Merge branch 'kprobe-fixes' of https://git.linaro.org/people/tixy/kernel into fixes

102 files changed, 1592 insertions, 860 deletions

diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 219b90bc0922..f15900132912 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -41,8 +41,10 @@ void acpi_gpe_apply_masked_gpes(void);
 void acpi_container_init(void);
 void acpi_memory_hotplug_init(void);
 #ifdef  CONFIG_ACPI_HOTPLUG_IOAPIC
+void pci_ioapic_remove(struct acpi_pci_root *root);
 int acpi_ioapic_remove(struct acpi_pci_root *root);
 #else
+static inline void pci_ioapic_remove(struct acpi_pci_root *root) { return; }
 static inline int acpi_ioapic_remove(struct acpi_pci_root *root) { return 0; }
 #endif
 #ifdef CONFIG_ACPI_DOCK
diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c
index 6d7ce6e12aaa..1120dfd625b8 100644
--- a/drivers/acpi/ioapic.c
+++ b/drivers/acpi/ioapic.c
@@ -206,24 +206,34 @@ int acpi_ioapic_add(acpi_handle root_handle)
         return ACPI_SUCCESS(status) && ACPI_SUCCESS(retval) ? 0 : -ENODEV;
 }
 
-int acpi_ioapic_remove(struct acpi_pci_root *root)
+void pci_ioapic_remove(struct acpi_pci_root *root)
 {
-        int retval = 0;
         struct acpi_pci_ioapic *ioapic, *tmp;
 
         mutex_lock(&ioapic_list_lock);
         list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
                 if (root->device->handle != ioapic->root_handle)
                         continue;
-
-                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
-                        retval = -EBUSY;
-
                 if (ioapic->pdev) {
                         pci_release_region(ioapic->pdev, 0);
                         pci_disable_device(ioapic->pdev);
                         pci_dev_put(ioapic->pdev);
                 }
+        }
+        mutex_unlock(&ioapic_list_lock);
+}
+
+int acpi_ioapic_remove(struct acpi_pci_root *root)
+{
+        int retval = 0;
+        struct acpi_pci_ioapic *ioapic, *tmp;
+
+        mutex_lock(&ioapic_list_lock);
+        list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
+                if (root->device->handle != ioapic->root_handle)
+                        continue;
+                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
+                        retval = -EBUSY;
                 if (ioapic->res.flags && ioapic->res.parent)
                         release_resource(&ioapic->res);
                 list_del(&ioapic->list);
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index bf601d4df8cf..919be0aa2578 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -648,12 +648,12 @@ static void acpi_pci_root_remove(struct acpi_device *device)
 
         pci_stop_root_bus(root->bus);
 
-        WARN_ON(acpi_ioapic_remove(root));
-
+        pci_ioapic_remove(root);
         device_set_run_wake(root->bus->bridge, false);
         pci_acpi_remove_bus_pm_notifier(device);
 
         pci_remove_root_bus(root->bus);
+        WARN_ON(acpi_ioapic_remove(root));
 
         dmar_device_remove(device->handle);
 
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 10aed84244f5..939641d6e262 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -50,7 +50,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
                         
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (46) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 644ba0888bd4..9cfd2e06a649 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -61,7 +61,7 @@
                         first drive found.
                         
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (45) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index ed93e8badf56..14c5d32f5d8b 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -59,7 +59,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (47) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 5db955fe3a94..3b5882bfb736 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -84,7 +84,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (97) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 61fc6824299a..e815312a00ad 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -61,7 +61,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (96) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 4d6807723798..517838b65964 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -120,10 +120,11 @@ static int atomic_dec_return_safe(atomic_t *v)
 
 /* Feature bits */
 
-#define RBD_FEATURE_LAYERING    (1<<0)
-#define RBD_FEATURE_STRIPINGV2  (1<<1)
-#define RBD_FEATURE_EXCLUSIVE_LOCK (1<<2)
-#define RBD_FEATURE_DATA_POOL (1<<7)
+#define RBD_FEATURE_LAYERING            (1ULL<<0)
+#define RBD_FEATURE_STRIPINGV2          (1ULL<<1)
+#define RBD_FEATURE_EXCLUSIVE_LOCK      (1ULL<<2)
+#define RBD_FEATURE_DATA_POOL           (1ULL<<7)
+
 #define RBD_FEATURES_ALL        (RBD_FEATURE_LAYERING |         \
                                  RBD_FEATURE_STRIPINGV2 |       \
                                  RBD_FEATURE_EXCLUSIVE_LOCK |   \
@@ -499,16 +500,23 @@ static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
         return is_lock_owner;
 }
 
+static ssize_t rbd_supported_features_show(struct bus_type *bus, char *buf)
+{
+        return sprintf(buf, "0x%llx\n", RBD_FEATURES_SUPPORTED);
+}
+
 static BUS_ATTR(add, S_IWUSR, NULL, rbd_add);
 static BUS_ATTR(remove, S_IWUSR, NULL, rbd_remove);
 static BUS_ATTR(add_single_major, S_IWUSR, NULL, rbd_add_single_major);
 static BUS_ATTR(remove_single_major, S_IWUSR, NULL, rbd_remove_single_major);
+static BUS_ATTR(supported_features, S_IRUGO, rbd_supported_features_show, NULL);
 
 static struct attribute *rbd_bus_attrs[] = {
         &bus_attr_add.attr,
         &bus_attr_remove.attr,
         &bus_attr_add_single_major.attr,
         &bus_attr_remove_single_major.attr,
+        &bus_attr_supported_features.attr,
         NULL,
 };
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index e27d89a36c34..dceb5edd1e54 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1189,6 +1189,8 @@ static int zram_add(void)
         blk_queue_io_min(zram->disk->queue, PAGE_SIZE);
         blk_queue_io_opt(zram->disk->queue, PAGE_SIZE);
         zram->disk->queue->limits.discard_granularity = PAGE_SIZE;
+        zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE;
+        zram->disk->queue->limits.chunk_sectors = 0;
         blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX);
         /*
          * zram_bio_discard() will clear all logical blocks if logical block
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index a5b1eb276c0b..e6d0d271c58c 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -6,7 +6,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/interrupt.h>
 #include <linux/time.h>
 #include <linux/timer.h>
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1ef26403bcc8..0ab024918907 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -313,13 +313,6 @@ static int random_read_wakeup_bits = 64;
 static int random_write_wakeup_bits = 28 * OUTPUT_POOL_WORDS;
 
 /*
- * The minimum number of seconds between urandom pool reseeding.  We
- * do this to limit the amount of entropy that can be drained from the
- * input pool even if there are heavy demands on /dev/urandom.
- */
-static int random_min_urandom_seed = 60;
-
-/*
  * Originally, we used a primitive polynomial of degree .poolwords
  * over GF(2).  The taps for various sizes are defined below.  They
  * were chosen to be evenly spaced except for the last tap, which is 1
@@ -409,7 +402,6 @@ static struct poolinfo {
  */
 static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
 static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
-static DECLARE_WAIT_QUEUE_HEAD(urandom_init_wait);
 static struct fasync_struct *fasync;
 
 static DEFINE_SPINLOCK(random_ready_list_lock);
@@ -467,7 +459,6 @@ struct entropy_store {
         int entropy_count;
         int entropy_total;
         unsigned int initialized:1;
-        unsigned int limit:1;
         unsigned int last_data_init:1;
         __u8 last_data[EXTRACT_SIZE];
 };
@@ -485,7 +476,6 @@ static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
 static struct entropy_store input_pool = {
         .poolinfo = &poolinfo_table[0],
         .name = "input",
-        .limit = 1,
         .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
         .pool = input_pool_data
 };
@@ -493,7 +483,6 @@ static struct entropy_store input_pool = {
 static struct entropy_store blocking_pool = {
         .poolinfo = &poolinfo_table[1],
         .name = "blocking",
-        .limit = 1,
         .pull = &input_pool,
         .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock),
         .pool = blocking_pool_data,
@@ -855,13 +844,6 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         spin_unlock_irqrestore(&primary_crng.lock, flags);
 }
 
-static inline void maybe_reseed_primary_crng(void)
-{
-        if (crng_init > 2 &&
-            time_after(jiffies, primary_crng.init_time + CRNG_RESEED_INTERVAL))
-                crng_reseed(&primary_crng, &input_pool);
-}
-
 static inline void crng_wait_ready(void)
 {
         wait_event_interruptible(crng_init_wait, crng_ready());
@@ -1220,15 +1202,6 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
             r->entropy_count > r->poolinfo->poolfracbits)
                 return;
 
-        if (r->limit == 0 && random_min_urandom_seed) {
-                unsigned long now = jiffies;
-
-                if (time_before(now,
-                                r->last_pulled + random_min_urandom_seed * HZ))
-                        return;
-                r->last_pulled = now;
-        }
-
         _xfer_secondary_pool(r, nbytes);
 }
 
@@ -1236,8 +1209,6 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
 {
         __u32   tmp[OUTPUT_POOL_WORDS];
 
-        /* For /dev/random's pool, always leave two wakeups' worth */
-        int rsvd_bytes = r->limit ? 0 : random_read_wakeup_bits / 4;
         int bytes = nbytes;
 
         /* pull at least as much as a wakeup */
@@ -1248,7 +1219,7 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
         trace_xfer_secondary_pool(r->name, bytes * 8, nbytes * 8,
                                   ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
         bytes = extract_entropy(r->pull, tmp, bytes,
-                                random_read_wakeup_bits / 8, rsvd_bytes);
+                                random_read_wakeup_bits / 8, 0);
         mix_pool_bytes(r, tmp, bytes);
         credit_entropy_bits(r, bytes*8);
 }
@@ -1276,7 +1247,7 @@ static void push_to_pool(struct work_struct *work)
 static size_t account(struct entropy_store *r, size_t nbytes, int min,
                       int reserved)
 {
-        int entropy_count, orig;
+        int entropy_count, orig, have_bytes;
         size_t ibytes, nfrac;
 
         BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
@@ -1285,14 +1256,12 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
 retry:
         entropy_count = orig = ACCESS_ONCE(r->entropy_count);
         ibytes = nbytes;
-        /* If limited, never pull more than available */
-        if (r->limit) {
-                int have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
+        /* never pull more than available */
+        have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
 
-                if ((have_bytes -= reserved) < 0)
-                        have_bytes = 0;
-                ibytes = min_t(size_t, ibytes, have_bytes);
-        }
+        if ((have_bytes -= reserved) < 0)
+                have_bytes = 0;
+        ibytes = min_t(size_t, ibytes, have_bytes);
         if (ibytes < min)
                 ibytes = 0;
 
@@ -1912,6 +1881,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
 static int min_read_thresh = 8, min_write_thresh;
 static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
 static int max_write_thresh = INPUT_POOL_WORDS * 32;
+static int random_min_urandom_seed = 60;
 static char sysctl_bootid[16];
 
 /*
@@ -2042,63 +2012,64 @@ struct ctl_table random_table[] = {
 };
 #endif  /* CONFIG_SYSCTL */
 
-static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-
-int random_int_secret_init(void)
-{
-        get_random_bytes(random_int_secret, sizeof(random_int_secret));
-        return 0;
-}
-
-static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-                __aligned(sizeof(unsigned long));
+struct batched_entropy {
+        union {
+                u64 entropy_u64[CHACHA20_BLOCK_SIZE / sizeof(u64)];
+                u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+        };
+        unsigned int position;
+};
 
 /*
- * Get a random word for internal kernel use only. Similar to urandom but
- * with the goal of minimal entropy pool depletion. As a result, the random
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
+ * Get a random word for internal kernel use only. The quality of the random
+ * number is either as good as RDRAND or as good as /dev/urandom, with the
+ * goal of being quite fast and not depleting entropy.
  */
-unsigned int get_random_int(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
+u64 get_random_u64(void)
 {
-        __u32 *hash;
-        unsigned int ret;
+        u64 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_int(&ret))
+#if BITS_PER_LONG == 64
+        if (arch_get_random_long((unsigned long *)&ret))
                 return ret;
+#else
+        if (arch_get_random_long((unsigned long *)&ret) &&
+            arch_get_random_long((unsigned long *)&ret + 1))
+            return ret;
+#endif
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = hash[0];
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u64);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+                extract_crng((u8 *)batch->entropy_u64);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u64[batch->position++];
+        put_cpu_var(batched_entropy_u64);
         return ret;
 }
-EXPORT_SYMBOL(get_random_int);
+EXPORT_SYMBOL(get_random_u64);
 
-/*
- * Same as get_random_int(), but returns unsigned long.
- */
-unsigned long get_random_long(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
+u32 get_random_u32(void)
 {
-        __u32 *hash;
-        unsigned long ret;
+        u32 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_long(&ret))
+        if (arch_get_random_int(&ret))
                 return ret;
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = *(unsigned long *)hash;
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u32);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+                extract_crng((u8 *)batch->entropy_u32);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u32[batch->position++];
+        put_cpu_var(batched_entropy_u32);
         return ret;
 }
-EXPORT_SYMBOL(get_random_long);
+EXPORT_SYMBOL(get_random_u32);
 
 /**
  * randomize_page - Generate a random, page aligned address
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a47543281864..38b9fdf854a4 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2532,4 +2532,5 @@ static int __init cpufreq_core_init(void)
 
         return 0;
 }
+module_param(off, int, 0444);
 core_initcall(cpufreq_core_init);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b1fbaa30ae04..3d37219a0dd7 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -377,6 +377,7 @@ static void intel_pstate_set_performance_limits(struct perf_limits *limits)
         intel_pstate_init_limits(limits);
         limits->min_perf_pct = 100;
         limits->min_perf = int_ext_tofp(1);
+        limits->min_sysfs_pct = 100;
 }
 
 static DEFINE_MUTEX(intel_pstate_driver_lock);
@@ -968,11 +969,20 @@ static int intel_pstate_resume(struct cpufreq_policy *policy)
 }
 
 static void intel_pstate_update_policies(void)
+        __releases(&intel_pstate_limits_lock)
+        __acquires(&intel_pstate_limits_lock)
 {
+        struct perf_limits *saved_limits = limits;
         int cpu;
 
+        mutex_unlock(&intel_pstate_limits_lock);
+
         for_each_possible_cpu(cpu)
                 cpufreq_update_policy(cpu);
+
+        mutex_lock(&intel_pstate_limits_lock);
+
+        limits = saved_limits;
 }
 
 /************************** debugfs begin ************************/
@@ -1180,10 +1190,10 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
 
         limits->no_turbo = clamp_t(int, input, 0, 1);
 
-        mutex_unlock(&intel_pstate_limits_lock);
-
         intel_pstate_update_policies();
 
+        mutex_unlock(&intel_pstate_limits_lock);
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1217,10 +1227,10 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
                                    limits->max_perf_pct);
         limits->max_perf = div_ext_fp(limits->max_perf_pct, 100);
 
-        mutex_unlock(&intel_pstate_limits_lock);
-
         intel_pstate_update_policies();
 
+        mutex_unlock(&intel_pstate_limits_lock);
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1254,10 +1264,10 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
                                    limits->min_perf_pct);
         limits->min_perf = div_ext_fp(limits->min_perf_pct, 100);
 
-        mutex_unlock(&intel_pstate_limits_lock);
-
         intel_pstate_update_policies();
 
+        mutex_unlock(&intel_pstate_limits_lock);
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1874,13 +1884,11 @@ static int intel_pstate_prepare_request(struct cpudata *cpu, int pstate)
 
         intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
         pstate = clamp_t(int, pstate, min_perf, max_perf);
-        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
         return pstate;
 }
 
 static void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
 {
-        pstate = intel_pstate_prepare_request(cpu, pstate);
         if (pstate == cpu->pstate.current_pstate)
                 return;
 
@@ -1900,6 +1908,8 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 
         update_turbo_state();
 
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
+        trace_cpu_frequency(target_pstate * cpu->pstate.scaling, cpu->cpu);
         intel_pstate_update_pstate(cpu, target_pstate);
 
         sample = &cpu->sample;
@@ -2132,16 +2142,11 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         mutex_lock(&intel_pstate_limits_lock);
 
         if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
+                pr_debug("set performance\n");
                 if (!perf_limits) {
                         limits = &performance_limits;
                         perf_limits = limits;
                 }
-                if (policy->max >= policy->cpuinfo.max_freq &&
-                    !limits->no_turbo) {
-                        pr_debug("set performance\n");
-                        intel_pstate_set_performance_limits(perf_limits);
-                        goto out;
-                }
         } else {
                 pr_debug("set powersave\n");
                 if (!perf_limits) {
@@ -2152,7 +2157,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         }
 
         intel_pstate_update_perf_limits(policy, perf_limits);
- out:
+
         if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                 /*
                  * NOHZ_FULL CPUs need this as the governor callback may not
@@ -2198,9 +2203,9 @@ static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
                 unsigned int max_freq, min_freq;
 
                 max_freq = policy->cpuinfo.max_freq *
-                                                limits->max_sysfs_pct / 100;
+                                        perf_limits->max_sysfs_pct / 100;
                 min_freq = policy->cpuinfo.max_freq *
-                                                limits->min_sysfs_pct / 100;
+                                        perf_limits->min_sysfs_pct / 100;
                 cpufreq_verify_within_limits(policy, min_freq, max_freq);
         }
 
@@ -2243,13 +2248,8 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
 
         cpu = all_cpu_data[policy->cpu];
 
-        /*
-         * We need sane value in the cpu->perf_limits, so inherit from global
-         * perf_limits limits, which are seeded with values based on the
-         * CONFIG_CPU_FREQ_DEFAULT_GOV_*, during boot up.
-         */
         if (per_cpu_limits)
-                memcpy(cpu->perf_limits, limits, sizeof(struct perf_limits));
+                intel_pstate_init_limits(cpu->perf_limits);
 
         policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling;
         policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
@@ -2301,7 +2301,6 @@ static struct cpufreq_driver intel_pstate = {
 static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits = limits;
 
         update_turbo_state();
         policy->cpuinfo.max_freq = limits->turbo_disabled ?
@@ -2309,15 +2308,6 @@ static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
 
         cpufreq_verify_within_cpu_limits(policy);
 
-        if (per_cpu_limits)
-                perf_limits = cpu->perf_limits;
-
-        mutex_lock(&intel_pstate_limits_lock);
-
-        intel_pstate_update_perf_limits(policy, perf_limits);
-
-        mutex_unlock(&intel_pstate_limits_lock);
-
         return 0;
 }
 
