ev_queue : NULL;
        atomic_set(&cq->usecnt, 0);
        obj->uobject.object = cq;
@@ -1522,6 +1522,7 @@ static int create_qp(struct ib_uverbs_file *file,
                qp->qp_type       = attr.qp_type;
                atomic_set(&qp->usecnt, 0);
                atomic_inc(&pd->usecnt);
+                qp->port = 0;
                if (attr.send_cq)
                        atomic_inc(&attr.send_cq->usecnt);
                if (attr.recv_cq)
@@ -1962,8 +1963,9 @@ static int modify_qp(struct ib_uverbs_file *file,
        attr->alt_timeout         = cmd->base.alt_timeout;
        attr->rate_limit          = cmd->rate_limit;
-        attr->ah_attr.type = rdma_ah_find_type(qp->device,
+        if (cmd->base.attr_mask & IB_QP_AV)
-                                               cmd->base.dest.port_num);
+                attr->ah_attr.type = rdma_ah_find_type(qp->device,
+                                                       cmd->base.dest.port_num);
        if (cmd->base.dest.is_global) {
                rdma_ah_set_grh(&attr->ah_attr, NULL,
                                cmd->base.dest.flow_label,
@@ -1981,8 +1983,9 @@ static int modify_qp(struct ib_uverbs_file *file,
        rdma_ah_set_port_num(&attr->ah_attr,
                             cmd->base.dest.port_num);
-        attr->alt_ah_attr.type = rdma_ah_find_type(qp->device,
+        if (cmd->base.attr_mask & IB_QP_ALT_PATH)
-                                                   cmd->base.dest.port_num);
+                attr->alt_ah_attr.type =
+                        rdma_ah_find_type(qp->device, cmd->base.dest.port_num);
        if (cmd->base.alt_dest.is_global) {
                rdma_ah_set_grh(&attr->alt_ah_attr, NULL,
                                cmd->base.alt_dest.flow_label,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index c023e2c81b8f..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1153,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                kref_get(&file->ref);
                mutex_unlock(&uverbs_dev->lists_mutex);
-                ib_uverbs_event_handler(&file->event_handler, &event);
                mutex_lock(&file->cleanup_mutex);
                ucontext = file->ucontext;
@@ -1170,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                         * for example due to freeing the resources
                         * (e.g mmput).
                         */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                        ib_dev->disassociate_ucontext(ucontext);
                        mutex_lock(&file->cleanup_mutex);
                        ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7f8fe443df46..b456e3ca1876 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -838,6 +838,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
        spin_lock_init(&qp->mr_lock);
        INIT_LIST_HEAD(&qp->rdma_mrs);
        INIT_LIST_HEAD(&qp->sig_mrs);
+        qp->port = 0;
        if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
                return ib_create_xrc_qp(qp, qp_init_attr);
@@ -1297,7 +1298,11 @@ int ib_modify_qp_with_udata(struct ib_qp *qp, struct ib_qp_attr *attr,
                if (ret)
                        return ret;
        }
-        return ib_security_modify_qp(qp, attr, attr_mask, udata);
+        ret = ib_security_modify_qp(qp, attr, attr_mask, udata);
+        if (!ret && (attr_mask & IB_QP_PORT))
+                qp->port = attr->port_num;
+        return ret;
 }
 EXPORT_SYMBOL(ib_modify_qp_with_udata);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
        rhp = php->rhp;
        if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                         use_dsgl))
                return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
        } else {
                u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                        return ERR_PTR(-EINVAL);
+                }
                memcpy(ah->av.mac, dmac, ETH_ALEN);
        }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
        u64 base = 0;
        u32 i, j;
        u32 k = 0;
-        u32 low;
        /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                get_64bit_val(buf, j, &temp);
                info[i].base = RS_64_1(temp, 32) * 512;
                if (info[i].base > base) {
                        base = info[i].base;
                        k = i;
                }
-                low = (u32)(temp);
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
-                if (low)
+                        info[i].cnt = 1;
-                        info[i].cnt = low;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
        }
        size = info[k].cnt * info[k].size + info[k].base;
        if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+        return temp;
+}
+/**
 * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
 * @buf: ptr to fpm query buffer
 * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                struct i40iw_hmc_info *hmc_info,
                                struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
        struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
        u16 max_pe_sds;
        obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
        hmc_fpm_misc->max_sds = max_pe_sds;
        hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
-        for (i = I40IW_HMC_IW_QP, j = 8;
+        get_64bit_val(buf, 8, &temp);
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                get_64bit_val(buf, j, &temp);
+        size = (u32)RS_64_1(temp, 32);
-                if (i == I40IW_HMC_IW_QP)
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
+        get_64bit_val(buf, 16, &temp);
-                obj_info[i].size = ((u64)1 << size);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-        }
+        size = (u32)RS_64_1(temp, 32);
-        for (i = I40IW_HMC_IW_MR, j = 48;
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
-                obj_info[i].max_cnt = (u32)temp;
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        }
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
        hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
        if (!hmc_fpm_misc->xf_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
        get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
        hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
        if (!hmc_fpm_misc->q1_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        return 0;
 }
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                hmc_info->sd_table.sd_entry = virt_mem.va;
        }
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
        return ret_code;
 }
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
        u8 fcn_id = vsi->fcn_id;
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                vsi->dev->fcn_id_array[fcn_id] = false;
        i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
        I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
        I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
        I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
        cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
        tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
        ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
        if (ret)
                return ret;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
        I40IW_ERR_INVALID_ALIGNMENT = -23,
        I40IW_ERR_FLUSHED_QUEUE = -24,
        I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
        I40IW_ERR_TIMEOUT = -27,
        I40IW_ERR_OPCODE_MISMATCH = -28,
        I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_rdma_write;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_send;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
        get_64bit_val(cqe, 0, &qword0);
        get_64bit_val(cqe, 16, &qword2);
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
        info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                         u8 *wqe_size)
 {
        if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        if (data_size <= 16)
                *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a7f2e60085c4..f7fcde1ff0aa 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1085,6 +1085,12 @@ static int mlx5_ib_modify_port(struct ib_device *ibdev, u8 port, int mask,
        bool is_ib = (mlx5_ib_port_link_layer(ibdev, port) ==
                      IB_LINK_LAYER_INFINIBAND);
+        /* CM layer calls ib_modify_port() regardless of the link layer. For
+         * Ethernet ports, qkey violation and Port capabilities are meaningless.
+         */
+        if (!is_ib)
+                return 0;
        if (MLX5_CAP_GEN(dev->mdev, ib_virt) && is_ib) {
                change_mask = props->clr_port_cap_mask | props->set_port_cap_mask;
                value = ~props->clr_port_cap_mask | props->set_port_cap_mask;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0889ff367c86..f58f8f5f3ebe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1238,6 +1238,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                        goto err_destroy_tis;
                sq->base.container_mibqp = qp;
+                sq->base.mqp.event = mlx5_ib_qp_event;
        }
        if (qp->rq.wqe_cnt) {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
        struct pvrdma_dev *dev = to_vdev(ibcq->device);
        struct pvrdma_cq *cq = to_vcq(ibcq);
        u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
        val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
+        spin_lock_irqsave(&cq->cq_lock, flags);
        pvrdma_write_uar_cq(dev, val);
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+        return has_data;
 }
 /**
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..714cf7f9b138 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1248,6 +1248,10 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN0100", 0 },
        { "ELAN0600", 0 },
        { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
        { "ELAN1000", 0 },
        { }
 };
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..20b5b21c1bba 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -380,8 +380,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                return 0;
        if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
-                button_info = 0;
+                button_info = 0x33;
        }
        psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index b97188acc4f1..2d80fa8a0634 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1519,6 +1519,13 @@ static int arm_smmu_add_device(struct device *dev)
        if (using_legacy_binding) {
                ret = arm_smmu_register_legacy_master(dev, &smmu);
+                /*
+                 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
+                 * will allocate/initialise a new one. Thus we need to update fwspec for
+                 * later use.
