Merge branch 'irq/urgent' into x86/apic

Pick up core changes which affect the vector rework.
author: Thomas Gleixner <tglx@linutronix.de> 2017-10-12 05:02:50 -0400
committer: Thomas Gleixner <tglx@linutronix.de> 2017-10-12 05:02:50 -0400
commit: 331b57d14829c49d75076779cdc54d7e4537bbf0 (patch)
tree: 79a70eadb04ed2fd65d3280021ec6ad5266d1cc1 /drivers
parent: 79761ce80aa0232157e428bde28c0cef6d43ac5f (diff)
parent: e43b3b58548051f8809391eb7bec7a27ed3003ea (diff)
263 files changed, 2497 insertions, 1369 deletions
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 077f9bad6f44..3c3a37b8503b 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -743,17 +743,19 @@ static int ghes_proc(struct ghes *ghes)
        }
        ghes_do_proc(ghes, ghes->estatus);
+out:
+        ghes_clear_estatus(ghes);
+        if (rc == -ENOENT)
+                return rc;
        /*
         * GHESv2 type HEST entries introduce support for error acknowledgment,
         * so only acknowledge the error if this support is present.
         */
-        if (is_hest_type_generic_v2(ghes)) {
+        if (is_hest_type_generic_v2(ghes))
-                rc = ghes_ack_error(ghes->generic_v2);
+                return ghes_ack_error(ghes->generic_v2);
-                if (rc)
-                        return rc;
-        }
-out:
-        ghes_clear_estatus(ghes);
        return rc;
 }
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 9565d572f8dd..de56394dd161 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -1178,12 +1178,44 @@ dev_put:
        return ret;
 }
+static bool __init iort_enable_acs(struct acpi_iort_node *iort_node)
+{
+        if (iort_node->type == ACPI_IORT_NODE_PCI_ROOT_COMPLEX) {
+                struct acpi_iort_node *parent;
+                struct acpi_iort_id_mapping *map;
+                int i;
+                map = ACPI_ADD_PTR(struct acpi_iort_id_mapping, iort_node,
+                                   iort_node->mapping_offset);
+                for (i = 0; i < iort_node->mapping_count; i++, map++) {
+                        if (!map->output_reference)
+                                continue;
+                        parent = ACPI_ADD_PTR(struct acpi_iort_node,
+                                        iort_table,  map->output_reference);
+                        /*
+                         * If we detect a RC->SMMU mapping, make sure
+                         * we enable ACS on the system.
+                         */
+                        if ((parent->type == ACPI_IORT_NODE_SMMU) ||
+                                (parent->type == ACPI_IORT_NODE_SMMU_V3)) {
+                                pci_request_acs();
+                                return true;
+                        }
+                }
+        }
+        return false;
+}
 static void __init iort_init_platform_devices(void)
 {
        struct acpi_iort_node *iort_node, *iort_end;
        struct acpi_table_iort *iort;
        struct fwnode_handle *fwnode;
        int i, ret;
+        bool acs_enabled = false;
        /*
         * iort_table and iort both point to the start of IORT table, but
@@ -1203,6 +1235,9 @@ static void __init iort_init_platform_devices(void)
                        return;
                }
+                if (!acs_enabled)
+                        acs_enabled = iort_enable_acs(iort_node);
                if ((iort_node->type == ACPI_IORT_NODE_SMMU) ||
                        (iort_node->type == ACPI_IORT_NODE_SMMU_V3)) {
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d055b3f2a207..ab34239a76ee 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2217,7 +2217,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                                       debug_id, (u64)fda->num_fds);
                                continue;
                        }
-                        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+                        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                        for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
                                task_close_fd(proc, fd_array[fd_index]);
                } break;
@@ -2326,7 +2326,6 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                             (u64)node->ptr);
                binder_node_unlock(node);
        } else {
-                int ret;
                struct binder_ref_data dest_rdata;
                binder_node_unlock(node);
@@ -2442,7 +2441,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
         */
        parent_buffer = parent->buffer -
                binder_alloc_get_user_buffer_offset(&target_proc->alloc);
-        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
        if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
                binder_user_error("%d:%d parent offset not aligned correctly.\n",
                                  proc->pid, thread->pid);
@@ -2508,7 +2507,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
                                  proc->pid, thread->pid);
                return -EINVAL;
        }
-        parent_buffer = (u8 *)(parent->buffer -
+        parent_buffer = (u8 *)((uintptr_t)parent->buffer -
                        binder_alloc_get_user_buffer_offset(
                                &target_proc->alloc));
        *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
@@ -3083,6 +3082,7 @@ static void binder_transaction(struct binder_proc *proc,
 err_dead_proc_or_thread:
        return_error = BR_DEAD_REPLY;
        return_error_line = __LINE__;
+        binder_dequeue_work(proc, tcomplete);
 err_translate_failed:
 err_bad_object_type:
 err_bad_offset:
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 8fe165844e47..064f5e31ec55 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -913,6 +913,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
        struct binder_alloc *alloc;
        uintptr_t page_addr;
        size_t index;
+        struct vm_area_struct *vma;
        alloc = page->alloc;
        if (!mutex_trylock(&alloc->mutex))
@@ -923,16 +924,22 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
        index = page - alloc->pages;
        page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        if (alloc->vma) {
+        vma = alloc->vma;
+        if (vma) {
                mm = get_task_mm(alloc->tsk);
                if (!mm)
                        goto err_get_task_mm_failed;
                if (!down_write_trylock(&mm->mmap_sem))
                        goto err_down_write_mmap_sem_failed;
+        }
+        list_lru_isolate(lru, item);
+        spin_unlock(lock);
+        if (vma) {
                trace_binder_unmap_user_start(alloc, index);
-                zap_page_range(alloc->vma,
+                zap_page_range(vma,
                               page_addr + alloc->user_buffer_offset,
                               PAGE_SIZE);
@@ -950,13 +957,12 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
        trace_binder_unmap_kernel_end(alloc, index);
-        list_lru_isolate(lru, item);
+        spin_lock(lock);
        mutex_unlock(&alloc->mutex);
-        return LRU_REMOVED;
+        return LRU_REMOVED_RETRY;
 err_down_write_mmap_sem_failed:
-        mmput(mm);
+        mmput_async(mm);
 err_get_task_mm_failed:
 err_page_already_freed:
        mutex_unlock(&alloc->mutex);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index cb9b0e9090e3..9f78bb03bb76 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -621,8 +621,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 static int ahci_pci_reset_controller(struct ata_host *host)
 {
        struct pci_dev *pdev = to_pci_dev(host->dev);
+        int rc;
-        ahci_reset_controller(host);
+        rc = ahci_reset_controller(host);
+        if (rc)
+                return rc;
        if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                struct ahci_host_priv *hpriv = host->private_data;
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 8401c3b5be92..b702c20fbc2b 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -492,6 +492,7 @@ static const struct ich_laptop ich_laptop[] = {
        { 0x27DF, 0x152D, 0x0778 },     /* ICH7 on unknown Intel */
        { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
        { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
+        { 0x24CA, 0x10CF, 0x11AB },     /* ICH4M on Fujitsu-Siemens Lifebook S6120 */
        { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
        { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
        { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1945a8ea2099..ee4c1ec9dca0 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3234,19 +3234,19 @@ static const struct ata_timing ata_timing[] = {
 };
 #define ENOUGH(v, unit)         (((v)-1)/(unit)+1)
-#define EZ(v, unit)             ((v)?ENOUGH(v, unit):0)
+#define EZ(v, unit)             ((v)?ENOUGH(((v) * 1000), unit):0)
 static void ata_timing_quantize(const struct ata_timing *t, struct ata_timing *q, int T, int UT)
 {
-        q->setup        = EZ(t->setup      * 1000,  T);
+        q->setup        = EZ(t->setup,       T);
-        q->act8b        = EZ(t->act8b      * 1000,  T);
+        q->act8b        = EZ(t->act8b,       T);
-        q->rec8b        = EZ(t->rec8b      * 1000,  T);
+        q->rec8b        = EZ(t->rec8b,       T);
-        q->cyc8b        = EZ(t->cyc8b      * 1000,  T);
+        q->cyc8b        = EZ(t->cyc8b,       T);
-        q->active       = EZ(t->active     * 1000,  T);
+        q->active       = EZ(t->active,      T);
-        q->recover      = EZ(t->recover    * 1000,  T);
+        q->recover      = EZ(t->recover,     T);
-        q->dmack_hold   = EZ(t->dmack_hold * 1000,  T);
+        q->dmack_hold   = EZ(t->dmack_hold,  T);
-        q->cycle        = EZ(t->cycle      * 1000,  T);
+        q->cycle        = EZ(t->cycle,       T);
-        q->udma         = EZ(t->udma       * 1000, UT);
+        q->udma         = EZ(t->udma,       UT);
 }
 void ata_timing_merge(const struct ata_timing *a, const struct ata_timing *b,
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index cfeb049a01ef..642afd88870b 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf,
 static int charlcd_open(struct inode *inode, struct file *file)
 {
        struct charlcd_priv *priv = to_priv(the_charlcd);
+        int ret;
+        ret = -EBUSY;
        if (!atomic_dec_and_test(&charlcd_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
+        ret = -EPERM;
        if (file->f_mode & FMODE_READ)  /* device is write-only */
-                return -EPERM;
+                goto fail;
        if (priv->must_clear) {
                charlcd_clear_display(&priv->lcd);
                priv->must_clear = false;
        }
        return nonseekable_open(inode, file);
+ fail:
+        atomic_inc(&charlcd_available);
+        return ret;
 }
 static int charlcd_release(struct inode *inode, struct file *file)
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index df126dcdaf18..6911acd896d9 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *file,
 static int keypad_open(struct inode *inode, struct file *file)
 {
+        int ret;
+        ret = -EBUSY;
        if (!atomic_dec_and_test(&keypad_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
+        ret = -EPERM;
        if (file->f_mode & FMODE_WRITE) /* device is read-only */
-                return -EPERM;
+                goto fail;
        keypad_buflen = 0;      /* flush the buffer on opening */
        return 0;
+ fail:
+        atomic_inc(&keypad_available);
+        return ret;
 }
 static int keypad_release(struct inode *inode, struct file *file)
diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
index 41be9ff7d70a..6df7d6676a48 100644
--- a/drivers/base/arch_topology.c
+++ b/drivers/base/arch_topology.c
@@ -166,11 +166,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu)
 }
 #ifdef CONFIG_CPU_FREQ
-static cpumask_var_t cpus_to_visit;
+static cpumask_var_t cpus_to_visit __initdata;
-static void parsing_done_workfn(struct work_struct *work);
+static void __init parsing_done_workfn(struct work_struct *work);
-static DECLARE_WORK(parsing_done_work, parsing_done_workfn);
+static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn);
-static int
+static int __init
 init_cpu_capacity_callback(struct notifier_block *nb,
                           unsigned long val,
                           void *data)
@@ -206,7 +206,7 @@ init_cpu_capacity_callback(struct notifier_block *nb,
        return 0;
 }
-static struct notifier_block init_cpu_capacity_notifier = {
+static struct notifier_block init_cpu_capacity_notifier __initdata = {
        .notifier_call = init_cpu_capacity_callback,
 };
@@ -232,7 +232,7 @@ static int __init register_cpufreq_notifier(void)
 }
 core_initcall(register_cpufreq_notifier);
-static void parsing_done_workfn(struct work_struct *work)
+static void __init parsing_done_workfn(struct work_struct *work)
 {
        cpufreq_unregister_notifier(&init_cpu_capacity_notifier,
                                         CPUFREQ_POLICY_NOTIFIER);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index d1bd99271066..9045c5f3734e 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -868,7 +868,8 @@ static ssize_t driver_override_store(struct device *dev,
        struct platform_device *pdev = to_platform_device(dev);
        char *driver_override, *old, *cp;
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                return -EINVAL;
        driver_override = kstrndup(buf, count, GFP_KERNEL);
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
index a8cc14fd8ae4..a6de32530693 100644
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -1581,6 +1581,9 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
        opp->available = availability_req;
+        dev_pm_opp_get(opp);
+        mutex_unlock(&opp_table->lock);
        /* Notify the change of the OPP availability */
        if (availability_req)
                blocking_notifier_call_chain(&opp_table->head, OPP_EVENT_ENABLE,
@@ -1589,8 +1592,12 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
                blocking_notifier_call_chain(&opp_table->head,
                                             OPP_EVENT_DISABLE, opp);
+        dev_pm_opp_put(opp);
+        goto put_table;
 unlock:
        mutex_unlock(&opp_table->lock);
+put_table:
        dev_pm_opp_put_opp_table(opp_table);
        return r;
 }
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 4a438b8abe27..2dfe99b328f8 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -17,7 +17,7 @@ if BLK_DEV
 config BLK_DEV_NULL_BLK
        tristate "Null test block driver"
-        depends on CONFIGFS_FS
+        select CONFIGFS_FS
 config BLK_DEV_FD
        tristate "Normal floppy disk support"
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bbd0d186cfc0..2d7178f7754e 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -342,7 +342,7 @@ static long __brd_direct_access(struct brd_device *brd, pgoff_t pgoff,
        if (!brd)
                return -ENODEV;
-        page = brd_insert_page(brd, PFN_PHYS(pgoff) / 512);
+        page = brd_insert_page(brd, (sector_t)pgoff << PAGE_SECTORS_SHIFT);
        if (!page)
                return -ENOSPC;
        *kaddr = page_address(page);
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
 struct loop_cmd {
        struct kthread_work work;
        struct request *rq;
-        union {
+        bool use_aio; /* use AIO interface to handle I/O */
-                bool use_aio; /* use AIO interface to handle I/O */
+        atomic_t ref; /* only for aio */
-                atomic_t ref; /* only for aio */
-        };
        long ret;
        struct kiocb iocb;
        struct bio_vec *bvec;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 2aa87cbdede0..883dfebd3014 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -820,9 +820,13 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
         * appropriate.
         */
        ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_STS_IOERR;
+        else if (!ret)
+                ret = BLK_STS_OK;
        complete(&cmd->send_complete);
-        return ret < 0 ? BLK_STS_IOERR : BLK_STS_OK;
+        return ret;
 }
 static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
@@ -1194,6 +1198,12 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
+        /* The block layer will pass back some non-nbd ioctls in case we have
+         * special handling for them, but we don't so just return an error.
+         */
+        if (_IOC_TYPE(cmd) != 0xab)
+                return -EINVAL;
        mutex_lock(&nbd->config_lock);
        /* Don't allow ioctl operations on a nbd device that was created with
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 2981c27d3aae..f149d3e61234 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -766,27 +766,6 @@ static void zram_slot_unlock(struct zram *zram, u32 index)
        bit_spin_unlock(ZRAM_ACCESS, &zram->table[index].value);
 }
-static bool zram_same_page_read(struct zram *zram, u32 index,
-                                struct page *page,
-                                unsigned int offset, unsigned int len)
-{
-        zram_slot_lock(zram, index);
-        if (unlikely(!zram_get_handle(zram, index) ||
-                        zram_test_flag(zram, index, ZRAM_SAME))) {
-                void *mem;
-                zram_slot_unlock(zram, index);
-                mem = kmap_atomic(page);
-                zram_fill_page(mem + offset, len,
-                                        zram_get_element(zram, index));
-                kunmap_atomic(mem);
-                return true;
-        }
-        zram_slot_unlock(zram, index);
-        return false;
-}
 static void zram_meta_free(struct zram *zram, u64 disksize)
 {
        size_t num_pages = disksize >> PAGE_SHIFT;
@@ -884,11 +863,20 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index,
                zram_slot_unlock(zram, index);
        }
-        if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE))
-                return 0;
        zram_slot_lock(zram, index);
        handle = zram_get_handle(zram, index);
+        if (!handle || zram_test_flag(zram, index, ZRAM_SAME)) {
+                unsigned long value;
+                void *mem;
+                value = handle ? zram_get_element(zram, index) : 0;
+                mem = kmap_atomic(page);
+                zram_fill_page(mem, PAGE_SIZE, value);
+                kunmap_atomic(mem);
+                zram_slot_unlock(zram, index);
+                return 0;
+        }
        size = zram_get_obj_size(zram, index);
        src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO);
diff --git a/drivers/clk/clk-bulk.c b/drivers/clk/clk-bulk.c
index c834f5abfc49..4c10456f8a32 100644
--- a/drivers/clk/clk-bulk.c
+++ b/drivers/clk/clk-bulk.c
@@ -105,6 +105,7 @@ err:
        return  ret;
 }
+EXPORT_SYMBOL_GPL(clk_bulk_prepare);
 #endif /* CONFIG_HAVE_CLK_PREPARE */
diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index 62d7854e4b87..5970a50671b9 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c
@@ -315,13 +315,13 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
        GATE(SCLK_PVTM_CORE, "clk_pvtm_core", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 0, GFLAGS),
        GATE(SCLK_PVTM_GPU, "clk_pvtm_gpu", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 1, GFLAGS),
        GATE(SCLK_PVTM_FUNC, "clk_pvtm_func", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 2, GFLAGS),
        GATE(SCLK_MIPI_24M, "clk_mipi_24m", "xin24m", CLK_IGNORE_UNUSED,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(2), 15, GFLAGS),
        COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0,
                        RK2928_CLKSEL_CON(11), 6, 2, MFLAGS, 0, 6, DFLAGS,
@@ -541,7 +541,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
        GATE(0, "pclk_grf", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 4, GFLAGS),
        GATE(0, "pclk_mipiphy", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "pclk_pmu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 2, GFLAGS),
+        GATE(0, "pclk_pmu", "pclk_pmu_pre", 0, RK2928_CLKGATE_CON(9), 2, GFLAGS),
        GATE(0, "pclk_pmu_niu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 3, GFLAGS),
        /* PD_MMC */
@@ -577,6 +577,8 @@ static const char *const rk3128_critical_clocks[] __initconst = {
        "aclk_peri",
        "hclk_peri",
        "pclk_peri",
+        "pclk_pmu",
+        "sclk_timer5",
 };
 static struct rockchip_clk_provider *__init rk3128_common_clk_init(struct device_node *np)
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index e40b77583c47..d8d3cb67b402 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump src_mask_suspend_e4210[] = {
 #define PLL_ENABLED     (1 << 31)
 #define PLL_LOCKED      (1 << 29)
+static void exynos4_clk_enable_pll(u32 reg)
+{
+        u32 pll_con = readl(reg_base + reg);
+        pll_con |= PLL_ENABLED;
+        writel(pll_con, reg_base + reg);
+        while (!(pll_con & PLL_LOCKED)) {
+                cpu_relax();
+                pll_con = readl(reg_base + reg);
+        }
+}
 static void exynos4_clk_wait_for_pll(u32 reg)
 {
        u32 pll_con;
@@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void)
        samsung_clk_save(reg_base, exynos4_save_pll,
                                ARRAY_SIZE(exynos4_clk_pll_regs));
+        exynos4_clk_enable_pll(EPLL_CON0);
+        exynos4_clk_enable_pll(VPLL_CON0);
        if (exynos4_soc == EXYNOS4210) {
                samsung_clk_save(reg_base, exynos4_save_soc,
                                        ARRAY_SIZE(exynos4210_clk_save));
diff --git a/drivers/clocksource/numachip.c b/drivers/clocksource/numachip.c
index 6a20dc8b253f..9a7d7f0f23fe 100644
--- a/drivers/clocksource/numachip.c
+++ b/drivers/clocksource/numachip.c
@@ -43,7 +43,7 @@ static int numachip2_set_next_event(unsigned long delta, struct clock_event_devi
        return 0;
 }
-static struct clock_event_device numachip2_clockevent = {
+static const struct clock_event_device numachip2_clockevent __initconst = {
        .name            = "numachip2",
        .rating          = 400,
        .set_next_event  = numachip2_set_next_event,
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 430edadca527..a753c50e9e41 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -118,6 +118,10 @@ static const struct of_device_id blacklist[] __initconst = {
        { .compatible = "sigma,tango4", },
+        { .compatible = "ti,am33xx", },
+        { .compatible = "ti,am43", },
+        { .compatible = "ti,dra7", },
        { }
 };
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 08629ee69d11..00e73d28077c 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -361,12 +361,12 @@ static const struct fpga_manager_ops altera_cvp_ops = {
        .write_complete = altera_cvp_write_complete,
 };
-static ssize_t show_chkcfg(struct device_driver *dev, char *buf)
+static ssize_t chkcfg_show(struct device_driver *dev, char *buf)
 {
        return snprintf(buf, 3, "%d\n", altera_cvp_chkcfg);
 }
-static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
+static ssize_t chkcfg_store(struct device_driver *drv, const char *buf,
                            size_t count)
 {
        int ret;
@@ -378,7 +378,7 @@ static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
        return count;
 }
-static DRIVER_ATTR(chkcfg, 0600, show_chkcfg, store_chkcfg);
+static DRIVER_ATTR_RW(chkcfg);
 static int altera_cvp_probe(struct pci_dev *pdev,
                            const struct pci_device_id *dev_id);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index d228f5a99044..dbbe986f90f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -636,7 +636,194 @@ static void gfx_v6_0_tiling_mode_table_init(struct amdgpu_device *adev)
                                NUM_BANKS(ADDR_SURF_2_BANK);
                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
                        WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
-        } else if (adev->asic_type == CHIP_OLAND || adev->asic_type == CHIP_HAINAN) {
+        } else if (adev->asic_type == CHIP_OLAND) {
+                tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[1] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[2] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[3] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[4] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[5] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[6] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[7] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[8] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[9] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[10] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[11] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[12] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[13] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[14] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[15] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[16] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[17] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[21] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_2) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[22] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[23] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[24] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[25] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_1KB) |
+                                NUM_BANKS(ADDR_SURF_8_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1);
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
+        } else if (adev->asic_type == CHIP_HAINAN) {
                tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
                                PIPE_CONFIG(ADDR_SURF_P2) |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index e4a8c2e52cb2..660b3fbade41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -892,6 +892,8 @@ static int kfd_ioctl_get_tile_config(struct file *filep,
        int err = 0;
        dev = kfd_device_by_id(args->gpu_id);
+        if (!dev)
+                return -EINVAL;
        dev->kfd2kgd->get_tile_config(dev->kgd, &config);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 5979158c3f7b..944abfad39c1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -292,7 +292,10 @@ static int create_signal_event(struct file *devkfd,
                                struct kfd_event *ev)
 {
        if (p->signal_event_count == KFD_SIGNAL_EVENT_LIMIT) {
-                pr_warn("Signal event wasn't created because limit was reached\n");
+                if (!p->signal_event_limit_reached) {
+                        pr_warn("Signal event wasn't created because limit was reached\n");
+                        p->signal_event_limit_reached = true;
+                }
                return -ENOMEM;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index 0649dd43e780..ed71ad40e8f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -184,7 +184,7 @@ static void uninitialize(struct kernel_queue *kq)
        if (kq->queue->properties.type == KFD_QUEUE_TYPE_HIQ)
                kq->mqd->destroy_mqd(kq->mqd,
                                        kq->queue->mqd,
-                                        false,
+                                        KFD_PREEMPT_TYPE_WAVEFRONT_RESET,
                                        QUEUE_PREEMPT_DEFAULT_TIMEOUT_MS,
                                        kq->queue->pipe,
                                        kq->queue->queue);
@@ -210,6 +210,11 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
        uint32_t wptr, rptr;
        unsigned int *queue_address;
+        /* When rptr == wptr, the buffer is empty.
+         * When rptr == wptr + 1, the buffer is full.
+         * It is always rptr that advances to the position of wptr, rather than
+         * the opposite. So we can only use up to queue_size_dwords - 1 dwords.
+         */
        rptr = *kq->rptr_kernel;
        wptr = *kq->wptr_kernel;
        queue_address = (unsigned int *)kq->pq_kernel_addr;
@@ -219,11 +224,10 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
        pr_debug("wptr: %d\n", wptr);
        pr_debug("queue_address 0x%p\n", queue_address);
-        available_size = (rptr - 1 - wptr + queue_size_dwords) %
+        available_size = (rptr + queue_size_dwords - 1 - wptr) %
                                                        queue_size_dwords;
-        if (packet_size_in_dwords >= queue_size_dwords ||
+        if (packet_size_in_dwords > available_size) {
-                        packet_size_in_dwords >= available_size) {
                /*
                 * make sure calling functions know
                 * acquire_packet_buffer() failed
@@ -233,6 +237,14 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
        }
        if (wptr + packet_size_in_dwords >= queue_size_dwords) {
+                /* make sure after rolling back to position 0, there is
+                 * still enough space.
+                 */
+                if (packet_size_in_dwords >= rptr) {
+                        *buffer_ptr = NULL;
+                        return -ENOMEM;
+                }
+                /* fill nops, roll back and start at position 0 */
                while (wptr > 0) {
                        queue_address[wptr] = kq->nop_packet;
                        wptr = (wptr + 1) % queue_size_dwords;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index b397ec726400..b87e96cee5fa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -521,6 +521,7 @@ struct kfd_process {
        struct list_head signal_event_pages;
        u32 next_nonsignal_event_id;
        size_t signal_event_count;
+        bool signal_event_limit_reached;
 };
 /**
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 5a634594a6ce..57881167ccd2 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -551,12 +551,15 @@ static const struct etnaviv_gem_ops etnaviv_gem_shmem_ops = {
 void etnaviv_gem_free_object(struct drm_gem_object *obj)
 {
        struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
+        struct etnaviv_drm_private *priv = obj->dev->dev_private;
        struct etnaviv_vram_mapping *mapping, *tmp;
        /* object should not be active */
        WARN_ON(is_active(etnaviv_obj));
+        mutex_lock(&priv->gem_lock);
        list_del(&etnaviv_obj->gem_node);
+        mutex_unlock(&priv->gem_lock);
        list_for_each_entry_safe(mapping, tmp, &etnaviv_obj->vram_list,
                                 obj_node) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 026ef4e02f85..46dfe0737f43 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -445,8 +445,10 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
        cmdbuf->user_size = ALIGN(args->stream_size, 8);
        ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
-        if (ret == 0)
+        if (ret)
-                cmdbuf = NULL;
+                goto out;
+        cmdbuf = NULL;
        if (args->flags & ETNA_SUBMIT_FENCE_FD_OUT) {
                /*
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index d805b6e6fe71..27743be5b768 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -606,11 +606,6 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder,
                         connector->encoder->base.id,
                         connector->encoder->name);
-        /* ELD Conn_Type */
-        connector->eld[5] &= ~(3 << 2);
-        if (intel_crtc_has_dp_encoder(crtc_state))
-                connector->eld[5] |= (1 << 2);
        connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2;
        if (dev_priv->display.audio_codec_enable)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 183e87e8ea31..00c6aee0a9a1 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1163,6 +1163,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
        is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0;
        is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR);
+        if (port == PORT_A && is_dvi) {
+                DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n",
+                              is_hdmi ? "/HDMI" : "");
+                is_dvi = false;
+                is_hdmi = false;
+        }
        info->supports_dvi = is_dvi;
        info->supports_hdmi = is_hdmi;
        info->supports_dp = is_dp;
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 965988f79a55..92c1f8e166dc 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -216,7 +216,7 @@ static void gen9_set_dc_state_debugmask(struct drm_i915_private *dev_priv)
        mask = DC_STATE_DEBUG_MASK_MEMORY_UP;
-        if (IS_BROXTON(dev_priv))
+        if (IS_GEN9_LP(dev_priv))
                mask |= DC_STATE_DEBUG_MASK_CORES;
        /* The below bit doesn't need to be cleared ever afterwards */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4b4fd1f8110b..476681d5940c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1655,7 +1655,8 @@ bool intel_ddi_get_hw_state(struct intel_encoder *encoder,
 out:
        if (ret && IS_GEN9_LP(dev_priv)) {
                tmp = I915_READ(BXT_PHY_CTL(port));
-                if ((tmp & (BXT_PHY_LANE_POWERDOWN_ACK |
+                if ((tmp & (BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                            BXT_PHY_LANE_POWERDOWN_ACK |
                            BXT_PHY_LANE_ENABLED)) != BXT_PHY_LANE_ENABLED)
                        DRM_ERROR("Port %c enabled but PHY powered down? "
                                  "(PHY_CTL %08x)\n", port_name(port), tmp);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 00cd17c76fdc..64f7b51ed97c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12359,7 +12359,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
        struct drm_crtc_state *old_crtc_state, *new_crtc_state;
        struct drm_crtc *crtc;
        struct intel_crtc_state *intel_cstate;
-        bool hw_check = intel_state->modeset;
        u64 put_domains[I915_MAX_PIPES] = {};
        unsigned crtc_vblank_mask = 0;
        int i;
@@ -12376,7 +12375,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                if (needs_modeset(new_crtc_state) ||
                    to_intel_crtc_state(new_crtc_state)->update_pipe) {
-                        hw_check = true;
                        put_domains[to_intel_crtc(crtc)->pipe] =
                                modeset_get_crtc_power_domains(crtc,
diff --git a/drivers/gpu/drm/i915/intel_dpio_phy.c b/drivers/gpu/drm/i915/intel_dpio_phy.c
index 09b670929786..de38d014ed39 100644
--- a/drivers/gpu/drm/i915/intel_dpio_phy.c
+++ b/drivers/gpu/drm/i915/intel_dpio_phy.c
@@ -208,12 +208,6 @@ static const struct bxt_ddi_phy_info glk_ddi_phy_info[] = {
        },
 };
-static u32 bxt_phy_port_mask(const struct bxt_ddi_phy_info *phy_info)
-{
-        return (phy_info->dual_channel * BIT(phy_info->channel[DPIO_CH1].port)) |
-                BIT(phy_info->channel[DPIO_CH0].port);
-}
 static const struct bxt_ddi_phy_info *
 bxt_get_phy_list(struct drm_i915_private *dev_priv, int *count)
 {
@@ -313,7 +307,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                            enum dpio_phy phy)
 {
        const struct bxt_ddi_phy_info *phy_info;
-        enum port port;
        phy_info = bxt_get_phy_info(dev_priv, phy);
@@ -335,19 +328,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                return false;
        }
-        for_each_port_masked(port, bxt_phy_port_mask(phy_info)) {
-                u32 tmp = I915_READ(BXT_PHY_CTL(port));
-                if (tmp & BXT_PHY_CMNLANE_POWERDOWN_ACK) {
-                        DRM_DEBUG_DRIVER("DDI PHY %d powered, but common lane "
-                                         "for port %c powered down "
-                                         "(PHY_CTL %08x)\n",
-                                         phy, port_name(port), tmp);
-                        return false;
-                }
-        }
        return true;
 }
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 951e834dd274..28a778b785ac 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -30,6 +30,21 @@
 #include "intel_drv.h"
 #include "i915_drv.h"
+static void intel_connector_update_eld_conn_type(struct drm_connector *connector)
+{
+        u8 conn_type;
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                conn_type = DRM_ELD_CONN_TYPE_DP;
+        } else {
+                conn_type = DRM_ELD_CONN_TYPE_HDMI;
+        }
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] &= ~DRM_ELD_CONN_TYPE_MASK;
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= conn_type;
+}
 /**
 * intel_connector_update_modes - update connector from edid
 * @connector: DRM connector device to use
@@ -44,6 +59,8 @@ int intel_connector_update_modes(struct drm_connector *connector,
        ret = drm_add_edid_modes(connector, edid);
        drm_edid_to_eld(connector, edid);
+        intel_connector_update_eld_conn_type(connector);
        return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index b66d8e136aa3..b3a087cb0860 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2782,6 +2782,9 @@ static void cnl_display_core_init(struct drm_i915_private *dev_priv, bool resume
        /* 6. Enable DBUF */
        gen9_dbuf_enable(dev_priv);
+        if (resume && dev_priv->csr.dmc_payload)
+                intel_csr_load_program(dev_priv);
 }
 #undef CNL_PROCMON_IDX
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 14c5613b4388..afbf50d0c08f 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -509,23 +509,25 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
            .y2 = qfb->base.height
        };
-        if (!old_state->fb) {
+        if (old_state->fb) {
-                qxl_io_log(qdev,
+                qfb_old = to_qxl_framebuffer(old_state->fb);
-                           "create primary fb: %dx%d,%d,%d\n",
+                bo_old = gem_to_qxl_bo(qfb_old->obj);
-                           bo->surf.width, bo->surf.height,
+        } else {
-                           bo->surf.stride, bo->surf.format);
+                bo_old = NULL;
+        }
-                qxl_io_create_primary(qdev, 0, bo);
+        if (bo == bo_old)
-                bo->is_primary = true;
                return;
-        } else {
+        if (bo_old && bo_old->is_primary) {
-                qfb_old = to_qxl_framebuffer(old_state->fb);
+                qxl_io_destroy_primary(qdev);
-                bo_old = gem_to_qxl_bo(qfb_old->obj);
                bo_old->is_primary = false;
        }
-        bo->is_primary = true;
+        if (!bo->is_primary) {
+                qxl_io_create_primary(qdev, 0, bo);
+                bo->is_primary = true;
+        }
        qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
 }
@@ -534,13 +536,15 @@ static void qxl_primary_atomic_disable(struct drm_plane *plane,
 {
        struct qxl_device *qdev = plane->dev->dev_private;
-        if (old_state->fb)
+        if (old_state->fb) {
-        {       struct qxl_framebuffer *qfb =
+                struct qxl_framebuffer *qfb =
                        to_qxl_framebuffer(old_state->fb);
                struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
-                qxl_io_destroy_primary(qdev);
+                if (bo->is_primary) {
-                bo->is_primary = false;
+                        qxl_io_destroy_primary(qdev);
+                        bo->is_primary = false;
+                }
        }
 }
@@ -698,14 +702,15 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
        struct drm_gem_object *obj;
        struct qxl_bo *user_bo;
-        if (!plane->state->fb) {
+        if (!old_state->fb) {
-                /* we never executed prepare_fb, so there's nothing to
+                /*
+                 * we never executed prepare_fb, so there's nothing to
                 * unpin.
                 */
                return;
        }
-        obj = to_qxl_framebuffer(plane->state->fb)->obj;
+        obj = to_qxl_framebuffer(old_state->fb)->obj;
        user_bo = gem_to_qxl_bo(obj);
        qxl_bo_unpin(user_bo);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 997131d58c7f..ffc10cadcf34 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1663,7 +1663,7 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
        radeon_agp_suspend(rdev);
        pci_save_state(dev->pdev);
-        if (freeze && rdev->family >= CHIP_CEDAR) {
+        if (freeze && rdev->family >= CHIP_CEDAR && !(rdev->flags & RADEON_IS_IGP)) {
                rdev->asic->asic_reset(rdev, true);
                pci_restore_state(dev->pdev);
        } else if (suspend) {
diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
index 06f05302ee75..882d85db9053 100644
--- a/drivers/gpu/drm/sun4i/Kconfig
+++ b/drivers/gpu/drm/sun4i/Kconfig
@@ -26,7 +26,7 @@ config DRM_SUN4I_HDMI_CEC
       bool "Allwinner A10 HDMI CEC Support"
       depends on DRM_SUN4I_HDMI
       select CEC_CORE
-       depends on CEC_PIN
+       select CEC_PIN
       help
          Choose this option if you have an Allwinner SoC with an HDMI
          controller and want to use CEC.