@@ -2370,6 +2360,7 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
                 wrmsrl_on_cpu(policy->cpu, MSR_IA32_PERF_CTL,
                               pstate_funcs.get_val(cpu, target_pstate));
         }
+        freqs.new = target_pstate * cpu->pstate.scaling;
         cpufreq_freq_transition_end(policy, &freqs, false);
 
         return 0;
@@ -2383,8 +2374,9 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy,
 
         target_freq = intel_cpufreq_turbo_update(cpu, policy, target_freq);
         target_pstate = DIV_ROUND_UP(target_freq, cpu->pstate.scaling);
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
         intel_pstate_update_pstate(cpu, target_pstate);
-        return target_freq;
+        return target_pstate * cpu->pstate.scaling;
 }
 
 static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
@@ -2437,8 +2429,11 @@ static int intel_pstate_register_driver(void)
 
         intel_pstate_init_limits(&powersave_limits);
         intel_pstate_set_performance_limits(&performance_limits);
-        limits = IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE) ?
-                        &performance_limits : &powersave_limits;
+        if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE) &&
+            intel_pstate_driver == &intel_pstate)
+                limits = &performance_limits;
+        else
+                limits = &powersave_limits;
 
         ret = cpufreq_register_driver(intel_pstate_driver);
         if (ret) {
diff --git a/drivers/crypto/ux500/cryp/cryp.c b/drivers/crypto/ux500/cryp/cryp.c
index 43a0c8a26ab0..00a16ab601cb 100644
--- a/drivers/crypto/ux500/cryp/cryp.c
+++ b/drivers/crypto/ux500/cryp/cryp.c
@@ -82,7 +82,7 @@ void cryp_activity(struct cryp_device_data *device_data,
 void cryp_flush_inoutfifo(struct cryp_device_data *device_data)
 {
         /*
-         * We always need to disble the hardware before trying to flush the
+         * We always need to disable the hardware before trying to flush the
          * FIFO. This is something that isn't written in the design
          * specification, but we have been informed by the hardware designers
          * that this must be done.
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 349dc3e1e52e..974c5a31a005 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -65,6 +65,7 @@ static bool __init efi_virtmap_init(void)
         bool systab_found;
 
         efi_mm.pgd = pgd_alloc(&efi_mm);
+        mm_init_cpumask(&efi_mm);
         init_new_context(NULL, &efi_mm);
 
         systab_found = false;
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 6def402bf569..5da36e56b36a 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
         size = sizeof(secboot);
         status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
                              NULL, &size, &secboot);
+        if (status == EFI_NOT_FOUND)
+                return efi_secureboot_mode_disabled;
         if (status != EFI_SUCCESS)
                 goto out_efi_err;
 
@@ -78,7 +80,5 @@ secure_boot_enabled:
 
 out_efi_err:
         pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
-        if (status == EFI_NOT_FOUND)
-                return efi_secureboot_mode_disabled;
         return efi_secureboot_mode_unknown;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 6abb238b25c9..4120b351a8e5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2094,8 +2094,11 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         r = amdgpu_late_init(adev);
-        if (r)
+        if (r) {
+                if (fbcon)
+                        console_unlock();
                 return r;
+        }
 
         /* pin cursors */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 75fc376ba735..f7adbace428a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -59,9 +59,10 @@
  * - 3.7.0 - Add support for VCE clock list packet
  * - 3.8.0 - Add support raster config init in the kernel
  * - 3.9.0 - Add support for memory query info about VRAM and GTT.
+ * - 3.10.0 - Add support for new fences ioctl, new gem ioctl flags
  */
 #define KMS_DRIVER_MAJOR        3
-#define KMS_DRIVER_MINOR        9
+#define KMS_DRIVER_MINOR        10
 #define KMS_DRIVER_PATCHLEVEL   0
 
 int amdgpu_vram_limit = 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 51d759463384..106cf83c2e6b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -202,6 +202,27 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
         bool kernel = false;
         int r;
 
+        /* reject invalid gem flags */
+        if (args->in.domain_flags & ~(AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
+                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS |
+                                      AMDGPU_GEM_CREATE_CPU_GTT_USWC |
+                                      AMDGPU_GEM_CREATE_VRAM_CLEARED|
+                                      AMDGPU_GEM_CREATE_SHADOW |
+                                      AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+        /* reject invalid gem domains */
+        if (args->in.domains & ~(AMDGPU_GEM_DOMAIN_CPU |
+                                 AMDGPU_GEM_DOMAIN_GTT |
+                                 AMDGPU_GEM_DOMAIN_VRAM |
+                                 AMDGPU_GEM_DOMAIN_GDS |
+                                 AMDGPU_GEM_DOMAIN_GWS |
+                                 AMDGPU_GEM_DOMAIN_OA)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+
         /* create a gem object to contain this object in */
         if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |
             AMDGPU_GEM_DOMAIN_GWS | AMDGPU_GEM_DOMAIN_OA)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index 31375bdde6f1..011800f621c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -788,7 +788,7 @@ static int sdma_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        /* disble sdma engine before programing it */
+        /* disable sdma engine before programing it */
         sdma_v3_0_ctx_switch_enable(adev, false);
         sdma_v3_0_enable(adev, false);
 
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c8baab9bee0d..ba58f1b11d1e 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -148,6 +148,9 @@ static const struct edid_quirk {
 
         /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
         { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
+
+        /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
+        { "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
 };
 
 /*
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 4a6a2ed65732..b7d7721e72fa 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -41,6 +41,54 @@ enum {
         INTEL_GVT_PCI_BAR_MAX,
 };
 
+/* bitmap for writable bits (RW or RW1C bits, but cannot co-exist in one
+ * byte) byte by byte in standard pci configuration space. (not the full
+ * 256 bytes.)
+ */
+static const u8 pci_cfg_space_rw_bmp[PCI_INTERRUPT_LINE + 4] = {
+        [PCI_COMMAND]           = 0xff, 0x07,
+        [PCI_STATUS]            = 0x00, 0xf9, /* the only one RW1C byte */
+        [PCI_CACHE_LINE_SIZE]   = 0xff,
+        [PCI_BASE_ADDRESS_0 ... PCI_CARDBUS_CIS - 1] = 0xff,
+        [PCI_ROM_ADDRESS]       = 0x01, 0xf8, 0xff, 0xff,
+        [PCI_INTERRUPT_LINE]    = 0xff,
+};
+
+/**
+ * vgpu_pci_cfg_mem_write - write virtual cfg space memory
+ *
+ * Use this function to write virtual cfg space memory.
+ * For standard cfg space, only RW bits can be changed,
+ * and we emulates the RW1C behavior of PCI_STATUS register.
+ */
+static void vgpu_pci_cfg_mem_write(struct intel_vgpu *vgpu, unsigned int off,
+                                   u8 *src, unsigned int bytes)
+{
+        u8 *cfg_base = vgpu_cfg_space(vgpu);
+        u8 mask, new, old;
+        int i = 0;
+
+        for (; i < bytes && (off + i < sizeof(pci_cfg_space_rw_bmp)); i++) {
+                mask = pci_cfg_space_rw_bmp[off + i];
+                old = cfg_base[off + i];
+                new = src[i] & mask;
+
+                /**
+                 * The PCI_STATUS high byte has RW1C bits, here
+                 * emulates clear by writing 1 for these bits.
+                 * Writing a 0b to RW1C bits has no effect.
+                 */
+                if (off + i == PCI_STATUS + 1)
+                        new = (~new & old) & mask;
+
+                cfg_base[off + i] = (old & ~mask) | new;
+        }
+
+        /* For other configuration space directly copy as it is. */
+        if (i < bytes)
+                memcpy(cfg_base + off + i, src + i, bytes - i);
+}
+
 /**
  * intel_vgpu_emulate_cfg_read - emulate vGPU configuration space read
  *
@@ -123,7 +171,7 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
         u8 changed = old ^ new;
         int ret;
 
-        memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+        vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
         if (!(changed & PCI_COMMAND_MEMORY))
                 return 0;
 
@@ -237,6 +285,9 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
 {
         int ret;
 
+        if (vgpu->failsafe)
+                return 0;
+
         if (WARN_ON(bytes > 4))
                 return -EINVAL;
 
@@ -274,10 +325,10 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
                 if (ret)
                         return ret;
 
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         default:
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         }
         return 0;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index b9c8e2407682..7ae6e2b241c8 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -668,7 +668,7 @@ static inline void print_opcode(u32 cmd, int ring_id)
         if (d_info == NULL)
                 return;
 
-        gvt_err("opcode=0x%x %s sub_ops:",
+        gvt_dbg_cmd("opcode=0x%x %s sub_ops:",
                         cmd >> (32 - d_info->op_len), d_info->name);
 
         for (i = 0; i < d_info->nr_sub_op; i++)
@@ -693,23 +693,23 @@ static void parser_exec_state_dump(struct parser_exec_state *s)
         int cnt = 0;
         int i;
 
-        gvt_err("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
+        gvt_dbg_cmd("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
                         " ring_head(%08lx) ring_tail(%08lx)\n", s->vgpu->id,
                         s->ring_id, s->ring_start, s->ring_start + s->ring_size,
                         s->ring_head, s->ring_tail);
 
-        gvt_err("  %s %s ip_gma(%08lx) ",
+        gvt_dbg_cmd("  %s %s ip_gma(%08lx) ",
                         s->buf_type == RING_BUFFER_INSTRUCTION ?
                         "RING_BUFFER" : "BATCH_BUFFER",
                         s->buf_addr_type == GTT_BUFFER ?
                         "GTT" : "PPGTT", s->ip_gma);
 
         if (s->ip_va == NULL) {
-                gvt_err(" ip_va(NULL)");
+                gvt_dbg_cmd(" ip_va(NULL)");
                 return;
         }
 
-        gvt_err("  ip_va=%p: %08x %08x %08x %08x\n",
+        gvt_dbg_cmd("  ip_va=%p: %08x %08x %08x %08x\n",
                         s->ip_va, cmd_val(s, 0), cmd_val(s, 1),
                         cmd_val(s, 2), cmd_val(s, 3));
 
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 6d8fde880c39..5419ae6ec633 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -83,44 +83,80 @@ static int pipe_is_enabled(struct intel_vgpu *vgpu, int pipe)
         return 0;
 }
 
+static unsigned char virtual_dp_monitor_edid[GVT_EDID_NUM][EDID_SIZE] = {
+        {
+/* EDID with 1024x768 as its resolution */
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /* Standard Timings. All invalid */
+                0x00, 0xc0, 0x00, 0xc0, 0x00, 0x40, 0x00, 0x80, 0x00, 0x00,
+                0x00, 0x40, 0x00, 0x00, 0x00, 0x01,
+                /* 18 Byte Data Blocks 1: invalid */
+                0x00, 0x00, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0xef,
+        },
+        {
 /* EDID with 1920x1200 as its resolution */
-static unsigned char virtual_dp_monitor_edid[] = {
-        /*Header*/
-        0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
-        /* Vendor & Product Identification */
-        0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
-        /* Version & Revision */
-        0x01, 0x04,
-        /* Basic Display Parameters & Features */
-        0xa5, 0x34, 0x20, 0x78, 0x23,
-        /* Color Characteristics */
-        0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
-        /* Established Timings: maximum resolution is 1024x768 */
-        0x21, 0x08, 0x00,
-        /*
-         * Standard Timings.
-         * below new resolutions can be supported:
-         * 1920x1080, 1280x720, 1280x960, 1280x1024,
-         * 1440x900, 1600x1200, 1680x1050
-         */
-        0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
-        0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
-        /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
-        0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
-        0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
-        /* 18 Byte Data Blocks 2: invalid */
-        0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
-        0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-        /* 18 Byte Data Blocks 3: invalid */
-        0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
-        0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
-        /* 18 Byte Data Blocks 4: invalid */
-        0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
-        0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
-        /* Extension Block Count */
-        0x00,
-        /* Checksum */
-        0x45,
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /*
+                 * Standard Timings.
+                 * below new resolutions can be supported:
+                 * 1920x1080, 1280x720, 1280x960, 1280x1024,
+                 * 1440x900, 1600x1200, 1680x1050
+                 */
+                0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
+                0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
+                /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
+                0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0x45,
+        },
 };
 
 #define DPCD_HEADER_SIZE        0xb
@@ -140,14 +176,20 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                 vgpu_vreg(vgpu, SDEISR) &= ~(SDE_PORTA_HOTPLUG_SPT |
                                 SDE_PORTE_HOTPLUG_SPT);
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTB_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIB_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTC_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIC_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTD_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDID_DETECTED;
+        }
 
         if (IS_SKYLAKE(dev_priv) &&
                         intel_vgpu_has_monitor_on_port(vgpu, PORT_E)) {
@@ -160,6 +202,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                                 GEN8_PORT_DP_A_HOTPLUG;
                 else
                         vgpu_vreg(vgpu, SDEISR) |= SDE_PORTA_HOTPLUG_SPT;
+
+                vgpu_vreg(vgpu, DDI_BUF_CTL(PORT_A)) |= DDI_INIT_DISPLAY_DETECTED;
         }
 }
 
@@ -175,10 +219,13 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
 }
 
 static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
-                int type)
+                                    int type, unsigned int resolution)
 {
         struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
 
+        if (WARN_ON(resolution >= GVT_EDID_NUM))
+                return -EINVAL;
+
         port->edid = kzalloc(sizeof(*(port->edid)), GFP_KERNEL);
         if (!port->edid)
                 return -ENOMEM;
@@ -189,7 +236,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
                 return -ENOMEM;
         }
 
-        memcpy(port->edid->edid_block, virtual_dp_monitor_edid,
+        memcpy(port->edid->edid_block, virtual_dp_monitor_edid[resolution],
                         EDID_SIZE);
         port->edid->data_valid = true;
 
@@ -322,16 +369,18 @@ void intel_vgpu_clean_display(struct intel_vgpu *vgpu)
  * Zero on success, negative error code if failed.
  *
  */
-int intel_vgpu_init_display(struct intel_vgpu *vgpu)
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         intel_vgpu_init_i2c_edid(vgpu);
 
         if (IS_SKYLAKE(dev_priv))
-                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D);
+                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D,
+                                                resolution);
         else
-                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B);
+                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B,
+                                                resolution);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/display.h b/drivers/gpu/drm/i915/gvt/display.h
index 8b234ea961f6..d73de22102e2 100644
--- a/drivers/gpu/drm/i915/gvt/display.h
+++ b/drivers/gpu/drm/i915/gvt/display.h
@@ -154,10 +154,28 @@ struct intel_vgpu_port {
         int type;
 };
 
+enum intel_vgpu_edid {
+        GVT_EDID_1024_768,
+        GVT_EDID_1920_1200,
+        GVT_EDID_NUM,
+};
+
+static inline char *vgpu_edid_str(enum intel_vgpu_edid id)
+{
+        switch (id) {
+        case GVT_EDID_1024_768:
+                return "1024x768";
+        case GVT_EDID_1920_1200:
+                return "1920x1200";
+        default:
+                return "";
+        }
+}
+
 void intel_gvt_emulate_vblank(struct intel_gvt *gvt);
 void intel_gvt_check_vblank_emulation(struct intel_gvt *gvt);
 
-int intel_vgpu_init_display(struct intel_vgpu *vgpu);
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution);
 void intel_vgpu_reset_display(struct intel_vgpu *vgpu);
 void intel_vgpu_clean_display(struct intel_vgpu *vgpu);
 
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 1cb29b2d7dc6..933a7c211a1c 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -80,7 +80,7 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         int ret;
 
         size = sizeof(*h) + info->mmio_size + info->cfg_space_size - 1;
-        firmware = vmalloc(size);
+        firmware = vzalloc(size);
         if (!firmware)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 28c92346db0e..6a5ff23ded90 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1825,11 +1825,8 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         gma = g_gtt_index << GTT_PAGE_SHIFT;
 
         /* the VM may configure the whole GM space when ballooning is used */
-        if (WARN_ONCE(!vgpu_gmadr_is_valid(vgpu, gma),
-                                "vgpu%d: found oob ggtt write, offset %x\n",
-                                vgpu->id, off)) {
+        if (!vgpu_gmadr_is_valid(vgpu, gma))
                 return 0;
-        }
 
         ggtt_get_guest_entry(ggtt_mm, &e, g_gtt_index);
 
@@ -2015,6 +2012,22 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         return create_scratch_page_tree(vgpu);
 }
 
+static void intel_vgpu_free_mm(struct intel_vgpu *vgpu, int type)
+{
+        struct list_head *pos, *n;
+        struct intel_vgpu_mm *mm;
+
+        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
+                mm = container_of(pos, struct intel_vgpu_mm, list);
+                if (mm->type == type) {
+                        vgpu->gvt->gtt.mm_free_page_table(mm);
+                        list_del(&mm->list);
+                        list_del(&mm->lru_list);
+                        kfree(mm);
+                }
+        }
+}
+
 /**
  * intel_vgpu_clean_gtt - clean up per-vGPU graphics memory virulization
  * @vgpu: a vGPU
@@ -2027,19 +2040,11 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
  */
 void intel_vgpu_clean_gtt(struct intel_vgpu *vgpu)
 {
-        struct list_head *pos, *n;
-        struct intel_vgpu_mm *mm;
-
         ppgtt_free_all_shadow_page(vgpu);
         release_scratch_page_tree(vgpu);
 
-        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
-                mm = container_of(pos, struct intel_vgpu_mm, list);
-                vgpu->gvt->gtt.mm_free_page_table(mm);
-                list_del(&mm->list);
-                list_del(&mm->lru_list);
-                kfree(mm);
-        }
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_GGTT);
 }
 
 static void clean_spt_oos(struct intel_gvt *gvt)
@@ -2322,6 +2327,13 @@ void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr)
         int i;
 
         ppgtt_free_all_shadow_page(vgpu);
+
+        /* Shadow pages are only created when there is no page
+         * table tracking data, so remove page tracking data after
+         * removing the shadow pages.
+         */
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+
         if (!dmlr)
                 return;
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index e227caf5859e..23791920ced1 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -143,6 +143,8 @@ struct intel_vgpu {
         int id;
         unsigned long handle; /* vGPU handle used by hypervisor MPT modules */
         bool active;
+        bool pv_notified;
+        bool failsafe;
         bool resetting;
         void *sched_data;
 
@@ -203,18 +205,18 @@ struct intel_gvt_firmware {
 };
 
 struct intel_gvt_opregion {
-        void __iomem *opregion_va;
+        void *opregion_va;
         u32 opregion_pa;
 };
 
 #define NR_MAX_INTEL_VGPU_TYPES 20
 struct intel_vgpu_type {
         char name[16];
-        unsigned int max_instance;
         unsigned int avail_instance;
         unsigned int low_gm_size;
         unsigned int high_gm_size;
         unsigned int fence;
+        enum intel_vgpu_edid resolution;
 };
 
 struct intel_gvt {
@@ -317,6 +319,7 @@ struct intel_vgpu_creation_params {
         __u64 low_gm_sz;  /* in MB */
         __u64 high_gm_sz; /* in MB */
         __u64 fence_sz;
+        __u64 resolution;
         __s32 primary;
         __u64 vgpu_id;
 };
@@ -449,6 +452,11 @@ struct intel_gvt_ops {
 };
 
 
+enum {
+        GVT_FAILSAFE_UNSUPPORTED_GUEST,
+        GVT_FAILSAFE_INSUFFICIENT_RESOURCE,
+};
+
 #include "mpt.h"
 
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 1d450627ff65..8e43395c748a 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -121,6 +121,7 @@ static int new_mmio_info(struct intel_gvt *gvt,
                 info->size = size;
                 info->length = (i + 4) < end ? 4 : (end - i);
                 info->addr_mask = addr_mask;
+                info->ro_mask = ro_mask;
                 info->device = device;
                 info->read = read ? read : intel_vgpu_default_mmio_read;
                 info->write = write ? write : intel_vgpu_default_mmio_write;
@@ -150,15 +151,44 @@ static int render_mmio_to_ring_id(struct intel_gvt *gvt, unsigned int reg)
 #define fence_num_to_offset(num) \
         (num * 8 + i915_mmio_reg_offset(FENCE_REG_GEN6_LO(0)))
 