+                 */
+                fwspec = dev->iommu_fwspec;
                if (ret)
                        goto out_free;
        } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
        if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                             "atmel,at91sam9x5-rtc");
        if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                return;
        match = of_match_node(matches, root);
-        of_node_put(root);
        if (match) {
-                void (*fixup)(struct device_node *) = match->data;
+                void (*fixup)(void) = match->data;
-                fixup(root);
+                fixup();
        }
        of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                             const char *name, int nirqs,
                                             const struct of_device_id *matches);
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
        .xlate  = aic_irq_domain_xlate,
 };
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
        .xlate  = aic5_irq_domain_xlate,
 };
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
        ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
        ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
        if (data->can_wake) {
                /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                        *dev_id = args.args[0];
                        break;
                }
+                index++;
        } while (!ret);
        return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
        /* numa node id */
        u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
        u32     its_id;
 };
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
        return NUMA_NO_NODE;
 }
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                         const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                return -EINVAL;
        }
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
        node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
        if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
        acpi_table_parse_entries(ACPI_SIG_SRAT,
                        sizeof(struct acpi_table_srat),
                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                        gic_acpi_parse_srat_its, 0);
 }
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
        acpi_table_parse_srat_its();
        acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                              gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
                        if (static_key_true(&supports_deactivate))
                                gic_write_eoir(irqnr);
+                        else
+                                isb();
                        err = handle_domain_irq(gic_data.domain, irqnr, regs);
                        if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                            bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
        void __iomem *reg;
        int enabled;
        u64 val;
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
        if (cpu >= nr_cpu_ids)
                return -EINVAL;
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                if (likely(irqnr > 15 && irqnr < 1020)) {
                        if (static_key_true(&supports_deactivate))
                                writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                        handle_domain_irq(gic->domain, irqnr, regs);
                        continue;
                }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                goto out;
        cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                generic_handle_irq(cascade_irq);
+        }
 out:
        chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 #define FSM_TIMER_DEBUG 0
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
             struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
        fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                  fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
        for (i = 0; i < fncount; i++)
                if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                } else
                        fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                        fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
        void *arg;
 };
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
        l1fsm_s.event_count = L1_EVENT_COUNT;
        l1fsm_s.strEvent = strL1Event;
        l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
 }
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
        debug = deb;
        mISDN_register_Bprotocol(&X75SLP);
        l2fsm.state_count = L2_STATE_COUNT;
        l2fsm.event_count = L2_EVENT_COUNT;
        l2fsm.strEvent = strL2Event;
        l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
        return 0;
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 int TEIInit(u_int *deb)
 {
+        int res;
        debug = deb;
        teifsmu.state_count = TEI_STATE_COUNT;
        teifsmu.event_count = TEI_EVENT_COUNT;
        teifsmu.strEvent = strTeiEvent;
        teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
        teifsmn.state_count = TEI_STATE_COUNT;
        teifsmn.event_count = TEI_EVENT_COUNT;
        teifsmn.strEvent = strTeiEvent;
        teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
        deactfsm.state_count =  DEACT_STATE_COUNT;
        deactfsm.event_count = DEACT_EVENT_COUNT;
        deactfsm.strEvent = strDeactEvent;
        deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
        return 0;
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 void TEIFree(void)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c99634612fc4..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
        if (mddev->safemode == 1)
                mddev->safemode = 0;
        /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                spin_lock(&mddev->lock);
                if (mddev->in_sync) {
                        mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
        if (mddev_trylock(mddev)) {
                int spares = 0;
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
                if (mddev->ro) {
                        struct md_rdev *rdev;
                        if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
        bool need_split_bio;
        struct bio *split_bio;
-        unsigned int has_flush:1;      /* include flush request */
+        unsigned int has_flush:1;               /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
+        unsigned int has_fua:1;                 /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
        /*
         * io isn't sent yet, flush/fua request can only be submitted till it's
         * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
        struct r5l_io_unit *io_deferred;
        struct r5l_log *log = io->log;
        unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
        if (bio->bi_status)
                md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
        spin_lock_irqsave(&log->io_list_lock, flags);
        __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
        if (log->need_cache_flush && !list_empty(&io->stripe_list))
                r5l_move_to_end_ios(log);
        else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
        if (log->need_cache_flush)
                md_wakeup_thread(log->rdev->mddev->thread);
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                struct bio *bi;
                WARN_ON(bio_list_empty(&io->flush_barriers));
                while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                        bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                }
        }
+        /* decrease pending_stripe for flush payload */
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_flush_payload)
-        if (atomic_read(&io->pending_stripe) == 0)
+                if (atomic_dec_and_test(&io->pending_stripe))
-                __r5l_stripe_write_finished(io);
+                        __r5l_stripe_write_finished(io);
 }
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
        payload->size = cpu_to_le32(sizeof(__le64));
        payload->flush_stripes[0] = cpu_to_le64(sect);
        io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
        mutex_unlock(&log->io_mutex);
 }
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
 */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
+        struct r5conf *conf;
-        struct r5l_log *log = conf->log;
+        int err;
-        if (!log)
-                return -ENODEV;
        if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
            mode > R5C_JOURNAL_MODE_WRITE_BACK)
                return -EINVAL;
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
        if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                return -EINVAL;
+        }
        mddev_suspend(mddev);
        conf->log->r5c_journal_mode = mode;
        mddev_resume(mddev);
+        mddev_unlock(mddev);
        pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                 mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 99e644cda4d1..ebf69ff48ae2 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -72,7 +72,7 @@ struct atmel_smc_timing_xlate {
        { .name = nm, .converter = atmel_smc_cs_conf_set_pulse, .shift = pos}
 #define ATMEL_SMC_CYCLE_XLATE(nm, pos)  \
-        { .name = nm, .converter = atmel_smc_cs_conf_set_setup, .shift = pos}
+        { .name = nm, .converter = atmel_smc_cs_conf_set_cycle, .shift = pos}
 static void at91sam9_ebi_get_config(struct atmel_ebi_dev *ebid,
                                    struct atmel_ebi_dev_config *conf)
@@ -120,12 +120,14 @@ static int atmel_ebi_xslate_smc_timings(struct atmel_ebi_dev *ebid,
        if (!ret) {
                required = true;
                ncycles = DIV_ROUND_UP(val, clk_period_ns);
-                if (ncycles > ATMEL_SMC_MODE_TDF_MAX ||
+                if (ncycles > ATMEL_SMC_MODE_TDF_MAX) {
-                    ncycles < ATMEL_SMC_MODE_TDF_MIN) {
                        ret = -EINVAL;
                        goto out;
                }
+                if (ncycles < ATMEL_SMC_MODE_TDF_MIN)
+                        ncycles = ATMEL_SMC_MODE_TDF_MIN;
                smcconf->mode |= ATMEL_SMC_MODE_TDF(ncycles);
        }
@@ -263,7 +265,7 @@ static int atmel_ebi_xslate_smc_config(struct atmel_ebi_dev *ebid,
        }
        ret = atmel_ebi_xslate_smc_timings(ebid, np, &conf->smcconf);
-        if (ret)
+        if (ret < 0)
                return -EINVAL;
        if ((ret > 0 && !required) || (!ret && required)) {
diff --git a/drivers/mfd/atmel-smc.c b/drivers/mfd/atmel-smc.c
index 954cf0f66a31..20cc0ea470fa 100644
--- a/drivers/mfd/atmel-smc.c
+++ b/drivers/mfd/atmel-smc.c
@@ -206,7 +206,7 @@ EXPORT_SYMBOL_GPL(atmel_smc_cs_conf_set_pulse);
 *           parameter
 *
 * This function encodes the @ncycles value as described in the datasheet
- * (section "SMC Pulse Register"), and then stores the result in the
+ * (section "SMC Cycle Register"), and then stores the result in the
 * @conf->setup field at @shift position.
 *
 * Returns -EINVAL if @shift is invalid, -ERANGE if @ncycles does not fit in
diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c
index fbe0f245ce8e..fe1811523e4a 100644
--- a/drivers/mfd/da9062-core.c
+++ b/drivers/mfd/da9062-core.c
@@ -645,6 +645,9 @@ static const struct regmap_range da9062_aa_readable_ranges[] = {
                .range_min = DA9062AA_VLDO1_B,
                .range_max = DA9062AA_VLDO4_B,
        }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                .range_min = DA9062AA_INTERFACE,
                .range_max = DA9062AA_CONFIG_E,
        }, {
@@ -721,6 +724,9 @@ static const struct regmap_range da9062_aa_writeable_ranges[] = {
                .range_min = DA9062AA_VLDO1_B,
                .range_max = DA9062AA_VLDO4_B,
        }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                .range_min = DA9062AA_GP_ID_0,
                .range_max = DA9062AA_GP_ID_19,
        },
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 8621a198a2ce..bac33311f55a 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -216,6 +216,12 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
        /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+        /*
        * For not wake-able HW runtime pm framework
        * can't be used on pci device level.
        * Use domain runtime pm callbacks instead.
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index f811cd524468..e38a5f144373 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -138,6 +138,12 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
        /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+        /*
        * For not wake-able HW runtime pm framework
        * can't be used on pci device level.
        * Use domain runtime pm callbacks instead.
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index e5938c791330..f1bbfd389367 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2170,7 +2170,9 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
                 * from being accepted.
                 */
                card = md->queue.card;
+                spin_lock_irq(md->queue.queue->queue_lock);
                queue_flag_set(QUEUE_FLAG_BYPASS, md->queue.queue);
+                spin_unlock_irq(md->queue.queue->queue_lock);
                blk_set_queue_dying(md->queue.queue);
                mmc_cleanup_queue(&md->queue);
                if (md->disk->flags & GENHD_FL_UP) {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 4ffea14b7eb6..2bae69e39544 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1289,7 +1289,7 @@ out_err:
 static int mmc_select_hs400es(struct mmc_card *card)
 {
        struct mmc_host *host = card->host;
-        int err = 0;
+        int err = -EINVAL;
        u8 val;
        if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 04ff3c97a535..2ab4788d021f 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2086,7 +2086,7 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
        mmc->max_seg_size = mmc->max_req_size;
        mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
-                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
+                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
        mmc->caps |= mmc_pdata(host)->caps;
        if (mmc->caps & MMC_CAP_8_BIT_DATA)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index f336a9b85576..9ec8f033ac5f 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -113,6 +113,7 @@ static blk_status_t do_blktrans_request(struct mtd_blktrans_ops *tr,
                for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                        if (tr->writesect(dev, block, buf))
                                return BLK_STS_IOERR;
+                return BLK_STS_OK;
        default:
                return BLK_STS_IOERR;
        }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9bee6c1c70cc..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        new_slave->delay = 0;
        new_slave->link_failure_count = 0;
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                new_slave->link = BOND_LINK_DOWN;
        new_slave->last_rx = jiffies -
@@ -2140,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                        continue;
                case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
+                                if (net_ratelimit())
-                                            "failed to get link speed/duplex for %s\n",
+                                        netdev_warn(bond->dev,
-                                            slave->dev->name);
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                continue;
                        }
                        bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
        USING_SOFT_PARAMS  = (1 << 6),
        MASTER_PF          = (1 << 7),
        FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                    dev->name, adap->params.vpd.id, adap->name, buf);
 }
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
 /*
 * Free the following resources:
 * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
        pci_set_master(pdev);
        pci_save_state(pdev);
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        adapter->msg_enable = DFLT_MSG_ENABLE;
        memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        spin_lock_init(&adapter->stats_lock);
        spin_lock_init(&adapter->tid_release_lock);
        spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
        struct fw_iq_cmd c;
        struct sge *s = &adap->sge;
        struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
        /* Size needs to be multiple of 16, including status entry. */
        iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
                flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                             FW_IQ_CMD_FL0PADEN_F);
                if (cong >= 0)
                        c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
        USING_MSI          = (1UL << 1),
        USING_MSIX         = (1UL << 2),
        QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
         */
        adapter->name = pci_name(pdev);
        adapter->msg_enable = DFLT_MSG_ENABLE;
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        err = adap_init0(adapter);
        if (err)
                goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
        struct port_info *pi = netdev_priv(dev);
        struct fw_iq_cmd cmd, rpl;
        int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
        /*
         * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        cpu_to_be32(
                                FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                FW_IQ_CMD_FL0PADEN_F);
                /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 09b9bc17bce9..5fe5cdc51357 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -432,7 +432,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                /* Virtual PCI function needs to determine UAR page size from
                 * firmware. Only master PCI function can set the uar page size
                 */
-                if (enable_4k_uar)
+                if (enable_4k_uar || !dev->persist->num_vfs)
                        dev->uar_page_shift = DEFAULT_UAR_PAGE_SHIFT;
                else
                        dev->uar_page_shift = PAGE_SHIFT;
@@ -2277,7 +2277,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
-                if (enable_4k_uar) {
+                if (enable_4k_uar || !dev->persist->num_vfs) {
                        init_hca.log_uar_sz = ilog2(dev->caps.num_uars) +
                                                    PAGE_SHIFT - DEFAULT_UAR_PAGE_SHIFT;
                        init_hca.uar_page_sz = DEFAULT_UAR_PAGE_SHIFT - 12;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                return;
        }
-        if (link) {
+        if (link)
                netif_carrier_on(netdev);
-                rtnl_lock();
+        else
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
                netif_carrier_off(netdev);
-        }
        rcu_read_unlock();
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 4631ca8b8eb2..9f77ce038a4a 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -908,8 +908,7 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
        return NETDEV_TX_OK;
 err_unmap:
-        --f;
+        while (--f >= 0) {
-        while (f >= 0) {
                frag = &skb_shinfo(skb)->frags[f];
                dma_unmap_page(dp->dev, tx_ring->txbufs[wr_idx].dma_addr,
                               skb_frag_size(frag), DMA_TO_DEVICE);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
index 66ff15d08bad..0a66389c06c2 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
@@ -2311,7 +2311,7 @@ netxen_md_rdqueue(struct netxen_adapter *adapter,
                                 loop_cnt++) {
                NX_WR_DUMP_REG(select_addr, adapter->ahw.pci_base0, queue_id);
                read_addr = queueEntry->read_addr;
-                for (k = 0; k < read_cnt; k--) {
+                for (k = 0; k < read_cnt; k++) {
                        NX_RD_DUMP_REG(read_addr, adapter->ahw.pci_base0,
                                                        &read_value);
                        *data_buff++ = read_value;
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
        int rc;
        int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                              MAC_STATS_IN_PERIOD_MS, period);
        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
        rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        struct stmmac_priv *priv = netdev_priv(ndev);
        struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
        struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
        int addr, found;
        if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        else
                err = mdiobus_register(new_bus);
        if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                goto bus_register_fail;
        }
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                        irq_str = irq_num;
                        break;
                }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
+                phy_attached_info(phydev);
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
                found = 1;
        }
        if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                mdiobus_unregister(new_bus);
                mdiobus_free(new_bus);
                return -ENODEV;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 32ad87345f57..0a2c0a42283f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1879,6 +1879,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 err_detach:
        tun_detach_all(dev);
+        /* register_netdevice() already called tun_free_netdev() */
+        goto err_free_dev;
 err_free_flow:
        tun_flow_uninit(tun);
        security_tun_dev_free_security(tun->security);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
        brcmf_feat_firmware_capabilities(ifp);
        memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
-                                  &gscan_cfg, sizeof(gscan_cfg));
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
        brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
        if (drvr->bus_if->wowl_supported)
                brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9160",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9260",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9270",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 const struct iwl_cfg iwl9460_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 const struct iwl_cfg iwl9560_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
 * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
 *      command size (command version 4) that supports toggling ACK TX
 *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
 *
 * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
 */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
        IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
        IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
        NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
 * @fw_name_pre: Firmware filename prefix. The api version and extension
 *      (.ucode) will be added to filename before loading from disk. The
 *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
 *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
- *      step. Supported only in integrated solutions.