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi.h b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
index 1457750988da..a1f8cba251a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
@@ -15,7 +15,7 @@
 #include <drm/drm_connector.h>
 #include <drm/drm_encoder.h>
-#include <media/cec.h>
+#include <media/cec-pin.h>
 #define SUN4I_HDMI_CTRL_REG             0x004
 #define SUN4I_HDMI_CTRL_ENABLE                  BIT(31)
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 9ea6cd5a1370..3cf1a6932fac 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -302,26 +302,29 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
        hdmi->mod_clk = devm_clk_get(dev, "mod");
        if (IS_ERR(hdmi->mod_clk)) {
                dev_err(dev, "Couldn't get the HDMI mod clock\n");
-                return PTR_ERR(hdmi->mod_clk);
+                ret = PTR_ERR(hdmi->mod_clk);
+                goto err_disable_bus_clk;
        }
        clk_prepare_enable(hdmi->mod_clk);
        hdmi->pll0_clk = devm_clk_get(dev, "pll-0");
        if (IS_ERR(hdmi->pll0_clk)) {
                dev_err(dev, "Couldn't get the HDMI PLL 0 clock\n");
-                return PTR_ERR(hdmi->pll0_clk);
+                ret = PTR_ERR(hdmi->pll0_clk);
+                goto err_disable_mod_clk;
        }
        hdmi->pll1_clk = devm_clk_get(dev, "pll-1");
        if (IS_ERR(hdmi->pll1_clk)) {
                dev_err(dev, "Couldn't get the HDMI PLL 1 clock\n");
-                return PTR_ERR(hdmi->pll1_clk);
+                ret = PTR_ERR(hdmi->pll1_clk);
+                goto err_disable_mod_clk;
        }
        ret = sun4i_tmds_create(hdmi);
        if (ret) {
                dev_err(dev, "Couldn't create the TMDS clock\n");
-                return ret;
+                goto err_disable_mod_clk;
        }
        writel(SUN4I_HDMI_CTRL_ENABLE, hdmi->base + SUN4I_HDMI_CTRL_REG);
@@ -362,7 +365,7 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
        ret = sun4i_hdmi_i2c_create(dev, hdmi);
        if (ret) {
                dev_err(dev, "Couldn't create the HDMI I2C adapter\n");
-                return ret;
+                goto err_disable_mod_clk;
        }
        drm_encoder_helper_add(&hdmi->encoder,
@@ -422,6 +425,10 @@ err_cleanup_connector:
        drm_encoder_cleanup(&hdmi->encoder);
 err_del_i2c_adapter:
        i2c_del_adapter(hdmi->i2c);
+err_disable_mod_clk:
+        clk_disable_unprepare(hdmi->mod_clk);
+err_disable_bus_clk:
+        clk_disable_unprepare(hdmi->bus_clk);
        return ret;
 }
@@ -434,6 +441,8 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
        drm_connector_cleanup(&hdmi->connector);
        drm_encoder_cleanup(&hdmi->encoder);
        i2c_del_adapter(hdmi->i2c);
+        clk_disable_unprepare(hdmi->mod_clk);
+        clk_disable_unprepare(hdmi->bus_clk);
 }
 static const struct component_ops sun4i_hdmi_ops = {
diff --git a/drivers/gpu/drm/tegra/trace.h b/drivers/gpu/drm/tegra/trace.h
index e9b7cdad5c4c..5a1ab4046e92 100644
--- a/drivers/gpu/drm/tegra/trace.h
+++ b/drivers/gpu/drm/tegra/trace.h
@@ -63,6 +63,6 @@ DEFINE_EVENT(register_access, sor_readl,
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/tegra
 #define TRACE_INCLUDE_FILE trace
 #include <trace/define_trace.h>
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b397a14ab970..a98919199858 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -533,6 +533,7 @@
 #define USB_VENDOR_ID_IDEACOM           0x1cb6
 #define USB_DEVICE_ID_IDEACOM_IDC6650   0x6650
 #define USB_DEVICE_ID_IDEACOM_IDC6651   0x6651
+#define USB_DEVICE_ID_IDEACOM_IDC6680   0x6680
 #define USB_VENDOR_ID_ILITEK            0x222a
 #define USB_DEVICE_ID_ILITEK_MULTITOUCH 0x0001
@@ -660,6 +661,7 @@
 #define USB_DEVICE_ID_LENOVO_CBTKBD     0x6048
 #define USB_DEVICE_ID_LENOVO_TPPRODOCK  0x6067
 #define USB_DEVICE_ID_LENOVO_X1_COVER   0x6085
+#define USB_DEVICE_ID_LENOVO_X1_TAB     0x60a3
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 440b999304a5..9e8c4d2ba11d 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -930,6 +930,7 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
            field->application != HID_DG_PEN &&
            field->application != HID_DG_TOUCHPAD &&
            field->application != HID_GD_KEYBOARD &&
+            field->application != HID_GD_SYSTEM_CONTROL &&
            field->application != HID_CP_CONSUMER_CONTROL &&
            field->application != HID_GD_WIRELESS_RADIO_CTLS &&
            !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
@@ -1419,6 +1420,12 @@ static const struct hid_device_id mt_devices[] = {
                        USB_VENDOR_ID_ALPS_JP,
                        HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
+        /* Lenovo X1 TAB Gen 2 */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+                           USB_VENDOR_ID_LENOVO,
+                           USB_DEVICE_ID_LENOVO_X1_TAB) },
        /* Anton devices */
        { .driver_data = MT_CLS_EXPORT_ALL_INPUTS,
                MT_USB_DEVICE(USB_VENDOR_ID_ANTON,
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 5b40c2614599..ef241d66562e 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_device *hdev)
        if (!(data->device_flags & RMI_DEVICE))
                return 0;
-        ret = rmi_reset_attn_mode(hdev);
+        /* Make sure the HID device is ready to receive events */
+        ret = hid_hw_open(hdev);
        if (ret)
                return ret;
+        ret = rmi_reset_attn_mode(hdev);
+        if (ret)
+                goto out;
        ret = rmi_driver_resume(rmi_dev, false);
        if (ret) {
                hid_warn(hdev, "Failed to resume device: %d\n", ret);
-                return ret;
+                goto out;
        }
-        return 0;
+out:
+        hid_hw_close(hdev);
+        return ret;
 }
 #endif /* CONFIG_PM */
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index ec530454e6f6..5fbe0f81ab2e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -337,8 +337,8 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                        kfree(hidraw);
                } else {
                        /* close device for last reader */
-                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                        hid_hw_close(hidraw->hid);
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                }
        }
 }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 77396145d2d0..9145c2129a96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
 {
        /* the worst case is computed from the set_report command with a
         * reportID > 15 and the maximum report length */
-        int args_len = sizeof(__u8) + /* optional ReportID byte */
+        int args_len = sizeof(__u8) + /* ReportID */
+                       sizeof(__u8) + /* optional ReportID byte */
                       sizeof(__u16) + /* data register */
                       sizeof(__u16) + /* size of the report */
                       report_size; /* report */
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index a83fa76655b9..f489a5cfcb48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -99,6 +99,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index e82a696a1d07..906e654fb0ba 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
        /* Try to find an already-probed interface from the same device */
        list_for_each_entry(data, &wacom_udev_list, list) {
-                if (compare_device_paths(hdev, data->dev, '/'))
+                if (compare_device_paths(hdev, data->dev, '/')) {
+                        kref_get(&data->kref);
                        return data;
+                }
        }
        /* Fallback to finding devices that appear to be "siblings" */
@@ -766,6 +768,9 @@ static int wacom_led_control(struct wacom *wacom)
        if (!wacom->led.groups)
                return -ENOTSUPP;
+        if (wacom->wacom_wac.features.type == REMOTE)
+                return -ENOTSUPP;
        if (wacom->wacom_wac.pid) { /* wireless connected */
                report_id = WAC_CMD_WL_LED_CONTROL;
                buf_size = 13;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index bb17d7bbefd3..aa692e28b2cd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                                keys = data[9] & 0x07;
                        }
                } else {
-                        buttons = ((data[6] & 0x10) << 10) |
+                        buttons = ((data[6] & 0x10) << 5)  |
-                                  ((data[5] & 0x10) << 9)  |
+                                  ((data[5] & 0x10) << 4)  |
                                  ((data[6] & 0x0F) << 4)  |
                                  (data[5] & 0x0F);
                }
@@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                        continue;
                if (range) {
+                        /* Fix rotation alignment: userspace expects zero at left */
+                        int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]);
+                        rotation += 1800/4;
+                        if (rotation > 899)
+                                rotation -= 1800;
                        input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
                        input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
-                        input_report_abs(pen_input, ABS_TILT_X, frame[7]);
+                        input_report_abs(pen_input, ABS_TILT_X, (char)frame[7]);
-                        input_report_abs(pen_input, ABS_TILT_Y, frame[8]);
+                        input_report_abs(pen_input, ABS_TILT_Y, (char)frame[8]);
-                        input_report_abs(pen_input, ABS_Z, get_unaligned_le16(&frame[9]));
+                        input_report_abs(pen_input, ABS_Z, rotation);
                        input_report_abs(pen_input, ABS_WHEEL, get_unaligned_le16(&frame[11]));
                }
                input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
@@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
        unsigned char *data = wacom->data;
        int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01);
-        int ring = data[285];
+        int ring = data[285] & 0x7F;
-        int prox = buttons | (ring & 0x80);
+        bool ringstatus = data[285] & 0x80;
+        bool prox = buttons || ringstatus;
+        /* Fix touchring data: userspace expects 0 at left and increasing clockwise */
+        ring = 71 - ring;
+        ring += 3*72/16;
+        if (ring > 71)
+                ring -= 72;
        wacom_report_numbered_buttons(pad_input, 9, buttons);
-        input_report_abs(pad_input, ABS_WHEEL, (ring & 0x80) ? (ring & 0x7f) : 0);
+        input_report_abs(pad_input, ABS_WHEEL, ringstatus ? ring : 0);
        input_report_key(pad_input, wacom->tool[1], prox ? 1 : 0);
        input_report_abs(pad_input, ABS_MISC, prox ? PAD_DEVICE_ID : 0);
@@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
        return 0;
 }
+static int wacom_offset_rotation(struct input_dev *input, struct hid_usage *usage,
+                                 int value, int num, int denom)
+{
+        struct input_absinfo *abs = &input->absinfo[usage->code];
+        int range = (abs->maximum - abs->minimum + 1);
+        value += num*range/denom;
+        if (value > abs->maximum)
+                value -= range;
+        else if (value < abs->minimum)
+                value += range;
+        return value;
+}
 int wacom_equivalent_usage(int usage)
 {
        if ((usage & HID_USAGE_PAGE) == WACOM_HID_UP_WACOMDIGITIZER) {
@@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
        unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
        int i;
        bool is_touch_on = value;
+        bool do_report = false;
        /*
         * Avoid reporting this event and setting inrange_state if this usage
@@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
        }
        switch (equivalent_usage) {
+        case WACOM_HID_WD_TOUCHRING:
+                /*
+                 * Userspace expects touchrings to increase in value with
+                 * clockwise gestures and have their zero point at the
+                 * tablet's left. HID events "should" be clockwise-
+                 * increasing and zero at top, though the MobileStudio
+                 * Pro and 2nd-gen Intuos Pro don't do this...
+                 */
+                if (hdev->vendor == 0x56a &&
+                    (hdev->product == 0x34d || hdev->product == 0x34e ||  /* MobileStudio Pro */
+                     hdev->product == 0x357 || hdev->product == 0x358)) { /* Intuos Pro 2 */
+                        value = (field->logical_maximum - value);
+                        if (hdev->product == 0x357 || hdev->product == 0x358)
+                                value = wacom_offset_rotation(input, usage, value, 3, 16);
+                        else if (hdev->product == 0x34d || hdev->product == 0x34e)
+                                value = wacom_offset_rotation(input, usage, value, 1, 2);
+                }
+                else {
+                        value = wacom_offset_rotation(input, usage, value, 1, 4);
+                }
+                do_report = true;
+                break;
        case WACOM_HID_WD_TOUCHRINGSTATUS:
                if (!value)
                        input_event(input, usage->type, usage->code, 0);
@@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
                                         value, i);
                 /* fall through*/
        default:
+                do_report = true;
+                break;
+        }
+        if (do_report) {
                input_event(input, usage->type, usage->code, value);
                if (value)
                        wacom_wac->hid_data.pad_input_event_flag = true;
-                break;
        }
 }
@@ -2086,22 +2141,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                wacom_wac->hid_data.tipswitch |= value;
                return;
        case HID_DG_TOOLSERIALNUMBER:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+                if (value) {
-                wacom_wac->serial[0] |= (__u32)value;
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+                        wacom_wac->serial[0] |= (__u32)value;
+                }
                return;
+        case HID_DG_TWIST:
+                /*
+                 * Userspace expects pen twist to have its zero point when
+                 * the buttons/finger is on the tablet's left. HID values
+                 * are zero when buttons are toward the top.
+                 */
+                value = wacom_offset_rotation(input, usage, value, 1, 4);
+                break;
        case WACOM_HID_WD_SENSE:
                wacom_wac->hid_data.sense_state = value;
                return;
        case WACOM_HID_WD_SERIALHI:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
+                if (value) {
-                wacom_wac->serial[0] |= ((__u64)value) << 32;
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
-                /*
+                        wacom_wac->serial[0] |= ((__u64)value) << 32;
-                 * Non-USI EMR devices may contain additional tool type
+                        /*
-                 * information here. See WACOM_HID_WD_TOOLTYPE case for
+                         * Non-USI EMR devices may contain additional tool type
-                 * more details.
+                         * information here. See WACOM_HID_WD_TOOLTYPE case for
-                 */
+                         * more details.
-                if (value >> 20 == 1) {
+                         */
-                        wacom_wac->id[0] |= value & 0xFFFFF;
+                        if (value >> 20 == 1) {
+                                wacom_wac->id[0] |= value & 0xFFFFF;
+                        }
                }
                return;
        case WACOM_HID_WD_TOOLTYPE:
@@ -2205,7 +2272,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
                input_report_key(input, wacom_wac->tool[0], prox);
                if (wacom_wac->serial[0]) {
                        input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
-                        input_report_abs(input, ABS_MISC, id);
+                        input_report_abs(input, ABS_MISC, prox ? id : 0);
                }
                wacom_wac->hid_data.tipswitch = false;
@@ -2216,6 +2283,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
        if (!prox) {
                wacom_wac->tool[0] = 0;
                wacom_wac->id[0] = 0;
+                wacom_wac->serial[0] = 0;
        }
 }
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 060df71c2e8b..bcbb031f7263 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -936,14 +936,10 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 void vmbus_hvsock_device_unregister(struct vmbus_channel *channel)
 {
-        mutex_lock(&vmbus_connection.channel_mutex);
        BUG_ON(!is_hvsock_channel(channel));
        channel->rescind = true;
        vmbus_device_unregister(channel->device_obj);
-        mutex_unlock(&vmbus_connection.channel_mutex);
 }
 EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister);
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index daa75bd41f86..2364281d8593 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy)
                out_src = smsg_out;
                break;
+        case WRITE_TO_FILE:
+                out_src = fcopy_transaction.fcopy_msg;
+                out_len = sizeof(struct hv_do_fcopy);
+                break;
        default:
                out_src = fcopy_transaction.fcopy_msg;
                out_len = fcopy_transaction.recv_len;
diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
index 9c0dbb8191ad..e1be61095532 100644
--- a/drivers/hwmon/xgene-hwmon.c
+++ b/drivers/hwmon/xgene-hwmon.c
@@ -630,7 +630,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                         sizeof(struct slimpro_resp_msg) * ASYNC_MSG_FIFO_SIZE,
                         GFP_KERNEL);
        if (rc)
-                goto out_mbox_free;
+                return -ENOMEM;
        INIT_WORK(&ctx->workq, xgene_hwmon_evt_work);
@@ -646,7 +646,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                if (IS_ERR(ctx->mbox_chan)) {
                        dev_err(&pdev->dev,
                                "SLIMpro mailbox channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                }
        } else {
                struct acpi_pcct_hw_reduced *cppc_ss;
@@ -654,7 +655,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                if (device_property_read_u32(&pdev->dev, "pcc-channel",
                                             &ctx->mbox_idx)) {
                        dev_err(&pdev->dev, "no pcc-channel property\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                }
                cl->rx_callback = xgene_hwmon_pcc_rx_cb;
@@ -662,7 +664,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                if (IS_ERR(ctx->mbox_chan)) {
                        dev_err(&pdev->dev,
                                "PPC channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                }
                /*
@@ -675,13 +678,13 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                if (!cppc_ss) {
                        dev_err(&pdev->dev, "PPC subspace not found\n");
                        rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                }
                if (!ctx->mbox_chan->mbox->txdone_irq) {
                        dev_err(&pdev->dev, "PCC IRQ not supported\n");
                        rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                }
                /*
@@ -696,14 +699,14 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                } else {
                        dev_err(&pdev->dev, "Failed to get PCC comm region\n");
                        rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                }
                if (!ctx->pcc_comm_addr) {
                        dev_err(&pdev->dev,
                                "Failed to ioremap PCC comm region\n");
                        rc = -ENOMEM;
-                        goto out_mbox_free;
+                        goto out;
                }
                /*
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index bc9cebc30526..c2a2ce8ee541 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -144,6 +144,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                .driver_data = (kernel_ulong_t)0,
        },
        {
+                /* Lewisburg PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
                /* Gemini Lake */
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
                .driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -158,6 +163,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
                .driver_data = (kernel_ulong_t)&intel_th_2x,
        },
+        {
+                /* Cedar Fork PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
        { 0 },
 };
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575d8..f129869e05a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
        stm_source_link_drop(src);
-        device_destroy(&stm_source_class, src->dev.devt);
+        device_unregister(&src->dev);
 }
 EXPORT_SYMBOL_GPL(stm_source_unregister_device);
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c06dce2c1da7..45a3f3ca29b3 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -131,6 +131,7 @@ config I2C_I801
            Gemini Lake (SOC)
            Cannon Lake-H (PCH)
            Cannon Lake-LP (PCH)
+            Cedar Fork (PCH)
          This driver can also be built as a module.  If so, the module
          will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index e114e4e00d29..9e12a53ef7b8 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -68,6 +68,7 @@
 * Gemini Lake (SOC)            0x31d4  32      hard    yes     yes     yes
 * Cannon Lake-H (PCH)          0xa323  32      hard    yes     yes     yes
 * Cannon Lake-LP (PCH)         0x9da3  32      hard    yes     yes     yes
+ * Cedar Fork (PCH)             0x18df  32      hard    yes     yes     yes
 *
 * Features supported by this driver:
 * Software PEC                         no
@@ -204,6 +205,7 @@
 /* Older devices have their ID defined in <linux/pci_ids.h> */
 #define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS              0x0f12
+#define PCI_DEVICE_ID_INTEL_CDF_SMBUS                   0x18df
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS           0x1c22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS              0x1d22
@@ -1025,6 +1027,7 @@ static const struct pci_device_id i801_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CDF_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
@@ -1513,6 +1516,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
        case PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS:
        case PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS:
        case PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS:
+        case PCI_DEVICE_ID_INTEL_CDF_SMBUS:
        case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
        case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
                priv->features |= FEATURE_I2C_BLOCK_READ;
diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
index 84fb35f6837f..eb1d91b986fd 100644
--- a/drivers/i2c/busses/i2c-img-scb.c
+++ b/drivers/i2c/busses/i2c-img-scb.c
@@ -1459,6 +1459,6 @@ static struct platform_driver img_scb_i2c_driver = {
 };
 module_platform_driver(img_scb_i2c_driver);
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("IMG host I2C driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 22e08ae1704f..25fcc3c1e32b 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -627,6 +627,7 @@ static const struct dev_pm_ops sprd_i2c_pm_ops = {
 static const struct of_device_id sprd_i2c_of_match[] = {
        { .compatible = "sprd,sc9860-i2c", },
+        {},
 };
 static struct platform_driver sprd_i2c_driver = {
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 47c67b0ca896..d4a6e9c2e9aa 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -215,7 +215,7 @@ struct stm32f7_i2c_dev {
        unsigned int msg_num;
        unsigned int msg_id;
        struct stm32f7_i2c_msg f7_msg;
-        struct stm32f7_i2c_setup *setup;
+        struct stm32f7_i2c_setup setup;
        struct stm32f7_i2c_timings timing;
 };
@@ -265,7 +265,7 @@ static struct stm32f7_i2c_spec i2c_specs[] = {
        },
 };
-struct stm32f7_i2c_setup stm32f7_setup = {
+static const struct stm32f7_i2c_setup stm32f7_setup = {
        .rise_time = STM32F7_I2C_RISE_TIME_DEFAULT,
        .fall_time = STM32F7_I2C_FALL_TIME_DEFAULT,
        .dnf = STM32F7_I2C_DNF_DEFAULT,
@@ -537,7 +537,7 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
        writel_relaxed(timing, i2c_dev->base + STM32F7_I2C_TIMINGR);
        /* Enable I2C */
-        if (i2c_dev->setup->analog_filter)
+        if (i2c_dev->setup.analog_filter)
                stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
                                     STM32F7_I2C_CR1_ANFOFF);
        else
@@ -887,22 +887,19 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
        }
        setup = of_device_get_match_data(&pdev->dev);
-        i2c_dev->setup->rise_time = setup->rise_time;
+        i2c_dev->setup = *setup;
-        i2c_dev->setup->fall_time = setup->fall_time;
-        i2c_dev->setup->dnf = setup->dnf;
-        i2c_dev->setup->analog_filter = setup->analog_filter;
        ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
                                       &rise_time);
        if (!ret)
-                i2c_dev->setup->rise_time = rise_time;
+                i2c_dev->setup.rise_time = rise_time;
        ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-falling-time-ns",
                                       &fall_time);
        if (!ret)
-                i2c_dev->setup->fall_time = fall_time;
+                i2c_dev->setup.fall_time = fall_time;
-        ret = stm32f7_i2c_setup_timing(i2c_dev, i2c_dev->setup);
+        ret = stm32f7_i2c_setup_timing(i2c_dev, &i2c_dev->setup);
        if (ret)
                goto clk_free;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 01b2adfd8226..eaf39e5db08b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1451,6 +1451,7 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                if (hwif_init(hwif) == 0) {
                        printk(KERN_INFO "%s: failed to initialize IDE "
                                         "interface\n", hwif->name);
+                        device_unregister(hwif->portdev);
                        device_unregister(&hwif->gendev);
                        ide_disable_port(hwif);
                        continue;
diff --git a/drivers/ide/ide-scan-pci.c b/drivers/ide/ide-scan-pci.c
index 86aa88aeb3a6..acf874800ca4 100644
--- a/drivers/ide/ide-scan-pci.c
+++ b/drivers/ide/ide-scan-pci.c
@@ -56,6 +56,7 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
 {
        struct list_head *l;
        struct pci_driver *d;
+        int ret;
        list_for_each(l, &ide_pci_drivers) {
                d = list_entry(l, struct pci_driver, node);
@@ -63,10 +64,14 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
                        const struct pci_device_id *id =
                                pci_match_id(d->id_table, dev);
-                        if (id != NULL && d->probe(dev, id) >= 0) {
+                        if (id != NULL) {
-                                dev->driver = d;
+                                pci_assign_irq(dev);
-                                pci_dev_get(dev);
+                                ret = d->probe(dev, id);
-                                return 1;
+                                if (ret >= 0) {
+                                        dev->driver = d;
+                                        pci_dev_get(dev);
+                                        return 1;
+                                }
                        }
                }
        }
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 112d2fe1bcdb..fdc8e813170c 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -179,6 +179,7 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
 /**
 *      ide_pci_enable  -       do PCI enables
 *      @dev: PCI device
+ *      @bars: PCI BARs mask
 *      @d: IDE port info
 *
 *      Enable the IDE PCI device. We attempt to enable the device in full
@@ -189,9 +190,10 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
 *      Returns zero on success or an error code
 */
-static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
+static int ide_pci_enable(struct pci_dev *dev, int bars,
+                          const struct ide_port_info *d)
 {
-        int ret, bars;
+        int ret;
        if (pci_enable_device(dev)) {
                ret = pci_enable_device_io(dev);
@@ -216,18 +218,6 @@ static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
                goto out;
        }
-        if (d->host_flags & IDE_HFLAG_SINGLE)
-                bars = (1 << 2) - 1;
-        else
-                bars = (1 << 4) - 1;
-        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
-                if (d->host_flags & IDE_HFLAG_CS5520)
-                        bars |= (1 << 2);
-                else
-                        bars |= (1 << 4);
-        }
        ret = pci_request_selected_regions(dev, bars, d->name);
        if (ret < 0)
                printk(KERN_ERR "%s %s: can't reserve resources\n",
@@ -403,6 +393,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
 /**
 *      ide_setup_pci_controller        -       set up IDE PCI
 *      @dev: PCI device
+ *      @bars: PCI BARs mask
 *      @d: IDE port info
 *      @noisy: verbose flag
 *
@@ -411,7 +402,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
 *      and enables it if need be
 */
-static int ide_setup_pci_controller(struct pci_dev *dev,
+static int ide_setup_pci_controller(struct pci_dev *dev, int bars,
                                    const struct ide_port_info *d, int noisy)
 {
        int ret;
@@ -420,7 +411,7 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
        if (noisy)
                ide_setup_pci_noise(dev, d);
-        ret = ide_pci_enable(dev, d);
+        ret = ide_pci_enable(dev, bars, d);
        if (ret < 0)
                goto out;
@@ -428,16 +419,20 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
        if (ret < 0) {
                printk(KERN_ERR "%s %s: error accessing PCI regs\n",
                        d->name, pci_name(dev));
-                goto out;
+                goto out_free_bars;
        }
        if (!(pcicmd & PCI_COMMAND_IO)) {       /* is device disabled? */
                ret = ide_pci_configure(dev, d);
                if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
                printk(KERN_INFO "%s %s: device enabled (Linux)\n",
                        d->name, pci_name(dev));
        }
+        goto out;
+out_free_bars:
+        pci_release_selected_regions(dev, bars);
 out:
        return ret;
 }
@@ -540,13 +535,28 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
 {
        struct pci_dev *pdev[] = { dev1, dev2 };
        struct ide_host *host;
-        int ret, i, n_ports = dev2 ? 4 : 2;
+        int ret, i, n_ports = dev2 ? 4 : 2, bars;
        struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
+        if (d->host_flags & IDE_HFLAG_SINGLE)
+                bars = (1 << 2) - 1;
+        else
+                bars = (1 << 4) - 1;
+        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
+                if (d->host_flags & IDE_HFLAG_CS5520)
+                        bars |= (1 << 2);
+                else
+                        bars |= (1 << 4);
+        }
        for (i = 0; i < n_ports / 2; i++) {
-                ret = ide_setup_pci_controller(pdev[i], d, !i);
+                ret = ide_setup_pci_controller(pdev[i], bars, d, !i);
-                if (ret < 0)
+                if (ret < 0) {
+                        if (i == 1)
+                                pci_release_selected_regions(pdev[0], bars);
                        goto out;
+                }
                ide_pci_setup_ports(pdev[i], d, &hw[i*2], &hws[i*2]);
        }
@@ -554,7 +564,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
        host = ide_host_alloc(d, hws, n_ports);
        if (host == NULL) {
                ret = -ENOMEM;
-                goto out;
+                goto out_free_bars;
        }
        host->dev[0] = &dev1->dev;
@@ -576,7 +586,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
                 * do_ide_setup_pci_device() on the first device!
                 */
                if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
                /* fixup IRQ */
                if (ide_pci_is_in_compatibility_mode(pdev[i])) {
@@ -589,6 +599,13 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
        ret = ide_host_register(host, d, hws);
        if (ret)
                ide_host_free(host);
+        else
+                goto out;
+out_free_bars:
+        i = n_ports / 2;
+        while (i--)
+                pci_release_selected_regions(pdev[i], bars);
 out:
        return ret;
 }
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index e6706a09e100..47c3d7f32900 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
        unsigned int vref_mv)
 {
        struct ad7793_state *st = iio_priv(indio_dev);
-        int i, ret = -1;
+        int i, ret;
        unsigned long long scale_uv;
        u32 id;
@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
                return ret;
        /* reset the serial interface */
-        ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret));
+        ret = ad_sd_reset(&st->sd, 32);
        if (ret < 0)
                goto out;
        usleep_range(500, 2000); /* Wait for at least 500us */
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index d10bd0c97233..22c4c17cd996 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -177,6 +177,34 @@ out:
 }
 EXPORT_SYMBOL_GPL(ad_sd_read_reg);
+/**
+ * ad_sd_reset() - Reset the serial interface
+ *
+ * @sigma_delta: The sigma delta device
+ * @reset_length: Number of SCLKs with DIN = 1
+ *
+ * Returns 0 on success, an error code otherwise.
+ **/
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length)
+{
+        uint8_t *buf;
+        unsigned int size;
+        int ret;
+        size = DIV_ROUND_UP(reset_length, 8);
+        buf = kcalloc(size, sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        memset(buf, 0xff, size);
+        ret = spi_write(sigma_delta->spi, buf, size);
+        kfree(buf);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ad_sd_reset);
 static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
        unsigned int mode, unsigned int channel)
 {
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index 634717ae12f3..071dd23a33d9 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -17,6 +17,8 @@
 * MCP3204
 * MCP3208
 * ------------
+ * 13 bit converter
+ * MCP3301
 *
 * Datasheet can be found here:
 * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf  mcp3001
@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index,
 }
 static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
-                                  bool differential, int device_index)
+                                  bool differential, int device_index, int *val)
 {
        int ret;
@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
        switch (device_index) {
        case mcp3001:
-                return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                return 0;
        case mcp3002:
        case mcp3004:
        case mcp3008:
-                return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                return 0;
        case mcp3201:
-                return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                return 0;
        case mcp3202:
        case mcp3204:
        case mcp3208:
-                return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                return 0;
        case mcp3301:
-                return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12);
+                *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8
+                                    | adc->rx_buf[1], 12);
+                return 0;
        default:
                return -EINVAL;
        }
@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev,
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
                ret = mcp320x_adc_conversion(adc, channel->address,
-                        channel->differential, device_index);
+                        channel->differential, device_index, val);
                if (ret < 0)
                        goto out;
-                *val = ret;
                ret = IIO_VAL_INT;
                break;
@@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi)
        indio_dev->name = spi_get_device_id(spi)->name;
        indio_dev->modes = INDIO_DIRECT_MODE;
        indio_dev->info = &mcp320x_info;
+        spi_set_drvdata(spi, indio_dev);
        chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data];
        indio_dev->channels = chip_info->channels;
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index e3c15f88075f..4df32cf1650e 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1666,7 +1666,7 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
        num_channels = of_property_count_u32_elems(node, "st,adc-channels");
        if (num_channels < 0 ||
-            num_channels >= adc_info->max_channels) {
+            num_channels > adc_info->max_channels) {
                dev_err(&indio_dev->dev, "Bad st,adc-channels?\n");
                return num_channels < 0 ? num_channels : -EINVAL;
        }
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index d1210024f6bc..e0dc20488335 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -52,7 +52,7 @@
 #define ADS1015_CFG_COMP_QUE_MASK       GENMASK(1, 0)
 #define ADS1015_CFG_COMP_LAT_MASK       BIT(2)
-#define ADS1015_CFG_COMP_POL_MASK       BIT(2)
+#define ADS1015_CFG_COMP_POL_MASK       BIT(3)
 #define ADS1015_CFG_COMP_MODE_MASK      BIT(4)
 #define ADS1015_CFG_DR_MASK     GENMASK(7, 5)
 #define ADS1015_CFG_MOD_MASK    BIT(8)
@@ -1017,10 +1017,12 @@ static int ads1015_probe(struct i2c_client *client,
                switch (irq_trig) {
                case IRQF_TRIGGER_LOW:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                        break;
                case IRQF_TRIGGER_HIGH:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                        break;
                default:
                        return -EINVAL;
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 1edd99f0c5e5..e3cfb91bffc6 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -887,21 +887,27 @@ static int twl4030_madc_probe(struct platform_device *pdev)
        /* Enable 3v1 bias regulator for MADC[3:6] */
        madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1");
-        if (IS_ERR(madc->usb3v1))
+        if (IS_ERR(madc->usb3v1)) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto err_i2c;
+        }
        ret = regulator_enable(madc->usb3v1);
-        if (ret)
+        if (ret) {
                dev_err(madc->dev, "could not enable 3v1 bias regulator\n");
+                goto err_i2c;
+        }
        ret = iio_device_register(iio_dev);
        if (ret) {
                dev_err(&pdev->dev, "could not register iio device\n");
-                goto err_i2c;
+                goto err_usb3v1;
        }
        return 0;
+err_usb3v1:
+        regulator_disable(madc->usb3v1);
 err_i2c:
        twl4030_madc_set_current_generator(madc, 0, 0);
 err_current_generator:
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index d99bb1460fe2..02e833b14db0 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -463,8 +463,17 @@ int st_sensors_set_dataready_irq(struct iio_dev *indio_dev, bool enable)
        u8 drdy_mask;
        struct st_sensor_data *sdata = iio_priv(indio_dev);
-        if (!sdata->sensor_settings->drdy_irq.addr)
+        if (!sdata->sensor_settings->drdy_irq.addr) {
+                /*
+                 * there are some devices (e.g. LIS3MDL) where drdy line is
+                 * routed to a given pin and it is not possible to select a
+                 * different one. Take into account irq status register
+                 * to understand if irq trigger can be properly supported
+                 */
+                if (sdata->sensor_settings->drdy_irq.addr_stat_drdy)
+                        sdata->hw_irq_trigger = enable;
                return 0;
+        }
        /* Enable/Disable the interrupt generator 1. */
        if (sdata->sensor_settings->drdy_irq.ig1.en_addr > 0) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 17ec4cee51dc..a47428b4d31b 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf,
        ret = indio_dev->info->debugfs_reg_access(indio_dev,
                                                  indio_dev->cached_reg_addr,
                                                  0, &val);
-        if (ret)
+        if (ret) {
                dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__);
+                return ret;
+        }
        len = snprintf(buf, sizeof(buf), "0x%X\n", val);
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e68368b5b2a3..08aafba4481c 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -315,6 +315,10 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                                },
                        },
                },
+                .drdy_irq = {
+                        /* drdy line is routed drdy pin */
+                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 0d2ea3ee371b..8f26428804a2 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -573,7 +573,7 @@ static int bmp280_chip_config(struct bmp280_data *data)
        u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) |
                  BMP280_OSRS_PRESS_X(data->oversampling_press + 1);
-        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS,
+        ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
                                 BMP280_OSRS_TEMP_MASK |
                                 BMP280_OSRS_PRESS_MASK |
                                 BMP280_MODE_MASK,
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index 9b9053494daf..eb212f8c8879 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -174,6 +174,7 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
                clk_disable(priv->clk);
        /* Stop timer */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
        regmap_write(priv->regmap, TIM_PSC, 0);
        regmap_write(priv->regmap, TIM_ARR, 0);
@@ -715,8 +716,9 @@ static ssize_t stm32_count_set_preset(struct iio_dev *indio_dev,
        if (ret)
                return ret;
+        /* TIMx_ARR register shouldn't be buffered (ARPE=0) */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
        regmap_write(priv->regmap, TIM_ARR, preset);
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
        return len;
 }
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 30825bb9b8e9..8861c052155a 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -100,6 +100,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
        if (ret)
                goto pid_query_error;
+        nlmsg_end(skb, nlh);
        pr_debug("%s: Multicasting a nlmsg (dev = %s ifname = %s iwpm = %s)\n",
                __func__, pm_msg->dev_name, pm_msg->if_name, iwpm_ulib_name);
@@ -170,6 +172,8 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                &pm_msg->loc_addr, IWPM_NLA_MANAGE_ADDR);
        if (ret)
                goto add_mapping_error;
+        nlmsg_end(skb, nlh);
        nlmsg_request->req_buffer = pm_msg;
        ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -246,6 +250,8 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                &pm_msg->rem_addr, IWPM_NLA_QUERY_REMOTE_ADDR);
        if (ret)
                goto query_mapping_error;
+        nlmsg_end(skb, nlh);
        nlmsg_request->req_buffer = pm_msg;
        ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -308,6 +314,8 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
        if (ret)
                goto remove_mapping_error;
+        nlmsg_end(skb, nlh);
        ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
        if (ret) {
                skb = NULL; /* skb is freed in the netlink send-op handling */
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index c81c55942626..3c4faadb8cdd 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -597,6 +597,9 @@ static int send_mapinfo_num(u32 mapping_num, u8 nl_client, int iwpm_pid)
                                &mapping_num, IWPM_NLA_MAPINFO_SEND_NUM);
        if (ret)
                goto mapinfo_num_error;
+        nlmsg_end(skb, nlh);
        ret = rdma_nl_unicast(skb, iwpm_pid);
        if (ret) {
                skb = NULL;
@@ -678,6 +681,8 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid)
                        if (ret)
                                goto send_mapping_info_unlock;
+                        nlmsg_end(skb, nlh);
                        iwpm_print_sockaddr(&map_info->local_sockaddr,
                                "send_mapping_info: Local sockaddr:");
                        iwpm_print_sockaddr(&map_info->mapped_sockaddr,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 70ad19c4c73e..88bdafb297f5 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -432,8 +432,10 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
        atomic_set(&qp->qp_sec->error_list_count, 0);
        init_completion(&qp->qp_sec->error_complete);
        ret = security_ib_alloc_security(&qp->qp_sec->security);
-        if (ret)
+        if (ret) {
                kfree(qp->qp_sec);
+                qp->qp_sec = NULL;
+        }
        return ret;
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 4ab30d832ac5..52a2cf2d83aa 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3869,15 +3869,15 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
        resp.raw_packet_caps = attr.raw_packet_caps;
        resp.response_length += sizeof(resp.raw_packet_caps);
-        if (ucore->outlen < resp.response_length + sizeof(resp.xrq_caps))
+        if (ucore->outlen < resp.response_length + sizeof(resp.tm_caps))
                goto end;
-        resp.xrq_caps.max_rndv_hdr_size = attr.xrq_caps.max_rndv_hdr_size;
+        resp.tm_caps.max_rndv_hdr_size  = attr.tm_caps.max_rndv_hdr_size;
-        resp.xrq_caps.max_num_tags      = attr.xrq_caps.max_num_tags;
+        resp.tm_caps.max_num_tags       = attr.tm_caps.max_num_tags;
-        resp.xrq_caps.max_ops           = attr.xrq_caps.max_ops;
+        resp.tm_caps.max_ops            = attr.tm_caps.max_ops;
-        resp.xrq_caps.max_sge           = attr.xrq_caps.max_sge;
+        resp.tm_caps.max_sge            = attr.tm_caps.max_sge;
-        resp.xrq_caps.flags             = attr.xrq_caps.flags;
+        resp.tm_caps.flags              = attr.tm_caps.flags;
-        resp.response_length += sizeof(resp.xrq_caps);
+        resp.response_length += sizeof(resp.tm_caps);
 end:
        err = ib_copy_to_udata(ucore, &resp, resp.response_length);
        return err;
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b2ed4b9cda6e..0be42787759f 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1066,6 +1066,8 @@ static int read_idle_sma(struct hfi1_devdata *dd, u64 *data);
 static int thermal_init(struct hfi1_devdata *dd);
 static void update_statusp(struct hfi1_pportdata *ppd, u32 state);
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs);
 static int wait_logical_linkstate(struct hfi1_pportdata *ppd, u32 state,
                                  int msecs);
 static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
@@ -8238,6 +8240,7 @@ static irqreturn_t general_interrupt(int irq, void *data)
        u64 regs[CCE_NUM_INT_CSRS];
        u32 bit;
        int i;
+        irqreturn_t handled = IRQ_NONE;
        this_cpu_inc(*dd->int_counter);
@@ -8258,9 +8261,10 @@ static irqreturn_t general_interrupt(int irq, void *data)
        for_each_set_bit(bit, (unsigned long *)&regs[0],
                         CCE_NUM_INT_CSRS * 64) {
                is_interrupt(dd, bit);
+                handled = IRQ_HANDLED;
        }
-        return IRQ_HANDLED;
+        return handled;
 }
 static irqreturn_t sdma_interrupt(int irq, void *data)
@@ -9413,7 +9417,7 @@ static void set_qsfp_int_n(struct hfi1_pportdata *ppd, u8 enable)
        write_csr(dd, dd->hfi1_id ? ASIC_QSFP2_MASK : ASIC_QSFP1_MASK, mask);
 }
-void reset_qsfp(struct hfi1_pportdata *ppd)
+int reset_qsfp(struct hfi1_pportdata *ppd)
 {
        struct hfi1_devdata *dd = ppd->dd;
        u64 mask, qsfp_mask;
@@ -9443,6 +9447,13 @@ void reset_qsfp(struct hfi1_pportdata *ppd)
         * for alarms and warnings
         */
        set_qsfp_int_n(ppd, 1);
+        /*
+         * After the reset, AOC transmitters are enabled by default. They need
+         * to be turned off to complete the QSFP setup before they can be
+         * enabled again.