+
+static void enter_failsafe_mode(struct intel_vgpu *vgpu, int reason)
+{
+        switch (reason) {
+        case GVT_FAILSAFE_UNSUPPORTED_GUEST:
+                pr_err("Detected your guest driver doesn't support GVT-g.\n");
+                break;
+        case GVT_FAILSAFE_INSUFFICIENT_RESOURCE:
+                pr_err("Graphics resource is not enough for the guest\n");
+        default:
+                break;
+        }
+        pr_err("Now vgpu %d will enter failsafe mode.\n", vgpu->id);
+        vgpu->failsafe = true;
+}
+
 static int sanitize_fence_mmio_access(struct intel_vgpu *vgpu,
                 unsigned int fence_num, void *p_data, unsigned int bytes)
 {
         if (fence_num >= vgpu_fence_sz(vgpu)) {
-                gvt_err("vgpu%d: found oob fence register access\n",
-                                vgpu->id);
-                gvt_err("vgpu%d: total fence num %d access fence num %d\n",
-                                vgpu->id, vgpu_fence_sz(vgpu), fence_num);
+
+                /* When guest access oob fence regs without access
+                 * pv_info first, we treat guest not supporting GVT,
+                 * and we will let vgpu enter failsafe mode.
+                 */
+                if (!vgpu->pv_notified)
+                        enter_failsafe_mode(vgpu,
+                                        GVT_FAILSAFE_UNSUPPORTED_GUEST);
+
+                if (!vgpu->mmio.disable_warn_untrack) {
+                        gvt_err("vgpu%d: found oob fence register access\n",
+                                        vgpu->id);
+                        gvt_err("vgpu%d: total fence %d, access fence %d\n",
+                                        vgpu->id, vgpu_fence_sz(vgpu),
+                                        fence_num);
+                }
                 memset(p_data, 0, bytes);
+                return -EINVAL;
         }
         return 0;
 }
@@ -369,6 +399,74 @@ static int pipeconf_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
+/* ascendingly sorted */
+static i915_reg_t force_nonpriv_white_list[] = {
+        GEN9_CS_DEBUG_MODE1, //_MMIO(0x20ec)
+        GEN9_CTX_PREEMPT_REG,//_MMIO(0x2248)
+        GEN8_CS_CHICKEN1,//_MMIO(0x2580)
+        _MMIO(0x2690),
+        _MMIO(0x2694),
+        _MMIO(0x2698),
+        _MMIO(0x4de0),
+        _MMIO(0x4de4),
+        _MMIO(0x4dfc),
+        GEN7_COMMON_SLICE_CHICKEN1,//_MMIO(0x7010)
+        _MMIO(0x7014),
+        HDC_CHICKEN0,//_MMIO(0x7300)
+        GEN8_HDC_CHICKEN1,//_MMIO(0x7304)
+        _MMIO(0x7700),
+        _MMIO(0x7704),
+        _MMIO(0x7708),
+        _MMIO(0x770c),
+        _MMIO(0xb110),
+        GEN8_L3SQCREG4,//_MMIO(0xb118)
+        _MMIO(0xe100),
+        _MMIO(0xe18c),
+        _MMIO(0xe48c),
+        _MMIO(0xe5f4),
+};
+
+/* a simple bsearch */
+static inline bool in_whitelist(unsigned int reg)
+{
+        int left = 0, right = ARRAY_SIZE(force_nonpriv_white_list);
+        i915_reg_t *array = force_nonpriv_white_list;
+
+        while (left < right) {
+                int mid = (left + right)/2;
+
+                if (reg > array[mid].reg)
+                        left = mid + 1;
+                else if (reg < array[mid].reg)
+                        right = mid;
+                else
+                        return true;
+        }
+        return false;
+}
+
+static int force_nonpriv_write(struct intel_vgpu *vgpu,
+        unsigned int offset, void *p_data, unsigned int bytes)
+{
+        u32 reg_nonpriv = *(u32 *)p_data;
+        int ret = -EINVAL;
+
+        if ((bytes != 4) || ((offset & (bytes - 1)) != 0)) {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV offset %x(%dB)\n",
+                        vgpu->id, offset, bytes);
+                return ret;
+        }
+
+        if (in_whitelist(reg_nonpriv)) {
+                ret = intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                        bytes);
+        } else {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV write %x\n",
+                        vgpu->id, reg_nonpriv);
+        }
+        return ret;
+}
+
 static int ddi_buf_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -1001,6 +1099,7 @@ static int pvinfo_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
         if (invalid_read)
                 gvt_err("invalid pvinfo read: [%x:%x] = %x\n",
                                 offset, bytes, *(u32 *)p_data);
+        vgpu->pv_notified = true;
         return 0;
 }
 
@@ -1039,7 +1138,7 @@ static int send_display_ready_uevent(struct intel_vgpu *vgpu, int ready)
         char vmid_str[20];
         char display_ready_str[20];
 
-        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d\n", ready);
+        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d", ready);
         env[0] = display_ready_str;
 
         snprintf(vmid_str, 20, "VMID=%d", vgpu->id);
@@ -1078,6 +1177,9 @@ static int pvinfo_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         case _vgtif_reg(execlist_context_descriptor_lo):
         case _vgtif_reg(execlist_context_descriptor_hi):
                 break;
+        case _vgtif_reg(rsv5[0])..._vgtif_reg(rsv5[3]):
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_INSUFFICIENT_RESOURCE);
+                break;
         default:
                 gvt_err("invalid pvinfo write offset %x bytes %x data %x\n",
                                 offset, bytes, data);
@@ -1203,26 +1305,37 @@ static int mailbox_write(struct intel_vgpu *vgpu, unsigned int offset,
         u32 *data0 = &vgpu_vreg(vgpu, GEN6_PCODE_DATA);
 
         switch (cmd) {
-        case 0x6:
-                /**
-                 * "Read memory latency" command on gen9.
-                 * Below memory latency values are read
-                 * from skylake platform.
-                 */
-                if (!*data0)
-                        *data0 = 0x1e1a1100;
-                else
-                        *data0 = 0x61514b3d;
+        case GEN9_PCODE_READ_MEM_LATENCY:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv)) {
+                        /**
+                         * "Read memory latency" command on gen9.
+                         * Below memory latency values are read
+                         * from skylake platform.
+                         */
+                        if (!*data0)
+                                *data0 = 0x1e1a1100;
+                        else
+                                *data0 = 0x61514b3d;
+                }
+                break;
+        case SKL_PCODE_CDCLK_CONTROL:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv))
+                        *data0 = SKL_CDCLK_READY_FOR_CHANGE;
                 break;
-        case 0x5:
+        case GEN6_PCODE_READ_RC6VIDS:
                 *data0 |= 0x1;
                 break;
         }
 
         gvt_dbg_core("VM(%d) write %x to mailbox, return data0 %x\n",
                      vgpu->id, value, *data0);
-
-        value &= ~(1 << 31);
+        /**
+         * PCODE_READY clear means ready for pcode read/write,
+         * PCODE_ERROR_MASK clear means no error happened. In GVT-g we
+         * always emulate as pcode read/write success and ready for access
+         * anytime, since we don't touch real physical registers here.
+         */
+        value &= ~(GEN6_PCODE_READY | GEN6_PCODE_ERROR_MASK);
         return intel_vgpu_default_mmio_write(vgpu, offset, &value, bytes);
 }
 
@@ -1318,6 +1431,17 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         bool enable_execlist;
 
         write_vreg(vgpu, offset, p_data, bytes);
+
+        /* when PPGTT mode enabled, we will check if guest has called
+         * pvinfo, if not, we will treat this guest as non-gvtg-aware
+         * guest, and stop emulating its cfg space, mmio, gtt, etc.
+         */
+        if (((data & _MASKED_BIT_ENABLE(GFX_PPGTT_ENABLE)) ||
+                        (data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE)))
+                        && !vgpu->pv_notified) {
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_UNSUPPORTED_GUEST);
+                return 0;
+        }
         if ((data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE))
                         || (data & _MASKED_BIT_DISABLE(GFX_RUN_LIST_ENABLE))) {
                 enable_execlist = !!(data & GFX_RUN_LIST_ENABLE);
@@ -1400,6 +1524,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_GM(reg, d, r, w) \
         MMIO_F(reg, 4, F_GMADR, 0xFFFFF000, 0, d, r, w)
 
+#define MMIO_GM_RDR(reg, d, r, w) \
+        MMIO_F(reg, 4, F_GMADR | F_CMD_ACCESS, 0xFFFFF000, 0, d, r, w)
+
 #define MMIO_RO(reg, d, f, rm, r, w) \
         MMIO_F(reg, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1419,6 +1546,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_RING_GM(prefix, d, r, w) \
         MMIO_RING_F(prefix, 4, F_GMADR, 0xFFFF0000, 0, d, r, w)
 
+#define MMIO_RING_GM_RDR(prefix, d, r, w) \
+        MMIO_RING_F(prefix, 4, F_GMADR | F_CMD_ACCESS, 0xFFFF0000, 0, d, r, w)
+
 #define MMIO_RING_RO(prefix, d, f, rm, r, w) \
         MMIO_RING_F(prefix, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1427,73 +1557,81 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_RING_DFH(RING_IMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
+        MMIO_RING_DFH(RING_IMR, D_ALL, F_CMD_ACCESS, NULL,
+                intel_vgpu_reg_imr_handler);
 
         MMIO_DFH(SDEIMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
         MMIO_DFH(SDEIER, D_ALL, 0, NULL, intel_vgpu_reg_ier_handler);
         MMIO_DFH(SDEIIR, D_ALL, 0, NULL, intel_vgpu_reg_iir_handler);
         MMIO_D(SDEISR, D_ALL);
 
-        MMIO_RING_D(RING_HWSTAM, D_ALL);
+        MMIO_RING_DFH(RING_HWSTAM, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_GM(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
 
 #define RING_REG(base) (base + 0x28)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x134)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_GM(0x2148, D_ALL, NULL, NULL);
-        MMIO_GM(CCID, D_ALL, NULL, NULL);
-        MMIO_GM(0x12198, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x2148, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(CCID, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x12198, D_ALL, NULL, NULL);
         MMIO_D(GEN7_CXT_SIZE, D_ALL);
 
-        MMIO_RING_D(RING_TAIL, D_ALL);
-        MMIO_RING_D(RING_HEAD, D_ALL);
-        MMIO_RING_D(RING_CTL, D_ALL);
-        MMIO_RING_D(RING_ACTHD, D_ALL);
-        MMIO_RING_GM(RING_START, D_ALL, NULL, NULL);
+        MMIO_RING_DFH(RING_TAIL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_HEAD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_CTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_ACTHD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_START, D_ALL, NULL, NULL);
 
         /* RING MODE */
 #define RING_REG(base) (base + 0x29c)
-        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK, NULL, ring_mode_mmio_write);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
 #undef RING_REG
 
-        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                        NULL, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP_UDW, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(CACHE_MODE_1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-
-        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_D(GAM_ECOCHK, D_ALL);
-        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2124, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0x9030, D_ALL);
-        MMIO_D(0x20a0, D_ALL);
-        MMIO_D(0x2420, D_ALL);
-        MMIO_D(0x2430, D_ALL);
-        MMIO_D(0x2434, D_ALL);
-        MMIO_D(0x2438, D_ALL);
-        MMIO_D(0x243c, D_ALL);
-        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2430, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2434, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2438, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x243c, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0xe100, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_HALF_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* display */
         MMIO_F(0x60220, 0x20, 0, 0, 0, D_ALL, NULL, NULL);
@@ -2022,8 +2160,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(FORCEWAKE_ACK, D_ALL);
         MMIO_D(GEN6_GT_CORE_STATUS, D_ALL);
         MMIO_D(GEN6_GT_THREAD_STATUS_REG, D_ALL);
-        MMIO_D(GTFIFODBG, D_ALL);
-        MMIO_D(GTFIFOCTL, D_ALL);
+        MMIO_DFH(GTFIFODBG, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GTFIFOCTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DH(FORCEWAKE_MT, D_PRE_SKL, NULL, mul_force_wake_write);
         MMIO_DH(FORCEWAKE_ACK_HSW, D_HSW | D_BDW, NULL, NULL);
         MMIO_D(ECOBUS, D_ALL);
@@ -2080,7 +2218,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
 
         MMIO_F(0x4f000, 0x90, 0, 0, 0, D_ALL, NULL, NULL);
 
-        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_SKL);
+        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_BDW);
         MMIO_D(GEN6_PCODE_DATA, D_ALL);
         MMIO_D(0x13812c, D_ALL);
         MMIO_DH(GEN7_ERR_INT, D_ALL, NULL, NULL);
@@ -2159,36 +2297,35 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x1a054, D_ALL);
 
         MMIO_D(0x44070, D_ALL);
-
-        MMIO_D(0x215c, D_HSW_PLUS);
+        MMIO_DFH(0x215c, D_HSW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x12178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_F(0x2290, 8, 0, 0, 0, D_HSW_PLUS, NULL, NULL);
-        MMIO_D(GEN7_OACONTROL, D_HSW);
+        MMIO_F(0x2290, 8, F_CMD_ACCESS, 0, 0, D_HSW_PLUS, NULL, NULL);
+        MMIO_DFH(GEN7_OACONTROL, D_HSW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x2b00, D_BDW_PLUS);
         MMIO_D(0x2360, D_BDW_PLUS);
-        MMIO_F(0x5200, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5240, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5280, 16, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5200, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5240, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5280, 16, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
 
         MMIO_DFH(0x1c17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1c178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(BCS_SWCTRL, D_ALL);
-
-        MMIO_F(HS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(DS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_VERTICES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(VS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_DEPTH_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_DFH(BCS_SWCTRL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_F(HS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(DS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_VERTICES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(VS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_DEPTH_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
         MMIO_DH(0x4260, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4264, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4268, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
@@ -2196,6 +2333,17 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(0x4270, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DFH(0x4094, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
+        MMIO_DFH(ARB_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_BBADDR, D_ALL, NULL, NULL);
+        MMIO_DFH(0x2220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x12220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_1, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2217c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2204,7 +2352,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_DH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL,
+        MMIO_DFH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS, NULL,
                         intel_vgpu_reg_imr_handler);
 
         MMIO_DH(GEN8_GT_IMR(0), D_BDW_PLUS, NULL, intel_vgpu_reg_imr_handler);
@@ -2269,24 +2417,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(GEN8_MASTER_IRQ, D_BDW_PLUS, NULL,
                 intel_vgpu_reg_master_irq_handler);
 
-        MMIO_D(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(0x1c134, D_BDW_PLUS);
-
-        MMIO_D(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS);
-        MMIO_GM(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
-        MMIO_D(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK, NULL, ring_mode_mmio_write);
-        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
-        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
+        MMIO_DFH(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c134, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_GM_RDR(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
+        MMIO_DFH(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
+        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(RING_TIMESTAMP(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_RING_D(RING_ACTHD_UDW, D_BDW_PLUS);
+        MMIO_RING_DFH(RING_ACTHD_UDW, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
 #define RING_REG(base) (base + 0xd0)
         MMIO_RING_F(RING_REG, 4, F_RO, 0,
@@ -2303,13 +2458,16 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x234)
-        MMIO_RING_F(RING_REG, 8, F_RO, 0, ~0, D_BDW_PLUS, NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO, 0, ~0LL, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_F(RING_REG, 8, F_RO | F_CMD_ACCESS, 0, ~0, D_BDW_PLUS,
+                NULL, NULL);
+        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO | F_CMD_ACCESS, 0,
+                ~0LL, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x244)
-        MMIO_RING_D(RING_REG, D_BDW_PLUS);
-        MMIO_D(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
+        MMIO_RING_DFH(RING_REG, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x370)
@@ -2331,6 +2489,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN7_MISCCPCTL, D_BDW_PLUS);
         MMIO_D(0x1c054, D_BDW_PLUS);
 
+        MMIO_DH(GEN6_PCODE_MAILBOX, D_BDW_PLUS, NULL, mailbox_write);
+
         MMIO_D(GEN8_PRIVATE_PAT_LO, D_BDW_PLUS);
         MMIO_D(GEN8_PRIVATE_PAT_HI, D_BDW_PLUS);
 
@@ -2341,14 +2501,14 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 32, 0, 0, 0, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_RING_GM(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
-        MMIO_GM(0x1c080, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
+        MMIO_GM_RDR(RING_HWS_PGA(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
 
         MMIO_DFH(HDC_CHICKEN0, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW_PLUS);
 
         MMIO_D(WM_MISC, D_BDW);
         MMIO_D(BDW_EDP_PSR_BASE, D_BDW);
@@ -2362,27 +2522,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN8_EU_DISABLE1, D_BDW_PLUS);
         MMIO_D(GEN8_EU_DISABLE2, D_BDW_PLUS);
 
-        MMIO_D(0xfdc, D_BDW);
-        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(GEN7_ROW_CHICKEN2, D_BDW_PLUS);
-        MMIO_D(GEN8_UCGCTL6, D_BDW_PLUS);
+        MMIO_D(0xfdc, D_BDW_PLUS);
+        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN7_ROW_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN8_UCGCTL6, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(0xb1f0, D_BDW);
-        MMIO_D(0xb1c0, D_BDW);
+        MMIO_DFH(0xb1f0, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb1c0, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_L3SQCREG4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0xb100, D_BDW);
-        MMIO_D(0xb10c, D_BDW);
+        MMIO_DFH(0xb100, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb10c, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0xb110, D_BDW);
 
-        MMIO_DFH(0x24d0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d8, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24dc, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_F(0x24d0, 48, F_CMD_ACCESS, 0, 0, D_BDW_PLUS,
+                NULL, force_nonpriv_write);
+
+        MMIO_D(0x22040, D_BDW_PLUS);
+        MMIO_D(0x44484, D_BDW_PLUS);
+        MMIO_D(0x4448c, D_BDW_PLUS);
 
-        MMIO_D(0x83a4, D_BDW);
+        MMIO_DFH(0x83a4, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(GEN8_L3_LRA_1_GPGPU, D_BDW_PLUS);
 
-        MMIO_D(0x8430, D_BDW);
+        MMIO_DFH(0x8430, D_BDW, F_CMD_ACCESS, NULL, NULL);
 
         MMIO_D(0x110000, D_BDW_PLUS);
 
@@ -2394,10 +2558,19 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK, NULL, NULL);
-
-        MMIO_D(0x2248, D_BDW);
-
+        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x2248, D_BDW, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0xe220, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe230, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe240, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe260, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe270, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe280, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2a0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2b0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2c0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2420,7 +2593,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(HSW_PWR_WELL_BIOS, D_SKL);
         MMIO_DH(HSW_PWR_WELL_DRIVER, D_SKL, NULL, skl_power_well_ctl_write);
 
-        MMIO_DH(GEN6_PCODE_MAILBOX, D_SKL, NULL, mailbox_write);
         MMIO_D(0xa210, D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2578,16 +2750,16 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_F(0xb020, 0x80, F_CMD_ACCESS, 0, 0, D_SKL, NULL, NULL);
 