+ *      next step. Supported only in integrated solutions.
 * @ucode_api_max: Highest version of uCode API supported by driver.
 * @ucode_api_min: Lowest version of uCode API supported by driver.
 * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
        /* params specific to an individual device within a device family */
        const char *name;
        const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
        const char *fw_name_pre_rf_next_step;
        /* params not likely to change within a device family */
        const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
        const char *fw_pre_name;
        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
-                fw_pre_name = cfg->fw_name_pre_next_step;
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
        else if (drv->trans->cfg->integrated &&
                 CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                 cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                       int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
        int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
        const u8 *nvm_chan = cfg->ext_nvm ?
                             iwl_ext_nvm_channels : iwl_nvm_channels;
        struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        continue;
                }
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
                /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                    center_freq - prev_center_freq > 20) {
                        valid_rules++;
                        new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                rule->power_rule.max_eirp =
                        DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                rule->flags = reg_rule_flags;
-                                                          ch_flags, cfg);
                /* rely on auto-calculation to merge BW of contiguous chans */
                rule->flags |= NL80211_RRF_AUTO_BW;
                rule->freq_range.max_bandwidth_khz = 0;
-                prev_ch_flags = ch_flags;
                prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
                IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                              center_freq,
                              band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                              CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                              CHECK_AND_PRINT_I(160MHZ),
                              CHECK_AND_PRINT_I(INDOOR_ONLY),
                              CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                              ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                               !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
        }
        regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
                        entry = &wifi_pkg->package.elements[idx++];
                        if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
+                            (entry->integer.value > U8_MAX)) {
-                                return -EINVAL;
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
                        mvm->geo_profiles[i].values[j] = entry->integer.value;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index c7b1e58e3384..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2597,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
        spin_lock_bh(&mvm_sta->lock);
        for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                        ieee80211_free_txskb(mvm->hw, skb);
+                }
        }
        spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         * first index into rate scale table.
         */
        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                if (info->status.ampdu_ack_len == 0)
                        info->status.ampdu_len = 1;
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len);
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                continue;
                        rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                        rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success);
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
        baid_data = rcu_dereference(mvm->baid_map[baid]);
        if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
+                IWL_DEBUG_RX(mvm,
-                     "Received baid %d, but no data exists for this BAID\n",
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
-                     baid);
+                              baid, reorder);
                return false;
        }
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
        data = rcu_dereference(mvm->baid_map[baid]);
        if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                goto out;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index ab66b4394dfc..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                .add_modify = update ? 1 : 0,
                .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
        };
        int ret;
@@ -290,8 +291,8 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
                goto unlock;
        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+                                      sta->addr, ba_data->tid);
 unlock:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
        else
                udp_hdr(skb)->check = 0;
-        /* mac header len should include IV, size is in words */
+        /*
-        if (info->control.hw_key)
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                mh_len += info->control.hw_key->iv_len;
        mh_len /= 2;
        offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
        struct iwl_mvm_tid_data *tid_data;
        struct iwl_mvm_sta *mvmsta;
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
        if (iwl_mvm_has_new_tx_api(mvm)) {
                struct iwl_mvm_compressed_ba_notif *ba_res =
                        (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 9000 Series */
        {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index c49f1f8b2e57..37046ac2c441 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -336,7 +336,7 @@ static int nvme_get_stream_params(struct nvme_ctrl *ctrl,
        c.directive.opcode = nvme_admin_directive_recv;
        c.directive.nsid = cpu_to_le32(nsid);
-        c.directive.numd = cpu_to_le32(sizeof(*s));
+        c.directive.numd = cpu_to_le32((sizeof(*s) >> 2) - 1);
        c.directive.doper = NVME_DIR_RCV_ST_OP_PARAM;
        c.directive.dtype = NVME_DIR_STREAMS;
@@ -1509,7 +1509,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
        blk_queue_write_cache(q, vwc, vwc);
 }
-static void nvme_configure_apst(struct nvme_ctrl *ctrl)
+static int nvme_configure_apst(struct nvme_ctrl *ctrl)
 {
        /*
         * APST (Autonomous Power State Transition) lets us program a
@@ -1538,16 +1538,16 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
         * then don't do anything.
         */
        if (!ctrl->apsta)
-                return;
+                return 0;
        if (ctrl->npss > 31) {
                dev_warn(ctrl->device, "NPSS is invalid; not using APST\n");
-                return;
+                return 0;
        }
        table = kzalloc(sizeof(*table), GFP_KERNEL);
        if (!table)
-                return;
+                return 0;
        if (!ctrl->apst_enabled || ctrl->ps_max_latency_us == 0) {
                /* Turn off APST. */
@@ -1629,6 +1629,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                dev_err(ctrl->device, "failed to set APST feature (%d)\n", ret);
        kfree(table);
+        return ret;
 }
 static void nvme_set_latency_tolerance(struct device *dev, s32 val)
@@ -1835,13 +1836,16 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                 * In fabrics we need to verify the cntlid matches the
                 * admin connect
                 */
-                if (ctrl->cntlid != le16_to_cpu(id->cntlid))
+                if (ctrl->cntlid != le16_to_cpu(id->cntlid)) {
                        ret = -EINVAL;
+                        goto out_free;
+                }
                if (!ctrl->opts->discovery_nqn && !ctrl->kas) {
                        dev_err(ctrl->device,
                                "keep-alive support is mandatory for fabrics\n");
                        ret = -EINVAL;
+                        goto out_free;
                }
        } else {
                ctrl->cntlid = le16_to_cpu(id->cntlid);
@@ -1856,11 +1860,20 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
        else if (!ctrl->apst_enabled && prev_apst_enabled)
                dev_pm_qos_hide_latency_tolerance(ctrl->device);
-        nvme_configure_apst(ctrl);
+        ret = nvme_configure_apst(ctrl);
-        nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
+        ret = nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
        ctrl->identified = true;
+        return 0;
+out_free:
+        kfree(id);
        return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_init_identify);
@@ -2004,9 +2017,11 @@ static ssize_t wwid_show(struct device *dev, struct device_attribute *attr,
        if (memchr_inv(ns->eui, 0, sizeof(ns->eui)))
                return sprintf(buf, "eui.%8phN\n", ns->eui);
-        while (ctrl->serial[serial_len - 1] == ' ')
+        while (serial_len > 0 && (ctrl->serial[serial_len - 1] == ' ' ||
+                                  ctrl->serial[serial_len - 1] == '\0'))
                serial_len--;
-        while (ctrl->model[model_len - 1] == ' ')
+        while (model_len > 0 && (ctrl->model[model_len - 1] == ' ' ||
+                                 ctrl->model[model_len - 1] == '\0'))
                model_len--;
        return sprintf(buf, "nvme.%04x-%*phN-%*phN-%08x\n", ctrl->vid,
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                int i;
                for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                pr_warn("invalid parameter '%s'\n",
                                        opt_tokens[i].pattern);
                        }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index cd888a47d0fc..925467b31a33 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -801,6 +801,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                return;
        }
+        nvmeq->cqe_seen = 1;
        req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
        nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +831,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                consumed++;
        }
-        if (consumed) {
+        if (consumed)
                nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 static irqreturn_t nvme_irq(int irq, void *data)
@@ -1558,11 +1557,9 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
        if (dev->cmb) {
                iounmap(dev->cmb);
                dev->cmb = NULL;
-                if (dev->cmbsz) {
+                sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
-                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                             &dev_attr_cmb.attr, NULL);
-                                                     &dev_attr_cmb.attr, NULL);
+                dev->cmbsz = 0;
-                        dev->cmbsz = 0;
-                }
        }
 }
@@ -1953,16 +1950,14 @@ static int nvme_pci_enable(struct nvme_dev *dev)
        /*
         * CMBs can currently only exist on >=1.2 PCIe devices. We only
-         * populate sysfs if a CMB is implemented. Note that we add the
+         * populate sysfs if a CMB is implemented. Since nvme_dev_attrs_group
-         * CMB attribute to the nvme_ctrl kobj which removes the need to remove
+         * has no name we can pass NULL as final argument to
-         * it on exit. Since nvme_dev_attrs_group has no name we can pass
+         * sysfs_add_file_to_group.
-         * NULL as final argument to sysfs_add_file_to_group.
         */
        if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) {
                dev->cmb = nvme_map_cmb(dev);
+                if (dev->cmb) {
-                if (dev->cmbsz) {
                        if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                    &dev_attr_cmb.attr, NULL))
                                dev_warn(dev->ctrl.device,
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
        copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
        copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
        id->rab = 6;
        /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 31ca55dfcb1d..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -114,6 +114,11 @@ struct nvmet_fc_tgtport {
        struct kref                     ref;
 };
+struct nvmet_fc_defer_fcp_req {
+        struct list_head                req_list;
+        struct nvmefc_tgt_fcp_req       *fcp_req;
+};
 struct nvmet_fc_tgt_queue {
        bool                            ninetypercent;
        u16                             qid;
@@ -132,6 +137,8 @@ struct nvmet_fc_tgt_queue {
        struct nvmet_fc_tgt_assoc       *assoc;
        struct nvmet_fc_fcp_iod         *fod;           /* array of fcp_iods */
        struct list_head                fod_list;
+        struct list_head                pending_cmd_list;
+        struct list_head                avail_defer_list;
        struct workqueue_struct         *work_q;
        struct kref                     ref;
 } __aligned(sizeof(unsigned long long));
@@ -223,6 +230,8 @@ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+                                        struct nvmet_fc_fcp_iod *fod);
 /* *********************** FC-NVME DMA Handling **************************** */
@@ -385,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
        unsigned long flags;
        spin_lock_irqsave(&tgtport->lock, flags);
@@ -462,10 +471,10 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_fcp_iod *fod;
-        unsigned long flags;
+        lockdep_assert_held(&queue->qlock);
-        spin_lock_irqsave(&queue->qlock, flags);
        fod = list_first_entry_or_null(&queue->fod_list,
                                        struct nvmet_fc_fcp_iod, fcp_list);
        if (fod) {
@@ -477,17 +486,37 @@ nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
                 * will "inherit" that reference.