+         */
+        return set_qsfp_tx(ppd, 0);
 }
 static int handle_qsfp_error_conditions(struct hfi1_pportdata *ppd,
@@ -10305,6 +10316,7 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
 {
        struct hfi1_devdata *dd = ppd->dd;
        u32 previous_state;
+        int offline_state_ret;
        int ret;
        update_lcb_cache(dd);
@@ -10326,28 +10338,11 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                ppd->offline_disabled_reason =
                HFI1_ODR_MASK(OPA_LINKDOWN_REASON_TRANSIENT);
-        /*
+        offline_state_ret = wait_phys_link_offline_substates(ppd, 10000);
-         * Wait for offline transition. It can take a while for
+        if (offline_state_ret < 0)
-         * the link to go down.
+                return offline_state_ret;
-         */
-        ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 10000);
-        if (ret < 0)
-                return ret;
-        /*
-         * Now in charge of LCB - must be after the physical state is
-         * offline.quiet and before host_link_state is changed.
-         */
-        set_host_lcb_access(dd);
-        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
-        /* make sure the logical state is also down */
-        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
-        if (ret)
-                force_logical_link_state_down(ppd);
-        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+        /* Disabling AOC transmitters */
        if (ppd->port_type == PORT_TYPE_QSFP &&
            ppd->qsfp_info.limiting_active &&
            qsfp_mod_present(ppd)) {
@@ -10365,6 +10360,30 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
        }
        /*
+         * Wait for the offline.Quiet transition if it hasn't happened yet. It
+         * can take a while for the link to go down.
+         */
+        if (offline_state_ret != PLS_OFFLINE_QUIET) {
+                ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 30000);
+                if (ret < 0)
+                        return ret;
+        }
+        /*
+         * Now in charge of LCB - must be after the physical state is
+         * offline.quiet and before host_link_state is changed.
+         */
+        set_host_lcb_access(dd);
+        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
+        /* make sure the logical state is also down */
+        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
+        if (ret)
+                force_logical_link_state_down(ppd);
+        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+        /*
         * The LNI has a mandatory wait time after the physical state
         * moves to Offline.Quiet.  The wait time may be different
         * depending on how the link went down.  The 8051 firmware
@@ -10396,6 +10415,9 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                        & (HLS_DN_POLL | HLS_VERIFY_CAP | HLS_GOING_UP)) {
                /* went down while attempting link up */
                check_lni_states(ppd);
+                /* The QSFP doesn't need to be reset on LNI failure */
+                ppd->qsfp_info.reset_needed = 0;
        }
        /* the active link width (downgrade) is 0 on link down */
@@ -12804,6 +12826,39 @@ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
        return 0;
 }
+/*
+ * wait_phys_link_offline_quiet_substates - wait for any offline substate
+ * @ppd: port device
+ * @msecs: the number of milliseconds to wait
+ *
+ * Wait up to msecs milliseconds for any offline physical link
+ * state change to occur.
+ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
+ */
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs)
+{
+        u32 read_state;
+        unsigned long timeout;
+        timeout = jiffies + msecs_to_jiffies(msecs);
+        while (1) {
+                read_state = read_physical_state(ppd->dd);
+                if ((read_state & 0xF0) == PLS_OFFLINE)
+                        break;
+                if (time_after(jiffies, timeout)) {
+                        dd_dev_err(ppd->dd,
+                                   "timeout waiting for phy link offline.quiet substates. Read state 0x%x, %dms\n",
+                                   read_state, msecs);
+                        return -ETIMEDOUT;
+                }
+                usleep_range(1950, 2050); /* sleep 2ms-ish */
+        }
+        log_state_transition(ppd, read_state);
+        return read_state;
+}
 #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
 (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index b8345a60a0fb..50b8645d0b87 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -204,6 +204,7 @@
 #define PLS_OFFLINE_READY_TO_QUIET_LT      0x92
 #define PLS_OFFLINE_REPORT_FAILURE                 0x93
 #define PLS_OFFLINE_READY_TO_QUIET_BCC     0x94
+#define PLS_OFFLINE_QUIET_DURATION         0x95
 #define PLS_POLLING                                0x20
 #define PLS_POLLING_QUIET                          0x20
 #define PLS_POLLING_ACTIVE                         0x21
@@ -722,7 +723,7 @@ void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
 void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
-void reset_qsfp(struct hfi1_pportdata *ppd);
+int reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
 void start_freeze_handling(struct hfi1_pportdata *ppd, int flags);
 int send_idle_sma(struct hfi1_devdata *dd, u64 message);
diff --git a/drivers/infiniband/hw/hfi1/eprom.c b/drivers/infiniband/hw/hfi1/eprom.c
index d46b17107901..1613af1c58d9 100644
--- a/drivers/infiniband/hw/hfi1/eprom.c
+++ b/drivers/infiniband/hw/hfi1/eprom.c
@@ -204,7 +204,10 @@ done_asic:
        return ret;
 }
-/* magic character sequence that trails an image */
+/* magic character sequence that begins an image */
+#define IMAGE_START_MAGIC "APO="
+/* magic character sequence that might trail an image */
 #define IMAGE_TRAIL_MAGIC "egamiAPO"
 /* EPROM file types */
@@ -250,6 +253,7 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
 {
        void *buffer;
        void *p;
+        u32 length;
        int ret;
        buffer = kmalloc(P1_SIZE, GFP_KERNEL);
@@ -262,15 +266,21 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
                return ret;
        }
-        /* scan for image magic that may trail the actual data */
+        /* config partition is valid only if it starts with IMAGE_START_MAGIC */
-        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
+        if (memcmp(buffer, IMAGE_START_MAGIC, strlen(IMAGE_START_MAGIC))) {
-        if (!p) {
                kfree(buffer);
                return -ENOENT;
        }
+        /* scan for image magic that may trail the actual data */
+        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
+        if (p)
+                length = p - buffer;
+        else
+                length = P1_SIZE;
        *data = buffer;
-        *size = p - buffer;
+        *size = length;
        return 0;
 }
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 2bc89260235a..d9a1e9893136 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo)
        switch (ret) {
        case 0:
                ret = setup_base_ctxt(fd, uctxt);
-                if (uctxt->subctxt_cnt) {
+                if (ret)
-                        /*
+                        deallocate_ctxt(uctxt);
-                         * Base context is done (successfully or not), notify
-                         * anybody using a sub-context that is waiting for
-                         * this completion.
-                         */
-                        clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
-                        wake_up(&uctxt->wait);
-                }
                break;
        case 1:
                ret = complete_subctxt(fd);
@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
        /* Now allocate the RcvHdr queue and eager buffers. */
        ret = hfi1_create_rcvhdrq(dd, uctxt);
        if (ret)
-                return ret;
+                goto done;
        ret = hfi1_setup_eagerbufs(uctxt);
        if (ret)
-                goto setup_failed;
+                goto done;
        /* If sub-contexts are enabled, do the appropriate setup */
        if (uctxt->subctxt_cnt)
                ret = setup_subctxt(uctxt);
        if (ret)
-                goto setup_failed;
+                goto done;
        ret = hfi1_alloc_ctxt_rcv_groups(uctxt);
        if (ret)
-                goto setup_failed;
+                goto done;
        ret = init_user_ctxt(fd, uctxt);
        if (ret)
-                goto setup_failed;
+                goto done;
        user_init(uctxt);
@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
        fd->uctxt = uctxt;
        hfi1_rcd_get(uctxt);
-        return 0;
+done:
+        if (uctxt->subctxt_cnt) {
+                /*
+                 * On error, set the failed bit so sub-contexts will clean up
+                 * correctly.
+                 */
+                if (ret)
+                        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
-setup_failed:
+                /*
-        /* Set the failed bit so sub-context init can do the right thing */
+                 * Base context is done (successfully or not), notify anybody
-        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
+                 * using a sub-context that is waiting for this completion.
-        deallocate_ctxt(uctxt);
+                 */
+                clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
+                wake_up(&uctxt->wait);
+        }
        return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 82447b7cdda1..09e50fd2a08f 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -68,7 +68,7 @@
 /*
 * Code to adjust PCIe capabilities.
 */
-static int tune_pcie_caps(struct hfi1_devdata *);
+static void tune_pcie_caps(struct hfi1_devdata *);
 /*
 * Do all the common PCIe setup and initialization.
@@ -351,7 +351,7 @@ int pcie_speeds(struct hfi1_devdata *dd)
 */
 int request_msix(struct hfi1_devdata *dd, u32 msireq)
 {
-        int nvec, ret;
+        int nvec;
        nvec = pci_alloc_irq_vectors(dd->pcidev, 1, msireq,
                                     PCI_IRQ_MSIX | PCI_IRQ_LEGACY);
@@ -360,12 +360,7 @@ int request_msix(struct hfi1_devdata *dd, u32 msireq)
                return nvec;
        }
-        ret = tune_pcie_caps(dd);
+        tune_pcie_caps(dd);
-        if (ret) {
-                dd_dev_err(dd, "tune_pcie_caps() failed: %d\n", ret);
-                pci_free_irq_vectors(dd->pcidev);
-                return ret;
-        }
        /* check for legacy IRQ */
        if (nvec == 1 && !dd->pcidev->msix_enabled)
@@ -502,7 +497,7 @@ uint aspm_mode = ASPM_MODE_DISABLED;
 module_param_named(aspm, aspm_mode, uint, S_IRUGO);
 MODULE_PARM_DESC(aspm, "PCIe ASPM: 0: disable, 1: enable, 2: dynamic");
-static int tune_pcie_caps(struct hfi1_devdata *dd)
+static void tune_pcie_caps(struct hfi1_devdata *dd)
 {
        struct pci_dev *parent;
        u16 rc_mpss, rc_mps, ep_mpss, ep_mps;
@@ -513,22 +508,14 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
         * Turn on extended tags in DevCtl in case the BIOS has turned it off
         * to improve WFR SDMA bandwidth
         */
-        ret = pcie_capability_read_word(dd->pcidev,
+        ret = pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &ectl);
-                                        PCI_EXP_DEVCTL, &ectl);
+        if ((!ret) && !(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
-        if (ret) {
-                dd_dev_err(dd, "Unable to read from PCI config\n");
-                return ret;
-        }
-        if (!(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
                dd_dev_info(dd, "Enabling PCIe extended tags\n");
                ectl |= PCI_EXP_DEVCTL_EXT_TAG;
                ret = pcie_capability_write_word(dd->pcidev,
                                                 PCI_EXP_DEVCTL, ectl);
-                if (ret) {
+                if (ret)
-                        dd_dev_err(dd, "Unable to write to PCI config\n");
+                        dd_dev_info(dd, "Unable to write to PCI config\n");
-                        return ret;
-                }
        }
        /* Find out supported and configured values for parent (root) */
        parent = dd->pcidev->bus->self;
@@ -536,15 +523,22 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
         * The driver cannot perform the tuning if it does not have
         * access to the upstream component.
         */
-        if (!parent)
+        if (!parent) {
-                return -EINVAL;
+                dd_dev_info(dd, "Parent not found\n");
+                return;
+        }
        if (!pci_is_root_bus(parent->bus)) {
                dd_dev_info(dd, "Parent not root\n");
-                return -EINVAL;
+                return;
+        }
+        if (!pci_is_pcie(parent)) {
+                dd_dev_info(dd, "Parent is not PCI Express capable\n");
+                return;
+        }
+        if (!pci_is_pcie(dd->pcidev)) {
+                dd_dev_info(dd, "PCI device is not PCI Express capable\n");
+                return;
        }
-        if (!pci_is_pcie(parent) || !pci_is_pcie(dd->pcidev))
-                return -EINVAL;
        rc_mpss = parent->pcie_mpss;
        rc_mps = ffs(pcie_get_mps(parent)) - 8;
        /* Find out supported and configured values for endpoint (us) */
@@ -590,8 +584,6 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
                ep_mrrs = max_mrrs;
                pcie_set_readrq(dd->pcidev, ep_mrrs);
        }
-        return 0;
 }
 /* End of PCIe capability tuning */
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index a8af96d2b1b0..d486355880cb 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -790,7 +790,9 @@ static int tune_active_qsfp(struct hfi1_pportdata *ppd, u32 *ptr_tx_preset,
         * reuse of stale settings established in our previous pass through.
         */
        if (ppd->qsfp_info.reset_needed) {
-                reset_qsfp(ppd);
+                ret = reset_qsfp(ppd);
+                if (ret)
+                        return ret;
                refresh_qsfp_cache(ppd, &ppd->qsfp_info);
        } else {
                ppd->qsfp_info.reset_needed = 1;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index d1f5345f04f0..42ca5346777d 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -48,7 +48,7 @@
 * @wqe: cqp wqe for header
 * @header: header for the cqp wqe
 */
-static inline void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
 {
        wmb();            /* make sure WQE is populated before polarity is set */
        set_64bit_val(wqe, 24, header);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_p.h b/drivers/infiniband/hw/i40iw/i40iw_p.h
index e217a1259f57..5498ad01c280 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_p.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_p.h
@@ -59,6 +59,8 @@ enum i40iw_status_code i40iw_sc_mr_fast_register(struct i40iw_sc_qp *qp,
                                                 struct i40iw_fast_reg_stag_info *info,
                                                 bool post_sq);
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header);
 /* HMC/FPM functions */
 enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev,
                                            u8 hmc_fn_id);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index c2cab20c4bc5..59f70676f0e0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -123,12 +123,11 @@ static void i40iw_puda_post_recvbuf(struct i40iw_puda_rsrc *rsrc, u32 wqe_idx,
                get_64bit_val(wqe, 24, &offset24);
        offset24 = (offset24) ? 0 : LS_64(1, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, offset24);
        set_64bit_val(wqe, 0, buf->mem.pa);
        set_64bit_val(wqe, 8,
                      LS_64(buf->mem.size, I40IWQPSQ_FRAG_LEN));
-        set_64bit_val(wqe, 24, offset24);
+        i40iw_insert_wqe_hdr(wqe, offset24);
 }
 /**
@@ -409,9 +408,7 @@ enum i40iw_status_code i40iw_puda_send(struct i40iw_sc_qp *qp,
        set_64bit_val(wqe, 8, LS_64(info->len, I40IWQPSQ_FRAG_LEN));
        set_64bit_val(wqe, 16, header[0]);
-        /* Ensure all data is written before writing valid bit */
+        i40iw_insert_wqe_hdr(wqe, header[1]);
-        wmb();
-        set_64bit_val(wqe, 24, header[1]);
        i40iw_debug_buf(qp->dev, I40IW_DEBUG_PUDA, "PUDA SEND WQE", wqe, 32);
        i40iw_qp_post_wr(&qp->qp_uk);
@@ -539,7 +536,7 @@ static enum i40iw_status_code i40iw_puda_qp_wqe(struct i40iw_sc_dev *dev, struct
                 LS_64(2, I40IW_CQPSQ_QP_NEXTIWSTATE) |
                 LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
        i40iw_debug_buf(cqp->dev, I40IW_DEBUG_PUDA, "PUDA CQE", wqe, 32);
        i40iw_sc_cqp_post_sq(cqp);
@@ -655,7 +652,7 @@ static enum i40iw_status_code i40iw_puda_cq_wqe(struct i40iw_sc_dev *dev, struct
            LS_64(1, I40IW_CQPSQ_CQ_ENCEQEMASK) |
            LS_64(1, I40IW_CQPSQ_CQ_CEQIDVALID) |
            LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
        i40iw_debug_buf(dev, I40IW_DEBUG_PUDA, "PUDA CQE",
                        wqe, I40IW_CQP_WQE_SIZE * 8);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 28b3d02d511b..62be0a41ad0b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -826,12 +826,14 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
        attr->cap.max_inline_data = I40IW_MAX_INLINE_DATA_SIZE;
        attr->cap.max_send_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
        attr->cap.max_recv_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
+        attr->port_num = 1;
        init_attr->event_handler = iwqp->ibqp.event_handler;
        init_attr->qp_context = iwqp->ibqp.qp_context;
        init_attr->send_cq = iwqp->ibqp.send_cq;
        init_attr->recv_cq = iwqp->ibqp.recv_cq;
        init_attr->srq = iwqp->ibqp.srq;
        init_attr->cap = attr->cap;
+        init_attr->port_num = 1;
        return 0;
 }
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 05fb4bdff6a0..552f7bd4ecc3 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -778,13 +778,13 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
        }
        if (MLX5_CAP_GEN(mdev, tag_matching)) {
-                props->xrq_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+                props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
-                props->xrq_caps.max_num_tags =
+                props->tm_caps.max_num_tags =
                        (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
-                props->xrq_caps.flags = IB_TM_CAP_RC;
+                props->tm_caps.flags = IB_TM_CAP_RC;
-                props->xrq_caps.max_ops =
+                props->tm_caps.max_ops =
                        1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-                props->xrq_caps.max_sge = MLX5_TM_MAX_SGE;
+                props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
        }
        if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
@@ -4174,9 +4174,9 @@ err_bfreg:
 err_uar_page:
        mlx5_put_uars_page(dev->mdev, dev->mdev->priv.uar);
-err_cnt:
-        mlx5_ib_cleanup_cong_debugfs(dev);
 err_cong:
+        mlx5_ib_cleanup_cong_debugfs(dev);
+err_cnt:
        if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt))
                mlx5_ib_dealloc_counters(dev);
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 914f212e7ef6..f3dbd75a0a96 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -50,13 +50,9 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
 {
        unsigned long tmp;
        unsigned long m;
-        int i, k;
+        u64 base = ~0, p = 0;
-        u64 base = 0;
+        u64 len, pfn;
-        int p = 0;
+        int i = 0;
-        int skip;
-        int mask;
-        u64 len;
-        u64 pfn;
        struct scatterlist *sg;
        int entry;
        unsigned long page_shift = umem->page_shift;
@@ -76,33 +72,24 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
        m = find_first_bit(&tmp, BITS_PER_LONG);
        if (max_page_shift)
                m = min_t(unsigned long, max_page_shift - page_shift, m);
-        skip = 1 << m;
-        mask = skip - 1;
-        i = 0;
        for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                len = sg_dma_len(sg) >> page_shift;
                pfn = sg_dma_address(sg) >> page_shift;
-                for (k = 0; k < len; k++) {
+                if (base + p != pfn) {
-                        if (!(i & mask)) {
+                        /* If either the offset or the new
-                                tmp = (unsigned long)pfn;
+                         * base are unaligned update m
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
+                         */
-                                skip = 1 << m;
+                        tmp = (unsigned long)(pfn | p);
-                                mask = skip - 1;
+                        if (!IS_ALIGNED(tmp, 1 << m))
-                                base = pfn;
+                                m = find_first_bit(&tmp, BITS_PER_LONG);
-                                p = 0;
-                        } else {
+                        base = pfn;
-                                if (base + p != pfn) {
+                        p = 0;
-                                        tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, BITS_PER_LONG);
-                                        skip = 1 << m;
-                                        mask = skip - 1;
-                                        base = pfn;
-                                        p = 0;
-                                }
-                        }
-                        p++;
-                        i++;
                }
+                p += len;
+                i += len;
        }
        if (i) {
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 0e2789d9bb4d..37bbc543847a 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -47,7 +47,8 @@ enum {
 #define MLX5_UMR_ALIGN 2048
-static int clean_mr(struct mlx5_ib_mr *mr);
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
@@ -1270,8 +1271,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                err = mlx5_ib_update_xlt(mr, 0, ncont, page_shift,
                                         update_xlt_flags);
                if (err) {
-                        mlx5_ib_dereg_mr(&mr->ibmr);
+                        dereg_mr(dev, mr);
                        return ERR_PTR(err);
                }
        }
@@ -1356,7 +1358,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                  &npages, &page_shift, &ncont, &order);
                if (err < 0) {
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                        return err;
                }
        }
@@ -1410,7 +1412,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                if (err) {
                        mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                        ib_umem_release(mr->umem);
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                        return err;
                }
        }
@@ -1469,9 +1471,8 @@ mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
        }
 }
-static int clean_mr(struct mlx5_ib_mr *mr)
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
        int allocated_from_cache = mr->allocated_from_cache;
        int err;
@@ -1507,10 +1508,8 @@ static int clean_mr(struct mlx5_ib_mr *mr)
        return 0;
 }
-int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
-        struct mlx5_ib_mr *mr = to_mmr(ibmr);
        int npages = mr->npages;
        struct ib_umem *umem = mr->umem;
@@ -1539,7 +1538,7 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
        }
 #endif
-        clean_mr(mr);
+        clean_mr(dev, mr);
        if (umem) {
                ib_umem_release(umem);
@@ -1549,6 +1548,14 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
        return 0;
 }
+int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+{
+        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
+        struct mlx5_ib_mr *mr = to_mmr(ibmr);
+        return dereg_mr(dev, mr);
+}
 struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
                               enum ib_mr_type mr_type,
                               u32 max_num_sg)
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index f0dc5f4aa177..442b9bdc0f03 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -3232,7 +3232,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                            mr->ibmr.iova);
                        set_wqe_32bit_value(wqe->wqe_words,
                                            NES_IWARP_SQ_FMR_WQE_LENGTH_LOW_IDX,
-                                            mr->ibmr.length);
+                                            lower_32_bits(mr->ibmr.length));
                        set_wqe_32bit_value(wqe->wqe_words,
                                            NES_IWARP_SQ_FMR_WQE_LENGTH_HIGH_IDX, 0);
                        set_wqe_32bit_value(wqe->wqe_words,
@@ -3274,7 +3274,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                            mr->npages * 8);
                        nes_debug(NES_DBG_IW_TX, "SQ_REG_MR: iova_start: %llx, "
-                                  "length: %d, rkey: %0x, pgl_paddr: %llx, "
+                                  "length: %lld, rkey: %0x, pgl_paddr: %llx, "
                                  "page_list_len: %u, wqe_misc: %x\n",
                                  (unsigned long long) mr->ibmr.iova,
                                  mr->ibmr.length,
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index b2bb42e2805d..254083b524bd 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -387,7 +387,7 @@ struct qedr_qp {
                u8 wqe_size;
                u8 smac[ETH_ALEN];
-                u16 vlan_id;
+                u16 vlan;
                int rc;
        } *rqe_wr_id;
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 4689e802b332..ad8965397cf7 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -105,7 +105,7 @@ void qedr_ll2_complete_rx_packet(void *cxt,
        qp->rqe_wr_id[qp->rq.gsi_cons].rc = data->u.data_length_error ?
                -EINVAL : 0;
-        qp->rqe_wr_id[qp->rq.gsi_cons].vlan_id = data->vlan;
+        qp->rqe_wr_id[qp->rq.gsi_cons].vlan = data->vlan;
        /* note: length stands for data length i.e. GRH is excluded */
        qp->rqe_wr_id[qp->rq.gsi_cons].sg_list[0].length =
                data->length.data_length;
@@ -694,6 +694,7 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
        struct qedr_cq *cq = get_qedr_cq(ibcq);
        struct qedr_qp *qp = dev->gsi_qp;
        unsigned long flags;
+        u16 vlan_id;
        int i = 0;
        spin_lock_irqsave(&cq->cq_lock, flags);
@@ -712,9 +713,14 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                wc[i].wc_flags |= IB_WC_GRH | IB_WC_IP_CSUM_OK;
                ether_addr_copy(wc[i].smac, qp->rqe_wr_id[qp->rq.cons].smac);
                wc[i].wc_flags |= IB_WC_WITH_SMAC;
-                if (qp->rqe_wr_id[qp->rq.cons].vlan_id) {
+                vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan &
+                          VLAN_VID_MASK;
+                if (vlan_id) {
                        wc[i].wc_flags |= IB_WC_WITH_VLAN;
-                        wc[i].vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan_id;
+                        wc[i].vlan_id = vlan_id;
+                        wc[i].sl = (qp->rqe_wr_id[qp->rq.cons].vlan &
+                                    VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
                }
                qedr_inc_sw_cons(&qp->rq);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2e075377242e..6cd61638b441 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1000,19 +1000,6 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
                 */
                priv->dev->broadcast[8] = priv->pkey >> 8;
                priv->dev->broadcast[9] = priv->pkey & 0xff;
-                /*
-                 * Update the broadcast address in the priv->broadcast object,
-                 * in case it already exists, otherwise no one will do that.
-                 */
-                if (priv->broadcast) {
-                        spin_lock_irq(&priv->lock);
-                        memcpy(priv->broadcast->mcmember.mgid.raw,
-                               priv->dev->broadcast + 4,
-                        sizeof(union ib_gid));
-                        spin_unlock_irq(&priv->lock);
-                }
                return 0;
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index bac95b509a9b..dcc77014018d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2180,6 +2180,7 @@ static struct net_device *ipoib_add_port(const char *format,
 {
        struct ipoib_dev_priv *priv;
        struct ib_port_attr attr;
+        struct rdma_netdev *rn;
        int result = -ENOMEM;
        priv = ipoib_intf_alloc(hca, port, format);
@@ -2279,7 +2280,8 @@ register_failed:
        ipoib_dev_cleanup(priv->dev);
 device_init_failed:
-        free_netdev(priv->dev);
+        rn = netdev_priv(priv->dev);
+        rn->free_rdma_netdev(priv->dev);
        kfree(priv);
 alloc_mem_failed:
@@ -2328,7 +2330,7 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                return;
        list_for_each_entry_safe(priv, tmp, dev_list, list) {
-                struct rdma_netdev *rn = netdev_priv(priv->dev);
+                struct rdma_netdev *parent_rn = netdev_priv(priv->dev);
                ib_unregister_event_handler(&priv->event_handler);
                flush_workqueue(ipoib_workqueue);
@@ -2350,10 +2352,15 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                unregister_netdev(priv->dev);
                mutex_unlock(&priv->sysfs_mutex);
-                rn->free_rdma_netdev(priv->dev);
+                parent_rn->free_rdma_netdev(priv->dev);
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) {
+                        struct rdma_netdev *child_rn;
-                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        child_rn = netdev_priv(cpriv->dev);
+                        child_rn->free_rdma_netdev(cpriv->dev);
                        kfree(cpriv);
+                }
                kfree(priv);
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 9927cd6b7082..55a9b71ed05a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -141,14 +141,17 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
                return restart_syscall();
        }
-        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
-        if (!priv) {
                rtnl_unlock();
                mutex_unlock(&ppriv->sysfs_mutex);
-                return -ENOMEM;
+                return restart_syscall();
        }
-        down_write(&ppriv->vlan_rwsem);
+        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
+        if (!priv) {
+                result = -ENOMEM;
+                goto out;
+        }
        /*
         * First ensure this isn't a duplicate. We check the parent device and
@@ -175,8 +178,11 @@ out:
        rtnl_unlock();
        mutex_unlock(&ppriv->sysfs_mutex);
-        if (result) {
+        if (result && priv) {
-                free_netdev(priv->dev);
+                struct rdma_netdev *rn;
+                rn = netdev_priv(priv->dev);
+                rn->free_rdma_netdev(priv->dev);
                kfree(priv);
        }
@@ -204,7 +210,12 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                return restart_syscall();
        }
-        down_write(&ppriv->vlan_rwsem);
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
+                rtnl_unlock();
+                mutex_unlock(&ppriv->sysfs_mutex);
+                return restart_syscall();
+        }
        list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                if (priv->pkey == pkey &&
                    priv->child_type == IPOIB_LEGACY_CHILD) {
@@ -224,7 +235,10 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
        mutex_unlock(&ppriv->sysfs_mutex);
        if (dev) {
-                free_netdev(dev);
+                struct rdma_netdev *rn;
+                rn = netdev_priv(dev);
+                rn->free_rdma_netdev(priv->dev);
                kfree(priv);
                return 0;
        }
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9c3e9ab53a41..322209d5ff58 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -154,7 +154,7 @@ static void iser_dump_page_vec(struct iser_page_vec *page_vec)
 {
        int i;
-        iser_err("page vec npages %d data length %d\n",
+        iser_err("page vec npages %d data length %lld\n",
                 page_vec->npages, page_vec->fake_mr.length);
        for (i = 0; i < page_vec->npages; i++)
                iser_err("vec[%d]: %llx\n", i, page_vec->pages[i]);
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 382de42b8359..6fe2d0346073 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -874,7 +874,7 @@ static bool copy_device_table(void)
                hi = readl(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET + 4);
                entry = (((u64) hi) << 32) + lo;
                if (last_entry && last_entry != entry) {
-                        pr_err("IOMMU:%d should use the same dev table as others!/n",
+                        pr_err("IOMMU:%d should use the same dev table as others!\n",
                                iommu->index);
                        return false;
                }
@@ -882,7 +882,7 @@ static bool copy_device_table(void)
                old_devtb_size = ((entry & ~PAGE_MASK) + 1) << 12;
                if (old_devtb_size != dev_table_size) {
-                        pr_err("The device table size of IOMMU:%d is not expected!/n",
+                        pr_err("The device table size of IOMMU:%d is not expected!\n",
                                iommu->index);
                        return false;
                }
@@ -890,7 +890,7 @@ static bool copy_device_table(void)
        old_devtb_phys = entry & PAGE_MASK;
        if (old_devtb_phys >= 0x100000000ULL) {
-                pr_err("The address of old device table is above 4G, not trustworthy!/n");
+                pr_err("The address of old device table is above 4G, not trustworthy!\n");
                return false;
        }
        old_devtb = memremap(old_devtb_phys, dev_table_size, MEMREMAP_WB);
@@ -901,7 +901,7 @@ static bool copy_device_table(void)
        old_dev_tbl_cpy = (void *)__get_free_pages(gfp_flag,
                                get_order(dev_table_size));
        if (old_dev_tbl_cpy == NULL) {
-                pr_err("Failed to allocate memory for copying old device table!/n");
+                pr_err("Failed to allocate memory for copying old device table!\n");
                return false;
        }
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index d665d0dc16e8..6961fc393f0b 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -245,7 +245,7 @@ static void __arm_v7s_free_table(void *table, int lvl,
 static void __arm_v7s_pte_sync(arm_v7s_iopte *ptep, int num_entries,
                               struct io_pgtable_cfg *cfg)
 {
-        if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA))
+        if (cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)
                return;
        dma_sync_single_for_device(cfg->iommu_dev, __arm_v7s_dma_addr(ptep),
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index bd515be5b380..16d33ac19db0 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -371,7 +371,8 @@ static int mtk_iommu_map(struct iommu_domain *domain, unsigned long iova,
        int ret;
        spin_lock_irqsave(&dom->pgtlock, flags);
-        ret = dom->iop->map(dom->iop, iova, paddr, size, prot);
+        ret = dom->iop->map(dom->iop, iova, paddr & DMA_BIT_MASK(32),
+                            size, prot);
        spin_unlock_irqrestore(&dom->pgtlock, flags);
        return ret;
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 40159ac12ac8..c90976d7e53c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -175,14 +175,13 @@ static void gic_mask_irq(struct irq_data *d)
 static void gic_unmask_irq(struct irq_data *d)
 {
-        struct cpumask *affinity = irq_data_get_affinity_mask(d);
        unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
        unsigned int cpu;
        write_gic_smask(intr);
        gic_clear_pcpu_masks(intr);
-        cpu = cpumask_first_and(affinity, cpu_online_mask);
+        cpu = cpumask_first(irq_data_get_effective_affinity_mask(d));
        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
 }
@@ -420,13 +419,17 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
                                     irq_hw_number_t hw, unsigned int cpu)
 {
        int intr = GIC_HWIRQ_TO_SHARED(hw);
+        struct irq_data *data;
        unsigned long flags;
+        data = irq_get_irq_data(virq);
        spin_lock_irqsave(&gic_lock, flags);
        write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
        write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
        gic_clear_pcpu_masks(intr);
        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
+        irq_data_update_effective_affinity(data, cpumask_of(cpu));
        spin_unlock_irqrestore(&gic_lock, flags);
        return 0;
@@ -645,7 +648,7 @@ static int __init gic_of_init(struct device_node *node,
        /* Find the first available CPU vector. */
        i = 0;
-        reserved = (C_SW0 | C_SW1) >> __fls(C_SW0);
+        reserved = (C_SW0 | C_SW1) >> __ffs(C_SW0);
        while (!of_property_read_u32_index(node, "mti,reserved-cpu-vectors",
                                           i++, &cpu_vec))
                reserved |= BIT(cpu_vec);
@@ -684,11 +687,11 @@ static int __init gic_of_init(struct device_node *node,
        gicconfig = read_gic_config();
        gic_shared_intrs = gicconfig & GIC_CONFIG_NUMINTERRUPTS;
-        gic_shared_intrs >>= __fls(GIC_CONFIG_NUMINTERRUPTS);
+        gic_shared_intrs >>= __ffs(GIC_CONFIG_NUMINTERRUPTS);
        gic_shared_intrs = (gic_shared_intrs + 1) * 8;
        gic_vpes = gicconfig & GIC_CONFIG_PVPS;
-        gic_vpes >>= __fls(GIC_CONFIG_PVPS);
+        gic_vpes >>= __ffs(GIC_CONFIG_PVPS);
        gic_vpes = gic_vpes + 1;
        if (cpu_has_veic) {
diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c
index bbbbe0898233..9a257f969300 100644
--- a/drivers/leds/leds-as3645a.c
+++ b/drivers/leds/leds-as3645a.c
@@ -112,6 +112,10 @@
 #define AS_PEAK_mA_TO_REG(a) \
        ((min_t(u32, AS_PEAK_mA_MAX, a) - 1250) / 250)
+/* LED numbers for Devicetree */
+#define AS_LED_FLASH                            0
+#define AS_LED_INDICATOR                        1
 enum as_mode {
        AS_MODE_EXT_TORCH = 0 << AS_CONTROL_MODE_SETTING_SHIFT,
        AS_MODE_INDICATOR = 1 << AS_CONTROL_MODE_SETTING_SHIFT,
@@ -491,10 +495,29 @@ static int as3645a_parse_node(struct as3645a *flash,
                              struct device_node *node)
 {
        struct as3645a_config *cfg = &flash->cfg;
+        struct device_node *child;
        const char *name;
        int rval;
-        flash->flash_node = of_get_child_by_name(node, "flash");
+        for_each_child_of_node(node, child) {
+                u32 id = 0;
+                of_property_read_u32(child, "reg", &id);
+                switch (id) {
+                case AS_LED_FLASH:
+                        flash->flash_node = of_node_get(child);
+                        break;
+                case AS_LED_INDICATOR:
+                        flash->indicator_node = of_node_get(child);
+                        break;
+                default:
+                        dev_warn(&flash->client->dev,
+                                 "unknown LED %u encountered, ignoring\n", id);
+                        break;
+                }
+        }
        if (!flash->flash_node) {
                dev_err(&flash->client->dev, "can't find flash node\n");
                return -ENODEV;
@@ -534,11 +557,10 @@ static int as3645a_parse_node(struct as3645a *flash,
        of_property_read_u32(flash->flash_node, "voltage-reference",
                             &cfg->voltage_reference);
-        of_property_read_u32(flash->flash_node, "peak-current-limit",
+        of_property_read_u32(flash->flash_node, "ams,input-max-microamp",
                             &cfg->peak);
        cfg->peak = AS_PEAK_mA_TO_REG(cfg->peak);
-        flash->indicator_node = of_get_child_by_name(node, "indicator");
        if (!flash->indicator_node) {
                dev_warn(&flash->client->dev,
                         "can't find indicator node\n");
@@ -721,6 +743,7 @@ static int as3645a_remove(struct i2c_client *client)
        as3645a_set_control(flash, AS_MODE_EXT_TORCH, false);
        v4l2_flash_release(flash->vf);
+        v4l2_flash_release(flash->vfind);
        led_classdev_flash_unregister(&flash->fled);
        led_classdev_unregister(&flash->iled_cdev);
diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
index 7d5286b05036..1841d0359bac 100644
--- a/drivers/md/bcache/closure.c
+++ b/drivers/md/bcache/closure.c
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(closure_put);
 void __closure_wake_up(struct closure_waitlist *wait_list)
 {
        struct llist_node *list;
-        struct closure *cl;
+        struct closure *cl, *t;
        struct llist_node *reverse = NULL;
        list = llist_del_all(&wait_list->list);
@@ -73,7 +73,7 @@ void __closure_wake_up(struct closure_waitlist *wait_list)
        reverse = llist_reverse_order(list);
        /* Then do the wakeups */
-        llist_for_each_entry(cl, reverse, list) {
+        llist_for_each_entry_safe(cl, t, reverse, list) {
                closure_set_waiting(cl, 0);
                closure_sub(cl, CLOSURE_WAITING + 1);
        }
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 24eddbdf2ab4..203144762f36 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -149,5 +149,6 @@ static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen
 extern atomic_t dm_global_event_nr;
 extern wait_queue_head_t dm_global_eventq;
+void dm_issue_global_event(void);
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index a55ffd4f5933..96ab46512e1f 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2466,6 +2466,7 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                kfree(cipher_api);
                return ret;
        }
+        kfree(cipher_api);
        return 0;
 bad_mem:
@@ -2584,6 +2585,10 @@ static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **ar
                                ti->error = "Invalid feature value for sector_size";
                                return -EINVAL;
                        }
+                        if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) {
+                                ti->error = "Device size is not multiple of sector_size feature";
+                                return -EINVAL;
+                        }
                        cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT;
                } else if (!strcasecmp(opt_string, "iv_large_sectors"))
                        set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 8756a6850431..e52676fa9832 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -477,9 +477,13 @@ static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_si
 * Round up the ptr to an 8-byte boundary.