         MMIO_D(0xd08, D_SKL);
-        MMIO_D(0x20e0, D_SKL);
-        MMIO_D(0x20ec, D_SKL);
+        MMIO_DFH(0x20e0, D_SKL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x20ec, D_SKL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* TRTT */
-        MMIO_D(0x4de0, D_SKL);
-        MMIO_D(0x4de4, D_SKL);
-        MMIO_D(0x4de8, D_SKL);
-        MMIO_D(0x4dec, D_SKL);
-        MMIO_D(0x4df0, D_SKL);
-        MMIO_DH(0x4df4, D_SKL, NULL, gen9_trtte_write);
+        MMIO_DFH(0x4de0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de4, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de8, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4dec, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df4, D_SKL, F_CMD_ACCESS, NULL, gen9_trtte_write);
         MMIO_DH(0x4dfc, D_SKL, NULL, gen9_trtt_chicken_write);
 
         MMIO_D(0x45008, D_SKL);
@@ -2611,7 +2783,7 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x65f08, D_SKL);
         MMIO_D(0x320f0, D_SKL);
 
-        MMIO_D(_REG_VCS2_EXCC, D_SKL);
+        MMIO_DFH(_REG_VCS2_EXCC, D_SKL, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x70034, D_SKL);
         MMIO_D(0x71034, D_SKL);
         MMIO_D(0x72034, D_SKL);
@@ -2624,6 +2796,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_PLANE_KEYMSK_1(PIPE_C), D_SKL);
 
         MMIO_D(0x44500, D_SKL);
+        MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 0f7f5d97f582..84d801638ede 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -96,10 +96,10 @@ static int gvt_dma_map_iova(struct intel_vgpu *vgpu, kvm_pfn_t pfn,
         struct device *dev = &vgpu->gvt->dev_priv->drm.pdev->dev;
         dma_addr_t daddr;
 
-        page = pfn_to_page(pfn);
-        if (is_error_page(page))
+        if (unlikely(!pfn_valid(pfn)))
                 return -EFAULT;
 
+        page = pfn_to_page(pfn);
         daddr = dma_map_page(dev, page, 0, PAGE_SIZE,
                         PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr))
@@ -295,10 +295,10 @@ static ssize_t description_show(struct kobject *kobj, struct device *dev,
                 return 0;
 
         return sprintf(buf, "low_gm_size: %dMB\nhigh_gm_size: %dMB\n"
-                                "fence: %d\n",
-                                BYTES_TO_MB(type->low_gm_size),
-                                BYTES_TO_MB(type->high_gm_size),
-                                type->fence);
+                       "fence: %d\nresolution: %s\n",
+                       BYTES_TO_MB(type->low_gm_size),
+                       BYTES_TO_MB(type->high_gm_size),
+                       type->fence, vgpu_edid_str(type->resolution));
 }
 
 static MDEV_TYPE_ATTR_RO(available_instances);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 4df078bc5d04..60b698cb8365 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -57,6 +57,58 @@ int intel_vgpu_gpa_to_mmio_offset(struct intel_vgpu *vgpu, u64 gpa)
         (reg >= gvt->device_info.gtt_start_offset \
          && reg < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt))
 
+static void failsafe_emulate_mmio_rw(struct intel_vgpu *vgpu, uint64_t pa,
+                void *p_data, unsigned int bytes, bool read)
+{
+        struct intel_gvt *gvt = NULL;
+        void *pt = NULL;
+        unsigned int offset = 0;
+
+        if (!vgpu || !p_data)
+                return;
+
+        gvt = vgpu->gvt;
+        mutex_lock(&gvt->lock);
+        offset = intel_vgpu_gpa_to_mmio_offset(vgpu, pa);
+        if (reg_is_mmio(gvt, offset)) {
+                if (read)
+                        intel_vgpu_default_mmio_read(vgpu, offset, p_data,
+                                        bytes);
+                else
+                        intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                                        bytes);
+        } else if (reg_is_gtt(gvt, offset) &&
+                        vgpu->gtt.ggtt_mm->virtual_page_table) {
+                offset -= gvt->device_info.gtt_start_offset;
+                pt = vgpu->gtt.ggtt_mm->virtual_page_table + offset;
+                if (read)
+                        memcpy(p_data, pt, bytes);
+                else
+                        memcpy(pt, p_data, bytes);
+
+        } else if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
+                struct intel_vgpu_guest_page *gp;
+
+                /* Since we enter the failsafe mode early during guest boot,
+                 * guest may not have chance to set up its ppgtt table, so
+                 * there should not be any wp pages for guest. Keep the wp
+                 * related code here in case we need to handle it in furture.
+                 */
+                gp = intel_vgpu_find_guest_page(vgpu, pa >> PAGE_SHIFT);
+                if (gp) {
+                        /* remove write protection to prevent furture traps */
+                        intel_vgpu_clean_guest_page(vgpu, gp);
+                        if (read)
+                                intel_gvt_hypervisor_read_gpa(vgpu, pa,
+                                                p_data, bytes);
+                        else
+                                intel_gvt_hypervisor_write_gpa(vgpu, pa,
+                                                p_data, bytes);
+                }
+        }
+        mutex_unlock(&gvt->lock);
+}
+
 /**
  * intel_vgpu_emulate_mmio_read - emulate MMIO read
  * @vgpu: a vGPU
@@ -75,6 +127,11 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         unsigned int offset = 0;
         int ret = -EINVAL;
 
+
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, true);
+                return 0;
+        }
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -188,6 +245,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
         u32 old_vreg = 0, old_sreg = 0;
         int ret = -EINVAL;
 
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, false);
+                return 0;
+        }
+
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -236,7 +298,7 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
         mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
         if (!mmio && !vgpu->mmio.disable_warn_untrack)
-                gvt_err("vgpu%d: write untracked MMIO %x len %d val %x\n",
+                gvt_dbg_mmio("vgpu%d: write untracked MMIO %x len %d val %x\n",
                                 vgpu->id, offset, bytes, *(u32 *)p_data);
 
         if (!intel_gvt_mmio_is_unalign(gvt, offset)) {
@@ -322,6 +384,8 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu)
 
         /* set the bit 0:2(Core C-State ) to C0 */
         vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
+
+        vgpu->mmio.disable_warn_untrack = false;
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index d9fb41ab7119..5d1caf9daba9 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -27,7 +27,6 @@
 
 static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
 {
-        void __iomem *host_va = vgpu->gvt->opregion.opregion_va;
         u8 *buf;
         int i;
 
@@ -43,8 +42,8 @@ static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
         if (!vgpu_opregion(vgpu)->va)
                 return -ENOMEM;
 
-        memcpy_fromio(vgpu_opregion(vgpu)->va, host_va,
-                        INTEL_GVT_OPREGION_SIZE);
+        memcpy(vgpu_opregion(vgpu)->va, vgpu->gvt->opregion.opregion_va,
+               INTEL_GVT_OPREGION_SIZE);
 
         for (i = 0; i < INTEL_GVT_OPREGION_PAGES; i++)
                 vgpu_opregion(vgpu)->gfn[i] = (gpa >> PAGE_SHIFT) + i;
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index 2b3a642284b6..73f052a4f424 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -53,6 +53,14 @@ static struct render_mmio gen8_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
@@ -76,6 +84,14 @@ static struct render_mmio gen9_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index d6b6d0efdd1a..d3a56c949025 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -139,6 +139,9 @@ static int shadow_context_status_change(struct notifier_block *nb,
         struct intel_vgpu_workload *workload =
                 scheduler->current_workload[req->engine->id];
 
+        if (unlikely(!workload))
+                return NOTIFY_OK;
+
         switch (action) {
         case INTEL_CONTEXT_SCHEDULE_IN:
                 intel_gvt_load_render_mmio(workload->vgpu,
@@ -148,6 +151,15 @@ static int shadow_context_status_change(struct notifier_block *nb,
         case INTEL_CONTEXT_SCHEDULE_OUT:
                 intel_gvt_restore_render_mmio(workload->vgpu,
                                               workload->ring_id);
+                /* If the status is -EINPROGRESS means this workload
+                 * doesn't meet any issue during dispatching so when
+                 * get the SCHEDULE_OUT set the status to be zero for
+                 * good. If the status is NOT -EINPROGRESS means there
+                 * is something wrong happened during dispatching and
+                 * the status should not be set to zero
+                 */
+                if (workload->status == -EINPROGRESS)
+                        workload->status = 0;
                 atomic_set(&workload->shadow_ctx_active, 0);
                 break;
         default:
@@ -359,15 +371,23 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
         workload = scheduler->current_workload[ring_id];
         vgpu = workload->vgpu;
 
-        if (!workload->status && !vgpu->resetting) {
+        /* For the workload w/ request, needs to wait for the context
+         * switch to make sure request is completed.
+         * For the workload w/o request, directly complete the workload.
+         */
+        if (workload->req) {
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
-                update_guest_context(workload);
+                i915_gem_request_put(fetch_and_zero(&workload->req));
+
+                if (!workload->status && !vgpu->resetting) {
+                        update_guest_context(workload);
 
-                for_each_set_bit(event, workload->pending_events,
-                                 INTEL_GVT_EVENT_MAX)
-                        intel_vgpu_trigger_virtual_event(vgpu, event);
+                        for_each_set_bit(event, workload->pending_events,
+                                         INTEL_GVT_EVENT_MAX)
+                                intel_vgpu_trigger_virtual_event(vgpu, event);
+                }
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -397,7 +417,6 @@ static int workload_thread(void *priv)
         int ring_id = p->ring_id;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload = NULL;
-        long lret;
         int ret;
         bool need_force_wake = IS_SKYLAKE(gvt->dev_priv);
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
@@ -446,23 +465,24 @@ static int workload_thread(void *priv)
 
                 gvt_dbg_sched("ring id %d wait workload %p\n",
                                 workload->ring_id, workload);
-
-                lret = i915_wait_request(workload->req,
+retry:
+                i915_wait_request(workload->req,
                                          0, MAX_SCHEDULE_TIMEOUT);
-                if (lret < 0) {
-                        workload->status = lret;
-                        gvt_err("fail to wait workload, skip\n");
-                } else {
-                        workload->status = 0;
+                /* I915 has replay mechanism and a request will be replayed
+                 * if there is i915 reset. So the seqno will be updated anyway.
+                 * If the seqno is not updated yet after waiting, which means
+                 * the replay may still be in progress and we can wait again.
+                 */
+                if (!i915_gem_request_completed(workload->req)) {
+                        gvt_dbg_sched("workload %p not completed, wait again\n",
+                                        workload);
+                        goto retry;
                 }
 
 complete:
                 gvt_dbg_sched("will complete workload %p, status: %d\n",
                                 workload, workload->status);
 
-                if (workload->req)
-                        i915_gem_request_put(fetch_and_zero(&workload->req));
-
                 complete_current_workload(gvt, ring_id);
 
                 if (need_force_wake)
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 95a97aa0051e..41cfa5ccae84 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -64,6 +64,20 @@ void populate_pvinfo_page(struct intel_vgpu *vgpu)
         WARN_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 }
 
+static struct {
+        unsigned int low_mm;
+        unsigned int high_mm;
+        unsigned int fence;
+        enum intel_vgpu_edid edid;
+        char *name;
+} vgpu_types[] = {
+/* Fixed vGPU type table */
+        { MB_TO_BYTES(64), MB_TO_BYTES(512), 4, GVT_EDID_1024_768, "8" },
+        { MB_TO_BYTES(128), MB_TO_BYTES(512), 4, GVT_EDID_1920_1200, "4" },
+        { MB_TO_BYTES(256), MB_TO_BYTES(1024), 4, GVT_EDID_1920_1200, "2" },
+        { MB_TO_BYTES(512), MB_TO_BYTES(2048), 4, GVT_EDID_1920_1200, "1" },
+};
+
 /**
  * intel_gvt_init_vgpu_types - initialize vGPU type list
  * @gvt : GVT device
@@ -78,9 +92,8 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
         unsigned int min_low;
 
         /* vGPU type name is defined as GVTg_Vx_y which contains
-         * physical GPU generation type and 'y' means maximum vGPU
-         * instances user can create on one physical GPU for this
-         * type.
+         * physical GPU generation type (e.g V4 as BDW server, V5 as
+         * SKL server).
          *
          * Depend on physical SKU resource, might see vGPU types like
          * GVTg_V4_8, GVTg_V4_4, GVTg_V4_2, etc. We can create
@@ -92,7 +105,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
          */
         low_avail = gvt_aperture_sz(gvt) - HOST_LOW_GM_SIZE;
         high_avail = gvt_hidden_sz(gvt) - HOST_HIGH_GM_SIZE;
-        num_types = 4;
+        num_types = sizeof(vgpu_types) / sizeof(vgpu_types[0]);
 
         gvt->types = kzalloc(num_types * sizeof(struct intel_vgpu_type),
                              GFP_KERNEL);
@@ -101,28 +114,29 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
 
         min_low = MB_TO_BYTES(32);
         for (i = 0; i < num_types; ++i) {
-                if (low_avail / min_low == 0)
+                if (low_avail / vgpu_types[i].low_mm == 0)
                         break;
-                gvt->types[i].low_gm_size = min_low;
-                gvt->types[i].high_gm_size = max((min_low<<3), MB_TO_BYTES(384U));
-                gvt->types[i].fence = 4;
-                gvt->types[i].max_instance = min(low_avail / min_low,
-                                                 high_avail / gvt->types[i].high_gm_size);
-                gvt->types[i].avail_instance = gvt->types[i].max_instance;
+
+                gvt->types[i].low_gm_size = vgpu_types[i].low_mm;
+                gvt->types[i].high_gm_size = vgpu_types[i].high_mm;
+                gvt->types[i].fence = vgpu_types[i].fence;
+                gvt->types[i].resolution = vgpu_types[i].edid;
+                gvt->types[i].avail_instance = min(low_avail / vgpu_types[i].low_mm,
+                                                   high_avail / vgpu_types[i].high_mm);
 
                 if (IS_GEN8(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V4_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V4_%s",
+                                                vgpu_types[i].name);
                 else if (IS_GEN9(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V5_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V5_%s",
+                                                vgpu_types[i].name);
 
-                min_low <<= 1;
-                gvt_dbg_core("type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                             i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("type[%d]: %s avail %u low %u high %u fence %u res %s\n",
+                             i, gvt->types[i].name,
                              gvt->types[i].avail_instance,
                              gvt->types[i].low_gm_size,
-                             gvt->types[i].high_gm_size, gvt->types[i].fence);
+                             gvt->types[i].high_gm_size, gvt->types[i].fence,
+                             vgpu_edid_str(gvt->types[i].resolution));
         }
 
         gvt->num_types = i;
@@ -138,7 +152,7 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
 {
         int i;
         unsigned int low_gm_avail, high_gm_avail, fence_avail;
-        unsigned int low_gm_min, high_gm_min, fence_min, total_min;
+        unsigned int low_gm_min, high_gm_min, fence_min;
 
         /* Need to depend on maxium hw resource size but keep on
          * static config for now.
@@ -154,12 +168,11 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
                 low_gm_min = low_gm_avail / gvt->types[i].low_gm_size;
                 high_gm_min = high_gm_avail / gvt->types[i].high_gm_size;
                 fence_min = fence_avail / gvt->types[i].fence;
-                total_min = min(min(low_gm_min, high_gm_min), fence_min);
-                gvt->types[i].avail_instance = min(gvt->types[i].max_instance,
-                                                   total_min);
+                gvt->types[i].avail_instance = min(min(low_gm_min, high_gm_min),
+                                                   fence_min);
 
-                gvt_dbg_core("update type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                       i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("update type[%d]: %s avail %u low %u high %u fence %u\n",
+                       i, gvt->types[i].name,
                        gvt->types[i].avail_instance, gvt->types[i].low_gm_size,
                        gvt->types[i].high_gm_size, gvt->types[i].fence);
         }
@@ -248,7 +261,7 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_detach_hypervisor_vgpu;
 
-        ret = intel_vgpu_init_display(vgpu);
+        ret = intel_vgpu_init_display(vgpu, param->resolution);
         if (ret)
                 goto out_clean_gtt;
 
@@ -312,6 +325,7 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
         param.low_gm_sz = type->low_gm_size;
         param.high_gm_sz = type->high_gm_size;
         param.fence_sz = type->fence;
+        param.resolution = type->resolution;
 
         /* XXX current param based on MB */
         param.low_gm_sz = BYTES_TO_MB(param.low_gm_sz);
@@ -387,8 +401,12 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 populate_pvinfo_page(vgpu);
                 intel_vgpu_reset_display(vgpu);
 
-                if (dmlr)
+                if (dmlr) {
                         intel_vgpu_reset_cfg_space(vgpu);
+                        /* only reset the failsafe mode when dmlr reset */
+                        vgpu->failsafe = false;
+                        vgpu->pv_notified = false;
+                }
         }
 
         vgpu->resetting = false;
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index e10a4eda4078..1144e0c9e894 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -65,13 +65,11 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         switch (format) {
         case DRM_FORMAT_RGB565:
                 dev_dbg(drm->dev, "Setting up RGB565 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(0);
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0xf);
                 break;
         case DRM_FORMAT_XRGB8888:
                 dev_dbg(drm->dev, "Setting up XRGB8888 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(3);
                 /* Do not use packed pixels = one pixel per word instead. */
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0x7);
@@ -87,6 +85,36 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         return 0;
 }
 
+static void mxsfb_set_bus_fmt(struct mxsfb_drm_private *mxsfb)
+{
+        struct drm_crtc *crtc = &mxsfb->pipe.crtc;
+        struct drm_device *drm = crtc->dev;
+        u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
+        u32 reg;
+
+        reg = readl(mxsfb->base + LCDC_CTRL);
+
+        if (mxsfb->connector.display_info.num_bus_formats)
+                bus_format = mxsfb->connector.display_info.bus_formats[0];
+
+        reg &= ~CTRL_BUS_WIDTH_MASK;
+        switch (bus_format) {
+        case MEDIA_BUS_FMT_RGB565_1X16:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB666_1X18:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_18BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB888_1X24:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
+                break;
+        default:
+                dev_err(drm->dev, "Unknown media bus format %d\n", bus_format);
+                break;
+        }
+        writel(reg, mxsfb->base + LCDC_CTRL);
+}
+
 static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
 {
         u32 reg;
@@ -168,13 +196,22 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                 vdctrl0 |= VDCTRL0_HSYNC_ACT_HIGH;
         if (m->flags & DRM_MODE_FLAG_PVSYNC)
                 vdctrl0 |= VDCTRL0_VSYNC_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_DE_HIGH)
+        /* Make sure Data Enable is high active by default */
+        if (!(bus_flags & DRM_BUS_FLAG_DE_LOW))
                 vdctrl0 |= VDCTRL0_ENABLE_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_PIXDATA_NEGEDGE)
+        /*
+         * DRM_BUS_FLAG_PIXDATA_ defines are controller centric,
+         * controllers VDCTRL0_DOTCLK is display centric.
+         * Drive on positive edge       -> display samples on falling edge
+         * DRM_BUS_FLAG_PIXDATA_POSEDGE -> VDCTRL0_DOTCLK_ACT_FALLING
+         */
+        if (bus_flags & DRM_BUS_FLAG_PIXDATA_POSEDGE)
                 vdctrl0 |= VDCTRL0_DOTCLK_ACT_FALLING;
 
         writel(vdctrl0, mxsfb->base + LCDC_VDCTRL0);
 