                 */
        }
-        spin_unlock_irqrestore(&queue->qlock, flags);
        return fod;
 }
 static void
+nvmet_fc_queue_fcp_req(struct nvmet_fc_tgtport *tgtport,
+                       struct nvmet_fc_tgt_queue *queue,
+                       struct nvmefc_tgt_fcp_req *fcpreq)
+{
+        struct nvmet_fc_fcp_iod *fod = fcpreq->nvmet_fc_private;
+        /*
+         * put all admin cmds on hw queue id 0. All io commands go to
+         * the respective hw queue based on a modulo basis
+         */
+        fcpreq->hwqid = queue->qid ?
+                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
+        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+        else
+                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+}
+static void
 nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
                        struct nvmet_fc_fcp_iod *fod)
 {
        struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
        struct nvmet_fc_tgtport *tgtport = fod->tgtport;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
        unsigned long flags;
        fc_dma_sync_single_for_cpu(tgtport->dev, fod->rspdma,
@@ -495,21 +524,56 @@ nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
        fcpreq->nvmet_fc_private = NULL;
-        spin_lock_irqsave(&queue->qlock, flags);
-        list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
        fod->active = false;
        fod->abort = false;
        fod->aborted = false;
        fod->writedataactive = false;
        fod->fcpreq = NULL;
+        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
+        spin_lock_irqsave(&queue->qlock, flags);
+        deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+        if (!deferfcp) {
+                list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                /* Release reference taken at queue lookup and fod allocation */
+                nvmet_fc_tgt_q_put(queue);
+                return;
+        }
+        /* Re-use the fod for the next pending cmd that was deferred */
+        list_del(&deferfcp->req_list);
+        fcpreq = deferfcp->fcp_req;
+        /* deferfcp can be reused for another IO at a later date */
+        list_add_tail(&deferfcp->req_list, &queue->avail_defer_list);
        spin_unlock_irqrestore(&queue->qlock, flags);
+        /* Save NVME CMD IO in fod */
+        memcpy(&fod->cmdiubuf, fcpreq->rspaddr, fcpreq->rsplen);
+        /* Setup new fcpreq to be processed */
+        fcpreq->rspaddr = NULL;
+        fcpreq->rsplen  = 0;
+        fcpreq->nvmet_fc_private = fod;
+        fod->fcpreq = fcpreq;
+        fod->active = true;
+        /* inform LLDD IO is now being processed */
+        tgtport->ops->defer_rcv(&tgtport->fc_target_port, fcpreq);
+        /* Submit deferred IO for processing */
+        nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
        /*
-         * release the reference taken at queue lookup and fod allocation
+         * Leave the queue lookup get reference taken when
+         * fod was originally allocated.
         */
-        nvmet_fc_tgt_q_put(queue);
-        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
 }
 static int
@@ -569,6 +633,8 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
        queue->port = assoc->tgtport->port;
        queue->cpu = nvmet_fc_queue_to_cpu(assoc->tgtport, qid);
        INIT_LIST_HEAD(&queue->fod_list);
+        INIT_LIST_HEAD(&queue->avail_defer_list);
+        INIT_LIST_HEAD(&queue->pending_cmd_list);
        atomic_set(&queue->connected, 0);
        atomic_set(&queue->sqtail, 0);
        atomic_set(&queue->rsn, 1);
@@ -638,6 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
        struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
        struct nvmet_fc_fcp_iod *fod = queue->fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
        unsigned long flags;
        int i, writedataactive;
        bool disconnect;
@@ -666,6 +733,36 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
                        }
                }
        }
+        /* Cleanup defer'ed IOs in queue */
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
+                list_del(&deferfcp->req_list);
+                kfree(deferfcp);
+        }
+        for (;;) {
+                deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+                if (!deferfcp)
+                        break;
+                list_del(&deferfcp->req_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                tgtport->ops->defer_rcv(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                tgtport->ops->fcp_abort(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                tgtport->ops->fcp_req_release(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                kfree(deferfcp);
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
        spin_unlock_irqrestore(&queue->qlock, flags);
        flush_workqueue(queue->work_q);
@@ -2172,11 +2269,38 @@ nvmet_fc_handle_fcp_rqst_work(struct work_struct *work)
 * Pass a FC-NVME FCP CMD IU received from the FC link to the nvmet-fc
 * layer for processing.
 *
- * The nvmet-fc layer will copy cmd payload to an internal structure for
+ * The nvmet_fc layer allocates a local job structure (struct
- * processing.  As such, upon completion of the routine, the LLDD may
+ * nvmet_fc_fcp_iod) from the queue for the io and copies the
- * immediately free/reuse the CMD IU buffer passed in the call.
+ * CMD IU buffer to the job structure. As such, on a successful
+ * completion (returns 0), the LLDD may immediately free/reuse
+ * the CMD IU buffer passed in the call.
 *
- * If this routine returns error, the lldd should abort the exchange.
+ * However, in some circumstances, due to the packetized nature of FC
+ * and the api of the FC LLDD which may issue a hw command to send the
+ * response, but the LLDD may not get the hw completion for that command
+ * and upcall the nvmet_fc layer before a new command may be
+ * asynchronously received - its possible for a command to be received
+ * before the LLDD and nvmet_fc have recycled the job structure. It gives
+ * the appearance of more commands received than fits in the sq.
+ * To alleviate this scenario, a temporary queue is maintained in the
+ * transport for pending LLDD requests waiting for a queue job structure.
+ * In these "overrun" cases, a temporary queue element is allocated
+ * the LLDD request and CMD iu buffer information remembered, and the
+ * routine returns a -EOVERFLOW status. Subsequently, when a queue job
+ * structure is freed, it is immediately reallocated for anything on the
+ * pending request list. The LLDDs defer_rcv() callback is called,
+ * informing the LLDD that it may reuse the CMD IU buffer, and the io
+ * is then started normally with the transport.
+ *
+ * The LLDD, when receiving an -EOVERFLOW completion status, is to treat
+ * the completion as successful but must not reuse the CMD IU buffer
+ * until the LLDD's defer_rcv() callback has been called for the
+ * corresponding struct nvmefc_tgt_fcp_req pointer.
+ *
+ * If there is any other condition in which an error occurs, the
+ * transport will return a non-zero status indicating the error.
+ * In all cases other than -EOVERFLOW, the transport has not accepted the
+ * request and the LLDD should abort the exchange.
 *
 * @target_port: pointer to the (registered) target port the FCP CMD IU
 *              was received on.
@@ -2194,6 +2318,8 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
        struct nvme_fc_cmd_iu *cmdiu = cmdiubuf;
        struct nvmet_fc_tgt_queue *queue;
        struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
+        unsigned long flags;
        /* validate iu, so the connection id can be used to find the queue */
        if ((cmdiubuf_len != sizeof(*cmdiu)) ||
@@ -2214,29 +2340,60 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
         * when the fod is freed.
         */
+        spin_lock_irqsave(&queue->qlock, flags);
        fod = nvmet_fc_alloc_fcp_iod(queue);
-        if (!fod) {
+        if (fod) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                fcpreq->nvmet_fc_private = fod;
+                fod->fcpreq = fcpreq;
+                memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+                nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+                return 0;
+        }
+        if (!tgtport->ops->defer_rcv) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
                /* release the queue lookup reference */
                nvmet_fc_tgt_q_put(queue);
                return -ENOENT;
        }
-        fcpreq->nvmet_fc_private = fod;
+        deferfcp = list_first_entry_or_null(&queue->avail_defer_list,
-        fod->fcpreq = fcpreq;
+                        struct nvmet_fc_defer_fcp_req, req_list);
-        /*
+        if (deferfcp) {
-         * put all admin cmds on hw queue id 0. All io commands go to
+                /* Just re-use one that was previously allocated */
-         * the respective hw queue based on a modulo basis
+                list_del(&deferfcp->req_list);
-         */
+        } else {
-        fcpreq->hwqid = queue->qid ?
+                spin_unlock_irqrestore(&queue->qlock, flags);
-                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
-        memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
-        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                /* Now we need to dynamically allocate one */
-                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+                deferfcp = kmalloc(sizeof(*deferfcp), GFP_KERNEL);
-        else
+                if (!deferfcp) {
-                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+                        /* release the queue lookup reference */
+                        nvmet_fc_tgt_q_put(queue);
+                        return -ENOMEM;
+                }
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
-        return 0;
+        /* For now, use rspaddr / rsplen to save payload information */
+        fcpreq->rspaddr = cmdiubuf;
+        fcpreq->rsplen  = cmdiubuf_len;
+        deferfcp->fcp_req = fcpreq;
+        /* defer processing till a fod becomes available */
+        list_add_tail(&deferfcp->req_list, &queue->pending_cmd_list);
+        /* NOTE: the queue lookup reference is still valid */
+        spin_unlock_irqrestore(&queue->qlock, flags);
+        return -EOVERFLOW;
 }
 EXPORT_SYMBOL_GPL(nvmet_fc_rcv_fcp_req);
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
        bool coherent;
        unsigned long offset;
        const struct iommu_ops *iommu;
+        u64 mask;
        /*
         * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         * Limit coherent and dma mask based on size and default mask
         * set by the driver.
         */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
+        dev->coherent_dma_mask &= mask;
-        *dev->dma_mask = min((*dev->dma_mask),
+        *dev->dma_mask &= mask;
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
        coherent = of_dma_is_coherent(np);
        dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
        dino_dev->hba.dev = dev;
        dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
        spin_lock_init(&dino_dev->dinosaur_pen);
        dino_dev->hba.iommu = ccio_get_iommu(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b4b7eab29400..fdf65a6c13f6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -514,7 +514,7 @@ EXPORT_SYMBOL(pci_find_resource);
 */
 struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
 {
-        struct pci_dev *bridge, *highest_pcie_bridge = NULL;
+        struct pci_dev *bridge, *highest_pcie_bridge = dev;
        bridge = pci_upstream_bridge(dev);
        while (bridge && pci_is_pcie(bridge)) {
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                         PCI_EXP_DEVCTL_EXT_TAG);
 }
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
 static void pci_configure_device(struct pci_dev *dev)
 {
        struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
        pci_configure_mps(dev);
        pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
        memset(&hpp, 0, sizeof(hpp));
        ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                              quirk_tw686x_class);
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
 * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
 * values for the Attribute as were supplied in the header of the
 * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 4fac49e55d47..4b43aa62fbc7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -1301,7 +1301,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
 static const struct regmap_config regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
-        .max_register = 0x12,
 };
 static int ds1307_probe(struct i2c_client *client,
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f4538d7a3016..d145e0d90227 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -47,6 +47,17 @@ config SCSI_NETLINK
        default n
        depends on NET
+config SCSI_MQ_DEFAULT
+        bool "SCSI: use blk-mq I/O path by default"
+        depends on SCSI
+        ---help---
+          This option enables the new blk-mq based I/O path for SCSI
+          devices by default.  With the option the scsi_mod.use_blk_mq
+          module/boot option defaults to Y, without it to N, but it can
+          still be overridden either way.