 */
 #define ALIGN_MASK 7
+static inline size_t align_val(size_t val)
+{
+        return (val + ALIGN_MASK) & ~ALIGN_MASK;
+}
 static inline void *align_ptr(void *ptr)
 {
-        return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK);
+        return (void *)align_val((size_t)ptr);
 }
 /*
@@ -505,7 +509,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
        struct hash_cell *hc;
        size_t len, needed = 0;
        struct gendisk *disk;
-        struct dm_name_list *nl, *old_nl = NULL;
+        struct dm_name_list *orig_nl, *nl, *old_nl = NULL;
        uint32_t *event_nr;
        down_write(&_hash_lock);
@@ -516,17 +520,15 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
         */
        for (i = 0; i < NUM_BUCKETS; i++) {
                list_for_each_entry (hc, _name_buckets + i, name_list) {
-                        needed += sizeof(struct dm_name_list);
+                        needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);
-                        needed += strlen(hc->name) + 1;
+                        needed += align_val(sizeof(uint32_t));
-                        needed += ALIGN_MASK;
-                        needed += (sizeof(uint32_t) + ALIGN_MASK) & ~ALIGN_MASK;
                }
        }
        /*
         * Grab our output buffer.
         */
-        nl = get_result_buffer(param, param_size, &len);
+        nl = orig_nl = get_result_buffer(param, param_size, &len);
        if (len < needed) {
                param->flags |= DM_BUFFER_FULL_FLAG;
                goto out;
@@ -549,11 +551,16 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
                        strcpy(nl->name, hc->name);
                        old_nl = nl;
-                        event_nr = align_ptr(((void *) (nl + 1)) + strlen(hc->name) + 1);
+                        event_nr = align_ptr(nl->name + strlen(hc->name) + 1);
                        *event_nr = dm_get_event_nr(hc->md);
                        nl = align_ptr(event_nr + 1);
                }
        }
+        /*
+         * If mismatch happens, security may be compromised due to buffer
+         * overflow, so it's better to crash.
+         */
+        BUG_ON((char *)nl - (char *)orig_nl != needed);
 out:
        up_write(&_hash_lock);
@@ -1621,7 +1628,8 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
 * which has a variable size, is not used by the function processing
 * the ioctl.
 */
-#define IOCTL_FLAGS_NO_PARAMS   1
+#define IOCTL_FLAGS_NO_PARAMS           1
+#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT  2
 /*-----------------------------------------------------------------
 * Implementation of open/close/ioctl on the special char
@@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
                ioctl_fn fn;
        } _ioctls[] = {
                {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
-                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all},
+                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},
                {DM_LIST_DEVICES_CMD, 0, list_devices},
-                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create},
+                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},
-                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove},
+                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},
-                {DM_DEV_RENAME_CMD, 0, dev_rename},
+                {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},
                {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
                {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
                {DM_DEV_WAIT_CMD, 0, dev_wait},
@@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
            unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
                DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
+        if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)
+                dm_issue_global_event();
        /*
         * Copy the results back to userland.
         */
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5bfe285ea9d1..2245d06d2045 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
        if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
                return DM_MAPIO_REQUEUE;
-        mddev->pers->make_request(mddev, bio);
+        md_handle_request(mddev, bio);
        return DM_MAPIO_SUBMITTED;
 }
@@ -3297,11 +3297,10 @@ static const char *__raid_dev_status(struct raid_set *rs, struct md_rdev *rdev,
 static sector_t rs_get_progress(struct raid_set *rs,
                                sector_t resync_max_sectors, bool *array_in_sync)
 {
-        sector_t r, recovery_cp, curr_resync_completed;
+        sector_t r, curr_resync_completed;
        struct mddev *mddev = &rs->md;
        curr_resync_completed = mddev->curr_resync_completed ?: mddev->recovery_cp;
-        recovery_cp = mddev->recovery_cp;
        *array_in_sync = false;
        if (rs_is_raid0(rs)) {
@@ -3330,9 +3329,11 @@ static sector_t rs_get_progress(struct raid_set *rs,
                } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                        r = curr_resync_completed;
                else
-                        r = recovery_cp;
+                        r = mddev->recovery_cp;
-                if (r == MaxSector) {
+                if ((r == MaxSector) ||
+                    (test_bit(MD_RECOVERY_DONE, &mddev->recovery) &&
+                     (mddev->curr_resync_completed == resync_max_sectors))) {
                        /*
                         * Sync complete.
                         */
@@ -3892,7 +3893,7 @@ static void raid_resume(struct dm_target *ti)
 static struct target_type raid_target = {
        .name = "raid",
-        .version = {1, 12, 1},
+        .version = {1, 13, 0},
        .module = THIS_MODULE,
        .ctr = raid_ctr,
        .dtr = raid_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e54145969c5..4be85324f44d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -52,6 +52,12 @@ static struct workqueue_struct *deferred_remove_workqueue;
 atomic_t dm_global_event_nr = ATOMIC_INIT(0);
 DECLARE_WAIT_QUEUE_HEAD(dm_global_eventq);
+void dm_issue_global_event(void)
+{
+        atomic_inc(&dm_global_event_nr);
+        wake_up(&dm_global_eventq);
+}
 /*
 * One of these is allocated per bio.
 */
@@ -1865,9 +1871,8 @@ static void event_callback(void *context)
        dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
        atomic_inc(&md->event_nr);
-        atomic_inc(&dm_global_event_nr);
        wake_up(&md->eventq);
-        wake_up(&dm_global_eventq);
+        dm_issue_global_event();
 }
 /*
@@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
        }
        map = __bind(md, table, &limits);
+        dm_issue_global_event();
 out:
        mutex_unlock(&md->suspend_lock);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08fcaebc61bd..0ff1bbf6c90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -266,6 +266,37 @@ static DEFINE_SPINLOCK(all_mddevs_lock);
 * call has finished, the bio has been linked into some internal structure
 * and so is visible to ->quiesce(), so we don't need the refcount any more.
 */
+void md_handle_request(struct mddev *mddev, struct bio *bio)
+{
+check_suspended:
+        rcu_read_lock();
+        if (mddev->suspended) {
+                DEFINE_WAIT(__wait);
+                for (;;) {
+                        prepare_to_wait(&mddev->sb_wait, &__wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (!mddev->suspended)
+                                break;
+                        rcu_read_unlock();
+                        schedule();
+                        rcu_read_lock();
+                }
+                finish_wait(&mddev->sb_wait, &__wait);
+        }
+        atomic_inc(&mddev->active_io);
+        rcu_read_unlock();
+        if (!mddev->pers->make_request(mddev, bio)) {
+                atomic_dec(&mddev->active_io);
+                wake_up(&mddev->sb_wait);
+                goto check_suspended;
+        }
+        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
+                wake_up(&mddev->sb_wait);
+}
+EXPORT_SYMBOL(md_handle_request);
 static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
 {
        const int rw = bio_data_dir(bio);
@@ -285,23 +316,6 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
                bio_endio(bio);
                return BLK_QC_T_NONE;
        }
-check_suspended:
-        rcu_read_lock();
-        if (mddev->suspended) {
-                DEFINE_WAIT(__wait);
-                for (;;) {
-                        prepare_to_wait(&mddev->sb_wait, &__wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        if (!mddev->suspended)
-                                break;
-                        rcu_read_unlock();
-                        schedule();
-                        rcu_read_lock();
-                }
-                finish_wait(&mddev->sb_wait, &__wait);
-        }
-        atomic_inc(&mddev->active_io);
-        rcu_read_unlock();
        /*
         * save the sectors now since our bio can
@@ -310,20 +324,14 @@ check_suspended:
        sectors = bio_sectors(bio);
        /* bio could be mergeable after passing to underlayer */
        bio->bi_opf &= ~REQ_NOMERGE;
-        if (!mddev->pers->make_request(mddev, bio)) {
-                atomic_dec(&mddev->active_io);
+        md_handle_request(mddev, bio);
-                wake_up(&mddev->sb_wait);
-                goto check_suspended;
-        }
        cpu = part_stat_lock();
        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
        part_stat_unlock();
-        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
-                wake_up(&mddev->sb_wait);
        return BLK_QC_T_NONE;
 }
@@ -439,16 +447,22 @@ static void md_submit_flush_data(struct work_struct *ws)
        struct mddev *mddev = container_of(ws, struct mddev, flush_work);
        struct bio *bio = mddev->flush_bio;
+        /*
+         * must reset flush_bio before calling into md_handle_request to avoid a
+         * deadlock, because other bios passed md_handle_request suspend check
+         * could wait for this and below md_handle_request could wait for those
+         * bios because of suspend check
+         */
+        mddev->flush_bio = NULL;
+        wake_up(&mddev->sb_wait);
        if (bio->bi_iter.bi_size == 0)
                /* an empty barrier - all done */
                bio_endio(bio);
        else {
                bio->bi_opf &= ~REQ_PREFLUSH;
-                mddev->pers->make_request(mddev, bio);
+                md_handle_request(mddev, bio);
        }
-        mddev->flush_bio = NULL;
-        wake_up(&mddev->sb_wait);
 }
 void md_flush_request(struct mddev *mddev, struct bio *bio)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 561d22b9a9a8..d8287d3cd1bf 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -692,6 +692,7 @@ extern void md_stop_writes(struct mddev *mddev);
 extern int md_rdev_init(struct md_rdev *rdev);
 extern void md_rdev_clear(struct md_rdev *rdev);
+extern void md_handle_request(struct mddev *mddev, struct bio *bio);
 extern void mddev_suspend(struct mddev *mddev);
 extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 076409455b60..928e24a07133 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6575,14 +6575,17 @@ static ssize_t
 raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
 {
        struct r5conf *conf;
-        unsigned long new;
+        unsigned int new;
        int err;
        struct r5worker_group *new_groups, *old_groups;
        int group_cnt, worker_cnt_per_group;
        if (len >= PAGE_SIZE)
                return -EINVAL;
-        if (kstrtoul(page, 10, &new))
+        if (kstrtouint(page, 10, &new))
+                return -EINVAL;
+        /* 8192 should be big enough */
+        if (new > 8192)
                return -EINVAL;
        err = mddev_lock(mddev);
diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index ed43a4212479..129b558acc92 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -245,5 +245,5 @@ module_init(ir_sharp_decode_init);
 module_exit(ir_sharp_decode_exit);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("Sharp IR protocol decoder");
diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c
index 5dba23ca2e5f..dc9bc1807fdf 100644
--- a/drivers/misc/cxl/cxllib.c
+++ b/drivers/misc/cxl/cxllib.c
@@ -219,8 +219,17 @@ int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags)
        down_read(&mm->mmap_sem);
-        for (dar = addr; dar < addr + size; dar += page_size) {
+        vma = find_vma(mm, addr);
-                if (!vma || dar < vma->vm_start || dar > vma->vm_end) {
+        if (!vma) {
+                pr_err("Can't find vma for addr %016llx\n", addr);
+                rc = -EFAULT;
+                goto out;
+        }
+        /* get the size of the pages allocated */
+        page_size = vma_kernel_pagesize(vma);
+        for (dar = (addr & ~(page_size - 1)); dar < (addr + size); dar += page_size) {
+                if (dar < vma->vm_start || dar >= vma->vm_end) {
                        vma = find_vma(mm, addr);
                        if (!vma) {
                                pr_err("Can't find vma for addr %016llx\n", addr);
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 29fc1e662891..2ad7b5c69156 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1634,8 +1634,6 @@ static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
        }
        mqrq->areq.mrq = &brq->mrq;
-        mmc_queue_bounce_pre(mqrq);
 }
 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
@@ -1829,7 +1827,6 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                brq = &mq_rq->brq;
                old_req = mmc_queue_req_to_req(mq_rq);
                type = rq_data_dir(old_req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
-                mmc_queue_bounce_post(mq_rq);
                switch (status) {
                case MMC_BLK_SUCCESS:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a7eb623f8daa..36217ad5e9b1 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1286,6 +1286,23 @@ out_err:
        return err;
 }
+static void mmc_select_driver_type(struct mmc_card *card)
+{
+        int card_drv_type, drive_strength, drv_type;
+        card_drv_type = card->ext_csd.raw_driver_strength |
+                        mmc_driver_type_mask(0);
+        drive_strength = mmc_select_drive_strength(card,
+                                                   card->ext_csd.hs200_max_dtr,
+                                                   card_drv_type, &drv_type);
+        card->drive_strength = drive_strength;
+        if (drv_type)
+                mmc_set_driver_type(card->host, drv_type);
+}
 static int mmc_select_hs400es(struct mmc_card *card)
 {
        struct mmc_host *host = card->host;
@@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc_card *card)
                goto out_err;
        }
+        mmc_select_driver_type(card);
        /* Switch card to HS400 */
        val = EXT_CSD_TIMING_HS400 |
              card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
@@ -1374,23 +1393,6 @@ out_err:
        return err;
 }
-static void mmc_select_driver_type(struct mmc_card *card)
-{
-        int card_drv_type, drive_strength, drv_type;
-        card_drv_type = card->ext_csd.raw_driver_strength |
-                        mmc_driver_type_mask(0);
-        drive_strength = mmc_select_drive_strength(card,
-                                                   card->ext_csd.hs200_max_dtr,
-                                                   card_drv_type, &drv_type);
-        card->drive_strength = drive_strength;
-        if (drv_type)
-                mmc_set_driver_type(card->host, drv_type);
-}
 /*
 * For device supporting HS200 mode, the following sequence
 * should be done before executing the tuning process.
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 74c663b1c0a7..0a4e77a5ba33 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -23,8 +23,6 @@
 #include "core.h"
 #include "card.h"
-#define MMC_QUEUE_BOUNCESZ      65536
 /*
 * Prepare a MMC request. This just filters out odd stuff.
 */
@@ -150,26 +148,6 @@ static void mmc_queue_setup_discard(struct request_queue *q,
                queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, q);
 }
-static unsigned int mmc_queue_calc_bouncesz(struct mmc_host *host)
-{
-        unsigned int bouncesz = MMC_QUEUE_BOUNCESZ;
-        if (host->max_segs != 1 || (host->caps & MMC_CAP_NO_BOUNCE_BUFF))
-                return 0;
-        if (bouncesz > host->max_req_size)
-                bouncesz = host->max_req_size;
-        if (bouncesz > host->max_seg_size)
-                bouncesz = host->max_seg_size;
-        if (bouncesz > host->max_blk_count * 512)
-                bouncesz = host->max_blk_count * 512;
-        if (bouncesz <= 512)
-                return 0;
-        return bouncesz;
-}
 /**
 * mmc_init_request() - initialize the MMC-specific per-request data
 * @q: the request queue
@@ -184,26 +162,9 @@ static int mmc_init_request(struct request_queue *q, struct request *req,
        struct mmc_card *card = mq->card;
        struct mmc_host *host = card->host;
-        if (card->bouncesz) {
+        mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
-                mq_rq->bounce_buf = kmalloc(card->bouncesz, gfp);
+        if (!mq_rq->sg)
-                if (!mq_rq->bounce_buf)
+                return -ENOMEM;
-                        return -ENOMEM;
-                if (card->bouncesz > 512) {
-                        mq_rq->sg = mmc_alloc_sg(1, gfp);
-                        if (!mq_rq->sg)
-                                return -ENOMEM;
-                        mq_rq->bounce_sg = mmc_alloc_sg(card->bouncesz / 512,
-                                                        gfp);
-                        if (!mq_rq->bounce_sg)
-                                return -ENOMEM;
-                }
-        } else {
-                mq_rq->bounce_buf = NULL;
-                mq_rq->bounce_sg = NULL;
-                mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
-                if (!mq_rq->sg)
-                        return -ENOMEM;
-        }
        return 0;
 }
@@ -212,13 +173,6 @@ static void mmc_exit_request(struct request_queue *q, struct request *req)
 {
        struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
-        /* It is OK to kfree(NULL) so this will be smooth */
-        kfree(mq_rq->bounce_sg);
-        mq_rq->bounce_sg = NULL;
-        kfree(mq_rq->bounce_buf);
-        mq_rq->bounce_buf = NULL;
        kfree(mq_rq->sg);
        mq_rq->sg = NULL;
 }
@@ -242,12 +196,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
        if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
                limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
-        /*
-         * mmc_init_request() depends on card->bouncesz so it must be calculated
-         * before blk_init_allocated_queue() starts allocating requests.
-         */
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
        mq->card = card;
        mq->queue = blk_alloc_queue(GFP_KERNEL);
        if (!mq->queue)
@@ -271,17 +219,11 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
        if (mmc_can_erase(card))
                mmc_queue_setup_discard(mq->queue, card);
-        if (card->bouncesz) {
+        blk_queue_bounce_limit(mq->queue, limit);
-                blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
+        blk_queue_max_hw_sectors(mq->queue,
-                blk_queue_max_segments(mq->queue, card->bouncesz / 512);
+                min(host->max_blk_count, host->max_req_size / 512));
-                blk_queue_max_segment_size(mq->queue, card->bouncesz);
+        blk_queue_max_segments(mq->queue, host->max_segs);
-        } else {
+        blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-                blk_queue_bounce_limit(mq->queue, limit);
-                blk_queue_max_hw_sectors(mq->queue,
-                        min(host->max_blk_count, host->max_req_size / 512));
-                blk_queue_max_segments(mq->queue, host->max_segs);
-                blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-        }
        sema_init(&mq->thread_sem, 1);
@@ -370,56 +312,7 @@ void mmc_queue_resume(struct mmc_queue *mq)
 */
 unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
 {
-        unsigned int sg_len;
-        size_t buflen;
-        struct scatterlist *sg;
        struct request *req = mmc_queue_req_to_req(mqrq);
-        int i;
-        if (!mqrq->bounce_buf)
-                return blk_rq_map_sg(mq->queue, req, mqrq->sg);
-        sg_len = blk_rq_map_sg(mq->queue, req, mqrq->bounce_sg);
-        mqrq->bounce_sg_len = sg_len;
-        buflen = 0;
-        for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
-                buflen += sg->length;
-        sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
-        return 1;
-}
-/*
- * If writing, bounce the data to the buffer before the request
- * is sent to the host driver
- */
-void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != WRITE)
-                return;
-        sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
-}
-/*
- * If reading, bounce the data from the buffer after the request
- * has been handled by the host driver
- */
-void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != READ)
-                return;
-        sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
+        return blk_rq_map_sg(mq->queue, req, mqrq->sg);
-                mqrq->bounce_buf, mqrq->sg[0].length);
 }
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 04fc89360a7a..f18d3f656baa 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -49,9 +49,6 @@ enum mmc_drv_op {
 struct mmc_queue_req {
        struct mmc_blk_request  brq;
        struct scatterlist      *sg;
-        char                    *bounce_buf;
-        struct scatterlist      *bounce_sg;
-        unsigned int            bounce_sg_len;
        struct mmc_async_req    areq;
        enum mmc_drv_op         drv_op;
        int                     drv_op_result;
@@ -81,11 +78,8 @@ extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *,
 extern void mmc_cleanup_queue(struct mmc_queue *);
 extern void mmc_queue_suspend(struct mmc_queue *);
 extern void mmc_queue_resume(struct mmc_queue *);
 extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
                                     struct mmc_queue_req *);
-extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
-extern void mmc_queue_bounce_post(struct mmc_queue_req *);
 extern int mmc_access_rpmb(struct mmc_queue *);
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 27fb625cbcf3..fbd29f00fca0 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -1038,7 +1038,7 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
         */
        mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                     MMC_CAP_ERASE | MMC_CAP_CMD23 | MMC_CAP_POWER_OFF_CARD |
-                     MMC_CAP_3_3V_DDR | MMC_CAP_NO_BOUNCE_BUFF;
+                     MMC_CAP_3_3V_DDR;
        if (host->use_sg)
                mmc->max_segs = 16;
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c885c2d4b904..85745ef179e2 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -531,8 +531,7 @@ static int meson_mmc_clk_init(struct meson_host *host)
        div->shift = __ffs(CLK_DIV_MASK);
        div->width = __builtin_popcountl(CLK_DIV_MASK);
        div->hw.init = &init;
-        div->flags = (CLK_DIVIDER_ONE_BASED |
+        div->flags = CLK_DIVIDER_ONE_BASED;
-                      CLK_DIVIDER_ROUND_CLOSEST);
        clk = devm_clk_register(host->dev, &div->hw);
        if (WARN_ON(IS_ERR(clk)))
@@ -717,6 +716,22 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
        struct meson_host *host = mmc_priv(mmc);
+        int ret;
+        /*
+         * If this is the initial tuning, try to get a sane Rx starting
+         * phase before doing the actual tuning.
+         */
+        if (!mmc->doing_retune) {
+                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+                if (ret)
+                        return ret;
+        }
+        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
+        if (ret)
+                return ret;
        return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -746,6 +761,11 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        case MMC_POWER_UP:
                if (!IS_ERR(mmc->supply.vmmc))
                        mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+                /* Reset phases */
+                clk_set_phase(host->rx_clk, 0);
+                clk_set_phase(host->tx_clk, 270);
                break;
        case MMC_POWER_ON:
@@ -759,8 +779,6 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                host->vqmmc_enabled = true;
                }
-                /* Reset rx phase */
-                clk_set_phase(host->rx_clk, 0);
                break;
        }
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 59ab194cb009..c763b404510f 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -702,11 +702,7 @@ static int pxamci_probe(struct platform_device *pdev)
        pxamci_init_ocr(host);
-        /*
+        mmc->caps = 0;
-         * This architecture used to disable bounce buffers through its
-         * defconfig, now it is done at runtime as a host property.
-         */
-        mmc->caps = MMC_CAP_NO_BOUNCE_BUFF;
        host->cmdat = 0;
        if (!cpu_is_pxa25x()) {
                mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_SDIO_IRQ;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index bbaddf18a1b3..d0ccc6729fd2 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -392,6 +392,7 @@ static const struct sdhci_pci_fixes sdhci_intel_pch_sdio = {
 enum {
        INTEL_DSM_FNS           =  0,
+        INTEL_DSM_V18_SWITCH    =  3,
        INTEL_DSM_DRV_STRENGTH  =  9,
        INTEL_DSM_D3_RETUNE     = 10,
 };
@@ -557,6 +558,19 @@ static void intel_hs400_enhanced_strobe(struct mmc_host *mmc,
        sdhci_writel(host, val, INTEL_HS400_ES_REG);
 }
+static void sdhci_intel_voltage_switch(struct sdhci_host *host)
+{
+        struct sdhci_pci_slot *slot = sdhci_priv(host);
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct device *dev = &slot->chip->pdev->dev;
+        u32 result = 0;
+        int err;
+        err = intel_dsm(intel_host, dev, INTEL_DSM_V18_SWITCH, &result);
+        pr_debug("%s: %s DSM error %d result %u\n",
+                 mmc_hostname(host->mmc), __func__, err, result);
+}
 static const struct sdhci_ops sdhci_intel_byt_ops = {
        .set_clock              = sdhci_set_clock,
        .set_power              = sdhci_intel_set_power,
@@ -565,6 +579,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
        .reset                  = sdhci_reset,
        .set_uhs_signaling      = sdhci_set_uhs_signaling,
        .hw_reset               = sdhci_pci_hw_reset,
+        .voltage_switch         = sdhci_intel_voltage_switch,
 };
 static void byt_read_dsm(struct sdhci_pci_slot *slot)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 2eec2e652c53..0842bbc2d7ad 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -466,6 +466,7 @@ static int xenon_probe(struct platform_device *pdev)
 {
        struct sdhci_pltfm_host *pltfm_host;
        struct sdhci_host *host;
+        struct xenon_priv *priv;
        int err;
        host = sdhci_pltfm_init(pdev, &sdhci_xenon_pdata,
@@ -474,6 +475,7 @@ static int xenon_probe(struct platform_device *pdev)
                return PTR_ERR(host);
        pltfm_host = sdhci_priv(host);
+        priv = sdhci_pltfm_priv(pltfm_host);
        /*
         * Link Xenon specific mmc_host_ops function,
@@ -491,9 +493,20 @@ static int xenon_probe(struct platform_device *pdev)
        if (err)
                goto free_pltfm;
+        priv->axi_clk = devm_clk_get(&pdev->dev, "axi");
+        if (IS_ERR(priv->axi_clk)) {
+                err = PTR_ERR(priv->axi_clk);
+                if (err == -EPROBE_DEFER)
+                        goto err_clk;
+        } else {
+                err = clk_prepare_enable(priv->axi_clk);
+                if (err)
+                        goto err_clk;
+        }
        err = mmc_of_parse(host->mmc);
        if (err)
-                goto err_clk;
+                goto err_clk_axi;
        sdhci_get_of_property(pdev);
@@ -502,11 +515,11 @@ static int xenon_probe(struct platform_device *pdev)
        /* Xenon specific dt parse */
        err = xenon_probe_dt(pdev);
        if (err)
-                goto err_clk;
+                goto err_clk_axi;
        err = xenon_sdhc_prepare(host);
        if (err)
-                goto err_clk;
+                goto err_clk_axi;
        pm_runtime_get_noresume(&pdev->dev);
        pm_runtime_set_active(&pdev->dev);
@@ -527,6 +540,8 @@ remove_sdhc:
        pm_runtime_disable(&pdev->dev);
        pm_runtime_put_noidle(&pdev->dev);
        xenon_sdhc_unprepare(host);
+err_clk_axi:
+        clk_disable_unprepare(priv->axi_clk);
 err_clk:
        clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -538,6 +553,7 @@ static int xenon_remove(struct platform_device *pdev)
 {
        struct sdhci_host *host = platform_get_drvdata(pdev);
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
        pm_runtime_get_sync(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
@@ -546,7 +562,7 @@ static int xenon_remove(struct platform_device *pdev)
        sdhci_remove_host(host, 0);
        xenon_sdhc_unprepare(host);
+        clk_disable_unprepare(priv->axi_clk);
        clk_disable_unprepare(pltfm_host->clk);
        sdhci_pltfm_free(pdev);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 2bc0510c0769..9994995c7c56 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -83,6 +83,7 @@ struct xenon_priv {
        unsigned char   bus_width;
        unsigned char   timing;
        unsigned int    clock;
+        struct clk      *axi_clk;
        int             phy_type;
        /*
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 12cf8288d663..a7293e186e03 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -129,50 +129,6 @@ static int tmio_mmc_next_sg(struct tmio_mmc_host *host)
 #define CMDREQ_TIMEOUT  5000
-#ifdef CONFIG_MMC_DEBUG
-#define STATUS_TO_TEXT(a, status, i) \
-        do { \
-                if ((status) & TMIO_STAT_##a) { \
-                        if ((i)++) \
-                                printk(KERN_DEBUG " | "); \
-                        printk(KERN_DEBUG #a); \
-                } \
-        } while (0)
-static void pr_debug_status(u32 status)
-{
-        int i = 0;
-        pr_debug("status: %08x = ", status);
-        STATUS_TO_TEXT(CARD_REMOVE, status, i);
-        STATUS_TO_TEXT(CARD_INSERT, status, i);
-        STATUS_TO_TEXT(SIGSTATE, status, i);
-        STATUS_TO_TEXT(WRPROTECT, status, i);
-        STATUS_TO_TEXT(CARD_REMOVE_A, status, i);
-        STATUS_TO_TEXT(CARD_INSERT_A, status, i);
-        STATUS_TO_TEXT(SIGSTATE_A, status, i);
-        STATUS_TO_TEXT(CMD_IDX_ERR, status, i);
-        STATUS_TO_TEXT(STOPBIT_ERR, status, i);
-        STATUS_TO_TEXT(ILL_FUNC, status, i);
-        STATUS_TO_TEXT(CMD_BUSY, status, i);
-        STATUS_TO_TEXT(CMDRESPEND, status, i);
-        STATUS_TO_TEXT(DATAEND, status, i);
-        STATUS_TO_TEXT(CRCFAIL, status, i);
-        STATUS_TO_TEXT(DATATIMEOUT, status, i);
-        STATUS_TO_TEXT(CMDTIMEOUT, status, i);
-        STATUS_TO_TEXT(RXOVERFLOW, status, i);
-        STATUS_TO_TEXT(TXUNDERRUN, status, i);
-        STATUS_TO_TEXT(RXRDY, status, i);
-        STATUS_TO_TEXT(TXRQ, status, i);
-        STATUS_TO_TEXT(ILL_ACCESS, status, i);
-        printk("\n");
-}
-#else
-#define pr_debug_status(s)  do { } while (0)
-#endif
 static void tmio_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
 {
        struct tmio_mmc_host *host = mmc_priv(mmc);
@@ -762,9 +718,6 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
        status = sd_ctrl_read16_and_16_as_32(host, CTL_STATUS);
        ireg = status & TMIO_MASK_IRQ & ~host->sdcard_irq_mask;
-        pr_debug_status(status);
-        pr_debug_status(ireg);
        /* Clear the status except the interrupt status */
        sd_ctrl_write32_as_16_and_16(host, CTL_STATUS, TMIO_MASK_IRQ);
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 5736b0c90b33..a308e707392d 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -581,6 +581,14 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                slave->mtd.erasesize = parent->erasesize;
        }
+        /*
+         * Slave erasesize might differ from the master one if the master
+         * exposes several regions with different erasesize. Adjust
+         * wr_alignment accordingly.