+        mxsfb_set_bus_fmt(mxsfb);
+
         /* Frame length in lines. */
         writel(m->crtc_vtotal, mxsfb->base + LCDC_VDCTRL1);
 
@@ -184,8 +221,8 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                VDCTRL2_SET_HSYNC_PERIOD(m->crtc_htotal),
                mxsfb->base + LCDC_VDCTRL2);
 
-        writel(SET_HOR_WAIT_CNT(m->crtc_hblank_end - m->crtc_hsync_end) |
-               SET_VERT_WAIT_CNT(m->crtc_vblank_end - m->crtc_vsync_end),
+        writel(SET_HOR_WAIT_CNT(m->crtc_htotal - m->crtc_hsync_start) |
+               SET_VERT_WAIT_CNT(m->crtc_vtotal - m->crtc_vsync_start),
                mxsfb->base + LCDC_VDCTRL3);
 
         writel(SET_DOTCLK_H_VALID_DATA_CNT(m->hdisplay),
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index cdfbe0284635..ff6d6a6f842e 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -102,14 +102,18 @@ static void mxsfb_pipe_enable(struct drm_simple_display_pipe *pipe,
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_prepare(mxsfb->panel);
         mxsfb_crtc_enable(mxsfb);
+        drm_panel_enable(mxsfb->panel);
 }
 
 static void mxsfb_pipe_disable(struct drm_simple_display_pipe *pipe)
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_disable(mxsfb->panel);
         mxsfb_crtc_disable(mxsfb);
+        drm_panel_unprepare(mxsfb->panel);
 }
 
 static void mxsfb_pipe_update(struct drm_simple_display_pipe *pipe,
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_out.c b/drivers/gpu/drm/mxsfb/mxsfb_out.c
index fa8d17399407..b8e81422d4e2 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_out.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_out.c
@@ -112,6 +112,7 @@ static int mxsfb_attach_endpoint(struct drm_device *drm,
 
 int mxsfb_create_output(struct drm_device *drm)
 {
+        struct mxsfb_drm_private *mxsfb = drm->dev_private;
         struct device_node *ep_np = NULL;
         struct of_endpoint ep;
         int ret;
@@ -127,5 +128,8 @@ int mxsfb_create_output(struct drm_device *drm)
                 }
         }
 
+        if (!mxsfb->panel)
+                return -EPROBE_DEFER;
+
         return 0;
 }
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
index 31d62cd0d3d7..66a6ba9ec533 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
@@ -44,6 +44,7 @@
 #define CTRL_DATA_SELECT                (1 << 16)
 #define CTRL_SET_BUS_WIDTH(x)           (((x) & 0x3) << 10)
 #define CTRL_GET_BUS_WIDTH(x)           (((x) >> 10) & 0x3)
+#define CTRL_BUS_WIDTH_MASK             (0x3 << 10)
 #define CTRL_SET_WORD_LENGTH(x)         (((x) & 0x3) << 8)
 #define CTRL_GET_WORD_LENGTH(x)         (((x) >> 8) & 0x3)
 #define CTRL_MASTER                     (1 << 5)
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
index b5bfbe50bd87..b0ff304ce3dc 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
@@ -32,6 +32,10 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
 {
         const struct drm_display_mode *mode = &crtc->crtc.state->adjusted_mode;
         struct rcar_du_device *rcdu = crtc->group->dev;
+        struct vsp1_du_lif_config cfg = {
+                .width = mode->hdisplay,
+                .height = mode->vdisplay,
+        };
         struct rcar_du_plane_state state = {
                 .state = {
                         .crtc = &crtc->crtc,
@@ -66,12 +70,12 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
          */
         crtc->group->need_restart = true;
 
-        vsp1_du_setup_lif(crtc->vsp->vsp, mode->hdisplay, mode->vdisplay);
+        vsp1_du_setup_lif(crtc->vsp->vsp, &cfg);
 }
 
 void rcar_du_vsp_disable(struct rcar_du_crtc *crtc)
 {
-        vsp1_du_setup_lif(crtc->vsp->vsp, 0, 0);
+        vsp1_du_setup_lif(crtc->vsp->vsp, NULL);
 }
 
 void rcar_du_vsp_atomic_begin(struct rcar_du_crtc *crtc)
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 81a80c82f1bd..bd0d1988feb2 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -543,7 +543,7 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
         /*
          * In case a device driver's probe() fails (e.g.,
          * util_probe() -> vmbus_open() returns -ENOMEM) and the device is
-         * rescinded later (e.g., we dynamically disble an Integrated Service
+         * rescinded later (e.g., we dynamically disable an Integrated Service
          * in Hyper-V Manager), the driver's remove() invokes vmbus_close():
          * here we should skip most of the below cleanup work.
          */
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 0652281662a8..78792b4d6437 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -465,6 +465,7 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
         u8 *tmp_buf;
         int len = 0;
         int xfersz = brcmstb_i2c_get_xfersz(dev);
+        u32 cond, cond_per_msg;
 
         if (dev->is_suspended)
                 return -EBUSY;
@@ -481,10 +482,11 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         pmsg->buf ? pmsg->buf[0] : '0', pmsg->len);
 
                 if (i < (num - 1) && (msgs[i + 1].flags & I2C_M_NOSTART))
-                        brcmstb_set_i2c_start_stop(dev, ~(COND_START_STOP));
+                        cond = ~COND_START_STOP;
                 else
-                        brcmstb_set_i2c_start_stop(dev,
-                                                   COND_RESTART | COND_NOSTOP);
+                        cond = COND_RESTART | COND_NOSTOP;
+
+                brcmstb_set_i2c_start_stop(dev, cond);
 
                 /* Send slave address */
                 if (!(pmsg->flags & I2C_M_NOSTART)) {
@@ -497,13 +499,24 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         }
                 }
 
+                cond_per_msg = cond;
+
                 /* Perform data transfer */
                 while (len) {
                         bytes_to_xfer = min(len, xfersz);
 
-                        if (len <= xfersz && i == (num - 1))
-                                brcmstb_set_i2c_start_stop(dev,
-                                                           ~(COND_START_STOP));
+                        if (len <= xfersz) {
+                                if (i == (num - 1))
+                                        cond_per_msg = cond_per_msg &
+                                                ~(COND_RESTART | COND_NOSTOP);
+                                else
+                                        cond_per_msg = cond;
+                        } else {
+                                cond_per_msg = (cond_per_msg & ~COND_RESTART) |
+                                        COND_NOSTOP;
+                        }
+
+                        brcmstb_set_i2c_start_stop(dev, cond_per_msg);
 
                         rc = brcmstb_i2c_xfer_bsc_data(dev, tmp_buf,
                                                        bytes_to_xfer, pmsg);
@@ -512,6 +525,8 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
 
                         len -=  bytes_to_xfer;
                         tmp_buf += bytes_to_xfer;
+
+                        cond_per_msg = COND_NOSTART | COND_NOSTOP;
                 }
         }
 
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index c1db3a5a340f..d9aaf1790e0e 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -88,6 +88,7 @@ struct dw_i2c_dev {
         void __iomem            *base;
         struct completion       cmd_complete;
         struct clk              *clk;
+        struct reset_control    *rst;
         u32                     (*get_clk_rate_khz) (struct dw_i2c_dev *dev);
         struct dw_pci_controller *controller;
         int                     cmd_err;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 6ce431323125..79c4b4ea0539 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -38,6 +38,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/property.h>
 #include <linux/io.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/platform_data/i2c-designware.h>
@@ -199,6 +200,14 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         dev->irq = irq;
         platform_set_drvdata(pdev, dev);
 
+        dev->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL);
+        if (IS_ERR(dev->rst)) {
+                if (PTR_ERR(dev->rst) == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+        } else {
+                reset_control_deassert(dev->rst);
+        }
+
         if (pdata) {
                 dev->clk_freq = pdata->i2c_scl_freq;
         } else {
@@ -235,12 +244,13 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
             && dev->clk_freq != 1000000 && dev->clk_freq != 3400000) {
                 dev_err(&pdev->dev,
                         "Only 100kHz, 400kHz, 1MHz and 3.4MHz supported");
-                return -EINVAL;
+                r = -EINVAL;
+                goto exit_reset;
         }
 
         r = i2c_dw_eval_lock_support(dev);
         if (r)
-                return r;
+                goto exit_reset;
 
         dev->functionality = I2C_FUNC_10BIT_ADDR | DW_IC_DEFAULT_FUNCTIONALITY;
 
@@ -286,10 +296,18 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         }
 
         r = i2c_dw_probe(dev);
-        if (r && !dev->pm_runtime_disabled)
-                pm_runtime_disable(&pdev->dev);
+        if (r)
+                goto exit_probe;
 
         return r;
+
+exit_probe:
+        if (!dev->pm_runtime_disabled)
+                pm_runtime_disable(&pdev->dev);
+exit_reset:
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
+        return r;
 }
 
 static int dw_i2c_plat_remove(struct platform_device *pdev)
@@ -306,6 +324,8 @@ static int dw_i2c_plat_remove(struct platform_device *pdev)
         pm_runtime_put_sync(&pdev->dev);
         if (!dev->pm_runtime_disabled)
                 pm_runtime_disable(&pdev->dev);
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
index cbd93ce0661f..736a82472101 100644
--- a/drivers/i2c/busses/i2c-exynos5.c
+++ b/drivers/i2c/busses/i2c-exynos5.c
@@ -457,7 +457,6 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
 
         int_status = readl(i2c->regs + HSI2C_INT_STATUS);
         writel(int_status, i2c->regs + HSI2C_INT_STATUS);
-        trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
 
         /* handle interrupt related to the transfer status */
         if (i2c->variant->hw == HSI2C_EXYNOS7) {
@@ -482,11 +481,13 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
                         goto stop;
                 }
 
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if ((trans_status & HSI2C_MASTER_ST_MASK) == HSI2C_MASTER_ST_LOSE) {
                         i2c->state = -EAGAIN;
                         goto stop;
                 }
         } else if (int_status & HSI2C_INT_I2C) {
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if (trans_status & HSI2C_NO_DEV_ACK) {
                         dev_dbg(i2c->dev, "No ACK from device\n");
                         i2c->state = -ENXIO;
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 2aa61bbbd307..73b97c71a484 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char *buf, int len)
                 wdata1 |= *buf++ << ((i - 4) * 8);
 
         writel(wdata0, i2c->regs + REG_TOK_WDATA0);
-        writel(wdata0, i2c->regs + REG_TOK_WDATA1);
+        writel(wdata1, i2c->regs + REG_TOK_WDATA1);
 
         dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
                 wdata0, wdata1, len);
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 4a7d9bc2142b..45d61714c81b 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -172,14 +172,6 @@ static const struct i2c_adapter_quirks mt6577_i2c_quirks = {
         .max_comb_2nd_msg_len = 31,
 };
 
-static const struct i2c_adapter_quirks mt8173_i2c_quirks = {
-        .max_num_msgs = 65535,
-        .max_write_len = 65535,
-        .max_read_len = 65535,
-        .max_comb_1st_msg_len = 65535,
-        .max_comb_2nd_msg_len = 65535,
-};
-
 static const struct mtk_i2c_compatible mt6577_compat = {
         .quirks = &mt6577_i2c_quirks,
         .pmic_i2c = 0,
@@ -199,7 +191,6 @@ static const struct mtk_i2c_compatible mt6589_compat = {
 };
 
 static const struct mtk_i2c_compatible mt8173_compat = {
-        .quirks = &mt8173_i2c_quirks,
         .pmic_i2c = 0,
         .dcm = 1,
         .auto_restart = 1,
diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c
index 8f11d347b3ec..c811af4c8d81 100644
--- a/drivers/i2c/busses/i2c-riic.c
+++ b/drivers/i2c/busses/i2c-riic.c
@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data)
         }
 
         if (riic->is_last || riic->err) {
-                riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+                riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER);
                 writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+        } else {
+                /* Transfer is complete, but do not send STOP */
+                riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER);
+                complete(&riic->msg_done);
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 83768e85a919..2178266bca79 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -429,6 +429,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
         while (muxc->num_adapters) {
                 struct i2c_adapter *adap = muxc->adapter[--muxc->num_adapters];
                 struct i2c_mux_priv *priv = adap->algo_data;
+                struct device_node *np = adap->dev.of_node;
 
                 muxc->adapter[muxc->num_adapters] = NULL;
 
@@ -438,6 +439,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
 
                 sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
                 i2c_del_adapter(adap);
+                of_node_put(np);
                 kfree(priv);
         }
 }
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index 1eef56a89b1f..f96601268f71 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = {
 
 static int __init crossbar_of_init(struct device_node *node)
 {
-        int i, size, max = 0, reserved = 0, entry;
+        u32 max = 0, entry, reg_size;
+        int i, size, reserved = 0;
         const __be32 *irqsr;
         int ret = -ENOMEM;
 
@@ -275,9 +276,9 @@ static int __init crossbar_of_init(struct device_node *node)
         if (!cb->register_offsets)
                 goto err_irq_map;
 
-        of_property_read_u32(node, "ti,reg-size", &size);
+        of_property_read_u32(node, "ti,reg-size", &reg_size);
 
-        switch (size) {
+        switch (reg_size) {
         case 1:
                 cb->write = crossbar_writeb;
                 break;
@@ -303,7 +304,7 @@ static int __init crossbar_of_init(struct device_node *node)
                         continue;
 
                 cb->register_offsets[i] = reserved;
-                reserved += size;
+                reserved += reg_size;
         }
 
         of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 23201004fd7a..f77f840d2b5f 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1601,6 +1601,14 @@ static void __maybe_unused its_enable_quirk_cavium_23144(void *data)
         its->flags |= ITS_FLAGS_WORKAROUND_CAVIUM_23144;
 }
 
+static void __maybe_unused its_enable_quirk_qdf2400_e0065(void *data)
+{
+        struct its_node *its = data;
+
+        /* On QDF2400, the size of the ITE is 16Bytes */
+        its->ite_size = 16;
+}
+
 static const struct gic_quirk its_quirks[] = {
 #ifdef CONFIG_CAVIUM_ERRATUM_22375
         {
@@ -1618,6 +1626,14 @@ static const struct gic_quirk its_quirks[] = {
                 .init   = its_enable_quirk_cavium_23144,
         },
 #endif
+#ifdef CONFIG_QCOM_QDF2400_ERRATUM_0065
+        {
+                .desc   = "ITS: QDF2400 erratum 0065",
+                .iidr   = 0x00001070, /* QDF2400 ITS rev 1.x */
+                .mask   = 0xffffffff,
+                .init   = its_enable_quirk_qdf2400_e0065,
+        },
+#endif
         {
         }
 };
diff --git a/drivers/isdn/hisax/st5481_b.c b/drivers/isdn/hisax/st5481_b.c
index 409849165838..f64a36007800 100644
--- a/drivers/isdn/hisax/st5481_b.c
+++ b/drivers/isdn/hisax/st5481_b.c
@@ -239,7 +239,7 @@ static void st5481B_mode(struct st5481_bcs *bcs, int mode)
                         }
                 }
         } else {
-                // Disble B channel interrupts
+                // Disable B channel interrupts
                 st5481_usb_device_ctrl_msg(adapter, FFMSK_B1+(bcs->channel * 2), 0, NULL, NULL);
 
                 // Disable B channel FIFOs
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index a126919ed102..5d13930f0f22 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -4,7 +4,6 @@
 
 #include <linux/blkdev.h>
 #include <linux/errno.h>
-#include <linux/blkdev.h>
 #include <linux/kernel.h>
 #include <linux/sched/clock.h>
 #include <linux/llist.h>
diff --git a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
index 7a681d8202c7..4442e478db72 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
@@ -256,8 +256,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * The actual DAP implementation may be restricted to only one of the modes.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the mode defined below.
-*
+* overrides or cannot handle the mode defined below.
 */
 #ifndef DRXDAP_SINGLE_MASTER
 #define DRXDAP_SINGLE_MASTER 1
@@ -272,7 +271,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
+* overrides or cannot handle the chunksize defined below.
 *
 * Beware that the DAP uses  DRXDAP_MAX_WCHUNKSIZE to create a temporary data
 * buffer. Do not undefine or choose too large, unless your system is able to
@@ -292,8 +291,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
-*
+* overrides or cannot handle the chunksize defined below.
 */
 #ifndef DRXDAP_MAX_RCHUNKSIZE
 #define  DRXDAP_MAX_RCHUNKSIZE 60
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index b4b583f7137a..b4c0f10fc3b0 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -54,12 +54,11 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
 /**
  * vsp1_du_setup_lif - Setup the output part of the VSP pipeline
  * @dev: the VSP device
- * @width: output frame width in pixels
- * @height: output frame height in pixels
+ * @cfg: the LIF configuration
  *
- * Configure the output part of VSP DRM pipeline for the given frame @width and
- * @height. This sets up formats on the BRU source pad, the WPF0 sink and source
- * pads, and the LIF sink pad.
+ * Configure the output part of VSP DRM pipeline for the given frame @cfg.width
+ * and @cfg.height. This sets up formats on the BRU source pad, the WPF0 sink
+ * and source pads, and the LIF sink pad.
  *
  * As the media bus code on the BRU source pad is conditioned by the
  * configuration of the BRU sink 0 pad, we also set up the formats on all BRU
@@ -69,8 +68,7 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
  *
  * Return 0 on success or a negative error code on failure.
  */
-int vsp1_du_setup_lif(struct device *dev, unsigned int width,
-                      unsigned int height)
+int vsp1_du_setup_lif(struct device *dev, const struct vsp1_du_lif_config *cfg)
 {
         struct vsp1_device *vsp1 = dev_get_drvdata(dev);
         struct vsp1_pipeline *pipe = &vsp1->drm->pipe;
@@ -79,11 +77,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         unsigned int i;
         int ret;
 
-        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
-                __func__, width, height);
-
-        if (width == 0 || height == 0) {
-                /* Zero width or height means the CRTC is being disabled, stop
+        if (!cfg) {
+                /* NULL configuration means the CRTC is being disabled, stop
                  * the pipeline and turn the light off.
                  */
                 ret = vsp1_pipeline_stop(pipe);
@@ -108,6 +103,9 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
                 return 0;
         }
 
+        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
+                __func__, cfg->width, cfg->height);
+
         /* Configure the format at the BRU sinks and propagate it through the
          * pipeline.
          */
@@ -117,8 +115,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         for (i = 0; i < bru->entity.source_pad; ++i) {
                 format.pad = i;
 
-                format.format.width = width;
-                format.format.height = height;
+                format.format.width = cfg->width;
+                format.format.height = cfg->height;
                 format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
                 format.format.field = V4L2_FIELD_NONE;
 
@@ -133,8 +131,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         }
 
         format.pad = bru->entity.source_pad;
-        format.format.width = width;
-        format.format.height = height;
+        format.format.width = cfg->width;
+        format.format.height = cfg->height;
         format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
         format.format.field = V4L2_FIELD_NONE;
 