+          If unsure say N.
 config SCSI_PROC_FS
        bool "legacy /proc/scsi/ support"
        depends on SCSI && PROC_FS
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 4591113c49de..a1a2c71e1626 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -549,7 +549,9 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
        if ((le32_to_cpu(get_name_reply->status) == CT_OK)
         && (get_name_reply->data[0] != '\0')) {
                char *sp = get_name_reply->data;
-                sp[sizeof(((struct aac_get_name_resp *)NULL)->data)] = '\0';
+                int data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+                sp[data_size - 1] = '\0';
                while (*sp == ' ')
                        ++sp;
                if (*sp) {
@@ -579,12 +581,15 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
 static int aac_get_container_name(struct scsi_cmnd * scsicmd)
 {
        int status;
+        int data_size;
        struct aac_get_name *dinfo;
        struct fib * cmd_fibcontext;
        struct aac_dev * dev;
        dev = (struct aac_dev *)scsicmd->device->host->hostdata;
+        data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
        cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
        aac_fib_init(cmd_fibcontext);
@@ -593,7 +598,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd)
        dinfo->command = cpu_to_le32(VM_ContainerConfig);
        dinfo->type = cpu_to_le32(CT_READ_NAME);
        dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
-        dinfo->count = cpu_to_le32(sizeof(((struct aac_get_name_resp *)NULL)->data));
+        dinfo->count = cpu_to_le32(data_size - 1);
        status = aac_fib_send(ContainerCommand,
                  cmd_fibcontext,
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d31a9bc2ba69..ee2667e20e42 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2274,7 +2274,7 @@ struct aac_get_name_resp {
        __le32          parm3;
        __le32          parm4;
        __le32          parm5;
-        u8              data[16];
+        u8              data[17];
 };
 #define CT_CID_TO_32BITS_UID 165
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 2029ad225121..5be0086142ca 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -3845,8 +3845,10 @@ csio_hw_start(struct csio_hw *hw)
        if (csio_is_hw_ready(hw))
                return 0;
-        else
+        else if (csio_match_state(hw, csio_hws_uninit))
                return -EINVAL;
+        else
+                return -ENODEV;
 }
 int
diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index ea0c31086cc6..dcd074169aa9 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -969,10 +969,14 @@ static int csio_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        pci_set_drvdata(pdev, hw);
-        if (csio_hw_start(hw) != 0) {
+        rv = csio_hw_start(hw);
-                dev_err(&pdev->dev,
+        if (rv) {
-                        "Failed to start FW, continuing in debug mode.\n");
+                if (rv == -EINVAL) {
-                return 0;
+                        dev_err(&pdev->dev,
+                                "Failed to start FW, continuing in debug mode.\n");
+                        return 0;
+                }
+                goto err_lnode_exit;
        }
        sprintf(hw->fwrev_str, "%u.%u.%u.%u\n",
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index a69a9ac836f5..1d02cf9fe06c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1635,6 +1635,9 @@ static int init_act_open(struct cxgbi_sock *csk)
                goto rel_resource;
        }
+        if (!(n->nud_state & NUD_VALID))
+                neigh_event_send(n, NULL);
        csk->atid = cxgb4_alloc_atid(lldi->tids, csk);
        if (csk->atid < 0) {
                pr_err("%s, NO atid available.\n", ndev->name);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..da5bdbdcce52 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                return;
        }
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
        if (!ioa_cfg->scan_enabled) {
                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                return;
@@ -7211,9 +7221,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
        ENTER;
        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
-                scsi_unblock_requests(ioa_cfg->host);
+                schedule_work(&ioa_cfg->work_q);
-                spin_lock_irq(ioa_cfg->host->host_lock);
        }
        ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7296,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
        wake_up_all(&ioa_cfg->reset_wait_q);
-        spin_unlock(ioa_cfg->host->host_lock);
+        ioa_cfg->scsi_unblock = 1;
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
        schedule_work(&ioa_cfg->work_q);
        LEAVE;
        return IPR_RC_JOB_RETURN;
@@ -9249,8 +9252,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                spin_unlock(&ioa_cfg->hrrq[i]._lock);
        }
        wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                scsi_block_requests(ioa_cfg->host);
+        }
        ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
        ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9312,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                        wake_up_all(&ioa_cfg->reset_wait_q);
                        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
-                                scsi_unblock_requests(ioa_cfg->host);
+                                schedule_work(&ioa_cfg->work_q);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
                        }
                        return;
                } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
        u8 cfg_locked:1;
        u8 clear_isr:1;
        u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
        u8 revid;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4ed48ed38e79..7ee1a94c0b33 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -205,8 +205,10 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                atomic_read(&tgtp->xmt_ls_rsp_error));
                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Release %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
                                atomic_read(&tgtp->xmt_fcp_release),
                                atomic_read(&tgtp->rcv_fcp_cmd_drop));
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 5cc8b0f7d885..744f3f395b64 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -782,8 +782,11 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                atomic_read(&tgtp->xmt_ls_rsp_error));
                len += snprintf(buf + len, size - len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                atomic_read(&tgtp->rcv_fcp_cmd_drop));
                if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fbeec344c6cc..bbbd0f84160d 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -841,12 +841,31 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
+static void
+lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
+                     struct nvmefc_tgt_fcp_req *rsp)
+{
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct lpfc_nvmet_rcv_ctx *ctxp =
+                container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
+        struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
+        struct lpfc_hba *phba = ctxp->phba;
+        lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
+                         ctxp->oxid, ctxp->size, smp_processor_id());
+        tgtp = phba->targetport->private;
+        atomic_inc(&tgtp->rcv_fcp_cmd_defer);
+        lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
+}
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
        .targetport_delete = lpfc_nvmet_targetport_delete,
        .xmt_ls_rsp     = lpfc_nvmet_xmt_ls_rsp,
        .fcp_op         = lpfc_nvmet_xmt_fcp_op,
        .fcp_abort      = lpfc_nvmet_xmt_fcp_abort,
        .fcp_req_release = lpfc_nvmet_xmt_fcp_release,
+        .defer_rcv      = lpfc_nvmet_defer_rcv,
        .max_hw_queues  = 1,
        .max_sgl_segments = LPFC_NVMET_DEFAULT_SEGS,
@@ -1504,6 +1523,17 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                return;
        }
+        /* Processing of FCP command is deferred */
+        if (rc == -EOVERFLOW) {
+                lpfc_nvmeio_data(phba,
+                                 "NVMET RCV BUSY: xri x%x sz %d from %06x\n",
+                                 oxid, size, sid);
+                /* defer reposting rcv buffer till .defer_rcv callback */
+                ctxp->rqb_buffer = nvmebuf;
+                atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                return;
+        }
        atomic_inc(&tgtp->rcv_fcp_cmd_drop);
        lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index e675ef17be08..48a76788b003 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -49,6 +49,7 @@ struct lpfc_nvmet_tgtport {
        atomic_t rcv_fcp_cmd_in;
        atomic_t rcv_fcp_cmd_out;
        atomic_t rcv_fcp_cmd_drop;
+        atomic_t rcv_fcp_cmd_defer;
        atomic_t xmt_fcp_release;
        /* Stats counters - lpfc_nvmet_xmt_fcp_op */
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 316c3df0c3fd..71c4746341ea 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6228,8 +6228,8 @@ static int megasas_probe_one(struct pci_dev *pdev,
 fail_start_aen:
 fail_io_attach:
        megasas_mgmt_info.count--;
-        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
        megasas_mgmt_info.max_index--;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
        instance->instancet->disable_intr(instance);
        megasas_destroy_irqs(instance);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                length = req ?
                                    req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                length = rsp ?
                                    rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index b20da0d27ad7..3f82ea1b72dc 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -500,7 +500,6 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-        unsigned long flags;
        /*
         * Ensure that the complete FCP WRITE payload has been received.
@@ -508,17 +507,6 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
         */
        cmd->cmd_in_wq = 0;
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        cmd->data_work = 1;
-        if (cmd->aborted) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
        cmd->qpair->tgt_counters.qla_core_ret_ctio++;
        if (!cmd->write_data_transferred) {
                /*
@@ -765,31 +753,13 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
        qlt_xmit_tm_rsp(mcmd);
 }
-#define DATA_WORK_NOT_FREE(_cmd) (_cmd->data_work && !_cmd->data_work_free)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
-        unsigned long flags;
        if (qlt_abort_cmd(cmd))
                return;
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        if ((cmd->state == QLA_TGT_STATE_NEW)||
-            ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
-                DATA_WORK_NOT_FREE(cmd))) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                /*
-                 * cmd has not reached fw, Use this trigger to free it.