+         */
+        if (!(slave->mtd.flags & MTD_NO_ERASE))
+                wr_alignment = slave->mtd.erasesize;
        tmp = slave->offset;
        remainder = do_div(tmp, wr_alignment);
        if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 146af8218314..8268636675ef 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
        size += (req->ecc.strength + 1) * sizeof(u16);
        /* Reserve space for mu, dmu and delta. */
        size = ALIGN(size, sizeof(s32));
-        size += (req->ecc.strength + 1) * sizeof(s32);
+        size += (req->ecc.strength + 1) * sizeof(s32) * 3;
        user = kzalloc(size, GFP_KERNEL);
        if (!user)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index c6678aa9b4ef..d74c7335c512 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1100,6 +1100,10 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port,
        };
        int i, err;
+        /* DSA and CPU ports have to be members of multiple vlans */
+        if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+                return 0;
        if (!vid_begin)
                return -EOPNOTSUPP;
@@ -3947,7 +3951,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
        if (chip->irq > 0) {
                if (chip->info->g2_irqs > 0)
                        mv88e6xxx_g2_irq_free(chip);
+                mutex_lock(&chip->reg_lock);
                mv88e6xxx_g1_irq_free(chip);
+                mutex_unlock(&chip->reg_lock);
        }
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 214986436ece..0fdaaa643073 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -51,6 +51,10 @@
 #define AQ_CFG_SKB_FRAGS_MAX   32U
+/* Number of descriptors available in one ring to resume this ring queue
+ */
+#define AQ_CFG_RESTART_DESC_THRES   (AQ_CFG_SKB_FRAGS_MAX * 2)
 #define AQ_CFG_NAPI_WEIGHT     64U
 #define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 6ac9e2602d6d..0a5bb4114eb4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -119,6 +119,35 @@ int aq_nic_cfg_start(struct aq_nic_s *self)
        return 0;
 }
+static int aq_nic_update_link_status(struct aq_nic_s *self)
+{
+        int err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
+        if (err)
+                return err;
+        if (self->link_status.mbps != self->aq_hw->aq_link_status.mbps)
+                pr_info("%s: link change old %d new %d\n",
+                        AQ_CFG_DRV_NAME, self->link_status.mbps,
+                        self->aq_hw->aq_link_status.mbps);
+        self->link_status = self->aq_hw->aq_link_status;
+        if (!netif_carrier_ok(self->ndev) && self->link_status.mbps) {
+                aq_utils_obj_set(&self->header.flags,
+                                 AQ_NIC_FLAG_STARTED);
+                aq_utils_obj_clear(&self->header.flags,
+                                   AQ_NIC_LINK_DOWN);
+                netif_carrier_on(self->ndev);
+                netif_tx_wake_all_queues(self->ndev);
+        }
+        if (netif_carrier_ok(self->ndev) && !self->link_status.mbps) {
+                netif_carrier_off(self->ndev);
+                netif_tx_disable(self->ndev);
+                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
+        }
+        return 0;
+}
 static void aq_nic_service_timer_cb(unsigned long param)
 {
        struct aq_nic_s *self = (struct aq_nic_s *)param;
@@ -131,26 +160,13 @@ static void aq_nic_service_timer_cb(unsigned long param)
        if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                goto err_exit;
-        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
+        err = aq_nic_update_link_status(self);
-        if (err < 0)
+        if (err)
                goto err_exit;
-        self->link_status = self->aq_hw->aq_link_status;
        self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
                    self->aq_nic_cfg.is_interrupt_moderation);
-        if (self->link_status.mbps) {
-                aq_utils_obj_set(&self->header.flags,
-                                 AQ_NIC_FLAG_STARTED);
-                aq_utils_obj_clear(&self->header.flags,
-                                   AQ_NIC_LINK_DOWN);
-                netif_carrier_on(self->ndev);
-        } else {
-                netif_carrier_off(self->ndev);
-                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
-        }
        memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
        memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
        for (i = AQ_DIMOF(self->aq_vec); i--;) {
@@ -214,7 +230,6 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
        SET_NETDEV_DEV(ndev, dev);
        ndev->if_port = port;
-        ndev->min_mtu = ETH_MIN_MTU;
        self->ndev = ndev;
        self->aq_pci_func = aq_pci_func;
@@ -241,7 +256,6 @@ err_exit:
 int aq_nic_ndev_register(struct aq_nic_s *self)
 {
        int err = 0;
-        unsigned int i = 0U;
        if (!self->ndev) {
                err = -EINVAL;
@@ -263,8 +277,7 @@ int aq_nic_ndev_register(struct aq_nic_s *self)
        netif_carrier_off(self->ndev);
-        for (i = AQ_CFG_VECS_MAX; i--;)
+        netif_tx_disable(self->ndev);
-                aq_nic_ndev_queue_stop(self, i);
        err = register_netdev(self->ndev);
        if (err < 0)
@@ -283,6 +296,7 @@ int aq_nic_ndev_init(struct aq_nic_s *self)
        self->ndev->features = aq_hw_caps->hw_features;
        self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
        self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
+        self->ndev->max_mtu = self->aq_hw_caps.mtu - ETH_FCS_LEN - ETH_HLEN;
        return 0;
 }
@@ -318,12 +332,8 @@ struct aq_nic_s *aq_nic_alloc_hot(struct net_device *ndev)
                err = -EINVAL;
                goto err_exit;
        }
-        if (netif_running(ndev)) {
+        if (netif_running(ndev))
-                unsigned int i;
+                netif_tx_disable(ndev);
-                for (i = AQ_CFG_VECS_MAX; i--;)
-                        netif_stop_subqueue(ndev, i);
-        }
        for (self->aq_vecs = 0; self->aq_vecs < self->aq_nic_cfg.vecs;
                self->aq_vecs++) {
@@ -383,16 +393,6 @@ err_exit:
        return err;
 }
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_start_subqueue(self->ndev, idx);
-}
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_stop_subqueue(self->ndev, idx);
-}
 int aq_nic_start(struct aq_nic_s *self)
 {
        struct aq_vec_s *aq_vec = NULL;
@@ -451,10 +451,6 @@ int aq_nic_start(struct aq_nic_s *self)
                        goto err_exit;
        }
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_start(self, i);
        err = netif_set_real_num_tx_queues(self->ndev, self->aq_vecs);
        if (err < 0)
                goto err_exit;
@@ -463,6 +459,8 @@ int aq_nic_start(struct aq_nic_s *self)
        if (err < 0)
                goto err_exit;
+        netif_tx_start_all_queues(self->ndev);
 err_exit:
        return err;
 }
@@ -475,6 +473,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
        unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
        unsigned int frag_count = 0U;
        unsigned int dx = ring->sw_tail;
+        struct aq_ring_buff_s *first = NULL;
        struct aq_ring_buff_s *dx_buff = &ring->buff_ring[dx];
        if (unlikely(skb_is_gso(skb))) {
@@ -485,6 +484,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                dx_buff->len_l4 = tcp_hdrlen(skb);
                dx_buff->mss = skb_shinfo(skb)->gso_size;
                dx_buff->is_txc = 1U;
+                dx_buff->eop_index = 0xffffU;
                dx_buff->is_ipv6 =
                        (ip_hdr(skb)->version == 6) ? 1U : 0U;
@@ -504,6 +504,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
        if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
                goto exit;
+        first = dx_buff;
        dx_buff->len_pkt = skb->len;
        dx_buff->is_sop = 1U;
        dx_buff->is_mapped = 1U;
@@ -532,40 +533,46 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
        for (; nr_frags--; ++frag_count) {
                unsigned int frag_len = 0U;
+                unsigned int buff_offset = 0U;
+                unsigned int buff_size = 0U;
                dma_addr_t frag_pa;
                skb_frag_t *frag = &skb_shinfo(skb)->frags[frag_count];
                frag_len = skb_frag_size(frag);
-                frag_pa = skb_frag_dma_map(aq_nic_get_dev(self), frag, 0,
-                                           frag_len, DMA_TO_DEVICE);
-                if (unlikely(dma_mapping_error(aq_nic_get_dev(self), frag_pa)))
+                while (frag_len) {
-                        goto mapping_error;
+                        if (frag_len > AQ_CFG_TX_FRAME_MAX)
+                                buff_size = AQ_CFG_TX_FRAME_MAX;
+                        else
+                                buff_size = frag_len;
+                        frag_pa = skb_frag_dma_map(aq_nic_get_dev(self),
+                                                   frag,
+                                                   buff_offset,
+                                                   buff_size,
+                                                   DMA_TO_DEVICE);
+                        if (unlikely(dma_mapping_error(aq_nic_get_dev(self),
+                                                       frag_pa)))
+                                goto mapping_error;
-                while (frag_len > AQ_CFG_TX_FRAME_MAX) {
                        dx = aq_ring_next_dx(ring, dx);
                        dx_buff = &ring->buff_ring[dx];
                        dx_buff->flags = 0U;
-                        dx_buff->len = AQ_CFG_TX_FRAME_MAX;
+                        dx_buff->len = buff_size;
                        dx_buff->pa = frag_pa;
                        dx_buff->is_mapped = 1U;
+                        dx_buff->eop_index = 0xffffU;
+                        frag_len -= buff_size;
+                        buff_offset += buff_size;
-                        frag_len -= AQ_CFG_TX_FRAME_MAX;
-                        frag_pa += AQ_CFG_TX_FRAME_MAX;
                        ++ret;
                }
-                dx = aq_ring_next_dx(ring, dx);
-                dx_buff = &ring->buff_ring[dx];
-                dx_buff->flags = 0U;
-                dx_buff->len = frag_len;
-                dx_buff->pa = frag_pa;
-                dx_buff->is_mapped = 1U;
-                ++ret;
        }
+        first->eop_index = dx;
        dx_buff->is_eop = 1U;
        dx_buff->skb = skb;
        goto exit;
@@ -602,7 +609,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
        unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs;
        unsigned int tc = 0U;
        int err = NETDEV_TX_OK;
-        bool is_nic_in_bad_state;
        frags = skb_shinfo(skb)->nr_frags + 1;
@@ -613,13 +619,10 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                goto err_exit;
        }
-        is_nic_in_bad_state = aq_utils_obj_test(&self->header.flags,
+        aq_ring_update_queue_state(ring);
-                                                AQ_NIC_FLAGS_IS_NOT_TX_READY) ||
-                                                (aq_ring_avail_dx(ring) <
-                                                AQ_CFG_SKB_FRAGS_MAX);
-        if (is_nic_in_bad_state) {
+        /* Above status update may stop the queue. Check this. */
-                aq_nic_ndev_queue_stop(self, ring->idx);
+        if (__netif_subqueue_stopped(self->ndev, ring->idx)) {
                err = NETDEV_TX_BUSY;
                goto err_exit;
        }
@@ -631,9 +634,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                                                      ring,
                                                      frags);
                if (err >= 0) {
-                        if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1)
-                                aq_nic_ndev_queue_stop(self, ring->idx);
                        ++ring->stats.tx.packets;
                        ring->stats.tx.bytes += skb->len;
                }
@@ -693,16 +693,9 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
 {
-        int err = 0;
-        if (new_mtu > self->aq_hw_caps.mtu) {
-                err = -EINVAL;
-                goto err_exit;
-        }
        self->aq_nic_cfg.mtu = new_mtu;
-err_exit:
+        return 0;
-        return err;
 }
 int aq_nic_set_mac(struct aq_nic_s *self, struct net_device *ndev)
@@ -905,9 +898,7 @@ int aq_nic_stop(struct aq_nic_s *self)
        struct aq_vec_s *aq_vec = NULL;
        unsigned int i = 0U;
-        for (i = 0U, aq_vec = self->aq_vec[0];
+        netif_tx_disable(self->ndev);
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_stop(self, i);
        del_timer_sync(&self->service_timer);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 7fc2a5ecb2b7..0ddd556ff901 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -83,8 +83,6 @@ struct net_device *aq_nic_get_ndev(struct aq_nic_s *self);
 int aq_nic_init(struct aq_nic_s *self);
 int aq_nic_cfg_start(struct aq_nic_s *self);
 int aq_nic_ndev_register(struct aq_nic_s *self);
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx);
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx);
 void aq_nic_ndev_free(struct aq_nic_s *self);
 int aq_nic_start(struct aq_nic_s *self);
 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 4eee1996a825..0654e0c76bc2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -104,6 +104,38 @@ int aq_ring_init(struct aq_ring_s *self)
        return 0;
 }
+static inline bool aq_ring_dx_in_range(unsigned int h, unsigned int i,
+                                       unsigned int t)
+{
+        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+}
+void aq_ring_update_queue_state(struct aq_ring_s *ring)
+{
+        if (aq_ring_avail_dx(ring) <= AQ_CFG_SKB_FRAGS_MAX)
+                aq_ring_queue_stop(ring);
+        else if (aq_ring_avail_dx(ring) > AQ_CFG_RESTART_DESC_THRES)
+                aq_ring_queue_wake(ring);
+}
+void aq_ring_queue_wake(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+        if (__netif_subqueue_stopped(ndev, ring->idx)) {
+                netif_wake_subqueue(ndev, ring->idx);
+                ring->stats.tx.queue_restarts++;
+        }
+}
+void aq_ring_queue_stop(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+        if (!__netif_subqueue_stopped(ndev, ring->idx))
+                netif_stop_subqueue(ndev, ring->idx);
+}
 void aq_ring_tx_clean(struct aq_ring_s *self)
 {
        struct device *dev = aq_nic_get_dev(self->aq_nic);
@@ -113,23 +145,28 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
                if (likely(buff->is_mapped)) {
-                        if (unlikely(buff->is_sop))
+                        if (unlikely(buff->is_sop)) {
+                                if (!buff->is_eop &&
+                                    buff->eop_index != 0xffffU &&
+                                    (!aq_ring_dx_in_range(self->sw_head,
+                                                buff->eop_index,
+                                                self->hw_head)))
+                                        break;
                                dma_unmap_single(dev, buff->pa, buff->len,
                                                 DMA_TO_DEVICE);
-                        else
+                        } else {
                                dma_unmap_page(dev, buff->pa, buff->len,
                                               DMA_TO_DEVICE);
+                        }
                }
                if (unlikely(buff->is_eop))
                        dev_kfree_skb_any(buff->skb);
-        }
-}
-static inline unsigned int aq_ring_dx_in_range(unsigned int h, unsigned int i,
+                buff->pa = 0U;
-                                               unsigned int t)
+                buff->eop_index = 0xffffU;
-{
+        }
-        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
 }
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 782176c5f4f8..5844078764bd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -65,7 +65,7 @@ struct __packed aq_ring_buff_s {
        };
        union {
                struct {
-                        u32 len:16;
+                        u16 len;
                        u32 is_ip_cso:1;
                        u32 is_udp_cso:1;
                        u32 is_tcp_cso:1;
@@ -77,8 +77,10 @@ struct __packed aq_ring_buff_s {
                        u32 is_cleaned:1;
                        u32 is_error:1;
                        u32 rsvd3:6;
+                        u16 eop_index;
+                        u16 rsvd4;
                };
-                u32 flags;
+                u64 flags;
        };
 };
@@ -94,6 +96,7 @@ struct aq_ring_stats_tx_s {
        u64 errors;
        u64 packets;
        u64 bytes;
+        u64 queue_restarts;
 };
 union aq_ring_stats_s {
@@ -147,6 +150,9 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
 int aq_ring_init(struct aq_ring_s *self);
 void aq_ring_rx_deinit(struct aq_ring_s *self);
 void aq_ring_free(struct aq_ring_s *self);
+void aq_ring_update_queue_state(struct aq_ring_s *ring);
+void aq_ring_queue_wake(struct aq_ring_s *ring);
+void aq_ring_queue_stop(struct aq_ring_s *ring);
 void aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                     struct napi_struct *napi,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index ebf588004c46..305ff8ffac2c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -59,12 +59,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                        if (ring[AQ_VEC_TX_ID].sw_head !=
                            ring[AQ_VEC_TX_ID].hw_head) {
                                aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
+                                aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
-                                if (aq_ring_avail_dx(&ring[AQ_VEC_TX_ID]) >
-                                    AQ_CFG_SKB_FRAGS_MAX) {
-                                        aq_nic_ndev_queue_start(self->aq_nic,
-                                                ring[AQ_VEC_TX_ID].idx);
-                                }
                                was_tx_cleaned = true;
                        }
@@ -364,6 +359,7 @@ void aq_vec_add_stats(struct aq_vec_s *self,
                stats_tx->packets += tx->packets;
                stats_tx->bytes += tx->bytes;
                stats_tx->errors += tx->errors;
+                stats_tx->queue_restarts += tx->queue_restarts;
        }
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index f3957e930340..fcf89e25a773 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -16,7 +16,7 @@
 #include "../aq_common.h"
-#define HW_ATL_B0_MTU_JUMBO (16000U)
+#define HW_ATL_B0_MTU_JUMBO  16352U
 #define HW_ATL_B0_MTU        1514U
 #define HW_ATL_B0_TX_RINGS 4U
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 4f5ec9a0fbfb..bf734b32e44b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -351,8 +351,7 @@ int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self)
                        break;
                default:
-                        link_status->mbps = 0U;
+                        return -EBUSY;
-                        break;
                }
        }
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index cec94bbb2ea5..8bc126a156e8 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1278,7 +1278,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
        ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
        if (ret)
-                return -ENOMEM;
+                goto error;
        n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
        for (i = 0, j = 0; i < cp->max_cid_space; i++) {
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index e0685e630afe..c1cdbfd83bdb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -2652,7 +2652,8 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
                dev_err(&hdev->pdev->dev,
                        "Configure rss tc size failed, invalid TC_SIZE = %d\n",
                        rss_size);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err;
        }
        roundup_size = roundup_pow_of_two(rss_size);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index dd0ee2691c86..9c86cb7cb988 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -333,7 +333,7 @@
 #define     MVPP2_GMAC_INBAND_AN_MASK           BIT(0)
 #define     MVPP2_GMAC_FLOW_CTRL_MASK           GENMASK(2, 1)
 #define     MVPP2_GMAC_PCS_ENABLE_MASK          BIT(3)
-#define     MVPP2_GMAC_PORT_RGMII_MASK          BIT(4)
+#define     MVPP2_GMAC_INTERNAL_CLK_MASK        BIT(4)
 #define     MVPP2_GMAC_DISABLE_PADDING          BIT(5)
 #define     MVPP2_GMAC_PORT_RESET_MASK          BIT(6)
 #define MVPP2_GMAC_AUTONEG_CONFIG               0xc
@@ -676,6 +676,7 @@ enum mvpp2_tag_type {
 #define MVPP2_PRS_RI_L3_MCAST                   BIT(15)
 #define MVPP2_PRS_RI_L3_BCAST                   (BIT(15) | BIT(16))
 #define MVPP2_PRS_RI_IP_FRAG_MASK               0x20000
+#define MVPP2_PRS_RI_IP_FRAG_TRUE               BIT(17)
 #define MVPP2_PRS_RI_UDF3_MASK                  0x300000
 #define MVPP2_PRS_RI_UDF3_RX_SPECIAL            BIT(21)
 #define MVPP2_PRS_RI_L4_PROTO_MASK              0x1c00000
@@ -792,6 +793,7 @@ struct mvpp2 {
        struct clk *pp_clk;
        struct clk *gop_clk;
        struct clk *mg_clk;
+        struct clk *axi_clk;
        /* List of pointers to port structures */
        struct mvpp2_port **port_list;
@@ -2315,7 +2317,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
            (proto != IPPROTO_IGMP))
                return -EINVAL;
-        /* Fragmented packet */
+        /* Not fragmented packet */
        tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                        MVPP2_PE_LAST_FREE_TID);
        if (tid < 0)
@@ -2334,8 +2336,12 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
                                  MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
        mvpp2_prs_sram_ai_update(&pe, MVPP2_PRS_IPV4_DIP_AI_BIT,
                                 MVPP2_PRS_IPV4_DIP_AI_BIT);
-        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_MASK,
+        mvpp2_prs_sram_ri_update(&pe, ri, ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
-                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK_L);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK);
        mvpp2_prs_tcam_data_byte_set(&pe, 5, proto, MVPP2_PRS_TCAM_PROTO_MASK);
        mvpp2_prs_tcam_ai_update(&pe, 0, MVPP2_PRS_IPV4_DIP_AI_BIT);
@@ -2346,7 +2352,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
        mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
        mvpp2_prs_hw_write(priv, &pe);
-        /* Not fragmented packet */
+        /* Fragmented packet */
        tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                        MVPP2_PE_LAST_FREE_TID);
        if (tid < 0)
@@ -2358,8 +2364,11 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
        pe.sram.word[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
        mvpp2_prs_sram_ri_update(&pe, ri, ri_mask);
-        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, MVPP2_PRS_TCAM_PROTO_MASK_L);
+        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_TRUE,
-        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, MVPP2_PRS_TCAM_PROTO_MASK);
+                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, 0x0);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, 0x0);
        /* Update shadow table and hw entry */
        mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
@@ -4591,7 +4600,6 @@ static void mvpp2_port_mii_gmac_configure(struct mvpp2_port *port)
                val |= MVPP2_GMAC_INBAND_AN_MASK | MVPP2_GMAC_PCS_ENABLE_MASK;
        } else if (phy_interface_mode_is_rgmii(port->phy_interface)) {
                val &= ~MVPP2_GMAC_PCS_ENABLE_MASK;
-                val |= MVPP2_GMAC_PORT_RGMII_MASK;
        }
        writel(val, port->base + MVPP2_GMAC_CTRL_2_REG);
@@ -7496,7 +7504,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
 /* Ports initialization */
 static int mvpp2_port_probe(struct platform_device *pdev,
                            struct device_node *port_node,
-                            struct mvpp2 *priv)
+                            struct mvpp2 *priv, int index)
 {
        struct device_node *phy_node;
        struct phy *comphy;
@@ -7670,7 +7678,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
        }
        netdev_info(dev, "Using %s mac address %pM\n", mac_from, dev->dev_addr);
-        priv->port_list[id] = port;
+        priv->port_list[index] = port;
        return 0;
 err_free_port_pcpu:
@@ -7963,6 +7971,18 @@ static int mvpp2_probe(struct platform_device *pdev)
                err = clk_prepare_enable(priv->mg_clk);
                if (err < 0)
                        goto err_gop_clk;
+                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
+                if (IS_ERR(priv->axi_clk)) {
+                        err = PTR_ERR(priv->axi_clk);
+                        if (err == -EPROBE_DEFER)
+                                goto err_gop_clk;
+                        priv->axi_clk = NULL;
+                } else {
+                        err = clk_prepare_enable(priv->axi_clk);
+                        if (err < 0)
+                                goto err_gop_clk;
+                }
        }
        /* Get system's tclk rate */
@@ -8005,16 +8025,19 @@ static int mvpp2_probe(struct platform_device *pdev)
        }
        /* Initialize ports */
+        i = 0;
        for_each_available_child_of_node(dn, port_node) {
-                err = mvpp2_port_probe(pdev, port_node, priv);
+                err = mvpp2_port_probe(pdev, port_node, priv, i);
                if (err < 0)
                        goto err_mg_clk;
+                i++;
        }
        platform_set_drvdata(pdev, priv);
        return 0;
 err_mg_clk:
+        clk_disable_unprepare(priv->axi_clk);
        if (priv->hw_version == MVPP22)
                clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8052,6 +8075,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                                  aggr_txq->descs_dma);
        }
+        clk_disable_unprepare(priv->axi_clk);
        clk_disable_unprepare(priv->mg_clk);
        clk_disable_unprepare(priv->pp_clk);
        clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
index 1e3a6c3e4132..80eef4163f52 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
@@ -139,7 +139,7 @@ TRACE_EVENT(mlx5_fs_del_fg,
        {MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO, "NEXT_PRIO"}
 TRACE_EVENT(mlx5_fs_set_fte,
-            TP_PROTO(const struct fs_fte *fte, bool new_fte),
+            TP_PROTO(const struct fs_fte *fte, int new_fte),
            TP_ARGS(fte, new_fte),
            TP_STRUCT__entry(
                __field(const struct fs_fte *, fte)
@@ -149,7 +149,7 @@ TRACE_EVENT(mlx5_fs_set_fte,
                __field(u32, action)
                __field(u32, flow_tag)
                __field(u8,  mask_enable)
-                __field(bool, new_fte)
+                __field(int, new_fte)
                __array(u32, mask_outer, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                __array(u32, mask_inner, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                __array(u32, mask_misc, MLX5_ST_SZ_DW(fte_match_set_misc))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index f11fd07ac4dd..850cdc980ab5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -291,7 +291,7 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv)
        priv->fs.vlan.filter_disabled = false;
        if (priv->netdev->flags & IFF_PROMISC)
                return;
-        mlx5e_del_any_vid_rules(priv);
+        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
@@ -302,7 +302,7 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
        priv->fs.vlan.filter_disabled = true;
        if (priv->netdev->flags & IFF_PROMISC)
                return;
-        mlx5e_add_any_vid_rules(priv);
+        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dfc29720ab77..cc11bbbd0309 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -184,7 +184,6 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
        struct mlx5e_sw_stats temp, *s = &temp;
        struct mlx5e_rq_stats *rq_stats;
        struct mlx5e_sq_stats *sq_stats;
-        u64 tx_offload_none = 0;
        int i, j;
        memset(s, 0, sizeof(*s));
@@ -199,6 +198,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                s->rx_lro_bytes += rq_stats->lro_bytes;
                s->rx_csum_none += rq_stats->csum_none;
                s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                s->rx_xdp_drop += rq_stats->xdp_drop;
                s->rx_xdp_tx += rq_stats->xdp_tx;
@@ -229,14 +229,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                        s->tx_queue_dropped     += sq_stats->dropped;
                        s->tx_xmit_more         += sq_stats->xmit_more;
                        s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
-                        tx_offload_none         += sq_stats->csum_none;
+                        s->tx_csum_none         += sq_stats->csum_none;
+                        s->tx_csum_partial      += sq_stats->csum_partial;
                }
        }
-        /* Update calculated offload counters */
-        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
-        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
        s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                priv->stats.pport.phy_counters,
                                counter_set.phys_layer_cntrs.link_down_events);
@@ -3333,8 +3330,8 @@ static int mlx5e_handle_feature(struct net_device *netdev,
        err = feature_handler(netdev, enable);
        if (err) {
-                netdev_err(netdev, "%s feature 0x%llx failed err %d\n",
+                netdev_err(netdev, "%s feature %pNF failed, err %d\n",
-                           enable ? "Enable" : "Disable", feature, err);
+                           enable ? "Enable" : "Disable", &feature, err);
                return err;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f1dd638384d3..15a1687483cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -627,6 +627,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
        if (lro) {
                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                rq->stats.csum_unnecessary++;
                return;
        }
@@ -644,7 +645,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                        skb->csum_level = 1;
                        skb->encapsulation = 1;
                        rq->stats.csum_unnecessary_inner++;
+                        return;
                }
+                rq->stats.csum_unnecessary++;
                return;
        }
 csum_none:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 6d199ffb1c0b..f8637213afc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -68,6 +68,7 @@ struct mlx5e_sw_stats {
        u64 rx_xdp_drop;
        u64 rx_xdp_tx;
        u64 rx_xdp_tx_full;
+        u64 tx_csum_none;
        u64 tx_csum_partial;
        u64 tx_csum_partial_inner;
        u64 tx_queue_stopped;
@@ -108,6 +109,7 @@ static const struct counter_desc sw_stats_desc[] = {
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx_full) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_none) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
@@ -339,6 +341,7 @@ struct mlx5e_rq_stats {
        u64 packets;
        u64 bytes;
        u64 csum_complete;
+        u64 csum_unnecessary;
        u64 csum_unnecessary_inner;
        u64 csum_none;
        u64 lro_packets;
@@ -363,6 +366,7 @@ static const struct counter_desc rq_stats_desc[] = {
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, xdp_drop) },
@@ -392,6 +396,7 @@ struct mlx5e_sq_stats {
        u64 tso_bytes;
        u64 tso_inner_packets;
        u64 tso_inner_bytes;
+        u64 csum_partial;
        u64 csum_partial_inner;
        u64 nop;
        /* less likely accessed in data path */
@@ -408,6 +413,7 @@ static const struct counter_desc sq_stats_desc[] = {
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index da503e6411da..1aa2028ed995 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1317,6 +1317,69 @@ static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 upda
        return true;
 }
+static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
+                                          struct tcf_exts *exts)
+{
+        const struct tc_action *a;
+        bool modify_ip_header;
+        LIST_HEAD(actions);
+        u8 htype, ip_proto;
+        void *headers_v;
+        u16 ethertype;
+        int nkeys, i;
+        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
+        /* for non-IP we only re-write MACs, so we're okay */
+        if (ethertype != ETH_P_IP && ethertype != ETH_P_IPV6)
+                goto out_ok;
+        modify_ip_header = false;
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
+                if (!is_tcf_pedit(a))
+                        continue;
+                nkeys = tcf_pedit_nkeys(a);
+                for (i = 0; i < nkeys; i++) {
+                        htype = tcf_pedit_htype(a, i);
+                        if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
+                            htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
+                                modify_ip_header = true;
+                                break;
+                        }
+                }
+        }
+        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
+        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
+                return false;
+        }
+out_ok:
+        return true;
+}
+static bool actions_match_supported(struct mlx5e_priv *priv,
+                                    struct tcf_exts *exts,
+                                    struct mlx5e_tc_flow_parse_attr *parse_attr,
+                                    struct mlx5e_tc_flow *flow)
+{
+        u32 actions;
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                actions = flow->esw_attr->action;
+        else
+                actions = flow->nic_attr->action;
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
+                return modify_header_match_supported(&parse_attr->spec, exts);
+        return true;
+}
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                struct mlx5e_tc_flow_parse_attr *parse_attr,
                                struct mlx5e_tc_flow *flow)
@@ -1378,6 +1441,9 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                return -EINVAL;
        }
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
        return 0;
 }
@@ -1564,7 +1630,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
                break;
        default:
                err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
        }
        fl4.flowi4_tos = tun_key->tos;
        fl4.daddr = tun_key->u.ipv4.dst;
@@ -1573,7 +1639,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
        err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev,
                                      &fl4, &n, &ttl);
        if (err)
-                goto out;
+                goto free_encap;
        /* used by mlx5e_detach_encap to lookup a neigh hash table
         * entry in the neigh hash table when a user deletes a rule
@@ -1590,7 +1656,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
         */
        err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
        if (err)
-                goto out;
+                goto free_encap;
        read_lock_bh(&n->lock);
        nud_state = n->nud_state;
@@ -1630,8 +1696,9 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
 destroy_neigh_entry:
        mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
        kfree(encap_header);
+out:
        if (n)
                neigh_release(n);
        return err;
@@ -1668,7 +1735,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
                break;
        default:
                err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
        }
        fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label);
@@ -1678,7 +1745,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
        err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev,
                                      &fl6, &n, &ttl);
        if (err)
-                goto out;
+                goto free_encap;
        /* used by mlx5e_detach_encap to lookup a neigh hash table
         * entry in the neigh hash table when a user deletes a rule
@@ -1695,7 +1762,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
         */
        err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
        if (err)
-                goto out;
+                goto free_encap;
        read_lock_bh(&n->lock);
        nud_state = n->nud_state;
@@ -1736,8 +1803,9 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
 destroy_neigh_entry:
        mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
        kfree(encap_header);
+out:
        if (n)
                neigh_release(n);
        return err;
@@ -1791,6 +1859,7 @@ vxlan_encap_offload_err:
                }
        }
+        /* must verify if encap is valid or not */
        if (found)
                goto attach_flow;
@@ -1817,6 +1886,8 @@ attach_flow:
        *encap_dev = e->out_dev;
        if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                attr->encap_id = e->encap_id;
+        else
+                err = -EAGAIN;
        return err;
@@ -1934,6 +2005,10 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                return -EINVAL;
        }
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index fee43e40fa16..1d6925d4369a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -193,6 +193,7 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, struct
                        sq->stats.csum_partial_inner++;
                } else {
                        eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
+                        sq->stats.csum_partial++;
                }
        } else
                sq->stats.csum_none++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
index e37453d838db..c0fd2212e890 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
@@ -71,11 +71,11 @@ int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
        return 0;
 }
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps)
+int mlx5_fpga_caps(struct mlx5_core_dev *dev)
 {
        u32 in[MLX5_ST_SZ_DW(fpga_cap)] = {0};
-        return mlx5_core_access_reg(dev, in, sizeof(in), caps,
+        return mlx5_core_access_reg(dev, in, sizeof(in), dev->caps.fpga,
                                    MLX5_ST_SZ_BYTES(fpga_cap),
                                    MLX5_REG_FPGA_CAP, 0, 0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
index 94bdfd47c3f0..d05233c9b4f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
@@ -65,7 +65,7 @@ struct mlx5_fpga_qp_counters {
        u64 rx_total_drop;
 };
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps);
+int mlx5_fpga_caps(struct mlx5_core_dev *dev);
 int mlx5_fpga_query(struct mlx5_core_dev *dev, struct mlx5_fpga_query *query);
 int mlx5_fpga_ctrl_op(struct mlx5_core_dev *dev, u8 op);
 int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
index 9034e9960a76..dc8970346521 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
@@ -139,8 +139,7 @@ int mlx5_fpga_device_start(struct mlx5_core_dev *mdev)
        if (err)
                goto out;
-        err = mlx5_fpga_caps(fdev->mdev,
+        err = mlx5_fpga_caps(fdev->mdev);
-                             fdev->mdev->caps.hca_cur[MLX5_CAP_FPGA]);
        if (err)
                goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index e0d0efd903bc..36ecc2b2e187 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -293,6 +293,9 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
        }
        if (fte->action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+                int max_list_size = BIT(MLX5_CAP_FLOWTABLE_TYPE(dev,
+                                        log_max_flow_counter,
+                                        ft->type));
                int list_size = 0;
                list_for_each_entry(dst, &fte->node.children, node.list) {
@@ -305,12 +308,17 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                        in_dests += MLX5_ST_SZ_BYTES(dest_format_struct);
                        list_size++;
                }
+                if (list_size > max_list_size) {
+                        err = -EINVAL;
+                        goto err_out;
+                }
                MLX5_SET(flow_context, in_flow_context, flow_counter_list_size,
                         list_size);
        }
        err = mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+err_out:
        kvfree(in);
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 5509a752f98e..48dd78975062 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -52,6 +52,7 @@ enum fs_flow_table_type {
        FS_FT_FDB             = 0X4,
        FS_FT_SNIFFER_RX        = 0X5,
        FS_FT_SNIFFER_TX        = 0X6,
+        FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
 };
 enum fs_flow_table_op_mod {
@@ -260,4 +261,14 @@ void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
 #define fs_for_each_dst(pos, fte)                       \
        fs_list_for_each_entry(pos, &(fte)->node.children)
+#define MLX5_CAP_FLOWTABLE_TYPE(mdev, cap, type) (              \
+        (type == FS_FT_NIC_RX) ? MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) :         \
+        (type == FS_FT_ESW_EGRESS_ACL) ? MLX5_CAP_ESW_EGRESS_ACL(mdev, cap) :           \
+        (type == FS_FT_ESW_INGRESS_ACL) ? MLX5_CAP_ESW_INGRESS_ACL(mdev, cap) :         \
+        (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
+        (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
+        (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
+        (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+        )
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 85298051a3e4..145e392ab849 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)
 {
        struct mlx5e_priv          *priv    = mlx5i_epriv(netdev);
        const struct mlx5e_profile *profile = priv->profile;
+        struct mlx5_core_dev       *mdev    = priv->mdev;
        mlx5e_detach_netdev(priv);
        profile->cleanup(priv);
        destroy_workqueue(priv->wq);
        free_netdev(netdev);
-        mlx5e_destroy_mdev_resources(priv->mdev);
+        mlx5e_destroy_mdev_resources(mdev);
 }
 EXPORT_SYMBOL(mlx5_rdma_netdev_free);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index 6c48e9959b65..2a8b529ce6dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -109,7 +109,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                                mlx5_core_warn(dev,
                                               "failed to restore VF %d settings, err %d\n",
                                               vf, err);
-                        continue;
+                                continue;
                        }
                }
                mlx5_core_dbg(dev, "successfully enabled VF* %d\n", vf);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 2cfb3f5d092d..032089efc1a0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -2723,6 +2723,7 @@ static void mlxsw_sp_nexthop_type_fini(struct mlxsw_sp *mlxsw_sp,
                mlxsw_sp_nexthop_rif_fini(nh);
                break;
        case MLXSW_SP_NEXTHOP_TYPE_IPIP:
+                mlxsw_sp_nexthop_rif_fini(nh);
                mlxsw_sp_nexthop_ipip_fini(mlxsw_sp, nh);
                break;
        }
@@ -2742,7 +2743,11 @@ static int mlxsw_sp_nexthop4_type_init(struct mlxsw_sp *mlxsw_sp,
            router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                     MLXSW_SP_L3_PROTO_IPV4)) {
                nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
        }
        nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -4009,7 +4014,11 @@ static int mlxsw_sp_nexthop6_type_init(struct mlxsw_sp *mlxsw_sp,
            router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                     MLXSW_SP_L3_PROTO_IPV6)) {
                nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
        }
        nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -5068,6 +5077,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
        vr = mlxsw_sp_vr_get(mlxsw_sp, tb_id ? : RT_TABLE_MAIN);
        if (IS_ERR(vr))
                return ERR_CAST(vr);
+        vr->rif_count++;
        err = mlxsw_sp_rif_index_alloc(mlxsw_sp, &rif_index);
        if (err)
@@ -5099,7 +5109,6 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
        mlxsw_sp_rif_counters_alloc(rif);
        mlxsw_sp->router->rifs[rif_index] = rif;
-        vr->rif_count++;
        return rif;
@@ -5110,6 +5119,7 @@ err_fid_get:
        kfree(rif);
 err_rif_alloc:
 err_rif_index_alloc:
+        vr->rif_count--;
        mlxsw_sp_vr_put(vr);
        return ERR_PTR(err);
 }
@@ -5124,7 +5134,6 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
        mlxsw_sp_router_rif_gone_sync(mlxsw_sp, rif);
        vr = &mlxsw_sp->router->vrs[rif->vr_id];
-        vr->rif_count--;
        mlxsw_sp->router->rifs[rif->rif_index] = NULL;
        mlxsw_sp_rif_counters_free(rif);
        ops->deconfigure(rif);
@@ -5132,6 +5141,7 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
                /* Loopback RIFs are not associated with a FID. */
                mlxsw_sp_fid_put(fid);
        kfree(rif);
+        vr->rif_count--;
        mlxsw_sp_vr_put(vr);
 }
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 0ea3ca09c689..3ed9033e56db 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -898,7 +898,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt,
                curr_rxbuf->dma_addr =
                        dma_map_single(adpt->netdev->dev.parent, skb->data,
-                                       curr_rxbuf->length, DMA_FROM_DEVICE);
+                                       adpt->rxbuf_size, DMA_FROM_DEVICE);
                ret = dma_mapping_error(adpt->netdev->dev.parent,
                                        curr_rxbuf->dma_addr);
                if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 98f22551eb45..1e33aea59f50 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -51,10 +51,7 @@ struct rmnet_walk_data {
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
-        rx_handler_func_t *rx_handler;
+        return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
-        rx_handler = rcu_dereference(real_dev->rx_handler);
-        return (rx_handler == rmnet_rx_handler);
 }
 /* Needs rtnl lock */
diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h
index a63ef82e7c72..dfae3c9d57c6 100644
--- a/drivers/net/ethernet/rocker/rocker_tlv.h
+++ b/drivers/net/ethernet/rocker/rocker_tlv.h
@@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info)
 int rocker_tlv_put(struct rocker_desc_info *desc_info,
                   int attrtype, int attrlen, const void *data);
-static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info,
+static inline int
-                                    int attrtype, u8 value)
+rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value);
+        u8 tmp = value; /* work around GCC PR81715 */
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp);
 }
-static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info,
+static inline int
-                                     int attrtype, u16 value)
+rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp);
 }
-static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info,
+static inline int
-                                      int attrtype, __be16 value)
+rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp);
 }
-static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info,
+static inline int
-                                     int attrtype, u32 value)
+rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp);
 }
-static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info,
+static inline int
-                                      int attrtype, __be32 value)
+rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp);
 }
-static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info,
+static inline int
-                                     int attrtype, u64 value)
+rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value);
+        u64 tmp = value;
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp);
 }
 static inline struct rocker_tlv *
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
index dd6a2f9791cc..5efef8001edf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
@@ -511,6 +511,7 @@ static struct platform_driver dwc_eth_dwmac_driver = {
        .remove = dwc_eth_dwmac_remove,
        .driver = {
                .name           = "dwc-eth-dwmac",
+                .pm             = &stmmac_pltfr_pm_ops,
                .of_match_table = dwc_eth_dwmac_match,
        },
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 99823f54696a..13133b30b575 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -83,6 +83,117 @@ struct rk_priv_data {
        (((tx) ? soc##_GMAC_TXCLK_DLY_ENABLE : soc##_GMAC_TXCLK_DLY_DISABLE) | \
         ((rx) ? soc##_GMAC_RXCLK_DLY_ENABLE : soc##_GMAC_RXCLK_DLY_DISABLE))
+#define RK3128_GRF_MAC_CON0     0x0168
+#define RK3128_GRF_MAC_CON1     0x016c
+/* RK3128_GRF_MAC_CON0 */
+#define RK3128_GMAC_TXCLK_DLY_ENABLE   GRF_BIT(14)
+#define RK3128_GMAC_TXCLK_DLY_DISABLE  GRF_CLR_BIT(14)
+#define RK3128_GMAC_RXCLK_DLY_ENABLE   GRF_BIT(15)
+#define RK3128_GMAC_RXCLK_DLY_DISABLE  GRF_CLR_BIT(15)
+#define RK3128_GMAC_CLK_RX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 7)
+#define RK3128_GMAC_CLK_TX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 0)
+/* RK3128_GRF_MAC_CON1 */
+#define RK3128_GMAC_PHY_INTF_SEL_RGMII  \
+                (GRF_BIT(6) | GRF_CLR_BIT(7) | GRF_CLR_BIT(8))
+#define RK3128_GMAC_PHY_INTF_SEL_RMII   \
+                (GRF_CLR_BIT(6) | GRF_CLR_BIT(7) | GRF_BIT(8))
+#define RK3128_GMAC_FLOW_CTRL          GRF_BIT(9)
+#define RK3128_GMAC_FLOW_CTRL_CLR      GRF_CLR_BIT(9)
+#define RK3128_GMAC_SPEED_10M          GRF_CLR_BIT(10)
+#define RK3128_GMAC_SPEED_100M         GRF_BIT(10)
+#define RK3128_GMAC_RMII_CLK_25M       GRF_BIT(11)
+#define RK3128_GMAC_RMII_CLK_2_5M      GRF_CLR_BIT(11)
+#define RK3128_GMAC_CLK_125M           (GRF_CLR_BIT(12) | GRF_CLR_BIT(13))
+#define RK3128_GMAC_CLK_25M            (GRF_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_CLK_2_5M           (GRF_CLR_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_RMII_MODE          GRF_BIT(14)
+#define RK3128_GMAC_RMII_MODE_CLR      GRF_CLR_BIT(14)
+static void rk3128_set_to_rgmii(struct rk_priv_data *bsp_priv,
+                                int tx_delay, int rx_delay)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RGMII |
+                     RK3128_GMAC_RMII_MODE_CLR);
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON0,
+                     DELAY_ENABLE(RK3128, tx_delay, rx_delay) |
+                     RK3128_GMAC_CLK_RX_DL_CFG(rx_delay) |
+                     RK3128_GMAC_CLK_TX_DL_CFG(tx_delay));
+}
+static void rk3128_set_to_rmii(struct rk_priv_data *bsp_priv)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RMII | RK3128_GMAC_RMII_MODE);
+}
+static void rk3128_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+        if (speed == 10)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_2_5M);
+        else if (speed == 100)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_25M);
+        else if (speed == 1000)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_125M);
+        else
+                dev_err(dev, "unknown speed value for RGMII! speed=%d", speed);
+}
+static void rk3128_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+        if (speed == 10) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_2_5M |
+                             RK3128_GMAC_SPEED_10M);
+        } else if (speed == 100) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_25M |
+                             RK3128_GMAC_SPEED_100M);
+        } else {
+                dev_err(dev, "unknown speed value for RMII! speed=%d", speed);
+        }
+}
+static const struct rk_gmac_ops rk3128_ops = {
+        .set_to_rgmii = rk3128_set_to_rgmii,
+        .set_to_rmii = rk3128_set_to_rmii,
+        .set_rgmii_speed = rk3128_set_rgmii_speed,
+        .set_rmii_speed = rk3128_set_rmii_speed,
+};
 #define RK3228_GRF_MAC_CON0     0x0900
 #define RK3228_GRF_MAC_CON1     0x0904
@@ -1313,6 +1424,7 @@ static int rk_gmac_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(rk_gmac_pm_ops, rk_gmac_suspend, rk_gmac_resume);
 static const struct of_device_id rk_gmac_dwmac_match[] = {
+        { .compatible = "rockchip,rk3128-gmac", .data = &rk3128_ops },
        { .compatible = "rockchip,rk3228-gmac", .data = &rk3228_ops },
        { .compatible = "rockchip,rk3288-gmac", .data = &rk3288_ops },
        { .compatible = "rockchip,rk3328-gmac", .data = &rk3328_ops },
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index c4407e8e39a3..2f7d7ec59962 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -296,6 +296,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
 {
        void __iomem *ioaddr = hw->pcsr;
        unsigned int pmt = 0;
+        u32 config;
        if (mode & WAKE_MAGIC) {
                pr_debug("GMAC: WOL Magic frame\n");
@@ -306,6 +307,12 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
                pmt |= power_down | global_unicast | wake_up_frame_en;
        }
+        if (pmt) {
+                /* The receiver must be enabled for WOL before powering down */
+                config = readl(ioaddr + GMAC_CONFIG);
+                config |= GMAC_CONFIG_RE;
+                writel(config, ioaddr + GMAC_CONFIG);
+        }
        writel(pmt, ioaddr + GMAC_PMT);
 }
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index a404552555d4..c3f77e3b7819 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -120,7 +120,7 @@ struct ppp {
        int             n_channels;     /* how many channels are attached 54 */
        spinlock_t      rlock;          /* lock for receive side 58 */
        spinlock_t      wlock;          /* lock for transmit side 5c */
-        int             *xmit_recursion __percpu; /* xmit recursion detect */
+        int __percpu    *xmit_recursion; /* xmit recursion detect */
        int             mru;            /* max receive unit 60 */
        unsigned int    flags;          /* control bits 64 */
        unsigned int    xstate;         /* transmit state bits 68 */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3c9985f29950..5ce580f413b9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1496,11 +1496,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        switch (tun->flags & TUN_TYPE_MASK) {
        case IFF_TUN:
                if (tun->flags & IFF_NO_PI) {
-                        switch (skb->data[0] & 0xf0) {
+                        u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
-                        case 0x40:
+                        switch (ip_version) {
+                        case 4:
                                pi.proto = htons(ETH_P_IP);
                                break;
-                        case 0x60:
+                        case 6:
                                pi.proto = htons(ETH_P_IPV6);
                                break;
                        default:
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 8ab281b478f2..29c7e2ec0dcb 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -54,11 +54,19 @@ static int is_wireless_rndis(struct usb_interface_descriptor *desc)
                desc->bInterfaceProtocol == 3);
 }
+static int is_novatel_rndis(struct usb_interface_descriptor *desc)
+{
+        return (desc->bInterfaceClass == USB_CLASS_MISC &&
+                desc->bInterfaceSubClass == 4 &&
+                desc->bInterfaceProtocol == 1);
+}
 #else
 #define is_rndis(desc)          0
 #define is_activesync(desc)     0
 #define is_wireless_rndis(desc) 0
+#define is_novatel_rndis(desc)  0
 #endif
@@ -150,7 +158,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         */
        rndis = (is_rndis(&intf->cur_altsetting->desc) ||
                 is_activesync(&intf->cur_altsetting->desc) ||
-                 is_wireless_rndis(&intf->cur_altsetting->desc));
+                 is_wireless_rndis(&intf->cur_altsetting->desc) ||
+                 is_novatel_rndis(&intf->cur_altsetting->desc));
        memset(info, 0, sizeof(*info));
        info->control = intf;
@@ -547,6 +556,7 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define LINKSYS_VENDOR_ID       0x13b1
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
@@ -737,6 +747,15 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+#if IS_ENABLED(CONFIG_USB_RTL8152)
+/* Linksys USB3GIGV1 Ethernet Adapter */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LINKSYS_VENDOR_ID, 0x0041, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+#endif
 /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
 {
        USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ceb78e2ea4f0..941ece08ba78 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -613,6 +613,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_LINKSYS               0x13b1
 #define VENDOR_ID_NVIDIA                0x0955
 #define MCU_TYPE_PLA                    0x0100
@@ -5316,6 +5317,7 @@ static const struct usb_device_id rtl8152_table[] = {
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
        {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
        {}
 };
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a151f267aebb..b807c91abe1d 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -632,6 +632,10 @@ static const struct usb_device_id	products [] = {
        /* RNDIS for tethering */
        USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
        .driver_info = (unsigned long) &rndis_info,
+}, {
+        /* Novatel Verizon USB730L */
+        USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+        .driver_info = (unsigned long) &rndis_info,
 },
        { },            // END
 };
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index bc1633945a56..195dafb98131 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3396,9 +3396,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 MODULE_DEVICE_TABLE(pci, ath10k_pci_id_table);
-#ifdef CONFIG_PM
+static __maybe_unused int ath10k_pci_pm_suspend(struct device *dev)
-static int ath10k_pci_pm_suspend(struct device *dev)
 {
        struct ath10k *ar = dev_get_drvdata(dev);
        int ret;
@@ -3414,7 +3412,7 @@ static int ath10k_pci_pm_suspend(struct device *dev)
        return ret;
 }
-static int ath10k_pci_pm_resume(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_resume(struct device *dev)
 {
        struct ath10k *ar = dev_get_drvdata(dev);
        int ret;
@@ -3433,7 +3431,6 @@ static int ath10k_pci_pm_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ath10k_pci_pm_ops,
                         ath10k_pci_pm_suspend,
                         ath10k_pci_pm_resume);
-#endif
 static struct pci_driver ath10k_pci_driver = {
        .name = "ath10k_pci",
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab503ad..4157c90ad973 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
        eth_broadcast_addr(params_le->bssid);
        params_le->bss_type = DOT11_BSSTYPE_ANY;
-        params_le->scan_type = 0;
+        params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
        params_le->channel_num = 0;
        params_le->nprobes = cpu_to_le32(-1);
        params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
        params_le->home_time = cpu_to_le32(-1);
        memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
-        /* if request is null exit so it will be all channel broadcast scan */
-        if (!request)
-                return;
        n_ssids = request->n_ssids;
        n_channels = request->n_channels;
        /* Copy channel array if applicable */
        brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
                  n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
                        ptr += sizeof(ssid_le);
                }
        } else {
-                brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
+                brcmf_dbg(SCAN, "Performing passive scan\n");
-                if ((request->ssids) && request->ssids->ssid_len) {
+                params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
-                        brcmf_dbg(SCAN, "SSID %s len=%d\n",
-                                  params_le->ssid_le.SSID,
-                                  request->ssids->ssid_len);
-                        params_le->ssid_le.SSID_len =
-                                cpu_to_le32(request->ssids->ssid_len);
-                        memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
-                                request->ssids->ssid_len);
-                }
        }
        /* Adding mask to channel numbers */
        params_le->channel_num =
@@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
        s32 status;
        struct brcmf_escan_result_le *escan_result_le;
+        u32 escan_buflen;
        struct brcmf_bss_info_le *bss_info_le;
        struct brcmf_bss_info_le *bss = NULL;
        u32 bi_length;
@@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
        if (status == BRCMF_E_STATUS_PARTIAL) {
                brcmf_dbg(SCAN, "ESCAN Partial result\n");
+                if (e->datalen < sizeof(*escan_result_le)) {
+                        brcmf_err("invalid event data length\n");
+                        goto exit;
+                }
                escan_result_le = (struct brcmf_escan_result_le *) data;
                if (!escan_result_le) {
                        brcmf_err("Invalid escan result (NULL pointer)\n");
                        goto exit;
                }
+                escan_buflen = le32_to_cpu(escan_result_le->buflen);
+                if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+                    escan_buflen > e->datalen ||
+                    escan_buflen < sizeof(*escan_result_le)) {
+                        brcmf_err("Invalid escan buffer length: %d\n",
+                                  escan_buflen);
+                        goto exit;
+                }
                if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                        brcmf_err("Invalid bss_count %d: ignoring\n",
                                  escan_result_le->bss_count);
@@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                }
                bi_length = le32_to_cpu(bss_info_le->length);
-                if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
+                if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
-                                        WL_ESCAN_RESULTS_FIXED_SIZE)) {
+                        brcmf_err("Ignoring invalid bss_info length: %d\n",
-                        brcmf_err("Invalid bss_info length %d: ignoring\n",
                                  bi_length);
                        goto exit;
                }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 8391989b1882..e0d22fedb2b4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -45,6 +45,11 @@
 #define BRCMF_SCAN_PARAMS_COUNT_MASK    0x0000ffff
 #define BRCMF_SCAN_PARAMS_NSSID_SHIFT   16
+/* scan type definitions */
+#define BRCMF_SCANTYPE_DEFAULT          0xFF
+#define BRCMF_SCANTYPE_ACTIVE           0
+#define BRCMF_SCANTYPE_PASSIVE          1
 #define BRCMF_WSEC_MAX_PSK_LEN          32
 #define BRCMF_WSEC_PASSPHRASE           BIT(0)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 5de19ea10575..b205a7bfb828 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2167,7 +2167,7 @@ out:
         * 1. We are not using a unified image
         * 2. We are using a unified image but had an error while exiting D3
         */
-        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+        set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
        set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
        /*
         * When switching images we return 1, which causes mac80211
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 15f2d826bb4b..3bcaa82f59b2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1546,6 +1546,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
        struct iwl_mvm_mc_iter_data *data = _data;
        struct iwl_mvm *mvm = data->mvm;
        struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = MCAST_FILTER_CMD,
+                .flags = CMD_ASYNC,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
        int ret, len;
        /* if we don't have free ports, mcast frames will be dropped */
@@ -1560,7 +1565,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
        memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
        len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+        hcmd.len[0] = len;
+        hcmd.data[0] = cmd;
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
        if (ret)
                IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1635,6 +1643,12 @@ static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
        if (!cmd)
                goto out;
+        if (changed_flags & FIF_ALLMULTI)
+                cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
+        if (cmd->pass_all)
+                cmd->count = 0;
        iwl_mvm_recalc_multicast(mvm);
 out:
        mutex_unlock(&mvm->mutex);
@@ -2563,7 +2577,7 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
                         * queues, so we should never get a second deferred
                         * frame for the RA/TID.