@@ -180,7 +178,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         /* Verify that the format at the output of the pipeline matches the
          * requested frame size and media bus code.
          */
-        if (format.format.width != width || format.format.height != height ||
+        if (format.format.width != cfg->width ||
+            format.format.height != cfg->height ||
             format.format.code != MEDIA_BUS_FMT_ARGB8888_1X32) {
                 dev_dbg(vsp1->dev, "%s: format mismatch\n", __func__);
                 return -EPIPE;
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 393dccaabdd0..1688893a65bb 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -436,6 +436,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
                 return -ERESTARTSYS;
 
         ir = irctls[iminor(inode)];
+        mutex_unlock(&lirc_dev_lock);
+
         if (!ir) {
                 retval = -ENODEV;
                 goto error;
@@ -476,8 +478,6 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
         }
 
 error:
-        mutex_unlock(&lirc_dev_lock);
-
         nonseekable_open(inode, file);
 
         return retval;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index b109f8246b96..ec4b25bd2ec2 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -176,12 +176,13 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 {
         u8 tolerance, config;
         struct nvt_dev *nvt = dev->priv;
+        unsigned long flags;
         int i;
 
         /* hardcode the tolerance to 10% */
         tolerance = DIV_ROUND_UP(count, 10);
 
-        spin_lock(&nvt->lock);
+        spin_lock_irqsave(&nvt->lock, flags);
 
         nvt_clear_cir_wake_fifo(nvt);
         nvt_cir_wake_reg_write(nvt, count, CIR_WAKE_FIFO_CMP_DEEP);
@@ -203,7 +204,7 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 
         nvt_cir_wake_reg_write(nvt, config, CIR_WAKE_IRCON);
 
-        spin_unlock(&nvt->lock);
+        spin_unlock_irqrestore(&nvt->lock, flags);
 }
 
 static ssize_t wakeup_data_show(struct device *dev,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 2424946740e6..d84533699668 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1663,6 +1663,7 @@ static int rc_setup_rx_device(struct rc_dev *dev)
 {
         int rc;
         struct rc_map *rc_map;
+        u64 rc_type;
 
         if (!dev->map_name)
                 return -EINVAL;
@@ -1677,15 +1678,18 @@ static int rc_setup_rx_device(struct rc_dev *dev)
         if (rc)
                 return rc;
 
-        if (dev->change_protocol) {
-                u64 rc_type = (1ll << rc_map->rc_type);
+        rc_type = BIT_ULL(rc_map->rc_type);
 
+        if (dev->change_protocol) {
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_table;
                 dev->enabled_protocols = rc_type;
         }
 
+        if (dev->driver_type == RC_DRIVER_IR_RAW)
+                ir_raw_load_modules(&rc_type);
+
         set_bit(EV_KEY, dev->input_dev->evbit);
         set_bit(EV_REP, dev->input_dev->evbit);
         set_bit(EV_MSC, dev->input_dev->evbit);
@@ -1777,12 +1781,6 @@ int rc_register_device(struct rc_dev *dev)
                 dev->input_name ?: "Unspecified device", path ?: "N/A");
         kfree(path);
 
-        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                rc = rc_setup_rx_device(dev);
-                if (rc)
-                        goto out_dev;
-        }
-
         if (dev->driver_type == RC_DRIVER_IR_RAW ||
             dev->driver_type == RC_DRIVER_IR_RAW_TX) {
                 if (!raw_init) {
@@ -1791,7 +1789,13 @@ int rc_register_device(struct rc_dev *dev)
                 }
                 rc = ir_raw_event_register(dev);
                 if (rc < 0)
-                        goto out_rx;
+                        goto out_dev;
+        }
+
+        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
+                rc = rc_setup_rx_device(dev);
+                if (rc)
+                        goto out_raw;
         }
 
         /* Allow the RC sysfs nodes to be accessible */
@@ -1803,8 +1807,8 @@ int rc_register_device(struct rc_dev *dev)
 
         return 0;
 
-out_rx:
-        rc_free_rx_device(dev);
+out_raw:
+        ir_raw_event_unregister(dev);
 out_dev:
         device_del(&dev->dev);
 out_unlock:
diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 923fb2299553..41b54e40176c 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -487,10 +487,69 @@ static void serial_ir_timeout(unsigned long arg)
         ir_raw_event_handle(serial_ir.rcdev);
 }
 
+/* Needed by serial_ir_probe() */
+static int serial_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+                        unsigned int count);
+static int serial_ir_tx_duty_cycle(struct rc_dev *dev, u32 cycle);
+static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier);
+static int serial_ir_open(struct rc_dev *rcdev);
+static void serial_ir_close(struct rc_dev *rcdev);
+
 static int serial_ir_probe(struct platform_device *dev)
 {
+        struct rc_dev *rcdev;
         int i, nlow, nhigh, result;
 
+        rcdev = devm_rc_allocate_device(&dev->dev, RC_DRIVER_IR_RAW);
+        if (!rcdev)
+                return -ENOMEM;
+
+        if (hardware[type].send_pulse && hardware[type].send_space)
+                rcdev->tx_ir = serial_ir_tx;
+        if (hardware[type].set_send_carrier)
+                rcdev->s_tx_carrier = serial_ir_tx_carrier;
+        if (hardware[type].set_duty_cycle)
+                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
+
+        switch (type) {
+        case IR_HOMEBREW:
+                rcdev->input_name = "Serial IR type home-brew";
+                break;
+        case IR_IRDEO:
+                rcdev->input_name = "Serial IR type IRdeo";
+                break;
+        case IR_IRDEO_REMOTE:
+                rcdev->input_name = "Serial IR type IRdeo remote";
+                break;
+        case IR_ANIMAX:
+                rcdev->input_name = "Serial IR type AnimaX";
+                break;
+        case IR_IGOR:
+                rcdev->input_name = "Serial IR type IgorPlug";
+                break;
+        }
+
+        rcdev->input_phys = KBUILD_MODNAME "/input0";
+        rcdev->input_id.bustype = BUS_HOST;
+        rcdev->input_id.vendor = 0x0001;
+        rcdev->input_id.product = 0x0001;
+        rcdev->input_id.version = 0x0100;
+        rcdev->open = serial_ir_open;
+        rcdev->close = serial_ir_close;
+        rcdev->dev.parent = &serial_ir.pdev->dev;
+        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
+        rcdev->driver_name = KBUILD_MODNAME;
+        rcdev->map_name = RC_MAP_RC6_MCE;
+        rcdev->min_timeout = 1;
+        rcdev->timeout = IR_DEFAULT_TIMEOUT;
+        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
+        rcdev->rx_resolution = 250000;
+
+        serial_ir.rcdev = rcdev;
+
+        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
+                    (unsigned long)&serial_ir);
+
         result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler,
                                   share_irq ? IRQF_SHARED : 0,
                                   KBUILD_MODNAME, &hardware);
@@ -516,9 +575,6 @@ static int serial_ir_probe(struct platform_device *dev)
                 return -EBUSY;
         }
 
-        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
-                    (unsigned long)&serial_ir);
-
         result = hardware_init_port();
         if (result < 0)
                 return result;
@@ -552,7 +608,8 @@ static int serial_ir_probe(struct platform_device *dev)
                          sense ? "low" : "high");
 
         dev_dbg(&dev->dev, "Interrupt %d, port %04x obtained\n", irq, io);
-        return 0;
+
+        return devm_rc_register_device(&dev->dev, rcdev);
 }
 
 static int serial_ir_open(struct rc_dev *rcdev)
@@ -723,7 +780,6 @@ static void serial_ir_exit(void)
 
 static int __init serial_ir_init_module(void)
 {
-        struct rc_dev *rcdev;
         int result;
 
         switch (type) {
@@ -754,63 +810,9 @@ static int __init serial_ir_init_module(void)
                 sense = !!sense;
 
         result = serial_ir_init();
-        if (result)
-                return result;
-
-        rcdev = devm_rc_allocate_device(&serial_ir.pdev->dev, RC_DRIVER_IR_RAW);
-        if (!rcdev) {
-                result = -ENOMEM;
-                goto serial_cleanup;
-        }
-
-        if (hardware[type].send_pulse && hardware[type].send_space)
-                rcdev->tx_ir = serial_ir_tx;
-        if (hardware[type].set_send_carrier)
-                rcdev->s_tx_carrier = serial_ir_tx_carrier;
-        if (hardware[type].set_duty_cycle)
-                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
-
-        switch (type) {
-        case IR_HOMEBREW:
-                rcdev->input_name = "Serial IR type home-brew";
-                break;
-        case IR_IRDEO:
-                rcdev->input_name = "Serial IR type IRdeo";
-                break;
-        case IR_IRDEO_REMOTE:
-                rcdev->input_name = "Serial IR type IRdeo remote";
-                break;
-        case IR_ANIMAX:
-                rcdev->input_name = "Serial IR type AnimaX";
-                break;
-        case IR_IGOR:
-                rcdev->input_name = "Serial IR type IgorPlug";
-                break;
-        }
-
-        rcdev->input_phys = KBUILD_MODNAME "/input0";
-        rcdev->input_id.bustype = BUS_HOST;
-        rcdev->input_id.vendor = 0x0001;
-        rcdev->input_id.product = 0x0001;
-        rcdev->input_id.version = 0x0100;
-        rcdev->open = serial_ir_open;
-        rcdev->close = serial_ir_close;
-        rcdev->dev.parent = &serial_ir.pdev->dev;
-        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
-        rcdev->driver_name = KBUILD_MODNAME;
-        rcdev->map_name = RC_MAP_RC6_MCE;
-        rcdev->min_timeout = 1;
-        rcdev->timeout = IR_DEFAULT_TIMEOUT;
-        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
-        rcdev->rx_resolution = 250000;
-
-        serial_ir.rcdev = rcdev;
-
-        result = rc_register_device(rcdev);
-
         if (!result)
                 return 0;
-serial_cleanup:
+
         serial_ir_exit();
         return result;
 }
@@ -818,7 +820,6 @@ serial_cleanup:
 static void __exit serial_ir_exit_module(void)
 {
         del_timer_sync(&serial_ir.timeout_timer);
-        rc_unregister_device(serial_ir.rcdev);
         serial_ir_exit();
 }
 
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 6ca502d834b4..4f42d57f81d9 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -68,6 +68,7 @@
 struct dw2102_state {
         u8 initialized;
         u8 last_lock;
+        u8 data[MAX_XFER_SIZE + 4];
         struct i2c_client *i2c_client_demod;
         struct i2c_client *i2c_client_tuner;
 
@@ -661,62 +662,72 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                                                 int num)
 {
         struct dvb_usb_device *d = i2c_get_adapdata(adap);
-        u8 obuf[0x40], ibuf[0x40];
+        struct dw2102_state *state;
 
         if (!d)
                 return -ENODEV;
+
+        state = d->priv;
+
         if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
                 return -EAGAIN;
+        if (mutex_lock_interruptible(&d->data_mutex) < 0) {
+                mutex_unlock(&d->i2c_mutex);
+                return -EAGAIN;
+        }
 
         switch (num) {
         case 1:
                 switch (msg[0].addr) {
                 case SU3000_STREAM_CTRL:
-                        obuf[0] = msg[0].buf[0] + 0x36;
-                        obuf[1] = 3;
-                        obuf[2] = 0;
-                        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 0, 0) < 0)
+                        state->data[0] = msg[0].buf[0] + 0x36;
+                        state->data[1] = 3;
+                        state->data[2] = 0;
+                        if (dvb_usb_generic_rw(d, state->data, 3,
+                                        state->data, 0, 0) < 0)
                                 err("i2c transfer failed.");
                         break;
                 case DW2102_RC_QUERY:
-                        obuf[0] = 0x10;
-                        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 2, 0) < 0)
+                        state->data[0] = 0x10;
+                        if (dvb_usb_generic_rw(d, state->data, 1,
+                                        state->data, 2, 0) < 0)
                                 err("i2c transfer failed.");
-                        msg[0].buf[1] = ibuf[0];
-                        msg[0].buf[0] = ibuf[1];
+                        msg[0].buf[1] = state->data[0];
+                        msg[0].buf[0] = state->data[1];
                         break;
                 default:
                         /* always i2c write*/
-                        obuf[0] = 0x08;
-                        obuf[1] = msg[0].addr;
-                        obuf[2] = msg[0].len;
+                        state->data[0] = 0x08;
+                        state->data[1] = msg[0].addr;
+                        state->data[2] = msg[0].len;
 
-                        memcpy(&obuf[3], msg[0].buf, msg[0].len);
+                        memcpy(&state->data[3], msg[0].buf, msg[0].len);
 
-                        if (dvb_usb_generic_rw(d, obuf, msg[0].len + 3,
-                                                ibuf, 1, 0) < 0)
+                        if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3,
+                                                state->data, 1, 0) < 0)
                                 err("i2c transfer failed.");
 
                 }
                 break;
         case 2:
                 /* always i2c read */
-                obuf[0] = 0x09;
-                obuf[1] = msg[0].len;
-                obuf[2] = msg[1].len;
-                obuf[3] = msg[0].addr;
-                memcpy(&obuf[4], msg[0].buf, msg[0].len);
-
-                if (dvb_usb_generic_rw(d, obuf, msg[0].len + 4,
-                                        ibuf, msg[1].len + 1, 0) < 0)
+                state->data[0] = 0x09;
+                state->data[1] = msg[0].len;
+                state->data[2] = msg[1].len;
+                state->data[3] = msg[0].addr;
+                memcpy(&state->data[4], msg[0].buf, msg[0].len);
+
+                if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
+                                        state->data, msg[1].len + 1, 0) < 0)
                         err("i2c transfer failed.");
 
-                memcpy(msg[1].buf, &ibuf[1], msg[1].len);
+                memcpy(msg[1].buf, &state->data[1], msg[1].len);
                 break;
         default:
                 warn("more than 2 i2c messages at a time is not handled yet.");
                 break;
         }
+        mutex_unlock(&d->data_mutex);
         mutex_unlock(&d->i2c_mutex);
         return num;
 }
@@ -844,17 +855,23 @@ static int su3000_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 static int su3000_power_ctrl(struct dvb_usb_device *d, int i)
 {
         struct dw2102_state *state = (struct dw2102_state *)d->priv;
-        u8 obuf[] = {0xde, 0};
+        int ret = 0;
 
         info("%s: %d, initialized %d", __func__, i, state->initialized);
 
         if (i && !state->initialized) {
+                mutex_lock(&d->data_mutex);
+
+                state->data[0] = 0xde;
+                state->data[1] = 0;
+
                 state->initialized = 1;
                 /* reset board */
-                return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
+                ret = dvb_usb_generic_rw(d, state->data, 2, NULL, 0, 0);
+                mutex_unlock(&d->data_mutex);
         }
 
-        return 0;
+        return ret;
 }
 
 static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
@@ -1309,49 +1326,57 @@ static int prof_7500_frontend_attach(struct dvb_usb_adapter *d)
         return 0;
 }
 
-static int su3000_frontend_attach(struct dvb_usb_adapter *d)
+static int su3000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
-                                        &d->dev->i2c_adap);
-        if (d->fe_adap[0].fe == NULL)
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
+                                        &d->i2c_adap);
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached DS3000/TS2020!");
                 return 0;
         }
@@ -1360,47 +1385,55 @@ static int su3000_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int t220_frontend_attach(struct dvb_usb_adapter *d)
+static int t220_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x87, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        state->data[0] = 0xe;
+        state->data[1] = 0x87;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x86;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x86;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
         msleep(50);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
-                                        &d->dev->i2c_adap, NULL);
-        if (d->fe_adap[0].fe != NULL) {
-                if (dvb_attach(tda18271_attach, d->fe_adap[0].fe, 0x60,
-                                        &d->dev->i2c_adap, &tda18271_config)) {
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
+                                        &d->i2c_adap, NULL);
+        if (adap->fe_adap[0].fe != NULL) {
+                if (dvb_attach(tda18271_attach, adap->fe_adap[0].fe, 0x60,
+                                        &d->i2c_adap, &tda18271_config)) {
                         info("Attached TDA18271HD/CXD2820R!");
                         return 0;
                 }
@@ -1410,23 +1443,30 @@ static int t220_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int m88rs2000_frontend_attach(struct dvb_usb_adapter *d)
+static int m88rs2000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[] = { 0x51 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        state->data[0] = 0x51;
+
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(m88rs2000_attach, &s421_m88rs2000_config,
-                                        &d->dev->i2c_adap);
+        mutex_unlock(&d->data_mutex);
 
-        if (d->fe_adap[0].fe == NULL)
+        adap->fe_adap[0].fe = dvb_attach(m88rs2000_attach,
+                                        &s421_m88rs2000_config,
+                                        &d->i2c_adap);
+
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached RS2000/TS2020!");
                 return 0;
         }
@@ -1439,44 +1479,50 @@ static int tt_s2_4600_frontend_attach(struct dvb_usb_adapter *adap)
 {
         struct dvb_usb_device *d = adap->dev;
         struct dw2102_state *state = d->priv;
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
         struct i2c_adapter *i2c_adapter;
         struct i2c_client *client;
         struct i2c_board_info board_info;
         struct m88ds3103_platform_data m88ds3103_pdata = {};
         struct ts2020_config ts2020_config = {};
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
+        mutex_unlock(&d->data_mutex);
+
         /* attach demod */
         m88ds3103_pdata.clk = 27000000;
         m88ds3103_pdata.i2c_wr_max = 33;
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 6fb773dbcd0c..93be82fc338a 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -219,15 +219,20 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
         int write, unsigned long *paddr, int *pageshift)
 {
         pgd_t *pgdp;
-        pmd_t *pmdp;
+        p4d_t *p4dp;
         pud_t *pudp;
+        pmd_t *pmdp;
         pte_t pte;
 
         pgdp = pgd_offset(vma->vm_mm, vaddr);
         if (unlikely(pgd_none(*pgdp)))
                 goto err;
 
-        pudp = pud_offset(pgdp, vaddr);
+        p4dp = p4d_offset(pgdp, vaddr);
+        if (unlikely(p4d_none(*p4dp)))
+                goto err;
+
+        pudp = pud_offset(p4dp, vaddr);
         if (unlikely(pud_none(*pudp)))
                 goto err;
 
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 1ae872bfc3ba..747645c74134 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -186,7 +186,7 @@ static inline int write_enable(struct spi_nor *nor)
 }
 
 /*
- * Send write disble instruction to the chip.
+ * Send write disable instruction to the chip.
  */
 static inline int write_disable(struct spi_nor *nor)
 {
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 6d31f92ef2b6..84ac50f92c9c 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -1162,8 +1162,8 @@ struct ob_mac_tso_iocb_rsp {
 struct ib_mac_iocb_rsp {
         u8 opcode;              /* 0x20 */
         u8 flags1;
-#define IB_MAC_IOCB_RSP_OI      0x01    /* Overide intr delay */
-#define IB_MAC_IOCB_RSP_I       0x02    /* Disble Intr Generation */
+#define IB_MAC_IOCB_RSP_OI      0x01    /* Override intr delay */
+#define IB_MAC_IOCB_RSP_I       0x02    /* Disable Intr Generation */
 #define IB_MAC_CSUM_ERR_MASK 0x1c       /* A mask to use for csum errs */
 #define IB_MAC_IOCB_RSP_TE      0x04    /* Checksum error */
 #define IB_MAC_IOCB_RSP_NU      0x08    /* No checksum rcvd */
diff --git a/drivers/pci/dwc/pci-exynos.c b/drivers/pci/dwc/pci-exynos.c
index 993b650ef275..44f774c12fb2 100644
--- a/drivers/pci/dwc/pci-exynos.c
+++ b/drivers/pci/dwc/pci-exynos.c
@@ -132,10 +132,6 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         struct device *dev = pci->dev;
         struct resource *res;
 