-                 */
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-        return;
 }
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3d38c6d463b8..1bf274e3b2b6 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -800,7 +800,11 @@ MODULE_LICENSE("GPL");
 module_param(scsi_logging_level, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(scsi_logging_level, "a bit mask of logging levels");
+#ifdef CONFIG_SCSI_MQ_DEFAULT
 bool scsi_use_blk_mq = true;
+#else
+bool scsi_use_blk_mq = false;
+#endif
 module_param_named(use_blk_mq, scsi_use_blk_mq, bool, S_IWUSR | S_IRUGO);
 static int __init init_scsi(void)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bea36adeee17..e2647f2d4430 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1277,6 +1277,9 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
        struct request *rq = SCpnt->request;
+        if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
+                sd_zbc_write_unlock_zone(SCpnt);
        if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
                __free_page(rq->special_vec.bv_page);
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 96855df9f49d..8aa54779aac1 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -294,6 +294,9 @@ int sd_zbc_write_lock_zone(struct scsi_cmnd *cmd)
            test_and_set_bit(zno, sdkp->zones_wlock))
                return BLKPREP_DEFER;
+        WARN_ON_ONCE(cmd->flags & SCMD_ZONE_WRITE_LOCK);
+        cmd->flags |= SCMD_ZONE_WRITE_LOCK;
        return BLKPREP_OK;
 }
@@ -302,9 +305,10 @@ void sd_zbc_write_unlock_zone(struct scsi_cmnd *cmd)
        struct request *rq = cmd->request;
        struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
-        if (sdkp->zones_wlock) {
+        if (sdkp->zones_wlock && cmd->flags & SCMD_ZONE_WRITE_LOCK) {
                unsigned int zno = sd_zbc_zone_no(sdkp, blk_rq_pos(rq));
                WARN_ON_ONCE(!test_bit(zno, sdkp->zones_wlock));
+                cmd->flags &= ~SCMD_ZONE_WRITE_LOCK;
                clear_bit_unlock(zno, sdkp->zones_wlock);
                smp_mb__after_atomic();
        }
@@ -335,9 +339,6 @@ void sd_zbc_complete(struct scsi_cmnd *cmd,
        case REQ_OP_WRITE_ZEROES:
        case REQ_OP_WRITE_SAME:
-                /* Unlock the zone */
-                sd_zbc_write_unlock_zone(cmd);
                if (result &&
                    sshdr->sense_key == ILLEGAL_REQUEST &&
                    sshdr->asc == 0x21)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
        ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                return ret;
        recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
        kref_init(&tpnt->kref);
        tpnt->disk = disk;
        disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
        /* SCSI tape doesn't register this gendisk via add_disk().  Manually
         * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                goto out_put_disk;
+        disk->queue = SDp->request_queue;
        tpnt->driver = &st_template;
        tpnt->device = SDp;
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
        domain->dev = &pdev->dev;
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
        domain->regulator = devm_regulator_get_optional(domain->dev, "power");
        if (IS_ERR(domain->regulator)) {
                if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                        return PTR_ERR(domain->regulator);
                }
        } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                      domain->voltage, domain->voltage);
        }
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
        ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                           &domain->genpd);
        if (ret) {
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 279e7c5551dd..39225de9d7f1 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -745,6 +745,9 @@ void *knav_pool_create(const char *name,
        bool slot_found;
        int ret;
+        if (!kdev)
+                return ERR_PTR(-EPROBE_DEFER);
        if (!kdev->dev)
                return ERR_PTR(-ENODEV);
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
        ti_sci_pd->dev = dev;
+        ti_sci_pd->pd.name = "ti_sci_pd";
        ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
        ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ca11be21f64b..34ca7823255d 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
                        continue;
                }
+                set_current_state(TASK_RUNNING);
                wp = async->buf_write_ptr;
                n1 = min(n, async->prealloc_bufsz - wp);
                n2 = n - n1;
@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                        }
                        continue;
                }
+                set_current_state(TASK_RUNNING);
                rp = async->buf_read_ptr;
                n1 = min(n, async->prealloc_bufsz - rp);
                n2 = n - n1;
diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
index a6a8393d6664..3e00df74b18c 100644
--- a/drivers/staging/iio/resolver/ad2s1210.c
+++ b/drivers/staging/iio/resolver/ad2s1210.c
@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev,
                             long m)
 {
        struct ad2s1210_state *st = iio_priv(indio_dev);
-        bool negative;
+        u16 negative;
        int ret = 0;
        u16 pos;
        s16 vel;
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index e583dd8a418b..d4fa41be80f9 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -1510,11 +1510,13 @@ cxgbit_pass_open_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        if (!cnp) {
                pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
        }
        cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
        cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void
@@ -1530,11 +1532,13 @@ cxgbit_close_listsrv_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        if (!cnp) {
                pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
        }
        cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
        cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void
@@ -1819,12 +1823,16 @@ static void cxgbit_set_tcb_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        struct tid_info *t = lldi->tids;
        csk = lookup_tid(t, tid);
-        if (unlikely(!csk))
+        if (unlikely(!csk)) {
                pr_err("can't find connection for tid %u.\n", tid);
-        else
+                goto rel_skb;
+        } else {
                cxgbit_wake_up(&csk->com.wr_wait, __func__, rpl->status);
+        }
        cxgbit_put_csk(csk);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void cxgbit_rx_data(struct cxgbit_device *cdev, struct sk_buff *skb)
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index dda13f1af38e..514986b57c2d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -827,7 +827,7 @@ cxgbit_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
 static void
 cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
-                      unsigned int nents)
+                      unsigned int nents, u32 skip)
 {
        struct skb_seq_state st;
        const u8 *buf;
@@ -846,7 +846,7 @@ cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
                }
                consumed += sg_pcopy_from_buffer(sg, nents, (void *)buf,
-                                                 buf_len, consumed);
+                                                 buf_len, skip + consumed);
        }
 }
@@ -912,7 +912,7 @@ cxgbit_handle_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
                struct scatterlist *sg = &cmd->se_cmd.t_data_sg[0];
                u32 sg_nents = max(1UL, DIV_ROUND_UP(pdu_cb->dlen, PAGE_SIZE));
-                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents, 0);
        }
        cmd->write_data_done += pdu_cb->dlen;
@@ -1069,11 +1069,13 @@ static int cxgbit_handle_iscsi_dataout(struct cxgbit_sock *csk)
                  cmd->se_cmd.data_length);
        if (!(pdu_cb->flags & PDUCBF_RX_DATA_DDPD)) {
+                u32 skip = data_offset % PAGE_SIZE;
                sg_off = data_offset / PAGE_SIZE;
                sg_start = &cmd->se_cmd.t_data_sg[sg_off];
-                sg_nents = max(1UL, DIV_ROUND_UP(data_len, PAGE_SIZE));
+                sg_nents = max(1UL, DIV_ROUND_UP(skip + data_len, PAGE_SIZE));
-                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents, skip);
        }
 check_payload:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 74e4975dd1b1..5001261f5d69 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
                return 0;
        }
        np->np_thread_state = ISCSI_NP_THREAD_RESET;
+        atomic_inc(&np->np_reset_count);
        if (np->np_thread) {
                spin_unlock_bh(&np->np_thread_lock);
@@ -2167,6 +2168,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
        cmd->data_direction     = DMA_NONE;
+        kfree(cmd->text_in_ptr);
        cmd->text_in_ptr        = NULL;
        return 0;
@@ -3487,9 +3489,9 @@ iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                return text_length;
        if (completed) {
-                hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+                hdr->flags = ISCSI_FLAG_CMD_FINAL;
        } else {
-                hdr->flags |= ISCSI_FLAG_TEXT_CONTINUE;
+                hdr->flags = ISCSI_FLAG_TEXT_CONTINUE;
                cmd->read_data_done += text_length;
                if (cmd->targ_xfer_tag == 0xFFFFFFFF)
                        cmd->targ_xfer_tag = session_get_next_ttt(conn->sess);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index e9bdc8b86e7d..dc13afbd4c88 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1243,9 +1243,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
        flush_signals(current);
        spin_lock_bh(&np->np_thread_lock);
-        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+        if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
                np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+                spin_unlock_bh(&np->np_thread_lock);
                complete(&np->np_restart_comp);
+                return 1;
        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
                spin_unlock_bh(&np->np_thread_lock);
                goto exit;
@@ -1278,7 +1280,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                goto exit;
        } else if (rc < 0) {
                spin_lock_bh(&np->np_thread_lock);
-                if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+                if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+                        np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                        spin_unlock_bh(&np->np_thread_lock);
                        complete(&np->np_restart_comp);
                        iscsit_put_transport(conn->conn_transport);
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 36913734c6bc..02e8a5d86658 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl)
        mutex_lock(&tpg->acl_node_mutex);
        if (acl->dynamic_node_acl)
                acl->dynamic_node_acl = 0;
-        list_del(&acl->acl_list);
+        list_del_init(&acl->acl_list);
        mutex_unlock(&tpg->acl_node_mutex);
        target_shutdown_sessions(acl);
@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
         * in transport_deregister_session().
         */
        list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
-                list_del(&nacl->acl_list);
+                list_del_init(&nacl->acl_list);
                core_tpg_wait_for_nacl_pr_ref(nacl);
                core_free_device_list_for_node(nacl, se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 97fed9a298bd..836d552b0385 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -466,7 +466,7 @@ static void target_complete_nacl(struct kref *kref)
        }
        mutex_lock(&se_tpg->acl_node_mutex);
-        list_del(&nacl->acl_list);
+        list_del_init(&nacl->acl_list);
        mutex_unlock(&se_tpg->acl_node_mutex);
        core_tpg_wait_for_nacl_pr_ref(nacl);
@@ -538,7 +538,7 @@ void transport_free_session(struct se_session *se_sess)
                        spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
                        if (se_nacl->dynamic_stop)
-                                list_del(&se_nacl->acl_list);
+                                list_del_init(&se_nacl->acl_list);
                }
                mutex_unlock(&se_tpg->acl_node_mutex);
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 80ee130f8253..942d094269fb 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -563,8 +563,6 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                        block_remaining);
                        to_offset = get_block_offset_user(udev, dbi,
                                        block_remaining);
-                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        to += offset;
                        if (*iov_cnt != 0 &&
                            to_offset == iov_tail(*iov)) {
@@ -575,8 +573,10 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                (*iov)->iov_len = copy_bytes;
                        }
                        if (copy_data) {
-                                memcpy(to, from + sg->length - sg_remaining,
+                                offset = DATA_BLOCK_SIZE - block_remaining;
-                                        copy_bytes);
+                                memcpy(to + offset,
+                                       from + sg->length - sg_remaining,
+                                       copy_bytes);
                                tcmu_flush_dcache_range(to, copy_bytes);
                        }
                        sg_remaining -= copy_bytes;
@@ -637,9 +637,8 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                        copy_bytes = min_t(size_t, sg_remaining,
                                        block_remaining);
                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        from += offset;
                        tcmu_flush_dcache_range(from, copy_bytes);
-                        memcpy(to + sg->length - sg_remaining, from,
+                        memcpy(to + sg->length - sg_remaining, from + offset,
                                        copy_bytes);
                        sg_remaining -= copy_bytes;
@@ -1433,6 +1432,8 @@ static int tcmu_update_uio_info(struct tcmu_dev *udev)
        if (udev->dev_config[0])
                snprintf(str + used, size - used, "/%s", udev->dev_config);
+        /* If the old string exists, free it */
+        kfree(info->name);
        info->name = str;
        return 0;
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 308b6e17c88a..fe2f00ceafc5 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -333,6 +333,15 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
        int res;
        enum tb_port_type type;
+        /*
+         * Some DROMs list more ports than the controller actually has
+         * so we skip those but allow the parser to continue.
+         */
+        if (header->index > sw->config.max_port_number) {
+                dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n");
+                return 0;
+        }
        port = &sw->ports[header->index];
        port->disabled = header->port_disabled;
        if (port->disabled)
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..a6d5164c33a9 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -69,13 +69,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
 #ifdef CONFIG_UNIX98_PTYS
                if (tty->driver == ptm_driver) {
                        mutex_lock(&devpts_mutex);
-                        if (tty->link->driver_data) {
+                        if (tty->link->driver_data)
-                                struct path *path = tty->link->driver_data;
+                                devpts_pty_kill(tty->link->driver_data);
-                                devpts_pty_kill(path->dentry);
-                                path_put(path);
-                                kfree(path);
-                        }
                        mutex_unlock(&devpts_mutex);
                }
 #endif
@@ -607,25 +602,24 @@ static inline void legacy_pty_init(void) { }
 static struct cdev ptmx_cdev;
 /**
- *      pty_open_peer - open the peer of a pty
+ *      ptm_open_peer - open the peer of a pty
- *      @tty: the peer of the pty being opened
+ *      @master: the open struct file of the ptmx device node
+ *      @tty: the master of the pty being opened
+ *      @flags: the flags for open
 *
- *      Open the cached dentry in tty->link, providing a safe way for userspace
+ *      Provide a race free way for userspace to open the slave end of a pty
- *      to get the slave end of a pty (where they have the master fd and cannot
+ *      (where they have the master fd and cannot access or trust the mount
- *      access or trust the mount namespace /dev/pts was mounted inside).