                         */
-                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
+                        iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
                        ieee80211_free_txskb(mvm->hw, skb);
                }
        }
@@ -3975,6 +3989,43 @@ out_unlock:
        return ret;
 }
+static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
+{
+        if (drop) {
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        /* TODO new tx api */
+                        WARN_ONCE(1,
+                                  "Need to implement flush TX queue\n");
+                else
+                        iwl_mvm_flush_tx_path(mvm,
+                                iwl_mvm_flushable_queues(mvm) & queues,
+                                0);
+        } else {
+                if (iwl_mvm_has_new_tx_api(mvm)) {
+                        struct ieee80211_sta *sta;
+                        int i;
+                        mutex_lock(&mvm->mutex);
+                        for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
+                                sta = rcu_dereference_protected(
+                                                mvm->fw_id_to_mac_id[i],
+                                                lockdep_is_held(&mvm->mutex));
+                                if (IS_ERR_OR_NULL(sta))
+                                        continue;
+                                iwl_mvm_wait_sta_queues_empty(mvm,
+                                                iwl_mvm_sta_from_mac80211(sta));
+                        }
+                        mutex_unlock(&mvm->mutex);
+                } else {
+                        iwl_trans_wait_tx_queues_empty(mvm->trans,
+                                                       queues);
+                }
+        }
+}
 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif, u32 queues, bool drop)
 {
@@ -3985,7 +4036,12 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
        int i;
        u32 msk = 0;
-        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+        if (!vif) {
+                iwl_mvm_flush_no_vif(mvm, queues, drop);
+                return;
+        }
+        if (vif->type != NL80211_IFTYPE_STATION)
                return;
        /* Make sure we're done with the deferred traffic before flushing */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index ba7bd049d3d4..0fe723ca844e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -661,7 +661,8 @@ static void rs_tl_turn_on_agg(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
            (lq_sta->tx_agg_tid_en & BIT(tid)) &&
            (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
                IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
-                rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta);
+                if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
+                        tid_data->state = IWL_AGG_QUEUED;
        }
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 67ffd9774712..77f77bc5d083 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -672,11 +672,12 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         * If there was a significant jump in the nssn - adjust.
         * If the SN is smaller than the NSSN it might need to first go into
         * the reorder buffer, in which case we just release up to it and the
-         * rest of the function will take of storing it and releasing up to the
+         * rest of the function will take care of storing it and releasing up to
-         * nssn
+         * the nssn
         */
        if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
-                                buffer->buf_size)) {
+                                buffer->buf_size) ||
+            !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
                u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
                iwl_mvm_release_frames(mvm, sta, napi, buffer, min_sn);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 50983615dce6..774122fed454 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -555,7 +555,7 @@ static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
        struct iwl_host_cmd cmd = {
                .id = SCAN_OFFLOAD_ABORT_CMD,
        };
-        u32 status;
+        u32 status = CAN_ABORT_STATUS;
        ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
        if (ret)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 411a2055dc45..c4a343534c5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1285,7 +1285,7 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 {
        struct iwl_mvm_add_sta_cmd cmd;
        int ret;
-        u32 status;
+        u32 status = ADD_STA_SUCCESS;
        lockdep_assert_held(&mvm->mutex);
@@ -2385,8 +2385,10 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
                return -EINVAL;
-        if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
+        if (mvmsta->tid_data[tid].state != IWL_AGG_QUEUED &&
-                IWL_ERR(mvm, "Start AGG when state is not IWL_AGG_OFF %d!\n",
+            mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
+                IWL_ERR(mvm,
+                        "Start AGG when state is not IWL_AGG_QUEUED or IWL_AGG_OFF %d!\n",
                        mvmsta->tid_data[tid].state);
                return -ENXIO;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index d13893806513..aedabe101cf0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -281,6 +281,7 @@ struct iwl_mvm_vif;
 * These states relate to a specific RA / TID.
 *
 * @IWL_AGG_OFF: aggregation is not used
+ * @IWL_AGG_QUEUED: aggregation start work has been queued
 * @IWL_AGG_STARTING: aggregation are starting (between start and oper)
 * @IWL_AGG_ON: aggregation session is up
 * @IWL_EMPTYING_HW_QUEUE_ADDBA: establishing a BA session - waiting for the
@@ -290,6 +291,7 @@ struct iwl_mvm_vif;
 */
 enum iwl_mvm_agg_state {
        IWL_AGG_OFF = 0,
+        IWL_AGG_QUEUED,
        IWL_AGG_STARTING,
        IWL_AGG_ON,
        IWL_EMPTYING_HW_QUEUE_ADDBA,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 8876c2abc440..4d907f60bce9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -529,6 +529,7 @@ int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 state)
        lockdep_assert_held(&mvm->mutex);
+        status = 0;
        ret = iwl_mvm_send_cmd_pdu_status(mvm, WIDE_ID(PHY_OPS_GROUP,
                                                       CTDP_CONFIG_CMD),
                                          sizeof(cmd), &cmd, &status);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 172b5e63d3fb..6f2e2af23219 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -564,8 +564,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_ADHOC:
                /*
-                 * Handle legacy hostapd as well, where station will be added
+                 * Non-bufferable frames use the broadcast station, thus they
-                 * only just before sending the association response.
+                 * use the probe queue.
                 * Also take care of the case where we send a deauth to a
                 * station that we don't have, or similarly an association
                 * response (with non-success status) for a station we can't
@@ -573,9 +573,9 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                 * Also, disassociate frames might happen, particular with
                 * reason 7 ("Class 3 frame received from nonassociated STA").
                 */
-                if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) ||
+                if (ieee80211_is_mgmt(fc) &&
-                    ieee80211_is_deauth(fc) || ieee80211_is_assoc_resp(fc) ||
+                    (!ieee80211_is_bufferable_mmpdu(fc) ||
-                    ieee80211_is_disassoc(fc))
+                     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
                        return mvm->probe_queue;
                if (info->hw_queue == info->control.vif->cab_queue)
                        return mvmvif->cab_queue;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 856fa6e8327e..a450bc6bc774 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -115,6 +115,8 @@ int qtnf_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
        vif = qtnf_netdev_get_priv(wdev->netdev);
+        qtnf_scan_done(vif->mac, true);
        if (qtnf_cmd_send_del_intf(vif))
                pr_err("VIF%u.%u: failed to delete VIF\n", vif->mac->macid,
                       vif->vifid);
@@ -335,6 +337,8 @@ static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev)
        struct qtnf_vif *vif = qtnf_netdev_get_priv(dev);
        int ret;
+        qtnf_scan_done(vif->mac, true);
        ret = qtnf_cmd_send_stop_ap(vif);
        if (ret) {
                pr_err("VIF%u.%u: failed to stop AP operation in FW\n",
@@ -570,8 +574,6 @@ qtnf_del_station(struct wiphy *wiphy, struct net_device *dev,
            !qtnf_sta_list_lookup(&vif->sta_list, params->mac))
                return 0;
-        qtnf_scan_done(vif->mac, true);
        ret = qtnf_cmd_send_del_sta(vif, params);
        if (ret)
                pr_err("VIF%u.%u: failed to delete STA %pM\n",
@@ -1134,8 +1136,9 @@ void qtnf_virtual_intf_cleanup(struct net_device *ndev)
                }
                vif->sta_state = QTNF_STA_DISCONNECTED;
-                qtnf_scan_done(mac, true);
        }
+        qtnf_scan_done(mac, true);
 }
 void qtnf_cfg80211_vif_reset(struct qtnf_vif *vif)
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
index 6a4af52522b8..66db26613b1f 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
@@ -34,6 +34,9 @@ static inline void qtnf_scan_done(struct qtnf_wmac *mac, bool aborted)
                .aborted = aborted,
        };
+        if (timer_pending(&mac->scan_timeout))
+                del_timer_sync(&mac->scan_timeout);
        mutex_lock(&mac->mac_lock);
        if (mac->scan_req) {
diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
index 0fc2814eafad..43d2e7fd6e02 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -345,8 +345,6 @@ qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,
                return -EINVAL;
        }
-        if (timer_pending(&mac->scan_timeout))
-                del_timer_sync(&mac->scan_timeout);
        qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);
        return 0;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
index 502e72b7cdcc..69131965a298 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
@@ -661,14 +661,18 @@ static int qtnf_pcie_data_tx(struct qtnf_bus *bus, struct sk_buff *skb)
        struct qtnf_pcie_bus_priv *priv = (void *)get_bus_priv(bus);
        dma_addr_t txbd_paddr, skb_paddr;
        struct qtnf_tx_bd *txbd;
+        unsigned long flags;
        int len, i;
        u32 info;
        int ret = 0;
+        spin_lock_irqsave(&priv->tx0_lock, flags);
        if (!qtnf_tx_queue_ready(priv)) {
                if (skb->dev)
                        netif_stop_queue(skb->dev);
+                spin_unlock_irqrestore(&priv->tx0_lock, flags);
                return NETDEV_TX_BUSY;
        }
@@ -717,8 +721,10 @@ tx_done:
                dev_kfree_skb_any(skb);
        }
-        qtnf_pcie_data_tx_reclaim(priv);
        priv->tx_done_count++;
+        spin_unlock_irqrestore(&priv->tx0_lock, flags);
+        qtnf_pcie_data_tx_reclaim(priv);
        return NETDEV_TX_OK;
 }
@@ -1247,6 +1253,7 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        strcpy(bus->fwname, QTN_PCI_PEARL_FW_NAME);
        init_completion(&bus->request_firmware_complete);
        mutex_init(&bus->bus_lock);
+        spin_lock_init(&pcie_priv->tx0_lock);
        spin_lock_init(&pcie_priv->irq_lock);
        spin_lock_init(&pcie_priv->tx_reclaim_lock);
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
index e76a23716ee0..86ac1ccedb52 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
@@ -34,6 +34,8 @@ struct qtnf_pcie_bus_priv {
        /* lock for tx reclaim operations */
        spinlock_t tx_reclaim_lock;
+        /* lock for tx0 operations */
+        spinlock_t tx0_lock;
        u8 msi_enabled;
        int mps;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index acc816b67582..5a14cc7f28ee 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -134,8 +134,6 @@ static inline bool nvme_req_needs_retry(struct request *req)
                return false;
        if (nvme_req(req)->status & NVME_SC_DNR)
                return false;
-        if (jiffies - req->start_time >= req->timeout)
-                return false;
        if (nvme_req(req)->retries >= nvme_max_retries)
                return false;
        return true;
@@ -2138,7 +2136,7 @@ static umode_t nvme_ns_attrs_are_visible(struct kobject *kobj,
        struct nvme_ns *ns = nvme_get_ns_from_dev(dev);
        if (a == &dev_attr_uuid.attr) {
-                if (uuid_is_null(&ns->uuid) ||
+                if (uuid_is_null(&ns->uuid) &&
                    !memchr_inv(ns->nguid, 0, sizeof(ns->nguid)))
                        return 0;
        }
@@ -2590,7 +2588,7 @@ static void nvme_async_event_work(struct work_struct *work)
                container_of(work, struct nvme_ctrl, async_event_work);
        spin_lock_irq(&ctrl->lock);
-        while (ctrl->event_limit > 0) {
+        while (ctrl->state == NVME_CTRL_LIVE && ctrl->event_limit > 0) {
                int aer_idx = --ctrl->event_limit;
                spin_unlock_irq(&ctrl->lock);
@@ -2677,7 +2675,8 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                /*FALLTHRU*/
        case NVME_SC_ABORT_REQ:
                ++ctrl->event_limit;
-                queue_work(nvme_wq, &ctrl->async_event_work);
+                if (ctrl->state == NVME_CTRL_LIVE)
+                        queue_work(nvme_wq, &ctrl->async_event_work);
                break;
        default:
                break;
@@ -2692,7 +2691,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                nvme_queue_scan(ctrl);
                break;
        case NVME_AER_NOTICE_FW_ACT_STARTING:
-                schedule_work(&ctrl->fw_act_work);
+                queue_work(nvme_wq, &ctrl->fw_act_work);
                break;
        default:
                dev_warn(ctrl->device, "async event result %08x\n", result);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 47307752dc65..555c976cc2ee 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -565,6 +565,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
        opts->queue_size = NVMF_DEF_QUEUE_SIZE;
        opts->nr_io_queues = num_online_cpus();
        opts->reconnect_delay = NVMF_DEF_RECONNECT_DELAY;
+        opts->kato = NVME_DEFAULT_KATO;
        options = o = kstrdup(buf, GFP_KERNEL);
        if (!options)
@@ -655,21 +656,22 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                goto out;
                        }
-                        if (opts->discovery_nqn) {
-                                pr_err("Discovery controllers cannot accept keep_alive_tmo != 0\n");
-                                ret = -EINVAL;
-                                goto out;
-                        }
                        if (token < 0) {
                                pr_err("Invalid keep_alive_tmo %d\n", token);
                                ret = -EINVAL;
                                goto out;
-                        } else if (token == 0) {
+                        } else if (token == 0 && !opts->discovery_nqn) {
                                /* Allowed for debug */
                                pr_warn("keep_alive_tmo 0 won't execute keep alives!!!\n");
                        }
                        opts->kato = token;
+                        if (opts->discovery_nqn && opts->kato) {
+                                pr_err("Discovery controllers cannot accept KATO != 0\n");
+                                ret = -EINVAL;
+                                goto out;
+                        }
                        break;
                case NVMF_OPT_CTRL_LOSS_TMO:
                        if (match_int(args, &token)) {
@@ -762,8 +764,6 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
        uuid_copy(&opts->host->id, &hostid);
 out:
-        if (!opts->discovery_nqn && !opts->kato)
-                opts->kato = NVME_DEFAULT_KATO;
        kfree(options);
        return ret;
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index d2e882c0f496..af075e998944 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1376,7 +1376,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
        if (atomic_read(&op->state) == FCPOP_STATE_ABORTED)
                status = cpu_to_le16((NVME_SC_ABORT_REQ | NVME_SC_DNR) << 1);
        else if (freq->status)
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
        /*
         * For the linux implementation, if we have an unsuccesful
@@ -1404,7 +1404,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 */
                if (freq->transferred_length !=
                        be32_to_cpu(op->cmd_iu.data_len)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                        goto done;
                }
                result.u64 = 0;
@@ -1421,7 +1421,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                                        freq->transferred_length ||
                             op->rsp_iu.status_code ||
                             sqe->common.command_id != cqe->command_id)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                        goto done;
                }
                result = cqe->result;
@@ -1429,7 +1429,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                break;
        default:
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                goto done;
        }
@@ -1989,16 +1989,17 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
         * as well as those by FC-NVME spec.
         */
        WARN_ON_ONCE(sqe->common.metadata);
-        WARN_ON_ONCE(sqe->common.dptr.prp1);
-        WARN_ON_ONCE(sqe->common.dptr.prp2);
        sqe->common.flags |= NVME_CMD_SGL_METABUF;
        /*
-         * format SQE DPTR field per FC-NVME rules
+         * format SQE DPTR field per FC-NVME rules:
-         *    type=data block descr; subtype=offset;
+         *    type=0x5     Transport SGL Data Block Descriptor
-         *    offset is currently 0.
+         *    subtype=0xA  Transport-specific value
+         *    address=0
+         *    length=length of the data series
         */
-        sqe->rw.dptr.sgl.type = NVME_SGL_FMT_OFFSET;
+        sqe->rw.dptr.sgl.type = (NVME_TRANSPORT_SGL_DATA_DESC << 4) |
+                                        NVME_SGL_FMT_TRANSPORT_A;
        sqe->rw.dptr.sgl.length = cpu_to_le32(data_len);
        sqe->rw.dptr.sgl.addr = 0;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4a2121335f48..3f5a04c586ce 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -24,6 +24,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/once.h>
 #include <linux/pci.h>
 #include <linux/poison.h>
 #include <linux/t10-pi.h>
@@ -93,7 +94,7 @@ struct nvme_dev {
        struct mutex shutdown_lock;
        bool subsystem;
        void __iomem *cmb;
-        dma_addr_t cmb_dma_addr;
+        pci_bus_addr_t cmb_bus_addr;
        u64 cmb_size;
        u32 cmbsz;
        u32 cmbloc;
@@ -540,6 +541,20 @@ static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
 }
 #endif
+static void nvme_print_sgl(struct scatterlist *sgl, int nents)
+{
+        int i;
+        struct scatterlist *sg;
+        for_each_sg(sgl, sg, nents, i) {
+                dma_addr_t phys = sg_phys(sg);
+                pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
+                        "dma_address:%pad dma_length:%d\n",
+                        i, &phys, sg->offset, sg->length, &sg_dma_address(sg),
+                        sg_dma_len(sg));
+        }
+}
 static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
 {
        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
@@ -622,19 +637,10 @@ static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
        return BLK_STS_OK;
 bad_sgl:
-        if (WARN_ONCE(1, "Invalid SGL for payload:%d nents:%d\n",
+        WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
-                                blk_rq_payload_bytes(req), iod->nents)) {
+                        "Invalid SGL for payload:%d nents:%d\n",
-                for_each_sg(iod->sg, sg, iod->nents, i) {
+                        blk_rq_payload_bytes(req), iod->nents);
-                        dma_addr_t phys = sg_phys(sg);
-                        pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
-                               "dma_address:%pad dma_length:%d\n", i, &phys,
-                                        sg->offset, sg->length,
-                                        &sg_dma_address(sg),
-                                        sg_dma_len(sg));
-                }
-        }
        return BLK_STS_IOERR;
 }
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
@@ -1220,7 +1226,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
        if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
                unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
                                                      dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset;
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
                nvmeq->sq_cmds_io = dev->cmb + offset;
        } else {
                nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
@@ -1313,11 +1319,11 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
        if (result < 0)
                goto release_cq;
+        nvme_init_queue(nvmeq, qid);
        result = queue_request_irq(nvmeq);
        if (result < 0)
                goto release_sq;
-        nvme_init_queue(nvmeq, qid);
        return result;
 release_sq:
@@ -1464,6 +1470,7 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)
                return result;
        nvmeq->cq_vector = 0;
+        nvme_init_queue(nvmeq, 0);
        result = queue_request_irq(nvmeq);
        if (result) {
                nvmeq->cq_vector = -1;
@@ -1520,7 +1527,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
        resource_size_t bar_size;
        struct pci_dev *pdev = to_pci_dev(dev->dev);
        void __iomem *cmb;
-        dma_addr_t dma_addr;
+        int bar;
        dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
        if (!(NVME_CMB_SZ(dev->cmbsz)))
@@ -1533,7 +1540,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
        szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz));
        size = szu * NVME_CMB_SZ(dev->cmbsz);
        offset = szu * NVME_CMB_OFST(dev->cmbloc);
-        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc));
+        bar = NVME_CMB_BIR(dev->cmbloc);
+        bar_size = pci_resource_len(pdev, bar);
        if (offset > bar_size)
                return NULL;
@@ -1546,12 +1554,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
        if (size > bar_size - offset)
                size = bar_size - offset;
-        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset;
+        cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size);
-        cmb = ioremap_wc(dma_addr, size);
        if (!cmb)
                return NULL;
-        dev->cmb_dma_addr = dma_addr;
+        dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset;
        dev->cmb_size = size;
        return cmb;
 }
@@ -2156,7 +2163,6 @@ static void nvme_reset_work(struct work_struct *work)
        if (result)
                goto out;
-        nvme_init_queue(dev->queues[0], 0);
        result = nvme_alloc_admin_tags(dev);
        if (result)
                goto out;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 58983000964b..92a03ff5fb4d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -942,7 +942,12 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        }
        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
-        WARN_ON_ONCE(!changed);
+        if (!changed) {
+                /* state change failure is ok if we're in DELETING state */
+                WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
+                return;
+        }
        ctrl->ctrl.nr_reconnects = 0;
        nvme_start_ctrl(&ctrl->ctrl);
@@ -962,7 +967,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
        struct nvme_rdma_ctrl *ctrl = container_of(work,
                        struct nvme_rdma_ctrl, err_work);
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
        if (ctrl->ctrl.queue_count > 1) {
                nvme_stop_queues(&ctrl->ctrl);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 7c23eaf8e563..1b208beeef50 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -390,10 +390,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
        if (status)
                nvmet_set_status(req, status);
-        /* XXX: need to fill in something useful for sq_head */
+        if (req->sq->size)
-        req->rsp->sq_head = 0;
+                req->sq->sqhd = (req->sq->sqhd + 1) % req->sq->size;
-        if (likely(req->sq)) /* may happen during early failure */
+        req->rsp->sq_head = cpu_to_le16(req->sq->sqhd);
-                req->rsp->sq_id = cpu_to_le16(req->sq->qid);
+        req->rsp->sq_id = cpu_to_le16(req->sq->qid);
        req->rsp->command_id = req->cmd->common.command_id;
        if (req->ns)
@@ -420,6 +420,7 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq,
 void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
                u16 qid, u16 size)
 {
+        sq->sqhd = 0;
        sq->qid = qid;
        sq->size = size;
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 859a66725291..db3bf6b8bf9e 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -109,9 +109,14 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
                pr_warn("queue already connected!\n");
                return NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
        }
+        if (!sqsize) {
+                pr_warn("queue size zero!\n");
+                return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+        }
-        nvmet_cq_setup(ctrl, req->cq, qid, sqsize);
+        /* note: convert queue size from 0's-based value to 1's-based value */
-        nvmet_sq_setup(ctrl, req->sq, qid, sqsize);
+        nvmet_cq_setup(ctrl, req->cq, qid, sqsize + 1);
+        nvmet_sq_setup(ctrl, req->sq, qid, sqsize + 1);
        return 0;
 }
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 421e43bf1dd7..58e010bdda3e 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -148,7 +148,7 @@ struct nvmet_fc_tgt_assoc {
        u32                             a_id;
        struct nvmet_fc_tgtport         *tgtport;
        struct list_head                a_list;
-        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES];
+        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES + 1];
        struct kref                     ref;
 };
@@ -608,7 +608,7 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
        unsigned long flags;
        int ret;
-        if (qid >= NVMET_NR_QUEUES)
+        if (qid > NVMET_NR_QUEUES)
                return NULL;
        queue = kzalloc((sizeof(*queue) +
@@ -783,6 +783,9 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
        u16 qid = nvmet_fc_getqueueid(connection_id);
        unsigned long flags;
+        if (qid > NVMET_NR_QUEUES)
+                return NULL;
        spin_lock_irqsave(&tgtport->lock, flags);
        list_for_each_entry(assoc, &tgtport->assoc_list, a_list) {
                if (association_id == assoc->association_id) {
@@ -888,7 +891,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
        int i;
        spin_lock_irqsave(&tgtport->lock, flags);
-        for (i = NVMET_NR_QUEUES - 1; i >= 0; i--) {
+        for (i = NVMET_NR_QUEUES; i >= 0; i--) {
                queue = assoc->queues[i];
                if (queue) {
                        if (!nvmet_fc_tgt_q_get(queue))
@@ -1910,8 +1913,7 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                        spin_lock_irqsave(&fod->flock, flags);
                        fod->writedataactive = false;
                        spin_unlock_irqrestore(&fod->flock, flags);
-                        nvmet_req_complete(&fod->req,
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
-                                        NVME_SC_FC_TRANSPORT_ERROR);
                } else /* NVMET_FCOP_READDATA or NVMET_FCOP_READDATA_RSP */ {
                        fcpreq->fcp_error = ret;
                        fcpreq->transferred_length = 0;
@@ -1929,8 +1931,7 @@ __nvmet_fc_fod_op_abort(struct nvmet_fc_fcp_iod *fod, bool abort)
        /* if in the middle of an io and we need to tear down */
        if (abort) {
                if (fcpreq->op == NVMET_FCOP_WRITEDATA) {
-                        nvmet_req_complete(&fod->req,
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
-                                        NVME_SC_FC_TRANSPORT_ERROR);
                        return true;
                }
@@ -1968,8 +1969,7 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
                        fod->abort = true;
                        spin_unlock(&fod->flock);
-                        nvmet_req_complete(&fod->req,
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
-                                        NVME_SC_FC_TRANSPORT_ERROR);
                        return;
                }
@@ -2533,13 +2533,17 @@ nvmet_fc_remove_port(struct nvmet_port *port)
 {
        struct nvmet_fc_tgtport *tgtport = port->priv;
        unsigned long flags;
+        bool matched = false;
        spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
        if (tgtport->port == port) {
-                nvmet_fc_tgtport_put(tgtport);
+                matched = true;
                tgtport->port = NULL;
        }
        spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);
+        if (matched)
+                nvmet_fc_tgtport_put(tgtport);
 }
 static struct nvmet_fabrics_ops nvmet_fc_tgt_fcp_ops = {
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 1cb9847ec261..7b75d9de55ab 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -224,8 +224,6 @@ struct fcloop_nport {
        struct fcloop_lport *lport;
        struct list_head nport_list;
        struct kref ref;
-        struct completion rport_unreg_done;
-        struct completion tport_unreg_done;
        u64 node_name;
        u64 port_name;
        u32 port_role;
@@ -576,7 +574,7 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
        tfcp_req->aborted = true;
        spin_unlock(&tfcp_req->reqlock);
-        tfcp_req->status = NVME_SC_FC_TRANSPORT_ABORTED;
+        tfcp_req->status = NVME_SC_INTERNAL;
        /*
         * nothing more to do. If io wasn't active, the transport should
@@ -631,6 +629,32 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
 }
 static void
+fcloop_nport_free(struct kref *ref)
+{
+        struct fcloop_nport *nport =
+                container_of(ref, struct fcloop_nport, ref);
+        unsigned long flags;
+        spin_lock_irqsave(&fcloop_lock, flags);
+        list_del(&nport->nport_list);
+        spin_unlock_irqrestore(&fcloop_lock, flags);
+        kfree(nport);
+}
+static void
+fcloop_nport_put(struct fcloop_nport *nport)
+{
+        kref_put(&nport->ref, fcloop_nport_free);
+}
+static int
+fcloop_nport_get(struct fcloop_nport *nport)
+{
+        return kref_get_unless_zero(&nport->ref);
+}
+static void
 fcloop_localport_delete(struct nvme_fc_local_port *localport)
 {
        struct fcloop_lport *lport = localport->private;
@@ -644,8 +668,7 @@ fcloop_remoteport_delete(struct nvme_fc_remote_port *remoteport)
 {
        struct fcloop_rport *rport = remoteport->private;
-        /* release any threads waiting for the unreg to complete */
+        fcloop_nport_put(rport->nport);
-        complete(&rport->nport->rport_unreg_done);
 }
 static void
@@ -653,8 +676,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
 {
        struct fcloop_tport *tport = targetport->private;
-        /* release any threads waiting for the unreg to complete */
+        fcloop_nport_put(tport->nport);
-        complete(&tport->nport->tport_unreg_done);
 }
 #define FCLOOP_HW_QUEUES                4
@@ -722,6 +744,7 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr,
                goto out_free_opts;
        }
+        memset(&pinfo, 0, sizeof(pinfo));
        pinfo.node_name = opts->wwnn;
        pinfo.port_name = opts->wwpn;
        pinfo.port_role = opts->roles;
@@ -804,32 +827,6 @@ fcloop_delete_local_port(struct device *dev, struct device_attribute *attr,
        return ret ? ret : count;
 }
-static void
-fcloop_nport_free(struct kref *ref)
-{
-        struct fcloop_nport *nport =
-                container_of(ref, struct fcloop_nport, ref);
-        unsigned long flags;
-        spin_lock_irqsave(&fcloop_lock, flags);
-        list_del(&nport->nport_list);
-        spin_unlock_irqrestore(&fcloop_lock, flags);
-        kfree(nport);
-}
-static void
-fcloop_nport_put(struct fcloop_nport *nport)
-{
-        kref_put(&nport->ref, fcloop_nport_free);
-}
-static int
-fcloop_nport_get(struct fcloop_nport *nport)
-{
-        return kref_get_unless_zero(&nport->ref);
-}
 static struct fcloop_nport *
 fcloop_alloc_nport(const char *buf, size_t count, bool remoteport)
 {
@@ -938,6 +935,7 @@ fcloop_create_remote_port(struct device *dev, struct device_attribute *attr,
        if (!nport)
                return -EIO;
+        memset(&pinfo, 0, sizeof(pinfo));
        pinfo.node_name = nport->node_name;
        pinfo.port_name = nport->port_name;
        pinfo.port_role = nport->port_role;
@@ -979,24 +977,12 @@ __unlink_remote_port(struct fcloop_nport *nport)
 }
 static int
-__wait_remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
+__remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
 {
-        int ret;
        if (!rport)
                return -EALREADY;
-        init_completion(&nport->rport_unreg_done);
+        return nvme_fc_unregister_remoteport(rport->remoteport);
-        ret = nvme_fc_unregister_remoteport(rport->remoteport);
-        if (ret)
-                return ret;
-        wait_for_completion(&nport->rport_unreg_done);
-        fcloop_nport_put(nport);
-        return ret;
 }
 static ssize_t
@@ -1029,7 +1015,7 @@ fcloop_delete_remote_port(struct device *dev, struct device_attribute *attr,
        if (!nport)
                return -ENOENT;
-        ret = __wait_remoteport_unreg(nport, rport);
+        ret = __remoteport_unreg(nport, rport);
        return ret ? ret : count;
 }
@@ -1086,24 +1072,12 @@ __unlink_target_port(struct fcloop_nport *nport)
 }
 static int
-__wait_targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
+__targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
 {
-        int ret;
        if (!tport)
                return -EALREADY;
-        init_completion(&nport->tport_unreg_done);
+        return nvmet_fc_unregister_targetport(tport->targetport);
-        ret = nvmet_fc_unregister_targetport(tport->targetport);
-        if (ret)
-                return ret;
-        wait_for_completion(&nport->tport_unreg_done);
-        fcloop_nport_put(nport);
-        return ret;
 }
 static ssize_t
@@ -1136,7 +1110,7 @@ fcloop_delete_target_port(struct device *dev, struct device_attribute *attr,
        if (!nport)
                return -ENOENT;
-        ret = __wait_targetport_unreg(nport, tport);
+        ret = __targetport_unreg(nport, tport);
        return ret ? ret : count;
 }
@@ -1223,11 +1197,11 @@ static void __exit fcloop_exit(void)
                spin_unlock_irqrestore(&fcloop_lock, flags);
-                ret = __wait_targetport_unreg(nport, tport);
+                ret = __targetport_unreg(nport, tport);
                if (ret)
                        pr_warn("%s: Failed deleting target port\n", __func__);
-                ret = __wait_remoteport_unreg(nport, rport);
+                ret = __remoteport_unreg(nport, rport);
                if (ret)
                        pr_warn("%s: Failed deleting remote port\n", __func__);
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7d261ab894f4..7b8e20adf760 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -74,6 +74,7 @@ struct nvmet_sq {
        struct percpu_ref       ref;
        u16                     qid;
        u16                     size;
+        u16                     sqhd;
        struct completion       free_done;
        struct completion       confirm_done;
 };
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index de54c7f5048a..d12e5de78e70 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -135,7 +135,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
        /* Stop the user from writing */
        if (pos >= nvmem->size)
-                return 0;
+                return -EFBIG;
        if (count < nvmem->word_size)
                return -EINVAL;
@@ -789,6 +789,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
                return ERR_PTR(-EINVAL);
        nvmem = __nvmem_device_get(nvmem_np, NULL, NULL);
+        of_node_put(nvmem_np);
        if (IS_ERR(nvmem))
                return ERR_CAST(nvmem);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 1eecfa301f7f..8e075ea2743e 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -686,7 +686,7 @@ static ssize_t driver_override_store(struct device *dev,
                                     const char *buf, size_t count)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        char *driver_override, *old = pdev->driver_override, *cp;
+        char *driver_override, *old, *cp;
        /* We need to keep extra room for a newline */
        if (count >= (PAGE_SIZE - 1))
@@ -700,12 +700,15 @@ static ssize_t driver_override_store(struct device *dev,
        if (cp)
                *cp = '\0';
+        device_lock(dev);
+        old = pdev->driver_override;
        if (strlen(driver_override)) {
                pdev->driver_override = driver_override;
        } else {
                kfree(driver_override);
                pdev->driver_override = NULL;
        }
+        device_unlock(dev);
        kfree(old);
@@ -716,8 +719,12 @@ static ssize_t driver_override_show(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
+        ssize_t len;
-        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_unlock(dev);
+        return len;
 }
 static DEVICE_ATTR_RW(driver_override);
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 85de30f93a9c..56a8195096a2 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -254,10 +254,12 @@ static int bl_update_status(struct backlight_device *b)
 {
        struct acpi_device *device = bl_get_data(b);
-        if (b->props.power == FB_BLANK_POWERDOWN)
+        if (fext) {
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
+                if (b->props.power == FB_BLANK_POWERDOWN)
-        else
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+                else
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        }
        return set_lcd_level(device, b->props.brightness);
 }
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 315a4be8dc1e..9a68914100ad 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -51,6 +51,8 @@ module_param(mbox_sel, byte, S_IRUGO);
 MODULE_PARM_DESC(mbox_sel,
                 "RIO Messaging MBOX Selection Mask (default: 0x0f = all)");
+static DEFINE_SPINLOCK(tsi721_maint_lock);
 static void tsi721_omsg_handler(struct tsi721_device *priv, int ch);
 static void tsi721_imsg_handler(struct tsi721_device *priv, int ch);
@@ -124,12 +126,15 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
        void __iomem *regs = priv->regs + TSI721_DMAC_BASE(priv->mdma.ch_id);
        struct tsi721_dma_desc *bd_ptr;
        u32 rd_count, swr_ptr, ch_stat;
+        unsigned long flags;
        int i, err = 0;
        u32 op = do_wr ? MAINT_WR : MAINT_RD;
        if (offset > (RIO_MAINT_SPACE_SZ - len) || (len != sizeof(u32)))
                return -EINVAL;
+        spin_lock_irqsave(&tsi721_maint_lock, flags);
        bd_ptr = priv->mdma.bd_base;
        rd_count = ioread32(regs + TSI721_DMAC_DRDCNT);
@@ -197,7 +202,9 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
         */
        swr_ptr = ioread32(regs + TSI721_DMAC_DSWP);
        iowrite32(swr_ptr, regs + TSI721_DMAC_DSRP);
 err_out:
+        spin_unlock_irqrestore(&tsi721_maint_lock, flags);
        return err;
 }
diff --git a/drivers/rapidio/rio-access.c b/drivers/rapidio/rio-access.c
index a3824baca2e5..3ee9af83b638 100644
--- a/drivers/rapidio/rio-access.c
+++ b/drivers/rapidio/rio-access.c
@@ -14,16 +14,8 @@
 #include <linux/module.h>
 /*
- * These interrupt-safe spinlocks protect all accesses to RIO
- * configuration space and doorbell access.