-        /* If using the PHY framework, doesn't need to get other resource */
-        if (ep->using_phy)
-                return 0;
-
         ep->mem_res = devm_kzalloc(dev, sizeof(*ep->mem_res), GFP_KERNEL);
         if (!ep->mem_res)
                 return -ENOMEM;
@@ -145,6 +141,10 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         if (IS_ERR(ep->mem_res->elbi_base))
                 return PTR_ERR(ep->mem_res->elbi_base);
 
+        /* If using the PHY framework, doesn't need to get other resource */
+        if (ep->using_phy)
+                return 0;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         ep->mem_res->phy_base = devm_ioremap_resource(dev, res);
         if (IS_ERR(ep->mem_res->phy_base))
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 973472c23d89..1dfa10cc566b 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -478,7 +478,7 @@ static void aspm_calc_l1ss_info(struct pcie_link_state *link,
 
 static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 {
-        struct pci_dev *child, *parent = link->pdev;
+        struct pci_dev *child = link->downstream, *parent = link->pdev;
         struct pci_bus *linkbus = parent->subordinate;
         struct aspm_register_info upreg, dwreg;
 
@@ -491,9 +491,7 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 
         /* Get upstream/downstream components' register state */
         pcie_get_aspm_reg(parent, &upreg);
-        child = pci_function_0(linkbus);
         pcie_get_aspm_reg(child, &dwreg);
-        link->downstream = child;
 
         /*
          * If ASPM not supported, don't mess with the clocks and link,
@@ -800,6 +798,7 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
         INIT_LIST_HEAD(&link->children);
         INIT_LIST_HEAD(&link->link);
         link->pdev = pdev;
+        link->downstream = pci_function_0(pdev->subordinate);
 
         /*
          * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f754453fe754..673683660b5c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2174,6 +2174,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005d, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID,
                 quirk_blacklist_vpd);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd);
 
 /*
  * For Broadcom 5706, 5708, 5709 rev. A nics, any read beyond the
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index f8e9e1c2b2f6..c978be5eb9eb 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -422,6 +422,20 @@ static int msm_gpio_direction_output(struct gpio_chip *chip, unsigned offset, in
         return 0;
 }
 
+static int msm_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+{
+        struct msm_pinctrl *pctrl = gpiochip_get_data(chip);
+        const struct msm_pingroup *g;
+        u32 val;
+
+        g = &pctrl->soc->groups[offset];
+
+        val = readl(pctrl->regs + g->ctl_reg);
+
+        /* 0 = output, 1 = input */
+        return val & BIT(g->oe_bit) ? 0 : 1;
+}
+
 static int msm_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         const struct msm_pingroup *g;
@@ -510,6 +524,7 @@ static void msm_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 static struct gpio_chip msm_gpio_template = {
         .direction_input  = msm_gpio_direction_input,
         .direction_output = msm_gpio_direction_output,
+        .get_direction    = msm_gpio_get_direction,
         .get              = msm_gpio_get,
         .set              = msm_gpio_set,
         .request          = gpiochip_generic_request,
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
index 77a0236ee781..83f8864fa76a 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
@@ -390,22 +390,22 @@ static const struct pinctrl_pin_desc uniphier_ld11_pins[] = {
         UNIPHIER_PINCTRL_PIN(140, "AO1D0", 140,
                              140, UNIPHIER_PIN_DRV_1BIT,
                              140, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(141, "TCON0", 141,
+        UNIPHIER_PINCTRL_PIN(141, "AO1D1", 141,
                              141, UNIPHIER_PIN_DRV_1BIT,
                              141, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(142, "TCON1", 142,
+        UNIPHIER_PINCTRL_PIN(142, "AO1D2", 142,
                              142, UNIPHIER_PIN_DRV_1BIT,
                              142, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(143, "TCON2", 143,
+        UNIPHIER_PINCTRL_PIN(143, "XIRQ9", 143,
                              143, UNIPHIER_PIN_DRV_1BIT,
                              143, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(144, "TCON3", 144,
+        UNIPHIER_PINCTRL_PIN(144, "XIRQ10", 144,
                              144, UNIPHIER_PIN_DRV_1BIT,
                              144, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(145, "TCON4", 145,
+        UNIPHIER_PINCTRL_PIN(145, "XIRQ11", 145,
                              145, UNIPHIER_PIN_DRV_1BIT,
                              145, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(146, "TCON5", 146,
+        UNIPHIER_PINCTRL_PIN(146, "XIRQ13", 146,
                              146, UNIPHIER_PIN_DRV_1BIT,
                              146, UNIPHIER_PIN_PULL_DOWN),
         UNIPHIER_PINCTRL_PIN(147, "PWMA", 147,
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 109e2c99e6c1..95d8f25cbcca 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -6278,7 +6278,7 @@ ahd_reset(struct ahd_softc *ahd, int reinit)
                  * does not disable its parity logic prior to
                  * the start of the reset.  This may cause a
                  * parity error to be detected and thus a
-                 * spurious SERR or PERR assertion.  Disble
+                 * spurious SERR or PERR assertion.  Disable
                  * PERR and SERR responses during the CHIPRST.
                  */
                 mod_cmd = cmd & ~(PCIM_CMD_PERRESPEN|PCIM_CMD_SERRESPEN);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index c7839f6c35cc..d277e8620e3e 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3075,23 +3075,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
         put_device(&sdkp->dev);
 }
 
-struct sd_devt {
-        int idx;
-        struct disk_devt disk_devt;
-};
-
-static void sd_devt_release(struct disk_devt *disk_devt)
-{
-        struct sd_devt *sd_devt = container_of(disk_devt, struct sd_devt,
-                        disk_devt);
-
-        spin_lock(&sd_index_lock);
-        ida_remove(&sd_index_ida, sd_devt->idx);
-        spin_unlock(&sd_index_lock);
-
-        kfree(sd_devt);
-}
-
 /**
  *      sd_probe - called during driver initialization and whenever a
  *      new scsi device is attached to the system. It is called once
@@ -3113,7 +3096,6 @@ static void sd_devt_release(struct disk_devt *disk_devt)
 static int sd_probe(struct device *dev)
 {
         struct scsi_device *sdp = to_scsi_device(dev);
-        struct sd_devt *sd_devt;
         struct scsi_disk *sdkp;
         struct gendisk *gd;
         int index;
@@ -3139,13 +3121,9 @@ static int sd_probe(struct device *dev)
         if (!sdkp)
                 goto out;
 
-        sd_devt = kzalloc(sizeof(*sd_devt), GFP_KERNEL);
-        if (!sd_devt)
-                goto out_free;
-
         gd = alloc_disk(SD_MINORS);
         if (!gd)
-                goto out_free_devt;
+                goto out_free;
 
         do {
                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
@@ -3161,11 +3139,6 @@ static int sd_probe(struct device *dev)
                 goto out_put;
         }
 
-        atomic_set(&sd_devt->disk_devt.count, 1);
-        sd_devt->disk_devt.release = sd_devt_release;
-        sd_devt->idx = index;
-        gd->disk_devt = &sd_devt->disk_devt;
-
         error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
         if (error) {
                 sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name length exceeded.\n");
@@ -3205,12 +3178,11 @@ static int sd_probe(struct device *dev)
         return 0;
 
  out_free_index:
-        put_disk_devt(&sd_devt->disk_devt);
-        sd_devt = NULL;
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, index);
+        spin_unlock(&sd_index_lock);
  out_put:
         put_disk(gd);
- out_free_devt:
-        kfree(sd_devt);
  out_free:
         kfree(sdkp);
  out:
@@ -3271,7 +3243,10 @@ static void scsi_disk_release(struct device *dev)
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
         
-        put_disk_devt(disk->disk_devt);
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, sdkp->index);
+        spin_unlock(&sd_index_lock);
+
         disk->private_data = NULL;
         put_disk(disk);
         put_device(&sdkp->device->sdev_gendev);
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 7f8cf875157c..65a285631994 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -336,7 +336,6 @@ static int cvm_oct_poll(struct oct_rx_group *rx_group, int budget)
                 if (likely((port < TOTAL_NUMBER_OF_PORTS) &&
                            cvm_oct_device[port])) {
                         struct net_device *dev = cvm_oct_device[port];
-                        struct octeon_ethernet *priv = netdev_priv(dev);
 
                         /*
                          * Only accept packets for devices that are
diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index e61e4ca064a8..74094fff4367 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -1,6 +1,7 @@
 config BCM2835_VCHIQ
         tristate "Videocore VCHIQ"
         depends on HAS_DMA
+        depends on OF
         depends on RASPBERRYPI_FIRMWARE || (COMPILE_TEST && !RASPBERRYPI_FIRMWARE)
         default y
         help
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 1bacbc3b19a0..e94aea8c0d05 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -114,7 +114,7 @@
 #define DEFAULT_TX_BUF_COUNT 3
 
 struct n_hdlc_buf {
-        struct n_hdlc_buf *link;
+        struct list_head  list_item;
         int               count;
         char              buf[1];
 };
@@ -122,8 +122,7 @@ struct n_hdlc_buf {
 #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
 
 struct n_hdlc_buf_list {
-        struct n_hdlc_buf *head;
-        struct n_hdlc_buf *tail;
+        struct list_head  list;
         int               count;
         spinlock_t        spinlock;
 };
@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
  * @backup_tty - TTY to use if tty gets closed
  * @tbusy - reentrancy flag for tx wakeup code
  * @woke_up - FIXME: describe this field
- * @tbuf - currently transmitting tx buffer
  * @tx_buf_list - list of pending transmit frame buffers
  * @rx_buf_list - list of received frame buffers
  * @tx_free_buf_list - list unused transmit frame buffers
@@ -149,7 +147,6 @@ struct n_hdlc {
         struct tty_struct       *backup_tty;
         int                     tbusy;
         int                     woke_up;
-        struct n_hdlc_buf       *tbuf;
         struct n_hdlc_buf_list  tx_buf_list;
         struct n_hdlc_buf_list  rx_buf_list;
         struct n_hdlc_buf_list  tx_free_buf_list;
@@ -159,6 +156,8 @@ struct n_hdlc {
 /*
  * HDLC buffer list manipulation functions
  */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf);
 static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
                            struct n_hdlc_buf *buf);
 static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
 {
         struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
         struct n_hdlc_buf *buf;
-        unsigned long flags;
 
         while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
                 n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-        spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
-        if (n_hdlc->tbuf) {
-                n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
-                n_hdlc->tbuf = NULL;
-        }
-        spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 }
 
 static struct tty_ldisc_ops n_hdlc_ldisc = {
@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
                 } else
                         break;
         }
-        kfree(n_hdlc->tbuf);
         kfree(n_hdlc);
         
 }       /* end of n_hdlc_release() */
@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
         n_hdlc->woke_up = 0;
         spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 
-        /* get current transmit buffer or get new transmit */
-        /* buffer from list of pending transmit buffers */
-                
-        tbuf = n_hdlc->tbuf;
-        if (!tbuf)
-                tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
-                
+        tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
         while (tbuf) {
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d)sending frame %p, count=%d\n",
@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
 
                 /* rollback was possible and has been done */
                 if (actual == -ERESTARTSYS) {
-                        n_hdlc->tbuf = tbuf;
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
                 /* if transmit error, throw frame away by */
@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                                         
                         /* free current transmit buffer */
                         n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
-                        
-                        /* this tx buffer is done */
-                        n_hdlc->tbuf = NULL;
-                        
+
                         /* wait up sleeping writers */
                         wake_up_interruptible(&tty->write_wait);
         
@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                         if (debuglevel >= DEBUG_LEVEL_INFO)     
                                 printk("%s(%d)frame %p pending\n",
                                         __FILE__,__LINE__,tbuf);
-                                        
-                        /* buffer not accepted by driver */
-                        /* set this buffer as pending buffer */
-                        n_hdlc->tbuf = tbuf;
+
+                        /*
+                         * the buffer was not accepted by driver,
+                         * return it back into tx queue
+                         */
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
         }
@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
         int error = 0;
         int count;
         unsigned long flags;
-        
+        struct n_hdlc_buf *buf = NULL;
+
         if (debuglevel >= DEBUG_LEVEL_INFO)     
                 printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
                         __FILE__,__LINE__,cmd);
@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 /* report count of read data available */
                 /* in next available frame (if any) */
                 spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
-                if (n_hdlc->rx_buf_list.head)
-                        count = n_hdlc->rx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count = buf->count;
                 else
                         count = 0;
                 spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 count = tty_chars_in_buffer(tty);
                 /* add size of next output frame in queue */
                 spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
-                if (n_hdlc->tx_buf_list.head)
-                        count += n_hdlc->tx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count += buf->count;
                 spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
                 error = put_user(count, (int __user *)arg);
                 break;
@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                 poll_wait(filp, &tty->write_wait, wait);
 
                 /* set bits for operations that won't block */
-                if (n_hdlc->rx_buf_list.head)
+                if (!list_empty(&n_hdlc->rx_buf_list.list))
                         mask |= POLLIN | POLLRDNORM;    /* readable */
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
                         mask |= POLLHUP;
                 if (tty_hung_up_p(filp))
                         mask |= POLLHUP;
                 if (!tty_is_writelocked(tty) &&
-                                n_hdlc->tx_free_buf_list.head)
+                                !list_empty(&n_hdlc->tx_free_buf_list.list))
                         mask |= POLLOUT | POLLWRNORM;   /* writable */
         }
         return mask;
@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
         spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
         spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
         spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
-        
+
+        INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
+
         /* allocate free rx buffer list */
         for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
                 buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
 }       /* end of n_hdlc_alloc() */
 
 /**
+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
+ * @buf_list - pointer to the buffer list
+ * @buf - pointer to the buffer
+ */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
+}
+
+/**
  * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
- * @list - pointer to buffer list
+ * @buf_list - pointer to buffer list
  * @buf - pointer to buffer
  */
-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
                            struct n_hdlc_buf *buf)
 {
         unsigned long flags;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf->link=NULL;
-        if (list->tail)
-                list->tail->link = buf;
-        else
-                list->head = buf;
-        list->tail = buf;
-        (list->count)++;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
-        
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add_tail(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
 }       /* end of n_hdlc_buf_put() */
 
 /**
  * n_hdlc_buf_get - remove and return an HDLC buffer from list
- * @list - pointer to HDLC buffer list
+ * @buf_list - pointer to HDLC buffer list
  * 
  * Remove and return an HDLC buffer from the head of the specified HDLC buffer
  * list.
  * Returns a pointer to HDLC buffer if available, otherwise %NULL.
  */
-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
 {
         unsigned long flags;
         struct n_hdlc_buf *buf;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf = list->head;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        buf = list_first_entry_or_null(&buf_list->list,
+                                                struct n_hdlc_buf, list_item);
         if (buf) {
-                list->head = buf->link;
-                (list->count)--;
+                list_del(&buf->list_item);
+                buf_list->count--;
         }
-        if (!list->head)
-                list->tail = NULL;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
         return buf;
-        
 }       /* end of n_hdlc_buf_get() */
 
 static char hdlc_banner[] __initdata =
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index b4f86c219db1..7a17aedbf902 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1031,8 +1031,10 @@ static int s3c64xx_serial_startup(struct uart_port *port)
         if (ourport->dma) {
                 ret = s3c24xx_serial_request_dma(ourport);
                 if (ret < 0) {
-                        dev_warn(port->dev, "DMA request failed\n");
-                        return ret;
+                        dev_warn(port->dev,
+                                 "DMA request failed, DMA will not be used\n");
+                        devm_kfree(port->dev, ourport->dma);
+                        ourport->dma = NULL;
                 }
         }
 
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2092e46b1380..f8d0747810e7 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
                 val = dwc3_omap_read_utmi_ctrl(omap);
                 val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
                 dwc3_omap_write_utmi_ctrl(omap, val);
+                break;
 
         case OMAP_DWC3_VBUS_OFF:
                 val = dwc3_omap_read_utmi_ctrl(omap);
@@ -392,7 +393,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 {
         u32                     reg;
         struct device_node      *node = omap->dev->of_node;
-        int                     utmi_mode = 0;
+        u32                     utmi_mode = 0;
 
         reg = dwc3_omap_read_utmi_ctrl(omap);
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4db97ecae885..0d75158e43fe 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1342,6 +1342,68 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                 if (r == req) {
                         /* wait until it is processed */
                         dwc3_stop_active_transfer(dwc, dep->number, true);
+
+                        /*
+                         * If request was already started, this means we had to
+                         * stop the transfer. With that we also need to ignore
+                         * all TRBs used by the request, however TRBs can only
+                         * be modified after completion of END_TRANSFER
+                         * command. So what we do here is that we wait for
+                         * END_TRANSFER completion and only after that, we jump
+                         * over TRBs by clearing HWO and incrementing dequeue
+                         * pointer.
+                         *
+                         * Note that we have 2 possible types of transfers here:
+                         *
+                         * i) Linear buffer request
+                         * ii) SG-list based request
+                         *
+                         * SG-list based requests will have r->num_pending_sgs
+                         * set to a valid number (> 0). Linear requests,
+                         * normally use a single TRB.
+                         *
+                         * For each of these two cases, if r->unaligned flag is
+                         * set, one extra TRB has been used to align transfer
+                         * size to wMaxPacketSize.
+                         *
+                         * All of these cases need to be taken into
+                         * consideration so we don't mess up our TRB ring
+                         * pointers.
+                         */
+                        wait_event_lock_irq(dep->wait_end_transfer,
+                                        !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+                                        dwc->lock);
+
+                        if (!r->trb)
+                                goto out1;
+
+                        if (r->num_pending_sgs) {
+                                struct dwc3_trb *trb;
+                                int i = 0;
+
+                                for (i = 0; i < r->num_pending_sgs; i++) {
+                                        trb = r->trb + i;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+
+                                if (r->unaligned) {
+                                        trb = r->trb + r->num_pending_sgs + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        } else {
+                                struct dwc3_trb *trb = r->trb;
+
+                                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                dwc3_ep_inc_deq(dep);
+
+                                if (r->unaligned) {
+                                        trb = r->trb + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        }
                         goto out1;
                 }
                 dev_err(dwc->dev, "request %p was not queued to %s\n",
@@ -1352,6 +1414,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 
 out1:
         /* giveback the request */
+        dep->queued_requests--;
         dwc3_gadget_giveback(dep, req, -ECONNRESET);
 
 out0:
@@ -2126,12 +2189,12 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 return 1;
         }
 
-        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                return 1;
-
         count = trb->size & DWC3_TRB_SIZE_MASK;
         req->remaining += count;
 
+        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+                return 1;
+
         if (dep->direction) {
                 if (count) {
                         trb_status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -3228,15 +3291,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 
 int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
-        int ret;
-
         if (!dwc->gadget_driver)
                 return 0;
 