+ *      namespace /dev/pts was mounted inside).
 */
-static struct file *pty_open_peer(struct tty_struct *tty, int flags)
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
-{
-        if (tty->driver->subtype != PTY_TYPE_MASTER)
-                return ERR_PTR(-EIO);
-        return dentry_open(tty->link->driver_data, flags, current_cred());
-}
-static int pty_get_peer(struct tty_struct *tty, int flags)
 {
        int fd = -1;
-        struct file *filp = NULL;
+        struct file *filp;
        int retval = -EINVAL;
+        struct path path;
+        if (tty->driver != ptm_driver)
+                return -EIO;
        fd = get_unused_fd_flags(0);
        if (fd < 0) {
@@ -633,7 +627,16 @@ static int pty_get_peer(struct tty_struct *tty, int flags)
                goto err;
        }
-        filp = pty_open_peer(tty, flags);
+        /* Compute the slave's path */
+        path.mnt = devpts_mntget(master, tty->driver_data);
+        if (IS_ERR(path.mnt)) {
+                retval = PTR_ERR(path.mnt);
+                goto err_put;
+        }
+        path.dentry = tty->link->driver_data;
+        filp = dentry_open(&path, flags, current_cred());
+        mntput(path.mnt);
        if (IS_ERR(filp)) {
                retval = PTR_ERR(filp);
                goto err_put;
@@ -662,8 +665,6 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
                return pty_get_pktmode(tty, (int __user *)arg);
        case TIOCGPTN: /* Get PT Number */
                return put_user(tty->index, (unsigned int __user *)arg);
-        case TIOCGPTPEER: /* Open the other end */
-                return pty_get_peer(tty, (int) arg);
        case TIOCSIG:    /* Send signal to other side of pty */
                return pty_signal(tty, (int) arg);
        }
@@ -791,7 +792,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 {
        struct pts_fs_info *fsi;
        struct tty_struct *tty;
-        struct path *pts_path;
        struct dentry *dentry;
        int retval;
        int index;
@@ -845,26 +845,16 @@ static int ptmx_open(struct inode *inode, struct file *filp)
                retval = PTR_ERR(dentry);
                goto err_release;
        }
-        /* We need to cache a fake path for TIOCGPTPEER. */
+        tty->link->driver_data = dentry;
-        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
-        if (!pts_path)
-                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
-        pts_path->dentry = dentry;
-        path_get(pts_path);
-        tty->link->driver_data = pts_path;
        retval = ptm_driver->ops->open(tty, filp);
        if (retval)
-                goto err_path_put;
+                goto err_release;
        tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
        tty_unlock(tty);
        return 0;
-err_path_put:
-        path_put(pts_path);
-        kfree(pts_path);
 err_release:
        tty_unlock(tty);
        // This will also put-ref the fsi
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b5def356af63..1aab3010fbfa 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1043,13 +1043,24 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                if (up->dl_write)
                        uart->dl_write = up->dl_write;
-                if (serial8250_isa_config != NULL)
+                if (uart->port.type != PORT_8250_CIR) {
-                        serial8250_isa_config(0, &uart->port,
+                        if (serial8250_isa_config != NULL)
-                                        &uart->capabilities);
+                                serial8250_isa_config(0, &uart->port,
+                                                &uart->capabilities);
+                        ret = uart_add_one_port(&serial8250_reg,
+                                                &uart->port);
+                        if (ret == 0)
+                                ret = uart->port.line;
+                } else {
+                        dev_info(uart->port.dev,
+                                "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+                                uart->port.iobase,
+                                (unsigned long long)uart->port.mapbase,
+                                uart->port.irq);
-                ret = uart_add_one_port(&serial8250_reg, &uart->port);
+                        ret = 0;
-                if (ret == 0)
+                }
-                        ret = uart->port.line;
        }
        mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8a857bb34fbb..1888d168a41c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -142,15 +142,7 @@ static struct vendor_data vendor_sbsa = {
        .fixed_options          = true,
 };
-/*
+#ifdef CONFIG_ACPI_SPCR_TABLE
- * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
- * occasionally getting stuck as 1. To avoid the potential for a hang, check
- * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
- * implementations, so only do so if an affected platform is detected in
- * parse_spcr().
- */
-static bool qdf2400_e44_present = false;
 static struct vendor_data vendor_qdt_qdf2400_e44 = {
        .reg_offset             = pl011_std_offsets,
        .fr_busy                = UART011_FR_TXFE,
@@ -165,6 +157,7 @@ static struct vendor_data vendor_qdt_qdf2400_e44 = {
        .always_enabled         = true,
        .fixed_options          = true,
 };
+#endif
 static u16 pl011_st_offsets[REG_ARRAY_SIZE] = {
        [REG_DR] = UART01x_DR,
@@ -2375,12 +2368,14 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
        resource_size_t addr;
        int i;
-        if (strcmp(name, "qdf2400_e44") == 0) {
+        /*
-                pr_info_once("UART: Working around QDF2400 SoC erratum 44");
+         * Systems affected by the Qualcomm Technologies QDF2400 E44 erratum
-                qdf2400_e44_present = true;
+         * have a distinct console name, so make sure we check for that.
-        } else if (strcmp(name, "pl011") != 0) {
+         * The actual implementation of the erratum occurs in the probe
+         * function.
+         */
+        if ((strcmp(name, "qdf2400_e44") != 0) && (strcmp(name, "pl011") != 0))
                return -ENODEV;
-        }
        if (uart_parse_earlycon(options, &iotype, &addr, &options))
                return -ENODEV;
@@ -2734,11 +2729,17 @@ static int sbsa_uart_probe(struct platform_device *pdev)
        }
        uap->port.irq   = ret;
-        uap->reg_offset = vendor_sbsa.reg_offset;
+#ifdef CONFIG_ACPI_SPCR_TABLE
-        uap->vendor     = qdf2400_e44_present ?
+        if (qdf2400_e44_present) {
-                                        &vendor_qdt_qdf2400_e44 : &vendor_sbsa;
+                dev_info(&pdev->dev, "working around QDF2400 SoC erratum 44\n");
+                uap->vendor = &vendor_qdt_qdf2400_e44;
+        } else
+#endif
+                uap->vendor = &vendor_sbsa;
+        uap->reg_offset = uap->vendor->reg_offset;
        uap->fifosize   = 32;
-        uap->port.iotype = vendor_sbsa.access_32b ? UPIO_MEM32 : UPIO_MEM;
+        uap->port.iotype = uap->vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
        uap->port.ops   = &sbsa_uart_pops;
        uap->fixed_baud = baudrate;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 974b13d24401..10c4038c0e8d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2518,6 +2518,9 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case TIOCSSERIAL:
                tty_warn_deprecated_flags(p);
                break;
+        case TIOCGPTPEER:
+                /* Special because the struct file is needed */
+                return ptm_open_peer(file, tty, (int)arg);
        default:
                retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
                if (retval != -ENOIOCTLCMD)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index ab1bb3b538ac..7f277b092b5b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1888,7 +1888,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev,
        /* No more submits can occur */
        spin_lock_irq(&hcd_urb_list_lock);
 rescan:
-        list_for_each_entry (urb, &ep->urb_list, urb_list) {
+        list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
                int     is_in;
                if (urb->unlinked)
@@ -2485,6 +2485,8 @@ void usb_hc_died (struct usb_hcd *hcd)
        }
        if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
                hcd = hcd->shared_hcd;
+                clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+                set_bit(HCD_FLAG_DEAD, &hcd->flags);
                if (hcd->rh_registered) {
                        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 6e6797d145dd..822f8c50e423 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4725,7 +4725,8 @@ hub_power_remaining(struct usb_hub *hub)
 static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                u16 portchange)
 {
-        int status, i;
+        int status = -ENODEV;
+        int i;
        unsigned unit_load;
        struct usb_device *hdev = hub->hdev;
        struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4929,9 +4930,10 @@ loop:
 done:
        hub_port_disable(hub, port1, 1);
-        if (hcd->driver->relinquish_port && !hub->hdev->parent)
+        if (hcd->driver->relinquish_port && !hub->hdev->parent) {
-                hcd->driver->relinquish_port(hcd, port1);
+                if (status != -ENOTCONN && status != -ENODEV)
+                        hcd->driver->relinquish_port(hcd, port1);
+        }
 }
 /* Handle physical or logical connection change events.
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 3116edfcdc18..574da2b4529c 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -150,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* appletouch */
        { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+        { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
        /* Avision AV600U */
        { USB_DEVICE(0x0638, 0x0a13), .driver_info =
          USB_QUIRK_STRING_FETCH_255 },
@@ -249,6 +252,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
        { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
        { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
        { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Logitech Optical Mouse M90/M100 */
        { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6b299c7b7656..f064f1549333 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -896,9 +896,40 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                if (!node) {
                        trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS_FIRST;
+                        /*
+                         * USB Specification 2.0 Section 5.9.2 states that: "If
+                         * there is only a single transaction in the microframe,
+                         * only a DATA0 data packet PID is used.  If there are
+                         * two transactions per microframe, DATA1 is used for
+                         * the first transaction data packet and DATA0 is used
+                         * for the second transaction data packet.  If there are
+                         * three transactions per microframe, DATA2 is used for
+                         * the first transaction data packet, DATA1 is used for
+                         * the second, and DATA0 is used for the third."