- */
-static DEFINE_SPINLOCK(rio_config_lock);
-static DEFINE_SPINLOCK(rio_doorbell_lock);
-/*
 *  Wrappers for all RIO configuration access functions.  They just check
- *  alignment, do locking and call the low-level functions pointed to
+ *  alignment and call the low-level functions pointed to by rio_mport->ops.
- *  by rio_mport->ops.
 */
 #define RIO_8_BAD 0
@@ -44,13 +36,10 @@ int __rio_local_read_config_##size \
        (struct rio_mport *mport, u32 offset, type *value)              \
 {                                                                       \
        int res;                                                        \
-        unsigned long flags;                                            \
        u32 data = 0;                                                   \
        if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
        res = mport->ops->lcread(mport, mport->id, offset, len, &data); \
        *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
        return res;                                                     \
 }
@@ -67,13 +56,8 @@ int __rio_local_read_config_##size \
 int __rio_local_write_config_##size \
        (struct rio_mport *mport, u32 offset, type value)               \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
        if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
+        return mport->ops->lcwrite(mport, mport->id, offset, len, value);\
-        res = mport->ops->lcwrite(mport, mport->id, offset, len, value);\
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
 }
 RIO_LOP_READ(8, u8, 1)
@@ -104,13 +88,10 @@ int rio_mport_read_config_##size \
        (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type *value)     \
 {                                                                       \
        int res;                                                        \
-        unsigned long flags;                                            \
        u32 data = 0;                                                   \
        if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
        res = mport->ops->cread(mport, mport->id, destid, hopcount, offset, len, &data); \
        *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
        return res;                                                     \
 }
@@ -127,13 +108,9 @@ int rio_mport_read_config_##size \
 int rio_mport_write_config_##size \
        (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type value)      \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
        if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
+        return mport->ops->cwrite(mport, mport->id, destid, hopcount,   \
-        res = mport->ops->cwrite(mport, mport->id, destid, hopcount, offset, len, value); \
+                        offset, len, value);                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
 }
 RIO_OP_READ(8, u8, 1)
@@ -162,14 +139,7 @@ EXPORT_SYMBOL_GPL(rio_mport_write_config_32);
 */
 int rio_mport_send_doorbell(struct rio_mport *mport, u16 destid, u16 data)
 {
-        int res;
+        return mport->ops->dsend(mport, mport->id, destid, data);
-        unsigned long flags;
-        spin_lock_irqsave(&rio_doorbell_lock, flags);
-        res = mport->ops->dsend(mport, mport->id, destid, data);
-        spin_unlock_irqrestore(&rio_doorbell_lock, flags);
-        return res;
 }
 EXPORT_SYMBOL_GPL(rio_mport_send_doorbell);
diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
index e0c393214264..e2baecbb9dd3 100644
--- a/drivers/reset/Kconfig
+++ b/drivers/reset/Kconfig
@@ -34,11 +34,12 @@ config RESET_BERLIN
        help
          This enables the reset controller driver for Marvell Berlin SoCs.
-config RESET_HSDK_V1
+config RESET_HSDK
-        bool "HSDK v1 Reset Driver"
+        bool "Synopsys HSDK Reset Driver"
-        default n
+        depends on HAS_IOMEM
+        depends on ARC_SOC_HSDK || COMPILE_TEST
        help
-          This enables the reset controller driver for HSDK v1.
+          This enables the reset controller driver for HSDK board.
 config RESET_IMX7
        bool "i.MX7 Reset Driver" if COMPILE_TEST
diff --git a/drivers/reset/Makefile b/drivers/reset/Makefile
index d368367110e5..af1c15c330b3 100644
--- a/drivers/reset/Makefile
+++ b/drivers/reset/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_RESET_A10SR) += reset-a10sr.o
 obj-$(CONFIG_RESET_ATH79) += reset-ath79.o
 obj-$(CONFIG_RESET_BERLIN) += reset-berlin.o
-obj-$(CONFIG_RESET_HSDK_V1) += reset-hsdk-v1.o
+obj-$(CONFIG_RESET_HSDK) += reset-hsdk.o
 obj-$(CONFIG_RESET_IMX7) += reset-imx7.o
 obj-$(CONFIG_RESET_LANTIQ) += reset-lantiq.o
 obj-$(CONFIG_RESET_LPC18XX) += reset-lpc18xx.o
diff --git a/drivers/reset/reset-hsdk-v1.c b/drivers/reset/reset-hsdk.c
index bca13e4bf622..8bce391c6943 100644
--- a/drivers/reset/reset-hsdk-v1.c
+++ b/drivers/reset/reset-hsdk.c
@@ -1,7 +1,7 @@
 /*
 * Copyright (C) 2017 Synopsys.
 *
- * Synopsys HSDKv1 SDP reset driver.
+ * Synopsys HSDK Development platform reset driver.
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -18,9 +18,9 @@
 #include <linux/slab.h>
 #include <linux/types.h>
-#define to_hsdkv1_rst(p)        container_of((p), struct hsdkv1_rst, rcdev)
+#define to_hsdk_rst(p)  container_of((p), struct hsdk_rst, rcdev)
-struct hsdkv1_rst {
+struct hsdk_rst {
        void __iomem                    *regs_ctl;
        void __iomem                    *regs_rst;
        spinlock_t                      lock;
@@ -49,12 +49,12 @@ static const u32 rst_map[] = {
 #define CGU_IP_SW_RESET_RESET           BIT(0)
 #define SW_RESET_TIMEOUT                10000
-static void hsdkv1_reset_config(struct hsdkv1_rst *rst, unsigned long id)
+static void hsdk_reset_config(struct hsdk_rst *rst, unsigned long id)
 {
        writel(rst_map[id], rst->regs_ctl + CGU_SYS_RST_CTRL);
 }
-static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
+static int hsdk_reset_do(struct hsdk_rst *rst)
 {
        u32 reg;
@@ -69,28 +69,28 @@ static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
                !(reg & CGU_IP_SW_RESET_RESET), 5, SW_RESET_TIMEOUT);
 }
-static int hsdkv1_reset_reset(struct reset_controller_dev *rcdev,
+static int hsdk_reset_reset(struct reset_controller_dev *rcdev,
                              unsigned long id)
 {
-        struct hsdkv1_rst *rst = to_hsdkv1_rst(rcdev);
+        struct hsdk_rst *rst = to_hsdk_rst(rcdev);
        unsigned long flags;
        int ret;
        spin_lock_irqsave(&rst->lock, flags);
-        hsdkv1_reset_config(rst, id);
+        hsdk_reset_config(rst, id);
-        ret = hsdkv1_reset_do(rst);
+        ret = hsdk_reset_do(rst);
        spin_unlock_irqrestore(&rst->lock, flags);
        return ret;
 }
-static const struct reset_control_ops hsdkv1_reset_ops = {
+static const struct reset_control_ops hsdk_reset_ops = {
-        .reset  = hsdkv1_reset_reset,
+        .reset  = hsdk_reset_reset,
 };
-static int hsdkv1_reset_probe(struct platform_device *pdev)
+static int hsdk_reset_probe(struct platform_device *pdev)
 {
-        struct hsdkv1_rst *rst;
+        struct hsdk_rst *rst;
        struct resource *mem;
        rst = devm_kzalloc(&pdev->dev, sizeof(*rst), GFP_KERNEL);
@@ -110,7 +110,7 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
        spin_lock_init(&rst->lock);
        rst->rcdev.owner = THIS_MODULE;
-        rst->rcdev.ops = &hsdkv1_reset_ops;
+        rst->rcdev.ops = &hsdk_reset_ops;
        rst->rcdev.of_node = pdev->dev.of_node;
        rst->rcdev.nr_resets = HSDK_MAX_RESETS;
        rst->rcdev.of_reset_n_cells = 1;
@@ -118,20 +118,20 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
        return reset_controller_register(&rst->rcdev);
 }
-static const struct of_device_id hsdkv1_reset_dt_match[] = {
+static const struct of_device_id hsdk_reset_dt_match[] = {
-        { .compatible = "snps,hsdk-v1.0-reset" },
+        { .compatible = "snps,hsdk-reset" },
        { },
 };
-static struct platform_driver hsdkv1_reset_driver = {
+static struct platform_driver hsdk_reset_driver = {
-        .probe  = hsdkv1_reset_probe,
+        .probe  = hsdk_reset_probe,
        .driver = {
-                .name = "hsdk-v1.0-reset",
+                .name = "hsdk-reset",
-                .of_match_table = hsdkv1_reset_dt_match,
+                .of_match_table = hsdk_reset_dt_match,
        },
 };
-builtin_platform_driver(hsdkv1_reset_driver);
+builtin_platform_driver(hsdk_reset_driver);
 MODULE_AUTHOR("Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>");
-MODULE_DESCRIPTION("Synopsys HSDKv1 SDP reset driver");
+MODULE_DESCRIPTION("Synopsys HSDK SDP reset driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a64285ab0728..af3e4d3f9735 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -699,13 +699,13 @@ static void _aac_probe_container1(void * context, struct fib * fibptr)
        int status;
        dresp = (struct aac_mount *) fib_data(fibptr);
-        if (!(fibptr->dev->supplement_adapter_info.supported_options2 &
+        if (!aac_supports_2T(fibptr->dev)) {
-            AAC_OPTION_VARIABLE_BLOCK_SIZE))
                dresp->mnt[0].capacityhigh = 0;
-        if ((le32_to_cpu(dresp->status) != ST_OK) ||
+                if ((le32_to_cpu(dresp->status) == ST_OK) &&
-            (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
+                        (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
-                _aac_probe_container2(context, fibptr);
+                        _aac_probe_container2(context, fibptr);
-                return;
+                        return;
+                }
        }
        scsicmd = (struct scsi_cmnd *) context;
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 92fabf2b0c24..403a639574e5 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2701,6 +2701,11 @@ static inline int aac_is_src(struct aac_dev *dev)
        return 0;
 }
+static inline int aac_supports_2T(struct aac_dev *dev)
+{
+        return (dev->adapter_info.options & AAC_OPT_NEW_COMM_64);
+}
 char * get_container_type(unsigned type);
 extern int numacb;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 87cc4a93e637..62beb2596466 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
        bus = aac_logical_to_phys(scmd_channel(cmd));
        cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
                return FAILED;
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                return FAILED;
        pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
        bus = aac_logical_to_phys(scmd_channel(cmd));
        cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
                return FAILED;
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                return FAILED;
        pr_err("%s: Host adapter reset request. SCSI hang ?\n",
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 48c2b2b34b72..0c9361c87ec8 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -740,6 +740,8 @@ static void aac_send_iop_reset(struct aac_dev *dev)
        aac_set_intx_mode(dev);
        src_writel(dev, MUnit.IDR, IOP_SRC_RESET_MASK);
+        msleep(5000);
 }
 static void aac_send_hardware_soft_reset(struct aac_dev *dev)
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 785fb42f6650..2799a6b08f73 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3767,7 +3767,7 @@ static int ibmvscsis_write_pending(struct se_cmd *se_cmd)
         */
        if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) {
                pr_err("write_pending failed since: %d\n", vscsi->flags);
-                return 0;
+                return -EIO;
        }
        rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index bd4605a34f54..c62e8d111fd9 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
 /**
 * iscsi_session_teardown - destroy session, host, and cls_session
 * @cls_session: iscsi session
- *
- * The driver must have called iscsi_remove_session before
- * calling this.
 */
 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
        iscsi_pool_free(&session->cmdpool);
+        iscsi_remove_session(cls_session);
        kfree(session->password);
        kfree(session->password_in);
        kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
        kfree(session->portal_type);
        kfree(session->discovery_parent_type);
-        iscsi_destroy_session(cls_session);
+        iscsi_free_session(cls_session);
        iscsi_host_dec_session_cnt(shost);
        module_put(owner);
 }
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7e7ae786121b..100bc4c8798d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6131,6 +6131,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                                "Extents and RPI headers enabled.\n");
                }
                mempool_free(mboxq, phba->mbox_mem_pool);
+                rc = -EIO;
                goto out_free_bsmbx;
        }
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 79ba3ce063a4..23bdb1ca106e 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -884,7 +884,7 @@ out_err:
                                         wcqe->total_data_placed);
                        nCmd->transferred_length = 0;
                        nCmd->rcv_rsplen = 0;
-                        nCmd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                        nCmd->status = NVME_SC_INTERNAL;
                }
        }
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 1f59e7a74c7b..6b33a1f24f56 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -180,7 +180,7 @@ static void qla_nvme_sp_done(void *ptr, int res)
                goto rel;
        if (unlikely(res == QLA_FUNCTION_FAILED))
-                fd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                fd->status = NVME_SC_INTERNAL;
        else
                fd->status = 0;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 38942050b265..dab876c65473 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -580,7 +580,8 @@ int scsi_check_sense(struct scsi_cmnd *scmd)
                if (sshdr.asc == 0x20 || /* Invalid command operation code */
                    sshdr.asc == 0x21 || /* Logical block address out of range */
                    sshdr.asc == 0x24 || /* Invalid field in cdb */
-                    sshdr.asc == 0x26) { /* Parameter value invalid */
+                    sshdr.asc == 0x26 || /* Parameter value invalid */
+                    sshdr.asc == 0x27) { /* Write protected */
                        set_host_byte(scmd, DID_TARGET_FAILURE);
                }
                return SUCCESS;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index e7818afeda2b..15590a063ad9 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
        if (*bflags & BLIST_NO_DIF)
                sdev->no_dif = 1;
+        if (*bflags & BLIST_UNMAP_LIMIT_WS)
+                sdev->unmap_limit_for_ws = 1;
        sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
        if (*bflags & BLIST_TRY_VPD_PAGES)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index ba9d70f8a6a1..cbd4495d0ff9 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2739,7 +2739,8 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
        list_for_each_entry(rport, &fc_host->rports, peers) {
-                if ((rport->port_state == FC_PORTSTATE_BLOCKED) &&
+                if ((rport->port_state == FC_PORTSTATE_BLOCKED ||
+                     rport->port_state == FC_PORTSTATE_NOTPRESENT) &&
                        (rport->channel == channel)) {
                        switch (fc_host->tgtid_bind_type) {
@@ -2876,7 +2877,6 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                        memcpy(&rport->port_name, &ids->port_name,
                                sizeof(rport->port_name));
                        rport->port_id = ids->port_id;
-                        rport->roles = ids->roles;
                        rport->port_state = FC_PORTSTATE_ONLINE;
                        rport->flags &= ~FC_RPORT_FAST_FAIL_TIMEDOUT;
@@ -2885,15 +2885,7 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                                                fci->f->dd_fcrport_size);
                        spin_unlock_irqrestore(shost->host_lock, flags);
-                        if (ids->roles & FC_PORT_ROLE_FCP_TARGET) {
+                        fc_remote_port_rolechg(rport, ids->roles);
-                                scsi_target_unblock(&rport->dev, SDEV_RUNNING);
-                                /* initiate a scan of the target */
-                                spin_lock_irqsave(shost->host_lock, flags);
-                                rport->flags |= FC_RPORT_SCAN_PENDING;
-                                scsi_queue_work(shost, &rport->scan_work);
-                                spin_unlock_irqrestore(shost->host_lock, flags);
-                        }
                        return rport;
                }
        }
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8934f19bce8e..7404d26895f5 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2211,22 +2211,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 /**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
- *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
- */
-int iscsi_destroy_session(struct iscsi_cls_session *session)
-{
-        iscsi_remove_session(session);
-        ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
-        iscsi_free_session(session);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_session);
-/**
 * iscsi_create_conn - create iscsi class connection
 * @session: iscsi cls session
 * @dd_size: private driver data size
@@ -3689,7 +3673,7 @@ iscsi_if_rx(struct sk_buff *skb)
                uint32_t group;
                nlh = nlmsg_hdr(skb);
-                if (nlh->nlmsg_len < sizeof(*nlh) ||
+                if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
                    skb->len < nlh->nlmsg_len) {
                        break;
                }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index fb9f8b5f4673..d175c5c5ccf8 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -715,13 +715,21 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
                break;
        case SD_LBP_WS16:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
+                if (sdkp->device->unmap_limit_for_ws)
-                                          (u32)SD_MAX_WS16_BLOCKS);
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
                break;
        case SD_LBP_WS10:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
+                if (sdkp->device->unmap_limit_for_ws)
-                                          (u32)SD_MAX_WS10_BLOCKS);
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
                break;
        case SD_LBP_ZERO:
@@ -3099,8 +3107,6 @@ static int sd_revalidate_disk(struct gendisk *disk)
                sd_read_security(sdkp, buffer);
        }
-        sdkp->first_scan = 0;
        /*
         * We now have all cache related info, determine how we deal
         * with flush requests.
@@ -3115,7 +3121,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
        q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
        /*
-         * Use the device's preferred I/O size for reads and writes
+         * Determine the device's preferred I/O size for reads and writes
         * unless the reported value is unreasonably small, large, or
         * garbage.
         */
@@ -3129,8 +3135,19 @@ static int sd_revalidate_disk(struct gendisk *disk)
                rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
                                      (sector_t)BLK_DEF_MAX_SECTORS);
-        /* Combine with controller limits */
+        /* Do not exceed controller limit */
-        q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+        rw_max = min(rw_max, queue_max_hw_sectors(q));
+        /*
+         * Only update max_sectors if previously unset or if the current value
+         * exceeds the capabilities of the hardware.
+         */
+        if (sdkp->first_scan ||
+            q->limits.max_sectors > q->limits.max_dev_sectors ||
+            q->limits.max_sectors > q->limits.max_hw_sectors)
+                q->limits.max_sectors = rw_max;
+        sdkp->first_scan = 0;
        set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
        sd_config_write_same(sdkp);
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index d11c6de9c777..6150d2780e22 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_state *st,
        struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
        unsigned long long scale_uv;
        int i, ret, id;
-        u8 ones[6];
        /* reset the serial interface */
-        memset(&ones, 0xFF, 6);
+        ret = ad_sd_reset(&st->sd, 48);
-        ret = spi_write(st->sd.spi, &ones, 6);
        if (ret < 0)
                goto out;
        usleep_range(500, 1000); /* Wait for at least 500us */
diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index 13eaf16ecd16..87595c594b12 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -496,8 +496,12 @@ static int spinand_program_page(struct spi_device *spi_nand,
        if (!wbuf)
                return -ENOMEM;
-        enable_read_hw_ecc = 0;
+        enable_read_hw_ecc = 1;
-        spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        retval = spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        if (retval < 0) {
+                dev_err(&spi_nand->dev, "ecc error on read page!!!\n");
+                return retval;
+        }
        for (i = offset, j = 0; i < len; i++, j++)
                wbuf[i] &= buf[j];
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index c4b1b218ea38..290b419aa9dd 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -570,12 +570,6 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
                dev_dbg(&spi->dev, "set: DIO mapping");
        #endif
-        // check DIO number
-        if (DIONumber > 5) {
-                dev_dbg(&spi->dev, "set: illegal input param");
-                return -EINVAL;
-        }
        switch (DIONumber) {
        case 0: mask=MASK_DIO0; shift=SHIFT_DIO0; regaddr=REG_DIOMAPPING1; break;
        case 1: mask=MASK_DIO1; shift=SHIFT_DIO1; regaddr=REG_DIOMAPPING1; break;
@@ -583,6 +577,9 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
        case 3: mask=MASK_DIO3; shift=SHIFT_DIO3; regaddr=REG_DIOMAPPING1; break;
        case 4: mask=MASK_DIO4; shift=SHIFT_DIO4; regaddr=REG_DIOMAPPING2; break;
        case 5: mask=MASK_DIO5; shift=SHIFT_DIO5; regaddr=REG_DIOMAPPING2; break;
+        default:
+                dev_dbg(&spi->dev, "set: illegal input param");
+                return -EINVAL;
        }
        // read reg
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 6b778206a1a3..cb8a95aabd6c 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -119,9 +119,8 @@ void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
 void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
 {
-        rtw_free_mlme_priv_ie_data(pmlmepriv);
        if (pmlmepriv) {
+                rtw_free_mlme_priv_ie_data(pmlmepriv);
                if (pmlmepriv->free_bss_buf) {
                        vfree(pmlmepriv->free_bss_buf);
                }
diff --git a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
index 92277457aba4..ce1dd6f9036f 100644
--- a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
+++ b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
@@ -311,6 +311,8 @@ static ssize_t proc_set_cam(struct file *file, const char __user *buffer, size_t
                if (num < 2)
                        return count;
+                if (id >= TOTAL_CAM_ENTRY)
+                        return -EINVAL;
                if (strcmp("c", cmd) == 0) {
                        _clear_cam_entry(adapter, id);
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
index 5f84526cb5b5..edbf6af1c8b7 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
@@ -2901,11 +2901,11 @@ halmac_update_datapack_88xx(struct halmac_adapter *halmac_adapter,
        if (halmac_adapter->fw_version.h2c_version < 4)
                return HALMAC_RET_FW_NO_SUPPORT;
+        driver_adapter = halmac_adapter->driver_adapter;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "[TRACE]%s ==========>\n", __func__);
-        driver_adapter = halmac_adapter->driver_adapter;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "[TRACE]%s <==========\n", __func__);
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index f33024e4d853..544f638ed3ef 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -1618,10 +1618,11 @@ halmac_send_h2c_set_pwr_mode_88xx(struct halmac_adapter *halmac_adapter,
        void *driver_adapter = NULL;
        enum halmac_ret_status status = HALMAC_RET_SUCCESS;
+        driver_adapter = halmac_adapter->driver_adapter;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "%s!!\n", __func__);
-        driver_adapter = halmac_adapter->driver_adapter;
        h2c_header = h2c_buff;
        h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
@@ -1713,10 +1714,11 @@ halmac_media_status_rpt_88xx(struct halmac_adapter *halmac_adapter, u8 op_mode,
        void *driver_adapter = NULL;
        enum halmac_ret_status status = HALMAC_RET_SUCCESS;
+        driver_adapter = halmac_adapter->driver_adapter;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "halmac_send_h2c_set_pwr_mode_88xx!!\n");
-        driver_adapter = halmac_adapter->driver_adapter;
        h2c_header = H2c_buff;
        h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
@@ -2143,10 +2145,11 @@ halmac_func_ctrl_ch_switch_88xx(struct halmac_adapter *halmac_adapter,
        enum halmac_cmd_process_status *process_status =
                &halmac_adapter->halmac_state.scan_state_set.process_status;
+        driver_adapter = halmac_adapter->driver_adapter;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "halmac_ctrl_ch_switch!!\n");
-        driver_adapter = halmac_adapter->driver_adapter;
        halmac_api = (struct halmac_api *)halmac_adapter->halmac_api;
        if (halmac_transition_scan_state_88xx(
@@ -2276,15 +2279,13 @@ enum halmac_ret_status halmac_send_h2c_update_bcn_parse_info_88xx(
 {
        u8 h2c_buff[HALMAC_H2C_CMD_SIZE_88XX] = {0};
        u16 h2c_seq_mum = 0;
-        void *driver_adapter = NULL;
+        void *driver_adapter = halmac_adapter->driver_adapter;
        struct halmac_h2c_header_info h2c_header_info;
        enum halmac_ret_status status = HALMAC_RET_SUCCESS;
        HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                        "%s!!\n", __func__);
-        driver_adapter = halmac_adapter->driver_adapter;
        UPDATE_BEACON_PARSING_INFO_SET_FUNC_EN(h2c_buff, bcn_ie_info->func_en);
        UPDATE_BEACON_PARSING_INFO_SET_SIZE_TH(h2c_buff, bcn_ie_info->size_th);
        UPDATE_BEACON_PARSING_INFO_SET_TIMEOUT(h2c_buff, bcn_ie_info->timeout);
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 67956e24779c..56f7be6af1f6 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1376,6 +1376,8 @@ static void reset_highlight_buffers(struct vc_data *);
 static int read_all_key;
+static int in_keyboard_notifier;
 static void start_read_all_timer(struct vc_data *vc, int command);
 enum {
@@ -1408,7 +1410,10 @@ static void read_all_doc(struct vc_data *vc)
        cursor_track = read_all_mode;
        spk_reset_index_count(0);
        if (get_sentence_buf(vc, 0) == -1) {
-                kbd_fakekey2(vc, RA_DOWN_ARROW);
+                del_timer(&cursor_timer);
+                if (!in_keyboard_notifier)
+                        speakup_fake_down_arrow();
+                start_read_all_timer(vc, RA_DOWN_ARROW);
        } else {
                say_sentence_num(0, 0);
                synth_insert_next_index(0);
@@ -2212,8 +2217,10 @@ static int keyboard_notifier_call(struct notifier_block *nb,
        int ret = NOTIFY_OK;
        static int keycode;     /* to hold the current keycode */
+        in_keyboard_notifier = 1;
        if (vc->vc_mode == KD_GRAPHICS)
-                return ret;
+                goto out;
        /*
         * First, determine whether we are handling a fake keypress on
@@ -2225,7 +2232,7 @@ static int keyboard_notifier_call(struct notifier_block *nb,
         */
        if (speakup_fake_key_pressed())
-                return ret;
+                goto out;
        switch (code) {
        case KBD_KEYCODE:
@@ -2266,6 +2273,8 @@ static int keyboard_notifier_call(struct notifier_block *nb,
                        break;
                }
        }
+out:
+        in_keyboard_notifier = 0;
        return ret;
 }
diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
index 74cce4f1a7bd..27ecf6fb49fd 100644
--- a/drivers/staging/unisys/visorbus/visorchipset.c
+++ b/drivers/staging/unisys/visorbus/visorchipset.c
@@ -1826,7 +1826,7 @@ static __init int visorutil_spar_detect(void)
        return 0;
 }
-static int init_unisys(void)
+static int __init init_unisys(void)
 {
        int result;
@@ -1841,7 +1841,7 @@ static int init_unisys(void)
        return 0;
 };
-static void exit_unisys(void)
+static void __exit exit_unisys(void)
 {
        acpi_bus_unregister_driver(&unisys_acpi_driver);
 }
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 0159ca4407d8..be08849175ea 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo,
                        if (head_bytes > actual)
                                head_bytes = actual;
-                        memcpy((char *)page_address(pages[0]) +
+                        memcpy((char *)kmap(pages[0]) +
                                pagelist->offset,
                                fragments,
                                head_bytes);
+                        kunmap(pages[0]);
                }
                if ((actual >= 0) && (head_bytes < actual) &&
                        (tail_bytes != 0)) {
-                        memcpy((char *)page_address(pages[num_pages - 1]) +
+                        memcpy((char *)kmap(pages[num_pages - 1]) +
                                ((pagelist->offset + actual) &
                                (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)),
                                fragments + g_cache_line_size,
                                tail_bytes);
+                        kunmap(pages[num_pages - 1]);
                }
                down(&g_free_fragments_mutex);
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 1c0c9553bc05..7dd38047ba23 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -246,11 +246,11 @@ struct mxser_port {
        unsigned char err_shadow;
        struct async_icount icount; /* kernel counters for 4 input interrupts */
-        int timeout;
+        unsigned int timeout;
        int read_status_mask;
        int ignore_status_mask;
-        int xmit_fifo_size;
+        unsigned int xmit_fifo_size;
        int xmit_head;
        int xmit_tail;
        int xmit_cnt;
@@ -572,8 +572,9 @@ static void mxser_dtr_rts(struct tty_port *port, int on)
 static int mxser_set_baud(struct tty_struct *tty, long newspd)
 {
        struct mxser_port *info = tty->driver_data;
-        int quot = 0, baud;
+        unsigned int quot = 0, baud;
        unsigned char cval;
+        u64 timeout;
        if (!info->ioaddr)
                return -1;
@@ -594,8 +595,13 @@ static int mxser_set_baud(struct tty_struct *tty, long newspd)
                quot = 0;
        }
-        info->timeout = ((info->xmit_fifo_size * HZ * 10 * quot) / info->baud_base);
+        /*
-        info->timeout += HZ / 50;       /* Add .02 seconds of slop */
+         * worst case (128 * 1000 * 10 * 18432) needs 35 bits, so divide in the
+         * u64 domain
+         */
+        timeout = (u64)info->xmit_fifo_size * HZ * 10 * quot;
+        do_div(timeout, info->baud_base);
+        info->timeout = timeout + HZ / 50; /* Add .02 seconds of slop */
        if (quot) {
                info->MCR |= UART_MCR_DTR;
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 583c9a0c7ecc..8c48c3784831 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -507,9 +507,14 @@ static void bcm_uart_set_termios(struct uart_port *port,
 {
        unsigned int ctl, baud, quot, ier;
        unsigned long flags;
+        int tries;
        spin_lock_irqsave(&port->lock, flags);
+        /* Drain the hot tub fully before we power it off for the winter. */
+        for (tries = 3; !bcm_uart_tx_empty(port) && tries; tries--)
+                mdelay(10);
        /* disable uart while changing speed */
        bcm_uart_disable(port);
        bcm_uart_flush(port);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 849c1f9991ce..f0252184291e 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1276,7 +1276,6 @@ static void rx_dma_timer_init(struct lpuart_port *sport)
 static int lpuart_startup(struct uart_port *port)
 {
        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
        unsigned long flags;
        unsigned char temp;
@@ -1291,11 +1290,6 @@ static int lpuart_startup(struct uart_port *port)
        sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                UARTPFIFO_FIFOSIZE_MASK) + 1);
-        ret = devm_request_irq(port->dev, port->irq, lpuart_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
        spin_lock_irqsave(&sport->port.lock, flags);
        lpuart_setup_watermark(sport);
@@ -1333,7 +1327,6 @@ static int lpuart_startup(struct uart_port *port)
 static int lpuart32_startup(struct uart_port *port)
 {
        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
        unsigned long flags;
        unsigned long temp;
@@ -1346,11 +1339,6 @@ static int lpuart32_startup(struct uart_port *port)
        sport->rxfifo_size = 0x1 << (((temp >> UARTFIFO_RXSIZE_OFF) &
                UARTFIFO_FIFOSIZE_MASK) - 1);
-        ret = devm_request_irq(port->dev, port->irq, lpuart32_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
        spin_lock_irqsave(&sport->port.lock, flags);
        lpuart32_setup_watermark(sport);
@@ -1380,8 +1368,6 @@ static void lpuart_shutdown(struct uart_port *port)
        spin_unlock_irqrestore(&port->lock, flags);
-        devm_free_irq(port->dev, port->irq, sport);
        if (sport->lpuart_dma_rx_use) {
                del_timer_sync(&sport->lpuart_timer);
                lpuart_dma_rx_free(&sport->port);
@@ -1400,7 +1386,6 @@ static void lpuart_shutdown(struct uart_port *port)
 static void lpuart32_shutdown(struct uart_port *port)
 {
-        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
        unsigned long temp;
        unsigned long flags;
@@ -1413,8 +1398,6 @@ static void lpuart32_shutdown(struct uart_port *port)
        lpuart32_write(port, temp, UARTCTRL);
        spin_unlock_irqrestore(&port->lock, flags);
-        devm_free_irq(port->dev, port->irq, sport);
 }
 static void
@@ -2212,16 +2195,22 @@ static int lpuart_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, &sport->port);
-        if (lpuart_is_32(sport))
+        if (lpuart_is_32(sport)) {
                lpuart_reg.cons = LPUART32_CONSOLE;
-        else
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0,
+                                        DRIVER_NAME, sport);
+        } else {
                lpuart_reg.cons = LPUART_CONSOLE;
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0,
+                                        DRIVER_NAME, sport);
+        }
+        if (ret)
+                goto failed_irq_request;
        ret = uart_add_one_port(&lpuart_reg, &sport->port);
-        if (ret) {
+        if (ret)
-                clk_disable_unprepare(sport->clk);
+                goto failed_attach_port;
-                return ret;
-        }
        sport->dma_tx_chan = dma_request_slave_channel(sport->port.dev, "tx");
        if (!sport->dma_tx_chan)
@@ -2240,6 +2229,11 @@ static int lpuart_probe(struct platform_device *pdev)
        }
        return 0;
+failed_attach_port:
+failed_irq_request:
+        clk_disable_unprepare(sport->clk);
+        return ret;
 }
 static int lpuart_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index cdd2f942317c..b9c7a904c1ea 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -889,7 +889,16 @@ static int sccnxp_probe(struct platform_device *pdev)
                        goto err_out;
                uartclk = 0;
        } else {
-                clk_prepare_enable(clk);
+                ret = clk_prepare_enable(clk);
+                if (ret)
+                        goto err_out;
+                ret = devm_add_action_or_reset(&pdev->dev,
+                                (void(*)(void *))clk_disable_unprepare,
+                                clk);
+                if (ret)
+                        goto err_out;
                uartclk = clk_get_rate(clk);
        }
@@ -988,7 +997,7 @@ static int sccnxp_probe(struct platform_device *pdev)
        uart_unregister_driver(&s->uart);
 err_out:
        if (!IS_ERR(s->regulator))
-                return regulator_disable(s->regulator);
+                regulator_disable(s->regulator);
        return ret;
 }
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 5aacea1978a5..3e865dbf878c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb)
        /*
         * only set a new error if there is no previous error.