-        ret = dwc3_gadget_run_stop(dwc, false, false);
-        if (ret < 0)
-                return ret;
-
+        dwc3_gadget_run_stop(dwc, false, false);
         dwc3_disconnect_gadget(dwc);
         __dwc3_gadget_stop(dwc);
 
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 3129bcf74d7d..265e223ab645 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -28,23 +28,23 @@ struct dwc3;
 #define gadget_to_dwc(g)        (container_of(g, struct dwc3, gadget))
 
 /* DEPCFG parameter 1 */
-#define DWC3_DEPCFG_INT_NUM(n)          ((n) << 0)
+#define DWC3_DEPCFG_INT_NUM(n)          (((n) & 0x1f) << 0)
 #define DWC3_DEPCFG_XFER_COMPLETE_EN    (1 << 8)
 #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9)
 #define DWC3_DEPCFG_XFER_NOT_READY_EN   (1 << 10)
 #define DWC3_DEPCFG_FIFO_ERROR_EN       (1 << 11)
 #define DWC3_DEPCFG_STREAM_EVENT_EN     (1 << 13)
-#define DWC3_DEPCFG_BINTERVAL_M1(n)     ((n) << 16)
+#define DWC3_DEPCFG_BINTERVAL_M1(n)     (((n) & 0xff) << 16)
 #define DWC3_DEPCFG_STREAM_CAPABLE      (1 << 24)
-#define DWC3_DEPCFG_EP_NUMBER(n)        ((n) << 25)
+#define DWC3_DEPCFG_EP_NUMBER(n)        (((n) & 0x1f) << 25)
 #define DWC3_DEPCFG_BULK_BASED          (1 << 30)
 #define DWC3_DEPCFG_FIFO_BASED          (1 << 31)
 
 /* DEPCFG parameter 0 */
-#define DWC3_DEPCFG_EP_TYPE(n)          ((n) << 1)
-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  ((n) << 3)
-#define DWC3_DEPCFG_FIFO_NUMBER(n)      ((n) << 17)
-#define DWC3_DEPCFG_BURST_SIZE(n)       ((n) << 22)
+#define DWC3_DEPCFG_EP_TYPE(n)          (((n) & 0x3) << 1)
+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  (((n) & 0x7ff) << 3)
+#define DWC3_DEPCFG_FIFO_NUMBER(n)      (((n) & 0x1f) << 17)
+#define DWC3_DEPCFG_BURST_SIZE(n)       (((n) & 0xf) << 22)
 #define DWC3_DEPCFG_DATA_SEQ_NUM(n)     ((n) << 26)
 /* This applies for core versions earlier than 1.94a */
 #define DWC3_DEPCFG_IGN_SEQ_NUM         (1 << 31)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 78c44979dde3..cbff3b02840d 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
                 ret = unregister_gadget(gi);
                 if (ret)
                         goto err;
+                kfree(name);
         } else {
                 if (gi->composite.gadget_driver.udc_name) {
                         ret = -EBUSY;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index a5b7cd615698..a0085571824d 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1834,11 +1834,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
         while(count--) {
                 struct usb_endpoint_descriptor *ds;
+                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+                int needs_comp_desc = false;
                 int desc_idx;
 
-                if (ffs->gadget->speed == USB_SPEED_SUPER)
+                if (ffs->gadget->speed == USB_SPEED_SUPER) {
                         desc_idx = 2;
-                else if (ffs->gadget->speed == USB_SPEED_HIGH)
+                        needs_comp_desc = true;
+                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
                         desc_idx = 1;
                 else
                         desc_idx = 0;
@@ -1855,6 +1858,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
+
+                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                USB_DT_ENDPOINT_SIZE);
+                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+
+                if (needs_comp_desc)
+                        ep->ep->comp_desc = comp_desc;
+
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
                         epfile->ep = ep;
@@ -2253,7 +2264,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
 
                 if (len < sizeof(*d) ||
                     d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    d->Reserved1)
+                    !d->Reserved1)
                         return -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                         if (d->Reserved2[i])
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 27ed51b5082f..29b41b5dee04 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
         memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req));
         v4l2_event_queue(&uvc->vdev, &v4l2_event);
 
-        /* Pass additional setup data to userspace */
-        if (uvc->event_setup_out && uvc->event_length) {
-                uvc->control_req->length = uvc->event_length;
-                return usb_ep_queue(uvc->func.config->cdev->gadget->ep0,
-                        uvc->control_req, GFP_ATOMIC);
-        }
-
         return 0;
 }
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index a2615d64d07c..a2c916869293 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -84,8 +84,7 @@ static int ep_open(struct inode *, struct file *);
 
 /* /dev/gadget/$CHIP represents ep0 and the whole device */
 enum ep0_state {
-        /* DISBLED is the initial state.
-         */
+        /* DISABLED is the initial state. */
         STATE_DEV_DISABLED = 0,
 
         /* Only one open() of /dev/gadget/$CHIP; only one file tracks
@@ -1782,8 +1781,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         spin_lock_irq (&dev->lock);
         value = -EINVAL;
-        if (dev->buf)
+        if (dev->buf) {
+                kfree(kbuf);
                 goto fail;
+        }
         dev->buf = kbuf;
 
         /* full or low speed config */
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 11bbce28bc23..2035906b8ced 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -610,7 +610,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 {
         struct usba_ep *ep = to_usba_ep(_ep);
         struct usba_udc *udc = ep->udc;
-        unsigned long flags, ept_cfg, maxpacket;
+        unsigned long flags, maxpacket;
         unsigned int nr_trans;
 
         DBG(DBG_GADGET, "%s: ep_enable: desc=%p\n", ep->ep.name, desc);
@@ -630,7 +630,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
         ep->is_in = 0;
 
         DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
-                        ep->ep.name, ept_cfg, maxpacket);
+                        ep->ep.name, ep->ept_cfg, maxpacket);
 
         if (usb_endpoint_dir_in(desc)) {
                 ep->is_in = 1;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c60abe3a68f9..8cabc5944d5f 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
         int             rc;
 
         dum = *((void **)dev_get_platdata(&pdev->dev));
+        /* Clear usb_gadget region for new registration to udc-core */
+        memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
         dum->gadget.max_speed = USB_SPEED_SUPER;
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 85504419ab31..3828c2ec8623 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep)
          */
         while (!list_empty(&ep->queue)) {
                 struct net2280_request  *req;
-                u32                     tmp;
+                u32 req_dma_count;
 
                 req = list_entry(ep->queue.next,
                                 struct net2280_request, queue);
                 if (!req->valid)
                         break;
                 rmb();
-                tmp = le32_to_cpup(&req->td->dmacount);
-                if ((tmp & BIT(VALID_BIT)) != 0)
+                req_dma_count = le32_to_cpup(&req->td->dmacount);
+                if ((req_dma_count & BIT(VALID_BIT)) != 0)
                         break;
 
                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep)
                  */
                 if (unlikely(req->td->dmadesc == 0)) {
                         /* paranoia */
-                        tmp = readl(&ep->dma->dmacount);
-                        if (tmp & DMA_BYTE_COUNT_MASK)
+                        u32 const ep_dmacount = readl(&ep->dma->dmacount);
+
+                        if (ep_dmacount & DMA_BYTE_COUNT_MASK)
                                 break;
                         /* single transfer mode */
-                        dma_done(ep, req, tmp, 0);
+                        dma_done(ep, req, req_dma_count, 0);
                         num_completed++;
                         break;
                 } else if (!ep->is_in &&
                            (req->req.length % ep->ep.maxpacket) &&
                            !(ep->dev->quirks & PLX_PCIE)) {
 
-                        tmp = readl(&ep->regs->ep_stat);
+                        u32 const ep_stat = readl(&ep->regs->ep_stat);
                         /* AVOID TROUBLE HERE by not issuing short reads from
                          * your gadget driver.  That helps avoids errata 0121,
                          * 0122, and 0124; not all cases trigger the warning.
                          */
-                        if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) {
+                        if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) {
                                 ep_warn(ep->dev, "%s lost packet sync!\n",
                                                 ep->ep.name);
                                 req->req.status = -EOVERFLOW;
                         } else {
-                                tmp = readl(&ep->regs->ep_avail);
-                                if (tmp) {
+                                u32 const ep_avail = readl(&ep->regs->ep_avail);
+                                if (ep_avail) {
                                         /* fifo gets flushed later */
                                         ep->out_overflow = 1;
                                         ep_dbg(ep->dev,
                                                 "%s dma, discard %d len %d\n",
-                                                ep->ep.name, tmp,
+                                                ep->ep.name, ep_avail,
                                                 req->req.length);
                                         req->req.status = -EOVERFLOW;
                                 }
                         }
                 }
-                dma_done(ep, req, tmp, 0);
+                dma_done(ep, req, req_dma_count, 0);
                 num_completed++;
         }
 
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index e1335ad5bce9..832c4fdbe985 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev)
         usb_del_gadget_udc(&udc->gadget);
         pxa_cleanup_debugfs(udc);
 
-        if (!IS_ERR_OR_NULL(udc->transceiver))
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
                 usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-        usb_put_phy(udc->transceiver);
+                usb_put_phy(udc->transceiver);
+        }
 
         udc->transceiver = NULL;
         the_controller = NULL;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 414e3c376dbb..5302f988e7e6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        1);
                                 return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        0);
                                 return 0;
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 363d125300ea..2b4a00fa735d 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -109,7 +109,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci)
         xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK);
 
         /* xhci 1.1 controllers have the HCCPARAMS2 register */
-        if (hci_version > 100) {
+        if (hci_version > 0x100) {
                 temp = readl(&xhci->cap_regs->hcc_params2);
                 xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp);
                 xhci_dbg(xhci, "  HC %s Force save context capability",
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 9066ec9e0c2e..67d5dc79b6b5 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -382,7 +382,6 @@ static int usb_wakeup_of_property_parse(struct xhci_hcd_mtk *mtk,
 
 static int xhci_mtk_setup(struct usb_hcd *hcd);
 static const struct xhci_driver_overrides xhci_mtk_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = xhci_mtk_setup,
 };
 
@@ -678,13 +677,13 @@ static int xhci_mtk_probe(struct platform_device *pdev)
                 goto power_off_phys;
         }
 
-        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
-                xhci->shared_hcd->can_do_streams = 1;
-
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
                 goto put_usb3_hcd;
 
+        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+                xhci->shared_hcd->can_do_streams = 1;
+
         ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
         if (ret)
                 goto dealloc_usb2_hcd;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6d33b42ffcf5..bd02a6cd8e2c 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -286,6 +286,8 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
 
+        xhci->xhc_state |= XHCI_STATE_REMOVING;
+
         usb_remove_hcd(xhci->shared_hcd);
         usb_phy_shutdown(hcd->usb_phy);
 
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index a59fafb4b329..74436f8ca538 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1308,7 +1308,6 @@ static int tegra_xhci_setup(struct usb_hcd *hcd)
 }
 
 static const struct xhci_driver_overrides tegra_xhci_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = tegra_xhci_setup,
 };
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6d6c46000e56..50aee8b7718b 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -868,7 +868,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        /* disble usb3 ports Wake bits*/
+        /* disable usb3 ports Wake bits */
         port_index = xhci->num_usb3_ports;
         port_array = xhci->usb3_ports;
         while (port_index--) {
@@ -879,7 +879,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
                         writel(t2, port_array[port_index]);
         }
 
-        /* disble usb2 ports Wake bits*/
+        /* disable usb2 ports Wake bits */
         port_index = xhci->num_usb2_ports;
         port_array = xhci->usb2_ports;
         while (port_index--) {
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 095778ff984d..37c63cb39714 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface,
         iface_desc = interface->cur_altsetting;
         dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
-        if (iface_desc->desc.bNumEndpoints < 1) {
-                dev_err(&interface->dev, "Invalid number of endpoints\n");
-                retval = -EINVAL;
-                goto error;
-        }
-
         /* set up the endpoint information */
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                 endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface,
                         /* this one will match for the IOWarrior56 only */
                         dev->int_out_endpoint = endpoint;
         }
+
+        if (!dev->int_in_endpoint) {
+                dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
+                if (!dev->int_out_endpoint) {
+                        dev_err(&interface->dev, "no interrupt-out endpoint found\n");
+                        retval = -ENODEV;
+                        goto error;
+                }
+        }
+
         /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
         dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
         if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4e18600dc9b4..91f66d68bcb7 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -375,18 +375,24 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         if (of_get_property(np, "dynamic-power-switching", NULL))
                 hub->conf_data2 |= BIT(7);
 
-        if (of_get_property(np, "oc-delay-100us", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-4ms", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 |= BIT(4);
-        } else if (of_get_property(np, "oc-delay-8ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-16ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 |= BIT(4);
+        if (!of_property_read_u32(np, "oc-delay-us", property_u32)) {
+                if (*property_u32 == 100) {
+                        /* 100 us*/
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                } else if (*property_u32 == 4000) {
+                        /* 4 ms */
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else if (*property_u32 == 16000) {
+                        /* 16 ms */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else {
+                        /* 8 ms (DEFAULT) */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                }
         }
 
         if (of_get_property(np, "compound-device", NULL))
@@ -432,30 +438,9 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
                 }
         }
 
-        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
-        if (!of_property_read_u32(np, "max-sp-power", property_u32))
-                hub->max_power_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
-        if (!of_property_read_u32(np, "max-bp-power", property_u32))
-                hub->max_power_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
-        if (!of_property_read_u32(np, "max-sp-current", property_u32))
-                hub->max_current_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
-        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
-        if (!of_property_read_u32(np, "max-bp-current", property_u32))
-                hub->max_current_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
         hub->power_on_time = USB251XB_DEF_POWER_ON_TIME;
-        if (!of_property_read_u32(np, "power-on-time", property_u32))
-                hub->power_on_time = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                           255);
+        if (!of_property_read_u32(np, "power-on-time-ms", property_u32))
+                hub->power_on_time = min_t(u8, *property_u32 / 2, 255);
 
         if (of_property_read_u16_array(np, "language-id", &hub->lang_id, 1))
                 hub->lang_id = USB251XB_DEF_LANGUAGE_ID;
@@ -492,6 +477,10 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         /* The following parameters are currently not exposed to devicetree, but
          * may be as soon as needed.
          */
+        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
+        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
+        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
+        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
         hub->bat_charge_en = USB251XB_DEF_BATTERY_CHARGING_ENABLE;
         hub->boost_up = USB251XB_DEF_BOOST_UP;
         hub->boost_x = USB251XB_DEF_BOOST_X;
diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
index db68156568e6..b3b33cf7ddf6 100644
--- a/drivers/usb/phy/phy-isp1301.c
+++ b/drivers/usb/phy/phy-isp1301.c
@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, isp1301_id);
 
+static const struct of_device_id isp1301_of_match[] = {
+        {.compatible = "nxp,isp1301" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, isp1301_of_match);
+
 static struct i2c_client *isp1301_i2c_client;
 
 static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
         .driver = {
                 .name = DRV_NAME,
+                .of_match_table = of_match_ptr(isp1301_of_match),
         },
         .probe = isp1301_probe,
         .remove = isp1301_remove,
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index ab78111e0968..6537d3ca2797 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1500,7 +1500,7 @@ static int digi_read_oob_callback(struct urb *urb)
                 return -1;
 
         /* handle each oob command */
-        for (i = 0; i < urb->actual_length - 4; i += 4) {
+        for (i = 0; i < urb->actual_length - 3; i += 4) {
                 opcode = buf[i];
                 line = buf[i + 1];
                 status = buf[i + 2];
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index ceaeebaa6f90..a76b95d32157 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb)
         function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
         dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
                 port_number, function, data[1]);
+
+        if (port_number >= edge_serial->serial->num_ports) {
+                dev_err(dev, "bad port number %d\n", port_number);
+                goto exit;
+        }
+
         port = edge_serial->serial->port[port_number];
         edge_port = usb_get_serial_port_data(port);
         if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb)
 
         port_number = edge_port->port->port_number;
 
-        if (edge_port->lsr_event) {
+        if (urb->actual_length > 0 && edge_port->lsr_event) {
                 edge_port->lsr_event = 0;
                 dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
                         __func__, port_number, edge_port->lsr_mask, *data);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index a180b17d2432..dd706953b466 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -31,7 +31,6 @@
 #define BT_IGNITIONPRO_ID       0x2000
 
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_process_read_urb(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
 static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
         .attach =               omninet_attach,
         .port_probe =           omninet_port_probe,
         .port_remove =          omninet_port_remove,
-        .open =                 omninet_open,
         .write =                omninet_write,
         .write_room =           omninet_write_room,
         .write_bulk_callback =  omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
         return 0;
 }
 
-static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-        struct usb_serial       *serial = port->serial;
-        struct usb_serial_port  *wport;
-
-        wport = serial->port[1];
-        tty_port_tty_set(&wport->port, tty);
-
-        return usb_serial_generic_open(tty, port);
-}
-
 #define OMNINET_HEADERLEN       4
 #define OMNINET_BULKOUTSIZE     64
 #define OMNINET_PAYLOADSIZE     (OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index 93c6c9b08daa..8a069aa154ed 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb)
         if (!safe)
                 goto out;
 
+        if (length < 2) {
+                dev_err(&port->dev, "malformed packet\n");
+                return;
+        }
+
         fcs = fcs_compute10(data, length, CRC10_INITFCS);
         if (fcs) {
                 dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 16cc18369111..9129f6cb8230 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2071,6 +2071,20 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/*
+ * Reported by Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+ * The INIC-3619 bridge is used in the StarTech SLSODDU33B
+ * SATA-USB enclosure for slimline optical drives.
+ *
+ * The quirk enables MakeMKV to properly exchange keys with
+ * an installed BD drive.
+ */
+UNUSUAL_DEV(  0x13fd, 0x3609, 0x0209, 0x0209,
+                "Initio Corporation",
+                "INIC-3619",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Qinglin Ye <yestyle@gmail.com> */
 UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
                 "Kingston",
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index f8afc6dcc29f..e8cef1ad0fe3 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -681,3 +681,50 @@ xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask)
         return 0;
 }
 EXPORT_SYMBOL_GPL(xen_swiotlb_set_dma_mask);
+
+/*
+ * Create userspace mapping for the DMA-coherent memory.
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                     unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->mmap)
+                return __generic_dma_ops(dev)->mmap(dev, vma, cpu_addr,
+                                                    dma_addr, size, attrs);
+#endif
+        return dma_common_mmap(dev, vma, cpu_addr, dma_addr, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_dma_mmap);
+
+/*
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
+                        void *cpu_addr, dma_addr_t handle, size_t size,
+                        unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->get_sgtable) {
+#if 0
+        /*
+         * This check verifies that the page belongs to the current domain and
+         * is not one mapped from another domain.
+         * This check is for debug only, and should not go to production build
+         */
+                unsigned long bfn = PHYS_PFN(dma_to_phys(dev, handle));
+                BUG_ON (!page_is_ram(bfn));
+#endif
+                return __generic_dma_ops(dev)->get_sgtable(dev, sgt, cpu_addr,
+                                                           handle, size, attrs);
+        }
+#endif
+        return dma_common_get_sgtable(dev, sgt, cpu_addr, handle, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_get_sgtable);
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 4d343eed08f5..1f4733b80c87 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -55,7 +55,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/miscdevice.h>
-#include <linux/init.h>
 
 #include <xen/xenbus.h>
 #include <xen/xen.h>