+                         *
+                         * IOW, we should satisfy the following cases:
+                         *
+                         * 1) length <= maxpacket
+                         *      - DATA0
+                         *
+                         * 2) maxpacket < length <= (2 * maxpacket)
+                         *      - DATA1, DATA0
+                         *
+                         * 3) (2 * maxpacket) < length <= (3 * maxpacket)
+                         *      - DATA2, DATA1, DATA0
+                         */
                        if (speed == USB_SPEED_HIGH) {
                                struct usb_ep *ep = &dep->endpoint;
-                                trb->size |= DWC3_TRB_SIZE_PCM1(ep->mult - 1);
+                                unsigned int mult = ep->mult - 1;
+                                unsigned int maxp = usb_endpoint_maxp(ep->desc);
+                                if (length <= (2 * maxp))
+                                        mult--;
+                                if (length <= maxp)
+                                        mult--;
+                                trb->size |= DWC3_TRB_SIZE_PCM1(mult);
                        }
                } else {
                        trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 62dc9c7798e7..e1de8fe599a3 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -838,21 +838,32 @@ static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
        return usb3_req;
 }
-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
-                              struct renesas_usb3_request *usb3_req, int status)
+                                struct renesas_usb3_request *usb3_req,
+                                int status)
 {
        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
-        unsigned long flags;
        dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
                usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
                status);
        usb3_req->req.status = status;
-        spin_lock_irqsave(&usb3->lock, flags);
        usb3_ep->started = false;
        list_del_init(&usb3_req->queue);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+        spin_unlock(&usb3->lock);
        usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
+        spin_lock(&usb3->lock);
+}
+static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                              struct renesas_usb3_request *usb3_req, int status)
+{
+        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+        unsigned long flags;
+        spin_lock_irqsave(&usb3->lock, flags);
+        __usb3_request_done(usb3_ep, usb3_req, status);
+        spin_unlock_irqrestore(&usb3->lock, flags);
 }
 static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 858fefd67ebe..c8f38649f749 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -98,6 +98,7 @@ enum amd_chipset_gen {
        AMD_CHIPSET_HUDSON2,
        AMD_CHIPSET_BOLTON,
        AMD_CHIPSET_YANGTZE,
+        AMD_CHIPSET_TAISHAN,
        AMD_CHIPSET_UNKNOWN,
 };
@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
                        pinfo->sb_type.gen = AMD_CHIPSET_SB700;
                else if (rev >= 0x40 && rev <= 0x4f)
                        pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+        }
+        pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                          0x145c, NULL);
+        if (pinfo->smbus_dev) {
+                pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
        } else {
                pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
                                PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
 {
        /* Make sure amd chipset type has already been initialized */
        usb_amd_find_chipset_info();
-        if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
+        if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
-                return 0;
+            amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
+                dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
-        dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+                return 1;
-        return 1;
+        }
+        return 0;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 76decb8011eb..3344ffd5bb13 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
                                "Could not flush host TX%d fifo: csr: %04x\n",
                                ep->epnum, csr))
                        return;
+                mdelay(1);
        }
 }
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8fb86a5f458e..3d0dd2f97415 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -197,6 +197,7 @@ struct msm_otg {
        struct regulator *v3p3;
        struct regulator *v1p8;
        struct regulator *vddcx;
+        struct regulator_bulk_data supplies[3];
        struct reset_control *phy_rst;
        struct reset_control *link_rst;
@@ -1731,7 +1732,6 @@ static int msm_otg_reboot_notify(struct notifier_block *this,
 static int msm_otg_probe(struct platform_device *pdev)
 {
-        struct regulator_bulk_data regs[3];
        int ret = 0;
        struct device_node *np = pdev->dev.of_node;
        struct msm_otg_platform_data *pdata;
@@ -1817,17 +1817,18 @@ static int msm_otg_probe(struct platform_device *pdev)
                return motg->irq;
        }
-        regs[0].supply = "vddcx";
+        motg->supplies[0].supply = "vddcx";
-        regs[1].supply = "v3p3";
+        motg->supplies[1].supply = "v3p3";
-        regs[2].supply = "v1p8";
+        motg->supplies[2].supply = "v1p8";
-        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);
+        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(motg->supplies),
+                                      motg->supplies);
        if (ret)
                return ret;
-        motg->vddcx = regs[0].consumer;
+        motg->vddcx = motg->supplies[0].consumer;
-        motg->v3p3  = regs[1].consumer;
+        motg->v3p3  = motg->supplies[1].consumer;
-        motg->v1p8  = regs[2].consumer;
+        motg->v1p8  = motg->supplies[2].consumer;
        clk_set_rate(motg->clk, 60000000);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 93fba9033b00..2c8161bcf5b5 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -639,14 +639,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
        struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
        struct usbhs_pipe *pipe;
        unsigned long flags;
-        int ret = 0;
        spin_lock_irqsave(&uep->lock, flags);
        pipe = usbhsg_uep_to_pipe(uep);
-        if (!pipe) {
+        if (!pipe)
-                ret = -EINVAL;
                goto out;
-        }
        usbhsg_pipe_disable(uep);
        usbhs_pipe_free(pipe);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index d544b331c9f2..02b67abfc2a1 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -20,9 +20,13 @@
 /* Low Power Status register (LPSTS) */
 #define LPSTS_SUSPM     0x4000
-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
+/*
+ * USB General control register 2 (UGCTRL2)
+ * Remarks: bit[31:11] and bit[9:6] should be 0
+ */
 #define UGCTRL2_RESERVED_3      0x00000001      /* bit[3:0] should be B'0001 */
 #define UGCTRL2_USB0SEL_OTG     0x00000030
+#define UGCTRL2_VBUSSEL         0x00000400
 static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
 {
@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
 {
        struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
-        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
+        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
+                      UGCTRL2_VBUSSEL);
        if (enable) {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f64e914a8985..2d945c9f975c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -142,6 +142,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
        { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ebe51f11105d..fe123153b1a5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2025,6 +2025,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },                   /* D-Link DWM-158 */
        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),                     /* D-Link DWM-221 B1 */
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c9ebefd8f35f..a585b477415d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -52,6 +52,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485),
+                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
        { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
        { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09d9be88209e..3b5a15d1dc0d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_UC485      0x2021
 #define ATEN_PRODUCT_ID2        0x2118
 #define IODATA_VENDOR_ID        0x04bb
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index cbea9f329e71..cde115359793 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
 /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
 UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
                "Initio Corporation",
-                "",
+                "INIC-3069",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_ATA_1X),
+                US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 06615934fed1..0dceb9fa3a06 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void * __us)
 {
        struct us_data *us = (struct us_data *)__us;
        struct Scsi_Host *host = us_to_host(us);
+        struct scsi_cmnd *srb;
        for (;;) {
                usb_stor_dbg(us, "*** thread sleeping\n");
@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void * __us)
                scsi_lock(host);
                /* When we are called with no command pending, we're done */
+                srb = us->srb;
                if (us->srb == NULL) {
                        scsi_unlock(host);
                        mutex_unlock(&us->dev_mutex);
@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void * __us)
                /* lock access to the state */
                scsi_lock(host);
-                /* indicate that the command is done */
+                /* was the command aborted? */
-                if (us->srb->result != DID_ABORT << 16) {
+                if (us->srb->result == DID_ABORT << 16) {
-                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
-                                     us->srb->result);
-                        us->srb->scsi_done(us->srb);
-                } else {
 SkipForAbort:
                        usb_stor_dbg(us, "scsi command aborted\n");
+                        srb = NULL;     /* Don't call srb->scsi_done() */
                }
                /*
@@ -429,6 +428,13 @@ SkipForAbort:
                /* unlock the device pointers */
                mutex_unlock(&us->dev_mutex);
+                /* now that the locks are released, notify the SCSI core */
+                if (srb) {
+                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
+                                        srb->result);
+                        srb->scsi_done(srb);
+                }
        } /* for (;;) */
        /* Wait until we are told to stop */
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index ff01bed7112f..1e784adb89b1 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -17,6 +17,7 @@
 #include <asm/efi.h>
 static bool request_mem_succeeded = false;
+static bool nowc = false;
 static struct fb_var_screeninfo efifb_defined = {
        .activate               = FB_ACTIVATE_NOW,
@@ -99,6 +100,8 @@ static int efifb_setup(char *options)
                                screen_info.lfb_height = simple_strtoul(this_opt+7, NULL, 0);
                        else if (!strncmp(this_opt, "width:", 6))
                                screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
+                        else if (!strcmp(this_opt, "nowc"))
+                                nowc = true;
                }
        }
@@ -255,7 +258,10 @@ static int efifb_probe(struct platform_device *dev)
        info->apertures->ranges[0].base = efifb_fix.smem_start;
        info->apertures->ranges[0].size = size_remap;
-        info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
+        if (nowc)
+                info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+        else
+                info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
        if (!info->screen_base) {
                pr_err("efifb: abort, cannot ioremap video memory 0x%x @ 0x%lx\n",
                        efifb_fix.smem_len, efifb_fix.smem_start);
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index c166e0725be5..ba82f97fb42b 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
        imxfb_disable_controller(fbi);
        unregister_framebuffer(info);
+        fb_dealloc_cmap(&info->cmap);
        pdata = dev_get_platdata(&pdev->dev);
        if (pdata && pdata->exit)
                pdata->exit(fbi->pdev);
-        fb_dealloc_cmap(&info->cmap);
-        kfree(info->pseudo_palette);
-        framebuffer_release(info);
        dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
                    fbi->map_dma);
        iounmap(fbi->regs);
        release_mem_region(res->start, resource_size(res));
+        kfree(info->pseudo_palette);
+        framebuffer_release(info);
        return 0;
 }
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/core.c b/drivers/video/fbdev/omap2/omapfb/dss/core.c
index eecf695c16f4..09e5bb013d28 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/core.c
@@ -193,7 +193,6 @@ static struct notifier_block omap_dss_pm_notif_block = {
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
-        struct omap_dss_board_info *pdata = pdev->dev.platform_data;
        int r;
        core.pdev = pdev;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 8feab810aed9..7f188b8d0c67 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -7,9 +7,6 @@ obj-y	+= xenbus/
 nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_features.o                       := $(nostackp)
-CFLAGS_efi.o                            += -fshort-wchar
-LDFLAGS                                 += $(call ld-option, --no-wchar-size-warning)
 dom0-$(CONFIG_ARM64) += arm-device.o
 dom0-$(CONFIG_PCI) += pci.o
 dom0-$(CONFIG_USB_SUPPORT) += dbgp.o
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
        unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
        unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
 #else
        /*
         * XXX: Add support for merging bio_vec when using different page
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index bae1f5d36c26..2d43118077e4 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -574,7 +574,7 @@ static void shutdown_pirq(struct irq_data *data)
 static void enable_pirq(struct irq_data *data)
 {
-        startup_pirq(data);
+        enable_dynirq(data);
 }
 static void disable_pirq(struct irq_data *data)
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index e46080214955..3e59590c7254 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -857,6 +857,8 @@ static int xenwatch_thread(void *unused)
        struct list_head *ent;
        struct xs_watch_event *event;
+        xenwatch_pid = current->pid;
        for (;;) {
                wait_event_interruptible(watch_events_waitq,
                                         !list_empty(&watch_events));
@@ -925,7 +927,6 @@ int xs_init(void)
        task = kthread_run(xenwatch_thread, NULL, "xenwatch");
        if (IS_ERR(task))
                return PTR_ERR(task);
-        xenwatch_pid = task->pid;
        /* shutdown watches for kexec boot */
        xs_reset_watches();
author	Ingo Molnar <mingo@kernel.org>	2017-08-25 05:04:51 -0400
committer	Ingo Molnar <mingo@kernel.org>	2017-08-25 05:04:51 -0400
commit	10c9850cb2ced2ce528e5b692c639974213a64ec (patch)
tree	f8063beac0ba1dab069d25661845c5b7ef9a67c7 /drivers
parent	0c2364791343e4b04cd1f097ff2abc2799062448 (diff)
parent	90a6cd503982bfd33ce8c70eb49bd2dd33bc6325 (diff)