         * Errors are only cleared during read/open
+         * Avoid propagating -EPIPE (stall) to userspace since it is
+         * better handled as an empty read
         */
-        if (desc->rerr  == 0)
+        if (desc->rerr == 0 && status != -EPIPE)
                desc->rerr = status;
        if (length + desc->length > desc->wMaxCommand) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 4be52c602e9b..68b54bd88d1e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
                } else if (header->bDescriptorType ==
                                USB_DT_INTERFACE_ASSOCIATION) {
+                        struct usb_interface_assoc_descriptor *d;
+                        d = (struct usb_interface_assoc_descriptor *)header;
+                        if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+                                dev_warn(ddev,
+                                         "config %d has an invalid interface association descriptor of length %d, skipping\n",
+                                         cfgno, d->bLength);
+                                continue;
+                        }
                        if (iad_num == USB_MAXIADS) {
                                dev_warn(ddev, "found more Interface "
                                               "Association Descriptors "
                                               "than allocated for in "
                                               "configuration %d\n", cfgno);
                        } else {
-                                config->intf_assoc[iad_num] =
+                                config->intf_assoc[iad_num] = d;
-                                        (struct usb_interface_assoc_descriptor
-                                        *)header;
                                iad_num++;
                        }
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev)
                }
                if (dev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(100);
+                        msleep(200);
                result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                    bigbuffer, length);
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 318bb3b96687..4664e543cf2f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644);
 MODULE_PARM_DESC(usbfs_memory_mb,
                "maximum MB allowed for usbfs buffers (0 = no limit)");
+/* Hard limit, necessary to avoid arithmetic overflow */
+#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
 static atomic64_t usbfs_memory_usage;   /* Total memory currently allocated */
 /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                                USBDEVFS_URB_ZERO_PACKET |
                                USBDEVFS_URB_NO_INTERRUPT))
                return -EINVAL;
+        if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
+                return -EINVAL;
        if (uurb->buffer_length > 0 && !uurb->buffer)
                return -EINVAL;
        if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
@@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                        totlen += isopkt[u].length;
                }
                u *= sizeof(struct usb_iso_packet_descriptor);
-                uurb->buffer_length = totlen;
+                if (totlen <= uurb->buffer_length)
+                        uurb->buffer_length = totlen;
+                else
+                        WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
+                                  totlen, uurb->buffer_length);
                break;
        default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 41eaf0b52518..b5c733613823 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4838,7 +4838,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                        goto loop;
                if (udev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(1000);
+                        msleep(2000);
                /* consecutive bus-powered hubs aren't reliable; they can
                 * violate the voltage drop budget.  if the new child has
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4c38ea41ae96..371a07d874a3 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                        elength = 1;
                        goto next_desc;
                }
+                if ((buflen < elength) || (elength < 3)) {
+                        dev_err(&intf->dev, "invalid descriptor buffer length\n");
+                        break;
+                }
                if (buffer[1] != USB_DT_CS_INTERFACE) {
                        dev_err(&intf->dev, "skipping garbage\n");
                        goto next_desc;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 4cef7d4f9cd0..a26d1fde0f5e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -177,6 +177,7 @@ static const struct of_device_id of_dwc3_simple_match[] = {
        { .compatible = "rockchip,rk3399-dwc3" },
        { .compatible = "xlnx,zynqmp-dwc3" },
        { .compatible = "cavium,octeon-7130-usb-uctl" },
+        { .compatible = "sprd,sc9860-dwc3" },
        { /* Sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 827e376bfa97..75e6cb044eb2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                         DWC3_TRBCTL_CONTROL_DATA,
                                         true);
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
                /* Now prepare one extra TRB to align transfer size */
                dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                         maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                         DWC3_TRBCTL_CONTROL_DATA,
                                         true);
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
                /* Now prepare one extra TRB to align transfer size */
                dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                         0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                req->request.length, DWC3_TRBCTL_CONTROL_DATA,
                                false);
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue];
                ret = dwc3_ep0_start_trans(dep);
        }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 9990944a7245..8b342587f8ad 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -46,7 +46,8 @@
 static void ffs_data_get(struct ffs_data *ffs);
 static void ffs_data_put(struct ffs_data *ffs);
 /* Creates new ffs_data object. */
-static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
+static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
+        __attribute__((malloc));
 /* Opened counter handling. */
 static void ffs_data_opened(struct ffs_data *ffs);
@@ -780,11 +781,12 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
                                         struct usb_request *req)
 {
        struct ffs_io_data *io_data = req->context;
+        struct ffs_data *ffs = io_data->ffs;
        ENTER();
        INIT_WORK(&io_data->work, ffs_user_copy_worker);
-        schedule_work(&io_data->work);
+        queue_work(ffs->io_completion_wq, &io_data->work);
 }
 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
@@ -1500,7 +1502,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
        if (unlikely(ret < 0))
                return ERR_PTR(ret);
-        ffs = ffs_data_new();
+        ffs = ffs_data_new(dev_name);
        if (unlikely(!ffs))
                return ERR_PTR(-ENOMEM);
        ffs->file_perms = data.perms;
@@ -1610,6 +1612,7 @@ static void ffs_data_put(struct ffs_data *ffs)
                BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
                       waitqueue_active(&ffs->ep0req_completion.wait) ||
                       waitqueue_active(&ffs->wait));
+                destroy_workqueue(ffs->io_completion_wq);
                kfree(ffs->dev_name);
                kfree(ffs);
        }
@@ -1642,7 +1645,7 @@ static void ffs_data_closed(struct ffs_data *ffs)
        ffs_data_put(ffs);
 }
-static struct ffs_data *ffs_data_new(void)
+static struct ffs_data *ffs_data_new(const char *dev_name)
 {
        struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
        if (unlikely(!ffs))
@@ -1650,6 +1653,12 @@ static struct ffs_data *ffs_data_new(void)
        ENTER();
+        ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
+        if (!ffs->io_completion_wq) {
+                kfree(ffs);
+                return NULL;
+        }
        refcount_set(&ffs->ref, 1);
        atomic_set(&ffs->opened, 0);
        ffs->state = FFS_READ_DESCRIPTORS;
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d6bd0244b008..5153e29870c3 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -307,8 +307,6 @@ struct fsg_common {
        struct completion       thread_notifier;
        struct task_struct      *thread_task;
-        /* Callback functions. */
-        const struct fsg_operations     *ops;
        /* Gadget's private data. */
        void                    *private_data;
@@ -2438,6 +2436,7 @@ static void handle_exception(struct fsg_common *common)
 static int fsg_main_thread(void *common_)
 {
        struct fsg_common       *common = common_;
+        int                     i;
        /*
         * Allow the thread to be killed by a signal, but set the signal mask
@@ -2476,21 +2475,16 @@ static int fsg_main_thread(void *common_)
        common->thread_task = NULL;
        spin_unlock_irq(&common->lock);
-        if (!common->ops || !common->ops->thread_exits
+        /* Eject media from all LUNs */
-         || common->ops->thread_exits(common) < 0) {
-                int i;
-                down_write(&common->filesem);
+        down_write(&common->filesem);
-                for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
+        for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
-                        struct fsg_lun *curlun = common->luns[i];
+                struct fsg_lun *curlun = common->luns[i];
-                        if (!curlun || !fsg_lun_is_open(curlun))
-                                continue;
+                if (curlun && fsg_lun_is_open(curlun))
                        fsg_lun_close(curlun);
-                        curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
-                }
-                up_write(&common->filesem);
        }
+        up_write(&common->filesem);
        /* Let fsg_unbind() know the thread has exited */
        complete_and_exit(&common->thread_notifier, 0);
@@ -2681,13 +2675,6 @@ void fsg_common_remove_luns(struct fsg_common *common)
 }
 EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops)
-{
-        common->ops = ops;
-}
-EXPORT_SYMBOL_GPL(fsg_common_set_ops);
 void fsg_common_free_buffers(struct fsg_common *common)
 {
        _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h
index d3902313b8ac..dc05ca0c4359 100644
--- a/drivers/usb/gadget/function/f_mass_storage.h
+++ b/drivers/usb/gadget/function/f_mass_storage.h
@@ -60,17 +60,6 @@ struct fsg_module_parameters {
 struct fsg_common;
 /* FSF callback functions */
-struct fsg_operations {
-        /*
-         * Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set).
-         */
-        int (*thread_exits)(struct fsg_common *common);
-};
 struct fsg_lun_opts {
        struct config_group group;
        struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun);
 void fsg_common_remove_luns(struct fsg_common *common);
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops);
 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
                          unsigned int id, const char *name,
                          const char **name_pfx);
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 8df244fc9d80..ea0da35a44e2 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -555,6 +555,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        size_t                  size;   /* Amount of data in a TX request. */
        size_t                  bytes_copied = 0;
        struct usb_request      *req;
+        int                     value;
        DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
@@ -634,7 +635,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                        return -EAGAIN;
                }
-                if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
+                /* here, we unlock, and only unlock, to avoid deadlock. */
+                spin_unlock(&dev->lock);
+                value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
+                spin_lock(&dev->lock);
+                if (value) {
                        list_add(&req->list, &dev->tx_reqs);
                        spin_unlock_irqrestore(&dev->lock, flags);
                        mutex_unlock(&dev->lock_printer_io);
diff --git a/drivers/usb/gadget/function/u_fs.h b/drivers/usb/gadget/function/u_fs.h
index 540f1c48c1a8..79f70ebf85dc 100644
--- a/drivers/usb/gadget/function/u_fs.h
+++ b/drivers/usb/gadget/function/u_fs.h
@@ -279,6 +279,7 @@ struct ffs_data {
        }                               file_perms;
        struct eventfd_ctx *ffs_eventfd;
+        struct workqueue_struct *io_completion_wq;
        bool no_disconnect;
        struct work_struct reset_work;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 684900fcfe24..5c28bee327e1 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -28,7 +28,7 @@
 #include <linux/aio.h>
 #include <linux/uio.h>
 #include <linux/refcount.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/moduleparam.h>
@@ -116,6 +116,7 @@ enum ep0_state {
 struct dev_data {
        spinlock_t                      lock;
        refcount_t                      count;
+        int                             udc_usage;
        enum ep0_state                  state;          /* P: lock */
        struct usb_gadgetfs_event       event [N_EVENT];
        unsigned                        ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                INIT_WORK(&priv->work, ep_user_copy_worker);
                schedule_work(&priv->work);
        }
-        spin_unlock(&epdata->dev->lock);
        usb_ep_free_request(ep, req);
+        spin_unlock(&epdata->dev->lock);
        put_ep(epdata);
 }
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                        struct usb_request      *req = dev->req;
                        if ((retval = setup_req (ep, req, 0)) == 0) {
+                                ++dev->udc_usage;
                                spin_unlock_irq (&dev->lock);
                                retval = usb_ep_queue (ep, req, GFP_KERNEL);
                                spin_lock_irq (&dev->lock);
+                                --dev->udc_usage;
                        }
                        dev->state = STATE_DEV_CONNECTED;
@@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                                retval = -EIO;
                        else {
                                len = min (len, (size_t)dev->req->actual);
-// FIXME don't call this with the spinlock held ...
+                                ++dev->udc_usage;
+                                spin_unlock_irq(&dev->lock);
                                if (copy_to_user (buf, dev->req->buf, len))
                                        retval = -EFAULT;
                                else
                                        retval = len;
+                                spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                clean_req (dev->gadget->ep0, dev->req);
                                /* NOTE userspace can't yet choose to stall */
                        }
@@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                        retval = setup_req (dev->gadget->ep0, dev->req, len);
                        if (retval == 0) {
                                dev->state = STATE_DEV_CONNECTED;
+                                ++dev->udc_usage;
                                spin_unlock_irq (&dev->lock);
                                if (copy_from_user (dev->req->buf, buf, len))
                                        retval = -EFAULT;
@@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                                                GFP_KERNEL);
                                }
                                spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                if (retval < 0) {
                                        clean_req (dev->gadget->ep0, dev->req);
                                } else
@@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
        struct usb_gadget       *gadget = dev->gadget;
        long ret = -ENOTTY;
-        if (gadget->ops->ioctl)
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_DEV_OPENED ||
+                        dev->state == STATE_DEV_UNBOUND) {
+                /* Not bound to a UDC */
+        } else if (gadget->ops->ioctl) {
+                ++dev->udc_usage;
+                spin_unlock_irq(&dev->lock);
                ret = gadget->ops->ioctl (gadget, code, value);
+                spin_lock_irq(&dev->lock);
+                --dev->udc_usage;
+        }
+        spin_unlock_irq(&dev->lock);
        return ret;
 }
@@ -1463,10 +1483,12 @@ delegate:
                                if (value < 0)
                                        break;
+                                ++dev->udc_usage;
                                spin_unlock (&dev->lock);
                                value = usb_ep_queue (gadget->ep0, dev->req,
                                                        GFP_KERNEL);
                                spin_lock (&dev->lock);
+                                --dev->udc_usage;
                                if (value < 0) {
                                        clean_req (gadget->ep0, dev->req);
                                        break;
@@ -1490,8 +1512,12 @@ delegate:
                req->length = value;
                req->zero = value < w_length;
+                ++dev->udc_usage;
                spin_unlock (&dev->lock);
                value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+                spin_lock(&dev->lock);
+                --dev->udc_usage;
+                spin_unlock(&dev->lock);
                if (value < 0) {
                        DBG (dev, "ep_queue --> %d\n", value);
                        req->status = 0;
@@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev)
                /* break link to FS */
                ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
                list_del_init (&ep->epfiles);
+                spin_unlock_irq (&dev->lock);
                dentry = ep->dentry;
                ep->dentry = NULL;
                parent = d_inode(dentry->d_parent);
                /* break link to controller */
+                mutex_lock(&ep->lock);
                if (ep->state == STATE_EP_ENABLED)
                        (void) usb_ep_disable (ep->ep);
                ep->state = STATE_EP_UNBOUND;
                usb_ep_free_request (ep->ep, ep->req);
                ep->ep = NULL;
+                mutex_unlock(&ep->lock);
                wake_up (&ep->wait);
                put_ep (ep);
-                spin_unlock_irq (&dev->lock);
                /* break link to dcache */
                inode_lock(parent);
                d_delete (dentry);
@@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget)
        spin_lock_irq (&dev->lock);
        dev->state = STATE_DEV_UNBOUND;
+        while (dev->udc_usage > 0) {
+                spin_unlock_irq(&dev->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dev->lock);
+        }
        spin_unlock_irq (&dev->lock);
        destroy_ep_files (dev);
diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c
index e99ab57ee3e5..fcba59782f26 100644
--- a/drivers/usb/gadget/legacy/mass_storage.c
+++ b/drivers/usb/gadget/legacy/mass_storage.c
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
-static unsigned long msg_registered;
-static void msg_cleanup(void);
-static int msg_thread_exits(struct fsg_common *common)
-{
-        msg_cleanup();
-        return 0;
-}
 static int msg_do_config(struct usb_configuration *c)
 {
        struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = {
 static int msg_bind(struct usb_composite_dev *cdev)
 {
-        static const struct fsg_operations ops = {
-                .thread_exits = msg_thread_exits,
-        };
        struct fsg_opts *opts;
        struct fsg_config config;
        int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev)
        if (status)
                goto fail;
-        fsg_common_set_ops(opts->common, &ops);
        status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
        if (status)
                goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL");
 static int __init msg_init(void)
 {
-        int ret;
+        return usb_composite_probe(&msg_driver);
-        ret = usb_composite_probe(&msg_driver);
-        set_bit(0, &msg_registered);
-        return ret;
 }
 module_init(msg_init);
-static void msg_cleanup(void)
+static void __exit msg_cleanup(void)
 {
-        if (test_and_clear_bit(0, &msg_registered))
+        usb_composite_unregister(&msg_driver);
-                usb_composite_unregister(&msg_driver);
 }
 module_exit(msg_cleanup);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 7cd5c969fcbe..1e9567091d86 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -273,6 +273,7 @@ config USB_SNP_CORE
 config USB_SNP_UDC_PLAT
        tristate "Synopsys USB 2.0 Device controller"
        depends on USB_GADGET && OF && HAS_DMA
+        depends on EXTCON || EXTCON=n
        select USB_GADGET_DUALSPEED
        select USB_SNP_CORE
        default ARCH_BCM_IPROC
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 98d71400f8a1..a884c022df7a 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -29,6 +29,8 @@
 #include <linux/of_gpio.h>
 #include "atmel_usba_udc.h"
+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \
+                           | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)
 #ifdef CONFIG_USB_GADGET_DEBUG_FS
 #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev)
                                        IRQ_NOAUTOEN);
                        ret = devm_request_threaded_irq(&pdev->dev,
                                        gpio_to_irq(udc->vbus_pin), NULL,
-                                        usba_vbus_irq_thread, IRQF_ONESHOT,
+                                        usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS,
                                        "atmel_usba_udc", udc);
                        if (ret) {
                                udc->vbus_pin = -ENODEV;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 75c51ca4ee0f..d41d07aae0ce 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1320,8 +1320,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
        udc->dev.driver = &driver->driver;
        udc->gadget->dev.driver = &driver->driver;
-        if (driver->max_speed < udc->gadget->max_speed)
+        usb_gadget_udc_set_speed(udc, driver->max_speed);
-                usb_gadget_udc_set_speed(udc, driver->max_speed);
        ret = driver->bind(udc->gadget, driver);
        if (ret)
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index a030d7923d7d..b17618a55f1b 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -237,6 +237,8 @@ struct dummy_hcd {
        struct usb_device               *udev;
        struct list_head                urbp_list;
+        struct urbp                     *next_frame_urbp;
        u32                             stream_en_ep;
        u8                              num_stream[30 / 2];
@@ -253,11 +255,13 @@ struct dummy {
         */
        struct dummy_ep                 ep[DUMMY_ENDPOINTS];
        int                             address;
+        int                             callback_usage;
        struct usb_gadget               gadget;
        struct usb_gadget_driver        *driver;
        struct dummy_request            fifo_req;
        u8                              fifo_buf[FIFO_SIZE];
        u16                             devstatus;
+        unsigned                        ints_enabled:1;
        unsigned                        udc_suspended:1;
        unsigned                        pullup:1;
@@ -375,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
                             USB_PORT_STAT_CONNECTION) == 0)
                                dum_hcd->port_status |=
                                        (USB_PORT_STAT_C_CONNECTION << 16);
-                        if ((dum_hcd->port_status &
+                        if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
-                             USB_PORT_STAT_ENABLE) == 1 &&
+                            (dum_hcd->port_status &
-                                (dum_hcd->port_status &
+                             USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
-                                 USB_SS_PORT_LS_U0) == 1 &&
+                            dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
-                                dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
                                dum_hcd->active = 1;
                }
        } else {
@@ -440,18 +443,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                                (~dum_hcd->old_status) & dum_hcd->port_status;
                /* Report reset and disconnect events to the driver */
-                if (dum->driver && (disconnect || reset)) {
+                if (dum->ints_enabled && (disconnect || reset)) {
                        stop_activity(dum);
+                        ++dum->callback_usage;
+                        spin_unlock(&dum->lock);
                        if (reset)
                                usb_gadget_udc_reset(&dum->gadget, dum->driver);
                        else
                                dum->driver->disconnect(&dum->gadget);
+                        spin_lock(&dum->lock);
+                        --dum->callback_usage;
                }
-        } else if (dum_hcd->active != dum_hcd->old_active) {
+        } else if (dum_hcd->active != dum_hcd->old_active &&
+                        dum->ints_enabled) {
+                ++dum->callback_usage;
+                spin_unlock(&dum->lock);
                if (dum_hcd->old_active && dum->driver->suspend)
                        dum->driver->suspend(&dum->gadget);
                else if (!dum_hcd->old_active &&  dum->driver->resume)
                        dum->driver->resume(&dum->gadget);
+                spin_lock(&dum->lock);
+                --dum->callback_usage;
        }
        dum_hcd->old_status = dum_hcd->port_status;
@@ -972,8 +984,11 @@ static int dummy_udc_start(struct usb_gadget *g,
         * can't enumerate without help from the driver we're binding.
         */
+        spin_lock_irq(&dum->lock);
        dum->devstatus = 0;
        dum->driver = driver;
+        dum->ints_enabled = 1;
+        spin_unlock_irq(&dum->lock);
        return 0;
 }
@@ -984,6 +999,16 @@ static int dummy_udc_stop(struct usb_gadget *g)
        struct dummy            *dum = dum_hcd->dum;
        spin_lock_irq(&dum->lock);
+        dum->ints_enabled = 0;
+        stop_activity(dum);
+        /* emulate synchronize_irq(): wait for callbacks to finish */
+        while (dum->callback_usage > 0) {
+                spin_unlock_irq(&dum->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dum->lock);
+        }
        dum->driver = NULL;
        spin_unlock_irq(&dum->lock);
@@ -1037,7 +1062,12 @@ static int dummy_udc_probe(struct platform_device *pdev)
        memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
        dum->gadget.name = gadget_name;
        dum->gadget.ops = &dummy_ops;
-        dum->gadget.max_speed = USB_SPEED_SUPER;
+        if (mod_data.is_super_speed)
+                dum->gadget.max_speed = USB_SPEED_SUPER;
+        else if (mod_data.is_high_speed)
+                dum->gadget.max_speed = USB_SPEED_HIGH;
+        else
+                dum->gadget.max_speed = USB_SPEED_FULL;
        dum->gadget.dev.parent = &pdev->dev;
        init_dummy_udc_hw(dum);
@@ -1246,6 +1276,8 @@ static int dummy_urb_enqueue(
        list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
        urb->hcpriv = urbp;
+        if (!dum_hcd->next_frame_urbp)
+                dum_hcd->next_frame_urbp = urbp;
        if (usb_pipetype(urb->pipe) == PIPE_CONTROL)
                urb->error_count = 1;           /* mark as a new urb */
@@ -1521,6 +1553,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address)
        if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
                        dum->ss_hcd : dum->hs_hcd)))
                return NULL;
+        if (!dum->ints_enabled)
+                return NULL;
        if ((address & ~USB_DIR_IN) == 0)
                return &dum->ep[0];
        for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1762,6 +1796,7 @@ static void dummy_timer(unsigned long _dum_hcd)
                spin_unlock_irqrestore(&dum->lock, flags);
                return;
        }
+        dum_hcd->next_frame_urbp = NULL;
        for (i = 0; i < DUMMY_ENDPOINTS; i++) {
                if (!ep_info[i].name)
@@ -1778,6 +1813,10 @@ restart:
                int                     type;
                int                     status = -EINPROGRESS;
+                /* stop when we reach URBs queued after the timer interrupt */
+                if (urbp == dum_hcd->next_frame_urbp)
+                        break;
                urb = urbp->urb;
                if (urb->unlinked)
                        goto return_urb;
@@ -1857,10 +1896,12 @@ restart:
                         * until setup() returns; no reentrancy issues etc.
                         */
                        if (value > 0) {
+                                ++dum->callback_usage;
                                spin_unlock(&dum->lock);
                                value = dum->driver->setup(&dum->gadget,
                                                &setup);
                                spin_lock(&dum->lock);
+                                --dum->callback_usage;
                                if (value >= 0) {
                                        /* no delays (max 64KB data stage) */
@@ -2561,8 +2602,6 @@ static struct hc_driver dummy_hcd = {
        .product_desc =         "Dummy host controller",
        .hcd_priv_size =        sizeof(struct dummy_hcd),
-        .flags =                HCD_USB3 | HCD_SHARED,
        .reset =                dummy_setup,
        .start =                dummy_start,
        .stop =                 dummy_stop,
@@ -2591,8 +2630,12 @@ static int dummy_hcd_probe(struct platform_device *pdev)
        dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
        dum = *((void **)dev_get_platdata(&pdev->dev));
-        if (!mod_data.is_super_speed)
+        if (mod_data.is_super_speed)
+                dummy_hcd.flags = HCD_USB3 | HCD_SHARED;
+        else if (mod_data.is_high_speed)
                dummy_hcd.flags = HCD_USB2;
+        else
+                dummy_hcd.flags = HCD_USB11;
        hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
        if (!hs_hcd)
                return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index df37c1e6e9d5..63a206122058 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1038,7 +1038,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                        usb3_ep->ep.maxpacket);
        u8 *buf = usb3_req->req.buf + usb3_req->req.actual;
        u32 tmp = 0;
-        bool is_last;
+        bool is_last = !len ? true : false;
        if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0)
                return -EBUSY;
@@ -1059,7 +1059,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                usb3_write(usb3, tmp, fifo_reg);
        }
-        is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
+        if (!is_last)
+                is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
        /* Send the data */
        usb3_set_px_con_send(usb3_ep, len, is_last);
@@ -1150,7 +1151,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep,
                usb3_set_p0_con_for_ctrl_read_data(usb3);
        } else {
                usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD);
-                usb3_set_p0_con_for_ctrl_write_data(usb3);
+                if (usb3_req->req.length)
+                        usb3_set_p0_con_for_ctrl_write_data(usb3);
        }
        usb3_p0_xfer(usb3_ep, usb3_req);
@@ -2053,7 +2055,16 @@ static u32 usb3_calc_ramarea(int ram_size)
 static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep,
                                const struct usb_endpoint_descriptor *desc)
 {
-        return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc));
+        int i;
+        const u32 max_packet_array[] = {8, 16, 32, 64, 512};
+        u32 mpkt = PN_RAMMAP_MPKT(1024);
+        for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) {
+                if (usb_endpoint_maxp(desc) <= max_packet_array[i])
+                        mpkt = PN_RAMMAP_MPKT(max_packet_array[i]);
+        }
+        return usb3_ep->rammap_val | mpkt;
 }
 static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 658d9d1f9ea3..6dda3623a276 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev)
                if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
                        return 0;
-                usleep_range(40, 60);
+                udelay(50);
        }
        dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports);
 *
 * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
 * It signals to the BIOS that the OS wants control of the host controller,
- * and then waits 5 seconds for the BIOS to hand over control.
+ * and then waits 1 second for the BIOS to hand over control.
 * If we timeout, assume the BIOS is broken and take control anyway.
 */
 static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
        if (val & XHCI_HC_BIOS_OWNED) {
                writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
-                /* Wait for 5 seconds with 10 microsecond polling interval */
+                /* Wait for 1 second with 10 microsecond polling interval */
                timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
-                                0, 5000, 10);
+                                0, 1000000, 10);
                /* Assume a buggy BIOS and take HC ownership anyway */
                if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init:
         * operational or runtime registers.  Wait 5 seconds and no more.
         */
        timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
-                        5000, 10);
+                        5000000, 10);
        /* Assume a buggy HC and start HC initialization anyway */
        if (timeout) {
                val = readl(op_reg_base + XHCI_STS_OFFSET);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index ad89a6d4111b..da9158f171cb 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
        /* If PSI table exists, add the custom speed attributes from it */
        if (usb3_1 && xhci->usb3_rhub.psi_count) {
-                u32 ssp_cap_base, bm_attrib, psi;
+                u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
                int offset;
                ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
                for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
                        psi = xhci->usb3_rhub.psi[i];
                        psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
+                        psi_exp = XHCI_EXT_PORT_PSIE(psi);
+                        psi_mant = XHCI_EXT_PORT_PSIM(psi);
+                        /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */
+                        for (; psi_exp < 3; psi_exp++)
+                                psi_mant /= 1000;
+                        if (psi_mant >= 10)
+                                psi |= BIT(14);
                        if ((psi & PLT_MASK) == PLT_SYM) {
                        /* Symmetric, create SSA RX and TX from one PSI entry */
                                put_unaligned_le32(psi, &buf[offset]);
@@ -1506,9 +1515,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                t2 &= ~PORT_WKDISC_E;
                        }
-                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
-                            (hcd->speed < HCD_USB3))
-                                t2 &= ~PORT_WAKE_BITS;
                } else
                        t2 &= ~PORT_WAKE_BITS;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8071c8fdd15e..76f392954733 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -54,11 +54,6 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 static const char hcd_name[] = "xhci_hcd";
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        if (pdev->vendor == PCI_VENDOR_ID_AMD)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
-        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
-                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
-                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
        if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                xhci->quirks |= XHCI_LPM_SUPPORT;
                xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 163bafde709f..1cb6eaef4ae1 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -178,14 +178,18 @@ static int xhci_plat_probe(struct platform_device *pdev)
         * 2. xhci_plat is child of a device from firmware (dwc3-plat)
         * 3. xhci_plat is grandchild of a pci device (dwc3-pci)
         */
-        sysdev = &pdev->dev;
+        for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) {
-        if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node)
+                if (is_of_node(sysdev->fwnode) ||
-                sysdev = sysdev->parent;
+                        is_acpi_device_node(sysdev->fwnode))
+                        break;
 #ifdef CONFIG_PCI
-        else if (sysdev->parent && sysdev->parent->parent &&
+                else if (sysdev->bus == &pci_bus_type)
-                 sysdev->parent->parent->bus == &pci_bus_type)
+                        break;
-                sysdev = sysdev->parent->parent;
 #endif
+        }
+        if (!sysdev)
+                sysdev = &pdev->dev;
        /* Try to set 64-bit DMA first */
        if (WARN_ON(!sysdev->dma_mask))
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b2ff1ff1a02f..ee198ea47f49 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
        if (xhci->quirks & XHCI_MTK_HOST) {
                ret = xhci_mtk_add_ep_quirk(hcd, udev, ep);
                if (ret < 0) {
-                        xhci_free_endpoint_ring(xhci, virt_dev, ep_index);
+                        xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring);
+                        virt_dev->eps[ep_index].new_ring = NULL;
                        return ret;
                }
        }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2abaa4d6d39d..2b48aa4f6b76 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -735,6 +735,8 @@ struct xhci_ep_ctx {
 #define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
+/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)   (((p) >> 24) & 0xff)
 /* ep_info2 bitmasks */
 /*
@@ -1681,7 +1683,7 @@ struct xhci_bus_state {
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
-        if (hcd->speed == HCD_USB3)
+        if (hcd->speed >= HCD_USB3)
                return 0;
        else
                return 1;
@@ -1826,7 +1828,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-#define XHCI_U2_DISABLE_WAKE    (1 << 27)
+/* Reserved. It was XHCI_U2_DISABLE_WAKE */
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
        unsigned int            num_active_eps;
@@ -2540,8 +2542,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
        u8 lsa;
        u8 hid;
-        esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 |
+        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
-                EP_MAX_ESIT_PAYLOAD_LO(tx_info);
+                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
        ep_state = info & EP_STATE_MASK;
        max_pstr = info & EP_MAXPSTREAMS_MASK;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d1af831f43eb..68f26904c316 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe,
                              struct usbhs_fifo *fifo)
 {
        struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+        int ret = 0;
-        if (!usbhs_pipe_is_dcp(pipe))
+        if (!usbhs_pipe_is_dcp(pipe)) {
-                usbhsf_fifo_barrier(priv, fifo);
+                /*
+                 * This driver checks the pipe condition first to avoid -EBUSY
+                 * from usbhsf_fifo_barrier() with about 10 msec delay in
+                 * the interrupt handler if the pipe is RX direction and empty.
+                 */
+                if (usbhs_pipe_is_dir_in(pipe))
+                        ret = usbhs_pipe_is_accessible(pipe);
+                if (!ret)
+                        ret = usbhsf_fifo_barrier(priv, fifo);
+        }
-        usbhs_write(priv, fifo->ctr, BCLR);
+        /*
+         * if non-DCP pipe, this driver should set BCLR when
+         * usbhsf_fifo_barrier() returns 0.
+         */
+        if (!ret)
+                usbhs_write(priv, fifo->ctr, BCLR);
 }
 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1a59f335b063..a3ccb899df60 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -834,13 +834,25 @@ Retry_Sense:
                        if (result == USB_STOR_TRANSPORT_GOOD) {
                                srb->result = SAM_STAT_GOOD;
                                srb->sense_buffer[0] = 0x0;
+                        }
+                        /*
+                         * ATA-passthru commands use sense data to report
+                         * the command completion status, and often devices
+                         * return Check Condition status when nothing is
+                         * wrong.
+                         */
+                        else if (srb->cmnd[0] == ATA_16 ||
+                                        srb->cmnd[0] == ATA_12) {
+                                /* leave the data alone */
+                        }
                        /*
                         * If there was a problem, report an unspecified
                         * hardware error to prevent the higher layers from
                         * entering an infinite retry loop.
                         */
-                        } else {
+                        else {
                                srb->result = DID_ERROR << 16;
                                if ((sshdr.response_code & 0x72) == 0x72)
                                        srb->sense_buffer[1] = HARDWARE_ERROR;
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index f58caa9e6a27..a155cd02bce2 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf)
                intf->desc.bInterfaceProtocol == USB_PR_UAS);
 }
-static int uas_find_uas_alt_setting(struct usb_interface *intf)
+static struct usb_host_interface *uas_find_uas_alt_setting(
+                struct usb_interface *intf)
 {
        int i;
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf)
                struct usb_host_interface *alt = &intf->altsetting[i];
                if (uas_is_interface(alt))
-                        return alt->desc.bAlternateSetting;
+                        return alt;
        }
-        return -ENODEV;
+        return NULL;
 }
 static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf,
        struct usb_device *udev = interface_to_usbdev(intf);
        struct usb_hcd *hcd = bus_to_hcd(udev->bus);
        unsigned long flags = id->driver_info;
-        int r, alt;
+        struct usb_host_interface *alt;
+        int r;
        alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
+        if (!alt)
                return 0;
-        r = uas_find_endpoints(&intf->altsetting[alt], eps);
+        r = uas_find_endpoints(alt, eps);
        if (r < 0)
                return 0;
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index cfb1e3bbd434..63cf981ed81c 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 static int uas_switch_interface(struct usb_device *udev,
                                struct usb_interface *intf)
 {
-        int alt;
+        struct usb_host_interface *alt;
        alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
+        if (!alt)
-                return alt;
+                return -ENODEV;
-        return usb_set_interface(udev,
+        return usb_set_interface(udev, alt->desc.bInterfaceNumber,
-                        intf->altsetting[0].desc.bInterfaceNumber, alt);
+                        alt->desc.bAlternateSetting);
 }
 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 5a70c33ef0e0..eb06d88b41d6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_SANE_SENSE ),
+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
+                "Seagate",
+                "External",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT ),
 UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x9999,
                "Maxtor",
                "USB to SATA",
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 35a1e777b449..9a53912bdfe9 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface,
        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
                return -ENODEV;
+        if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
+                return -ENODEV;
        result = -ENOMEM;
        uwb_rc = uwb_rc_alloc();
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 01c20a260a8b..39dd4ef53c77 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -302,18 +302,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-        rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
+        struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
-        if (rc->uwbd.task == NULL)
+        if (IS_ERR(task)) {
+                rc->uwbd.task = NULL;
                printk(KERN_ERR "UWB: Cannot start management daemon; "
                       "UWB won't work\n");
-        else
+        } else {
+                rc->uwbd.task = task;
                rc->uwbd.pid = rc->uwbd.task->pid;
+        }
 }
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-        kthread_stop(rc->uwbd.task);
+        if (rc->uwbd.task)
+                kthread_stop(rc->uwbd.task);
        uwbd_flush(rc);
 }
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index 5fbfd9cfb6d6..5b3d57fc82d3 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -169,6 +169,9 @@ static int rom_write(struct pci_dev *dev, int offset, u32 value, void *data)
 static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
 {
        struct pci_bar_info *bar = data;
+        unsigned int pos = (offset - PCI_BASE_ADDRESS_0) / 4;
+        const struct resource *res = dev->resource;
+        u32 mask;
        if (unlikely(!bar)) {
                pr_warn(DRV_NAME ": driver data not found for %s\n",
@@ -179,7 +182,13 @@ static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
        /* A write to obtain the length must happen as a 32-bit write.
         * This does not (yet) support writing individual bytes
         */
-        if (value == ~0)
+        if (res[pos].flags & IORESOURCE_IO)
+                mask = ~PCI_BASE_ADDRESS_IO_MASK;
+        else if (pos && (res[pos - 1].flags & IORESOURCE_MEM_64))
+                mask = 0;
+        else
+                mask = ~PCI_BASE_ADDRESS_MEM_MASK;
+        if ((value | mask) == ~0U)
                bar->which = 1;
        else {
                u32 tmpval;
author	Thomas Gleixner <tglx@linutronix.de>	2017-10-12 05:02:50 -0400
committer	Thomas Gleixner <tglx@linutronix.de>	2017-10-12 05:02:50 -0400
commit	331b57d14829c49d75076779cdc54d7e4537bbf0 (patch)
tree	79a70eadb04ed2fd65d3280021ec6ad5266d1cc1 /drivers
parent	79761ce80aa0232157e428bde28c0cef6d43ac5f (diff)
parent	e43b3b58548051f8809391eb7bec7a27ed3003ea (diff)